[Midnightbsd-cvs] src [9223] trunk/crypto/openssh: OpenSSH 7.3p1
laffer1 at midnightbsd.org
laffer1 at midnightbsd.org
Sat Nov 5 16:36:34 EDT 2016
Revision: 9223
http://svnweb.midnightbsd.org/src/?rev=9223
Author: laffer1
Date: 2016-11-05 16:36:34 -0400 (Sat, 05 Nov 2016)
Log Message:
-----------
OpenSSH 7.3p1
Modified Paths:
--------------
trunk/crypto/openssh/ChangeLog
trunk/crypto/openssh/INSTALL
trunk/crypto/openssh/Makefile.in
trunk/crypto/openssh/OVERVIEW
trunk/crypto/openssh/PROTOCOL
trunk/crypto/openssh/PROTOCOL.agent
trunk/crypto/openssh/PROTOCOL.certkeys
trunk/crypto/openssh/PROTOCOL.chacha20poly1305
trunk/crypto/openssh/PROTOCOL.krl
trunk/crypto/openssh/PROTOCOL.mux
trunk/crypto/openssh/README
trunk/crypto/openssh/README.platform
trunk/crypto/openssh/addrmatch.c
trunk/crypto/openssh/atomicio.c
trunk/crypto/openssh/audit-linux.c
trunk/crypto/openssh/auth-bsdauth.c
trunk/crypto/openssh/auth-chall.c
trunk/crypto/openssh/auth-krb5.c
trunk/crypto/openssh/auth-options.c
trunk/crypto/openssh/auth-options.h
trunk/crypto/openssh/auth-pam.c
trunk/crypto/openssh/auth-pam.h
trunk/crypto/openssh/auth-passwd.c
trunk/crypto/openssh/auth-rh-rsa.c
trunk/crypto/openssh/auth-rhosts.c
trunk/crypto/openssh/auth-rsa.c
trunk/crypto/openssh/auth.c
trunk/crypto/openssh/auth.h
trunk/crypto/openssh/auth1.c
trunk/crypto/openssh/auth2-chall.c
trunk/crypto/openssh/auth2-gss.c
trunk/crypto/openssh/auth2-hostbased.c
trunk/crypto/openssh/auth2-kbdint.c
trunk/crypto/openssh/auth2-none.c
trunk/crypto/openssh/auth2-passwd.c
trunk/crypto/openssh/auth2-pubkey.c
trunk/crypto/openssh/auth2.c
trunk/crypto/openssh/authfd.c
trunk/crypto/openssh/authfd.h
trunk/crypto/openssh/authfile.c
trunk/crypto/openssh/authfile.h
trunk/crypto/openssh/bufaux.c
trunk/crypto/openssh/bufbn.c
trunk/crypto/openssh/bufec.c
trunk/crypto/openssh/buffer.c
trunk/crypto/openssh/buffer.h
trunk/crypto/openssh/canohost.c
trunk/crypto/openssh/canohost.h
trunk/crypto/openssh/chacha.h
trunk/crypto/openssh/channels.c
trunk/crypto/openssh/channels.h
trunk/crypto/openssh/cipher-3des1.c
trunk/crypto/openssh/cipher-bf1.c
trunk/crypto/openssh/cipher-chachapoly.c
trunk/crypto/openssh/cipher-chachapoly.h
trunk/crypto/openssh/cipher-ctr.c
trunk/crypto/openssh/cipher.c
trunk/crypto/openssh/cipher.h
trunk/crypto/openssh/clientloop.c
trunk/crypto/openssh/clientloop.h
trunk/crypto/openssh/compat.c
trunk/crypto/openssh/compat.h
trunk/crypto/openssh/config.guess
trunk/crypto/openssh/config.h.in
trunk/crypto/openssh/configure
trunk/crypto/openssh/configure.ac
trunk/crypto/openssh/contrib/Makefile
trunk/crypto/openssh/contrib/README
trunk/crypto/openssh/contrib/cygwin/README
trunk/crypto/openssh/contrib/cygwin/ssh-host-config
trunk/crypto/openssh/contrib/cygwin/ssh-user-config
trunk/crypto/openssh/contrib/redhat/openssh.spec
trunk/crypto/openssh/contrib/ssh-copy-id
trunk/crypto/openssh/contrib/ssh-copy-id.1
trunk/crypto/openssh/contrib/suse/openssh.spec
trunk/crypto/openssh/deattack.c
trunk/crypto/openssh/deattack.h
trunk/crypto/openssh/defines.h
trunk/crypto/openssh/dh.c
trunk/crypto/openssh/dh.h
trunk/crypto/openssh/digest-libc.c
trunk/crypto/openssh/digest-openssl.c
trunk/crypto/openssh/digest.h
trunk/crypto/openssh/dispatch.c
trunk/crypto/openssh/dispatch.h
trunk/crypto/openssh/dns.c
trunk/crypto/openssh/dns.h
trunk/crypto/openssh/entropy.c
trunk/crypto/openssh/ge25519.h
trunk/crypto/openssh/groupaccess.c
trunk/crypto/openssh/gss-genr.c
trunk/crypto/openssh/gss-serv-krb5.c
trunk/crypto/openssh/gss-serv.c
trunk/crypto/openssh/hmac.c
trunk/crypto/openssh/hmac.h
trunk/crypto/openssh/hostfile.c
trunk/crypto/openssh/hostfile.h
trunk/crypto/openssh/includes.h
trunk/crypto/openssh/kex.c
trunk/crypto/openssh/kex.h
trunk/crypto/openssh/kexc25519.c
trunk/crypto/openssh/kexc25519c.c
trunk/crypto/openssh/kexc25519s.c
trunk/crypto/openssh/kexdh.c
trunk/crypto/openssh/kexdhc.c
trunk/crypto/openssh/kexdhs.c
trunk/crypto/openssh/kexecdh.c
trunk/crypto/openssh/kexecdhc.c
trunk/crypto/openssh/kexecdhs.c
trunk/crypto/openssh/kexgex.c
trunk/crypto/openssh/kexgexc.c
trunk/crypto/openssh/kexgexs.c
trunk/crypto/openssh/key.c
trunk/crypto/openssh/key.h
trunk/crypto/openssh/krl.c
trunk/crypto/openssh/krl.h
trunk/crypto/openssh/log.c
trunk/crypto/openssh/log.h
trunk/crypto/openssh/loginrec.c
trunk/crypto/openssh/mac.c
trunk/crypto/openssh/mac.h
trunk/crypto/openssh/match.c
trunk/crypto/openssh/match.h
trunk/crypto/openssh/misc.c
trunk/crypto/openssh/misc.h
trunk/crypto/openssh/moduli
trunk/crypto/openssh/moduli.0
trunk/crypto/openssh/moduli.c
trunk/crypto/openssh/monitor.c
trunk/crypto/openssh/monitor.h
trunk/crypto/openssh/monitor_fdpass.c
trunk/crypto/openssh/monitor_mm.c
trunk/crypto/openssh/monitor_wrap.c
trunk/crypto/openssh/monitor_wrap.h
trunk/crypto/openssh/msg.c
trunk/crypto/openssh/msg.h
trunk/crypto/openssh/mux.c
trunk/crypto/openssh/myproposal.h
trunk/crypto/openssh/openbsd-compat/Makefile.in
trunk/crypto/openssh/openbsd-compat/arc4random.c
trunk/crypto/openssh/openbsd-compat/bcrypt_pbkdf.c
trunk/crypto/openssh/openbsd-compat/bindresvport.c
trunk/crypto/openssh/openbsd-compat/blowfish.c
trunk/crypto/openssh/openbsd-compat/bsd-asprintf.c
trunk/crypto/openssh/openbsd-compat/bsd-cygwin_util.c
trunk/crypto/openssh/openbsd-compat/bsd-cygwin_util.h
trunk/crypto/openssh/openbsd-compat/bsd-misc.c
trunk/crypto/openssh/openbsd-compat/bsd-misc.h
trunk/crypto/openssh/openbsd-compat/bsd-poll.h
trunk/crypto/openssh/openbsd-compat/bsd-snprintf.c
trunk/crypto/openssh/openbsd-compat/explicit_bzero.c
trunk/crypto/openssh/openbsd-compat/fake-rfc2553.h
trunk/crypto/openssh/openbsd-compat/getrrsetbyname-ldns.c
trunk/crypto/openssh/openbsd-compat/glob.c
trunk/crypto/openssh/openbsd-compat/glob.h
trunk/crypto/openssh/openbsd-compat/inet_aton.c
trunk/crypto/openssh/openbsd-compat/openbsd-compat.h
trunk/crypto/openssh/openbsd-compat/openssl-compat.c
trunk/crypto/openssh/openbsd-compat/openssl-compat.h
trunk/crypto/openssh/openbsd-compat/port-linux.c
trunk/crypto/openssh/openbsd-compat/port-solaris.c
trunk/crypto/openssh/openbsd-compat/port-solaris.h
trunk/crypto/openssh/openbsd-compat/port-tun.c
trunk/crypto/openssh/openbsd-compat/port-uw.c
trunk/crypto/openssh/openbsd-compat/readpassphrase.c
trunk/crypto/openssh/openbsd-compat/realpath.c
trunk/crypto/openssh/openbsd-compat/sha2.c
trunk/crypto/openssh/openbsd-compat/sha2.h
trunk/crypto/openssh/openbsd-compat/vis.c
trunk/crypto/openssh/openbsd-compat/vis.h
trunk/crypto/openssh/openbsd-compat/xcrypt.c
trunk/crypto/openssh/opensshd.init.in
trunk/crypto/openssh/packet.c
trunk/crypto/openssh/packet.h
trunk/crypto/openssh/pathnames.h
trunk/crypto/openssh/platform.c
trunk/crypto/openssh/platform.h
trunk/crypto/openssh/poly1305.h
trunk/crypto/openssh/progressmeter.c
trunk/crypto/openssh/progressmeter.h
trunk/crypto/openssh/readconf.c
trunk/crypto/openssh/readconf.h
trunk/crypto/openssh/readpass.c
trunk/crypto/openssh/regress/agent-pkcs11.sh
trunk/crypto/openssh/regress/cert-hostkey.sh
trunk/crypto/openssh/regress/cert-userkey.sh
trunk/crypto/openssh/regress/dhgex.sh
trunk/crypto/openssh/regress/host-expand.sh
trunk/crypto/openssh/regress/kextype.sh
trunk/crypto/openssh/regress/keytype.sh
trunk/crypto/openssh/regress/setuid-allowed.c
trunk/crypto/openssh/rijndael.c
trunk/crypto/openssh/rijndael.h
trunk/crypto/openssh/rsa.c
trunk/crypto/openssh/rsa.h
trunk/crypto/openssh/sandbox-seccomp-filter.c
trunk/crypto/openssh/sandbox-systrace.c
trunk/crypto/openssh/scp.0
trunk/crypto/openssh/scp.1
trunk/crypto/openssh/scp.c
trunk/crypto/openssh/servconf.c
trunk/crypto/openssh/servconf.h
trunk/crypto/openssh/serverloop.c
trunk/crypto/openssh/session.c
trunk/crypto/openssh/session.h
trunk/crypto/openssh/sftp-client.c
trunk/crypto/openssh/sftp-client.h
trunk/crypto/openssh/sftp-common.c
trunk/crypto/openssh/sftp-common.h
trunk/crypto/openssh/sftp-glob.c
trunk/crypto/openssh/sftp-server-main.c
trunk/crypto/openssh/sftp-server.0
trunk/crypto/openssh/sftp-server.8
trunk/crypto/openssh/sftp-server.c
trunk/crypto/openssh/sftp.0
trunk/crypto/openssh/sftp.1
trunk/crypto/openssh/sftp.c
trunk/crypto/openssh/ssh-add.0
trunk/crypto/openssh/ssh-add.1
trunk/crypto/openssh/ssh-add.c
trunk/crypto/openssh/ssh-agent.0
trunk/crypto/openssh/ssh-agent.1
trunk/crypto/openssh/ssh-agent.c
trunk/crypto/openssh/ssh-dss.c
trunk/crypto/openssh/ssh-ecdsa.c
trunk/crypto/openssh/ssh-ed25519.c
trunk/crypto/openssh/ssh-keygen.0
trunk/crypto/openssh/ssh-keygen.1
trunk/crypto/openssh/ssh-keygen.c
trunk/crypto/openssh/ssh-keyscan.0
trunk/crypto/openssh/ssh-keyscan.1
trunk/crypto/openssh/ssh-keyscan.c
trunk/crypto/openssh/ssh-keysign.0
trunk/crypto/openssh/ssh-keysign.8
trunk/crypto/openssh/ssh-keysign.c
trunk/crypto/openssh/ssh-pkcs11-client.c
trunk/crypto/openssh/ssh-pkcs11-helper.0
trunk/crypto/openssh/ssh-pkcs11-helper.c
trunk/crypto/openssh/ssh-pkcs11.c
trunk/crypto/openssh/ssh-pkcs11.h
trunk/crypto/openssh/ssh-rsa.c
trunk/crypto/openssh/ssh.0
trunk/crypto/openssh/ssh.1
trunk/crypto/openssh/ssh.c
trunk/crypto/openssh/ssh.h
trunk/crypto/openssh/ssh1.h
trunk/crypto/openssh/ssh2.h
trunk/crypto/openssh/ssh_config
trunk/crypto/openssh/ssh_config.0
trunk/crypto/openssh/ssh_config.5
trunk/crypto/openssh/sshconnect.c
trunk/crypto/openssh/sshconnect.h
trunk/crypto/openssh/sshconnect1.c
trunk/crypto/openssh/sshconnect2.c
trunk/crypto/openssh/sshd.0
trunk/crypto/openssh/sshd.8
trunk/crypto/openssh/sshd.c
trunk/crypto/openssh/sshd_config
trunk/crypto/openssh/sshd_config.0
trunk/crypto/openssh/sshd_config.5
trunk/crypto/openssh/sshlogin.c
trunk/crypto/openssh/sshpty.c
trunk/crypto/openssh/ttymodes.c
trunk/crypto/openssh/ttymodes.h
trunk/crypto/openssh/uidswap.c
trunk/crypto/openssh/umac.c
trunk/crypto/openssh/uuencode.c
trunk/crypto/openssh/version.h
trunk/crypto/openssh/xmalloc.c
trunk/crypto/openssh/xmalloc.h
Added Paths:
-----------
trunk/crypto/openssh/.skipped-commit-ids
trunk/crypto/openssh/bitmap.c
trunk/crypto/openssh/bitmap.h
trunk/crypto/openssh/cipher-aesctr.c
trunk/crypto/openssh/cipher-aesctr.h
trunk/crypto/openssh/opacket.c
trunk/crypto/openssh/opacket.h
trunk/crypto/openssh/openbsd-compat/bsd-err.c
trunk/crypto/openssh/openbsd-compat/kludge-fd_set.c
trunk/crypto/openssh/openbsd-compat/md5.c
trunk/crypto/openssh/openbsd-compat/md5.h
trunk/crypto/openssh/openbsd-compat/reallocarray.c
trunk/crypto/openssh/openbsd-compat/rmd160.c
trunk/crypto/openssh/openbsd-compat/rmd160.h
trunk/crypto/openssh/openbsd-compat/sha1.c
trunk/crypto/openssh/openbsd-compat/sha1.h
trunk/crypto/openssh/platform-pledge.c
trunk/crypto/openssh/platform-tracing.c
trunk/crypto/openssh/regress/cert-file.sh
trunk/crypto/openssh/regress/cfginclude.sh
trunk/crypto/openssh/regress/cfgparse.sh
trunk/crypto/openssh/regress/check-perm.c
trunk/crypto/openssh/regress/hostkey-agent.sh
trunk/crypto/openssh/regress/hostkey-rotate.sh
trunk/crypto/openssh/regress/keygen-knownhosts.sh
trunk/crypto/openssh/regress/limit-keytype.sh
trunk/crypto/openssh/regress/misc/
trunk/crypto/openssh/regress/multipubkey.sh
trunk/crypto/openssh/regress/netcat.c
trunk/crypto/openssh/regress/principals-command.sh
trunk/crypto/openssh/regress/sshcfgparse.sh
trunk/crypto/openssh/regress/t11.ok
trunk/crypto/openssh/regress/unittests/
trunk/crypto/openssh/regress/valgrind-unit.sh
trunk/crypto/openssh/sandbox-pledge.c
trunk/crypto/openssh/sandbox-solaris.c
trunk/crypto/openssh/ssh_api.c
trunk/crypto/openssh/ssh_api.h
trunk/crypto/openssh/sshbuf-getput-basic.c
trunk/crypto/openssh/sshbuf-getput-crypto.c
trunk/crypto/openssh/sshbuf-misc.c
trunk/crypto/openssh/sshbuf.c
trunk/crypto/openssh/sshbuf.h
trunk/crypto/openssh/ssherr.c
trunk/crypto/openssh/ssherr.h
trunk/crypto/openssh/sshkey.c
trunk/crypto/openssh/sshkey.h
trunk/crypto/openssh/utf8.c
trunk/crypto/openssh/utf8.h
Removed Paths:
-------------
trunk/crypto/openssh/contrib/caldera/
trunk/crypto/openssh/scard/
Property Changed:
----------------
trunk/crypto/openssh/
Index: trunk/crypto/openssh
===================================================================
--- trunk/crypto/openssh 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh 2016-11-05 20:36:34 UTC (rev 9223)
Property changes on: trunk/crypto/openssh
___________________________________________________________________
Modified: svn:mergeinfo
## -1,2 +1,2 ##
/vendor-crypto/openssh/6.6p1:6864
-/vendor-crypto/openssh/dist:6463-6862
\ No newline at end of property
+/vendor-crypto/openssh/dist:6463-9222
\ No newline at end of property
Copied: trunk/crypto/openssh/.skipped-commit-ids (from rev 9222, vendor-crypto/openssh/dist/.skipped-commit-ids)
===================================================================
--- trunk/crypto/openssh/.skipped-commit-ids (rev 0)
+++ trunk/crypto/openssh/.skipped-commit-ids 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,11 @@
+321065a95a7ccebdd5fd08482a1e19afbf524e35 Update DH groups
+d4f699a421504df35254cf1c6f1a7c304fb907ca Remove 1k bit groups
+aafe246655b53b52bc32c8a24002bc262f4230f7 Remove intermediate moduli
+8fa9cd1dee3c3339ae329cf20fb591db6d605120 put back SSH1 for 6.9
+f31327a48dd4103333cc53315ec53fe65ed8a17a Generate new moduli
+edbfde98c40007b7752a4ac106095e060c25c1ef Regen moduli
+052fd565e3ff2d8cec3bc957d1788f50c827f8e2 Switch to tame-based sandbox
+7cf73737f357492776223da1c09179fa6ba74660 Remove moduli <2k
+180d84674be1344e45a63990d60349988187c1ae Update moduli
+f6ae971186ba68d066cd102e57d5b0b2c211a5ee systrace is dead.
+96c5054e3e1f170c6276902d5bc65bb3b87a2603 remove DEBUGLIBS from Makefile
Modified: trunk/crypto/openssh/ChangeLog
===================================================================
--- trunk/crypto/openssh/ChangeLog 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ChangeLog 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,2887 +1,9202 @@
-20140313
- - (djm) Release OpenSSH 6.6
+commit 99522ba7ec6963a05c04a156bf20e3ba3605987c
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jul 28 08:54:27 2016 +1000
-20140304
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2014/03/03 22:22:30
- [session.c]
- ignore enviornment variables with embedded '=' or '\0' characters;
- spotted by Jann Horn; ok deraadt@
+ define _OPENBSD_SOURCE for reallocarray on NetBSD
+
+ Report by and debugged with Hisashi T Fujinaka, dtucker nailed
+ the problem (lack of prototype causing return type confusion).
-20140301
- - (djm) [regress/Makefile] Disable dhgex regress test; it breaks when
- no moduli file exists at the expected location.
+commit 3e1e076550c27c6bbdddf36d8f42bd79fbaaa187
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jul 27 08:25:42 2016 +1000
-20140228
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2014/02/27 00:41:49
- [bufbn.c]
- fix unsigned overflow that could lead to reading a short ssh protocol
- 1 bignum value; found by Ben Hawkes; ok deraadt@
- - djm at cvs.openbsd.org 2014/02/27 08:25:09
- [bufbn.c]
- off by one in range check
- - djm at cvs.openbsd.org 2014/02/27 22:47:07
- [sshd_config.5]
- bz#2184 clarify behaviour of a keyword that appears in multiple
- matching Match blocks; ok dtucker@
- - djm at cvs.openbsd.org 2014/02/27 22:57:40
- [version.h]
- openssh-6.6
- - dtucker at cvs.openbsd.org 2014/01/19 23:43:02
- [regress/sftp-chroot.sh]
- Don't use -q on sftp as it suppresses logging, instead redirect the
- output to the regress logfile.
- - dtucker at cvs.openbsd.org 2014/01/20 00:00:30
- [sregress/ftp-chroot.sh]
- append to rather than truncating the log file
- - dtucker at cvs.openbsd.org 2014/01/25 04:35:32
- [regress/Makefile regress/dhgex.sh]
- Add a test for DH GEX sizes
- - djm at cvs.openbsd.org 2014/01/26 10:22:10
- [regress/cert-hostkey.sh]
- automatically generate revoked keys from listed keys rather than
- manually specifying each type; from portable
- (Id sync only)
- - djm at cvs.openbsd.org 2014/01/26 10:49:17
- [scp-ssh-wrapper.sh scp.sh]
- make sure $SCP is tested on the remote end rather than whichever one
- happens to be in $PATH; from portable
- (Id sync only)
- - djm at cvs.openbsd.org 2014/02/27 20:04:16
- [login-timeout.sh]
- remove any existing LoginGraceTime from sshd_config before adding
- a specific one for the test back in
- - djm at cvs.openbsd.org 2014/02/27 21:21:25
- [agent-ptrace.sh agent.sh]
- keep return values that are printed in error messages;
- from portable
- (Id sync only)
- - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
- [contrib/suse/openssh.spec] Crank version numbers
- - (djm) [regress/host-expand.sh] Add RCS Id
+ KNF
-20140227
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2014/02/26 20:18:37
- [ssh.c]
- bz#2205: avoid early hostname lookups unless canonicalisation is enabled;
- ok dtucker@ markus@
- - djm at cvs.openbsd.org 2014/02/26 20:28:44
- [auth2-gss.c gss-serv.c ssh-gss.h sshd.c]
- bz#2107 - cache OIDs of supported GSSAPI mechanisms before privsep
- sandboxing, as running this code in the sandbox can cause violations;
- ok markus@
- - djm at cvs.openbsd.org 2014/02/26 20:29:29
- [channels.c]
- don't assume that the socks4 username is \0 terminated;
- spotted by Ben Hawkes; ok markus@
- - markus at cvs.openbsd.org 2014/02/26 21:53:37
- [sshd.c]
- ssh_gssapi_prepare_supported_oids needs GSSAPI
+commit d99ee9c4e5e217e7d05eeec84e9ce641f4675331
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jul 27 08:25:23 2016 +1000
-20140224
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2014/02/07 06:55:54
- [cipher.c mac.c]
- remove some logging that makes ssh debugging output very verbose;
- ok markus
- - djm at cvs.openbsd.org 2014/02/15 23:05:36
- [channels.c]
- avoid spurious "getsockname failed: Bad file descriptor" errors in ssh -W;
- bz#2200, debian#738692 via Colin Watson; ok dtucker@
- - djm at cvs.openbsd.org 2014/02/22 01:32:19
- [readconf.c]
- when processing Match blocks, skip 'exec' clauses if previous predicates
- failed to match; ok markus@
- - djm at cvs.openbsd.org 2014/02/23 20:03:42
- [ssh-ed25519.c]
- check for unsigned overflow; not reachable in OpenSSH but others might
- copy our code...
- - djm at cvs.openbsd.org 2014/02/23 20:11:36
- [readconf.c readconf.h ssh.c ssh_config.5]
- reparse ssh_config and ~/.ssh/config if hostname canonicalisation changes
- the hostname. This allows users to write configurations that always
- refer to canonical hostnames, e.g.
-
- CanonicalizeHostname yes
- CanonicalDomains int.example.org example.org
- CanonicalizeFallbackLocal no
-
- Host *.int.example.org
- Compression off
- Host *.example.org
- User djm
-
- ok markus@
+ Linux auditing also needs packet.h
-20140213
- - (dtucker) [configure.ac openbsd-compat/openssl-compat.{c,h}] Add compat
- code for older OpenSSL versions that don't have EVP_MD_CTX_copy_ex.
+commit 393bd381a45884b589baa9aed4394f1d250255ca
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jul 27 08:18:05 2016 +1000
-20140207
- - OpenBSD CVS Sync
- - naddy at cvs.openbsd.org 2014/02/05 20:13:25
- [ssh-keygen.1 ssh-keygen.c]
- tweak synopsis: calling ssh-keygen without any arguments is fine; ok jmc@
- while here, fix ordering in usage(); requested by jmc@
- - djm at cvs.openbsd.org 2014/02/06 22:21:01
- [sshconnect.c]
- in ssh_create_socket(), only do the getaddrinfo for BindAddress when
- BindAddress is actually specified. Fixes regression in 6.5 for
- UsePrivilegedPort=yes; patch from Corinna Vinschen
+ fix auditing on Linux
+
+ get_remote_ipaddr() was replaced with ssh_remote_ipaddr()
-20140206
- - (dtucker) [openbsd-compat/bsd-poll.c] Don't bother checking for non-NULL
- before freeing since free(NULL) is a no-op. ok djm.
- - (djm) [sandbox-seccomp-filter.c] Not all Linux architectures define
- __NR_shutdown; some go via the socketcall(2) multiplexer.
+commit 80e766fb089de4f3c92b1600eb99e9495e37c992
+Author: Damien Miller <djm at mindrot.org>
+Date: Sun Jul 24 21:50:13 2016 +1000
-20140205
- - (djm) [sandbox-capsicum.c] Don't fatal if Capsicum is offered by
- headers/libc but not supported by the kernel. Patch from Loganaden
- Velvindron @ AfriNIC
+ crank version numbers
-20140204
- - OpenBSD CVS Sync
- - markus at cvs.openbsd.org 2014/01/27 18:58:14
- [Makefile.in digest.c digest.h hostfile.c kex.h mac.c hmac.c hmac.h]
- replace openssl HMAC with an implementation based on our ssh_digest_*
- ok and feedback djm@
- - markus at cvs.openbsd.org 2014/01/27 19:18:54
- [auth-rsa.c cipher.c ssh-agent.c sshconnect1.c sshd.c]
- replace openssl MD5 with our ssh_digest_*; ok djm@
- - markus at cvs.openbsd.org 2014/01/27 20:13:46
- [digest.c digest-openssl.c digest-libc.c Makefile.in]
- rename digest.c to digest-openssl.c and add libc variant; ok djm@
- - jmc at cvs.openbsd.org 2014/01/28 14:13:39
- [ssh-keyscan.1]
- kill some bad Pa;
- From: Jan Stary
- - djm at cvs.openbsd.org 2014/01/29 00:19:26
- [sshd.c]
- use kill(0, ...) instead of killpg(0, ...); on most operating systems
- they are equivalent, but SUSv2 describes the latter as having undefined
- behaviour; from portable; ok dtucker
- (Id sync only; change is already in portable)
- - djm at cvs.openbsd.org 2014/01/29 06:18:35
- [Makefile.in auth.h auth2-jpake.c auth2.c jpake.c jpake.h monitor.c]
- [monitor.h monitor_wrap.c monitor_wrap.h readconf.c readconf.h]
- [schnorr.c schnorr.h servconf.c servconf.h ssh2.h sshconnect2.c]
- remove experimental, never-enabled JPAKE code; ok markus@
- - jmc at cvs.openbsd.org 2014/01/29 14:04:51
- [sshd_config.5]
- document kbdinteractiveauthentication;
- requested From: Ross L Richardson
-
- dtucker/markus helped explain its workings;
- - djm at cvs.openbsd.org 2014/01/30 22:26:14
- [sandbox-systrace.c]
- allow shutdown(2) syscall in sandbox - it may be called by packet_close()
- from portable
- (Id sync only; change is already in portable)
- - tedu at cvs.openbsd.org 2014/01/31 16:39:19
- [auth2-chall.c authfd.c authfile.c bufaux.c bufec.c canohost.c]
- [channels.c cipher-chachapoly.c clientloop.c configure.ac hostfile.c]
- [kexc25519.c krl.c monitor.c sandbox-systrace.c session.c]
- [sftp-client.c ssh-keygen.c ssh.c sshconnect2.c sshd.c sshlogin.c]
- [openbsd-compat/explicit_bzero.c openbsd-compat/openbsd-compat.h]
- replace most bzero with explicit_bzero, except a few that cna be memset
- ok djm dtucker
- - djm at cvs.openbsd.org 2014/02/02 03:44:32
- [auth1.c auth2-chall.c auth2-passwd.c authfile.c bufaux.c bufbn.c]
- [buffer.c cipher-3des1.c cipher.c clientloop.c gss-serv.c kex.c]
- [kexdhc.c kexdhs.c kexecdhc.c kexgexc.c kexecdhs.c kexgexs.c key.c]
- [monitor.c monitor_wrap.c packet.c readpass.c rsa.c serverloop.c]
- [ssh-add.c ssh-agent.c ssh-dss.c ssh-ecdsa.c ssh-ed25519.c]
- [ssh-keygen.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c]
- [sshd.c]
- convert memset of potentially-private data to explicit_bzero()
- - djm at cvs.openbsd.org 2014/02/03 23:28:00
- [ssh-ecdsa.c]
- fix memory leak; ECDSA_SIG_new() allocates 'r' and 's' for us, unlike
- DSA_SIG_new. Reported by Batz Spear; ok markus@
- - djm at cvs.openbsd.org 2014/02/02 03:44:31
- [digest-libc.c digest-openssl.c]
- convert memset of potentially-private data to explicit_bzero()
- - djm at cvs.openbsd.org 2014/02/04 00:24:29
- [ssh.c]
- delay lowercasing of hostname until right before hostname
- canonicalisation to unbreak case-sensitive matching of ssh_config;
- reported by Ike Devolder; ok markus@
- - (djm) [openbsd-compat/Makefile.in] Add missing explicit_bzero.o
- - (djm) [regress/setuid-allowed.c] Missing string.h for strerror()
+commit b1a478792d458f2e938a302e64bab2b520edc1b3
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jul 24 11:45:36 2016 +0000
-20140131
- - (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)
- syscall from sandboxes; it may be called by packet_close.
- - (dtucker) [readconf.c] Include <arpa/inet.h> for the hton macros. Fixes
- build with HP-UX's compiler. Patch from Kevin Brott.
- - (tim) [Makefile.in] build regress/setuid-allow.
+ upstream commit
+
+ openssh-7.3
+
+ Upstream-ID: af106a7eb665f642648cf1993e162c899f358718
-20140130
- - (djm) [configure.ac] Only check for width-specified integer types
- in headers that actually exist. patch from Tom G. Christensen;
- ok dtucker@
- - (djm) [configure.ac atomicio.c] Kludge around NetBSD offering
- different symbols for 'read' when various compiler flags are
- in use, causing atomicio.c comparisons against it to break and
- read/write operations to hang; ok dtucker
- - (djm) Release openssh-6.5p1
+commit 353766e0881f069aeca30275ab706cd60a1a8fdd
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Sat Jul 23 16:14:42 2016 +1000
-20140129
- - (djm) [configure.ac] Fix broken shell test '==' vs '='; patch from
- Tom G. Christensen
+ Move Cygwin IPPORT_RESERVED overrride to defines.h
+
+ Patch from vinschen at redhat.com.
-20140128
- - (djm) [configure.ac] Search for inet_ntop in libnsl and libresovl;
- ok dtucker
- - (djm) [sshd.c] Use kill(0, ...) instead of killpg(0, ...); the
- latter being specified to have undefined behaviour in SUSv3;
- ok dtucker
- - (tim) [regress/agent.sh regress/agent-ptrace.sh] Assign $? to a variable
- when used as an error message inside an if statement so we display the
- correct into. agent.sh patch from Petr Lautrbach.
+commit 368dd977ae07afb93f4ecea23615128c95ab2b32
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Jul 23 02:54:08 2016 +0000
-20140127
- - (dtucker) [Makefile.in] Remove trailing backslash which some make
- implementations (eg older Solaris) do not cope with.
+ upstream commit
+
+ fix pledge violation with ssh -f; reported by Valentin
+ Kozamernik ok dtucker@
+
+ Upstream-ID: a61db7988db88d9dac3c4dd70e18876a8edf84aa
-20140126
- - OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2014/01/25 10:12:50
- [cipher.c cipher.h kex.c kex.h kexgexc.c]
- Add a special case for the DH group size for 3des-cbc, which has an
- effective strength much lower than the key size. This causes problems
- with some cryptlib implementations, which don't support group sizes larger
- than 4k but also don't use the largest group size it does support as
- specified in the RFC. Based on a patch from Petr Lautrbach at Redhat,
- reduced by me with input from Markus. ok djm@ markus@
- - markus at cvs.openbsd.org 2014/01/25 20:35:37
- [kex.c]
- dh_need needs to be set to max(seclen, blocksize, ivlen, mac_len)
- ok dtucker@, noted by mancha
- - (djm) [configure.ac sandbox-capsicum.c sandbox-rlimit.c] Disable
- RLIMIT_NOFILE pseudo-sandbox on FreeBSD. In some configurations,
- libc will attempt to open additional file descriptors for crypto
- offload and crash if they cannot be opened.
- - (djm) [configure.ac] correct AC_DEFINE for previous.
+commit f00211e3c6d24d6ea2b64b4b1209f671f6c1d42e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 22 07:00:46 2016 +0000
-20140125
- - (djm) [configure.ac] Fix detection of capsicum sandbox on FreeBSD
- - (djm) [configure.ac] Do not attempt to use capsicum sandbox unless
- sys/capability.h exists and cap_rights_limit is in libc. Fixes
- build on FreeBSD9x which provides the header but not the libc
- support.
- - (djm) [configure.ac] autoconf sets finds to 'yes' not '1', so test
- against the correct thing.
+ upstream commit
+
+ improve wording; suggested by jmc@
+
+ Upstream-ID: 55cb0a24c8e0618b3ceec80998dc82c85db2d2f8
-20140124
- - (djm) [Makefile.in regress/scp-ssh-wrapper.sh regress/scp.sh] Make
- the scp regress test actually test the built scp rather than the one
- in $PATH. ok dtucker@
+commit 83cbca693c3b0719270e6a0f2efe3f9ee93a65b8
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jul 22 05:46:11 2016 +0000
-20140123
- - (tim) [session.c] Improve error reporting on set_id().
- - (dtucker) [configure.ac] NetBSD's (and FreeBSD's) strnvis is gratuitously
- incompatible with OpenBSD's despite post-dating it by more than a decade.
- Declare it as broken, and document FreeBSD's as the same. ok djm@
+ upstream commit
+
+ Lower loglevel for "Authenticated with partial success"
+ message similar to other similar level. bz#2599, patch from cgallek at
+ gmail.com, ok markus@
+
+ Upstream-ID: 3faab814e947dc7b2e292edede23e94c608cb4dd
-20140122
- - (djm) [openbsd-compat/setproctitle.c] Don't fail to compile if a
- platform that is expected to use the reuse-argv style setproctitle
- hack surprises us by providing a setproctitle in libc; ok dtucker
- - (djm) [configure.ac] Unless specifically requested, only attempt
- to build Position Independent Executables on gcc >= 4.x; ok dtucker
- - (djm) [configure.ac aclocal.m4] More tests to detect fallout from
- platform hardening options: include some long long int arithmatic
- to detect missing support functions for -ftrapv in libgcc and
- equivalents, actually test linking when -ftrapv is supplied and
- set either both -pie/-fPIE or neither. feedback and ok dtucker@
+commit 10358abd087ab228b7ce2048efc4f3854a9ab9a6
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jul 22 14:06:36 2016 +1000
-20140121
- - (dtucker) [configure.ac] Make PIE a configure-time option which defaults
- to on platforms where it's known to be reliably detected and off elsewhere.
- Works around platforms such as FreeBSD 9.1 where it does not interop with
- -ftrapv (it seems to work but fails when trying to link ssh). ok djm@
- - (dtucker) [aclocal.m4] Differentiate between compile-time and link-time
- tests in the configure output. ok djm.
- - (tim) [platform.c session.c] Fix bug affecting SVR5 platforms introduced
- with sftp chroot support. Move set_id call after chroot.
- - (djm) [aclocal.m4] Flesh out the code run in the OSSH_CHECK_CFLAG_COMPILE
- and OSSH_CHECK_LDFLAG_LINK tests to give them a better chance of
- detecting toolchain-related problems; ok dtucker
+ retry waitpid on EINTR failure
+
+ patch from Jakub Jelen on bz#2581; ok dtucker@
-20140120
- - (dtucker) [gss-serv-krb5.c] Fall back to krb5_cc_gen_new if the Kerberos
- implementation does not have krb5_cc_new_unique, similar to what we do
- in auth-krb5.c.
- - (djm) [regress/cert-hostkey.sh] Fix regress failure on platforms that
- skip one or more key types (e.g. RHEL/CentOS 6.5); ok dtucker@
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2014/01/20 00:08:48
- [digest.c]
- memleak; found by Loganaden Velvindron @ AfriNIC; ok markus@
+commit da88a70a89c800e74ea8e5661ffa127a3cc79a92
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 22 03:47:36 2016 +0000
-20140119
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2014/01/17 06:23:24
- [sftp-server.c]
- fix log message statvfs. ok djm
- - dtucker at cvs.openbsd.org 2014/01/18 09:36:26
- [session.c]
- explicitly define USE_PIPES to 1 to prevent redefinition warnings in
- portable on platforms that use pipes for everything. From vinschen at
- redhat.
- - dtucker at cvs.openbsd.org 2014/01/19 04:17:29
- [canohost.c addrmatch.c]
- Cast socklen_t when comparing to size_t and use socklen_t to iterate over
- the ip options, both to prevent signed/unsigned comparison warnings.
- Patch from vinschen at redhat via portable openssh, begrudging ok deraadt.
- - djm at cvs.openbsd.org 2014/01/19 04:48:08
- [ssh_config.5]
- fix inverted meaning of 'no' and 'yes' for CanonicalizeFallbackLocal
- - dtucker at cvs.openbsd.org 2014/01/19 11:21:51
- [addrmatch.c]
- Cast the sizeof to socklen_t so it'll work even if the supplied len is
- negative. Suggested by and ok djm, ok deraadt.
+ upstream commit
+
+ constify a few functions' arguments; patch from Jakub
+ Jelen bz#2581
+
+ Upstream-ID: f2043f51454ea37830ff6ad60c8b32b4220f448d
-20140118
- - (dtucker) [uidswap.c] Prevent unused variable warnings on Cygwin. Patch
- from vinschen at redhat.com
- - (dtucker) [openbsd-compat/bsd-cygwin_util.h] Add missing function
- declarations that stopped being included when we stopped including
- <windows.h> from openbsd-compat/bsd-cygwin_util.h. Patch from vinschen at
- redhat.com.
- - (dtucker) [configure.ac] On Cygwin the getopt variables (like optargs,
- optind) are defined in getopt.h already. Unfortunately they are defined as
- "declspec(dllimport)" for historical reasons, because the GNU linker didn't
- allow auto-import on PE/COFF targets way back when. The problem is the
- dllexport attributes collide with the definitions in the various source
- files in OpenSSH, which obviousy define the variables without
- declspec(dllimport). The least intrusive way to get rid of these warnings
- is to disable warnings for GCC compiler attributes when building on Cygwin.
- Patch from vinschen at redhat.com.
- - (dtucker) [sandbox-capsicum.c] Correct some error messages and make the
- return value check for cap_enter() consistent with the other uses in
- FreeBSD. From by Loganaden Velvindron @ AfriNIC via bz#2140.
+commit c36d91bd4ebf767f310f7cea88d61d1c15f53ddf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 22 03:39:13 2016 +0000
-20140117
- - (dtucker) [aclocal.m4 configure.ac] Add some additional compiler/toolchain
- hardening flags including -fstack-protector-strong. These default to on
- if the toolchain supports them, but there is a configure-time knob
- (--without-hardening) to disable them if necessary. ok djm@
- - (djm) [sftp-client.c] signed/unsigned comparison fix
- - (dtucker) [loginrec.c] Cast to the types specfied in the format
- specification to prevent warnings.
- - (dtucker) [crypto_api.h] Wrap stdlib.h include inside #ifdef HAVE_STDINT_H.
- - (dtucker) [poly1305.c] Wrap stdlib.h include inside #ifdef HAVE_STDINT_H.
- - (dtucker) [blocks.c fe25519.c ge25519.c hash.c sc25519.c verify.c] Include
- includes.h to pull in all of the compatibility stuff.
- - (dtucker) [openbsd-compat/bcrypt_pbkdf.c] Wrap stdlib.h include inside
- #ifdef HAVE_STDINT_H.
- - (dtucker) [defines.h] Add typedefs for uintXX_t types for platforms that
- don't have them.
- - (dtucker) [configure.ac] Split AC_CHECK_FUNCS for OpenSSL functions into
- separate lines and alphabetize for easier diffing of changes.
- - (dtucker) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2014/01/17 00:21:06
- [sftp-client.c]
- signed/unsigned comparison warning fix; from portable (Id sync only)
- - dtucker at cvs.openbsd.org 2014/01/17 05:26:41
- [digest.c]
- remove unused includes. ok djm@
- - (djm) [Makefile.in configure.ac sandbox-capsicum.c sandbox-darwin.c]
- [sandbox-null.c sandbox-rlimit.c sandbox-seccomp-filter.c]
- [sandbox-systrace.c ssh-sandbox.h sshd.c] Support preauth sandboxing
- using the Capsicum API introduced in FreeBSD 10. Patch by Dag-Erling
- Smorgrav, updated by Loganaden Velvindron @ AfriNIC; ok dtucker@
- - (dtucker) [configure.ac digest.c openbsd-compat/openssl-compat.c
- openbsd-compat/openssl-compat.h] Add compatibility layer for older
- openssl versions. ok djm@
- - (dtucker) Fix typo in #ifndef.
- - (dtucker) [configure.ac openbsd-compat/bsd-statvfs.c
- openbsd-compat/bsd-statvfs.h] Implement enough of statvfs on top of statfs
- to be useful (and for the regression tests to pass) on platforms that
- have statfs and fstatfs. ok djm@
- - (dtucker) [openbsd-compat/bsd-statvfs.h] Only start including headers if we
- need them to cut down on the name collisions.
- - (dtucker) [configure.ac] Also look in inttypes.h for uintXX_t types.
- - (dtucker) [configure.ac] Have --without-hardening not turn off
- stack-protector since that has a separate flag that's been around a while.
- - (dtucker) [readconf.c] Wrap paths.h inside an ifdef. Allows building on
- Solaris.
- - (dtucker) [defines.h] Move our definitions of uintXX_t types down to after
- they're defined if we have to define them ourselves. Fixes builds on old
- AIX.
+ upstream commit
+
+ move debug("%p", key) to before key is free'd; probable
+ undefined behaviour on strict compilers; reported by Jakub Jelen bz#2581
+
+ Upstream-ID: 767f323e1f5819508a0e35e388ec241bac2f953a
-20140118
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2014/01/16 07:31:09
- [sftp-client.c]
- needless and incorrect cast to size_t can break resumption of
- large download; patch from tobias@
- - djm at cvs.openbsd.org 2014/01/16 07:32:00
- [version.h]
- openssh-6.5
- - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
- [contrib/suse/openssh.spec] Crank RPM spec version numbers.
- - (djm) [README] update release notes URL.
+commit 286f5a77c3bfec1e8892ca268087ac885ac871bf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 22 03:35:11 2016 +0000
-20140112
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2014/01/10 05:59:19
- [sshd_config]
- the /etc/ssh/ssh_host_ed25519_key is loaded by default too
- - djm at cvs.openbsd.org 2014/01/12 08:13:13
- [bufaux.c buffer.h kex.c kex.h kexc25519.c kexc25519c.c kexc25519s.c]
- [kexdhc.c kexdhs.c kexecdhc.c kexecdhs.c kexgexc.c kexgexs.c]
- avoid use of OpenSSL BIGNUM type and functions for KEX with
- Curve25519 by adding a buffer_put_bignum2_from_string() that stores
- a string using the bignum encoding rules. Will make it easier to
- build a reduced-feature OpenSSH without OpenSSL in the future;
- ok markus@
+ upstream commit
+
+ reverse the order in which -J/JumpHost proxies are visited to
+ be more intuitive and document
+
+ reported by and manpage bits naddy@
+
+ Upstream-ID: 3a68fd6a841fd6cf8cedf6552a9607ba99df179a
-20140110
- - (djm) OpenBSD CVS Sync
- - tedu at cvs.openbsd.org 2014/01/04 17:50:55
- [mac.c monitor_mm.c monitor_mm.h xmalloc.c]
- use standard types and formats for size_t like variables. ok dtucker
- - guenther at cvs.openbsd.org 2014/01/09 03:26:00
- [sftp-common.c]
- When formating the time for "ls -l"-style output, show dates in the future
- with the year, and rearrange a comparison to avoid a potentional signed
- arithmetic overflow that would give the wrong result.
- ok djm@
- - djm at cvs.openbsd.org 2014/01/09 23:20:00
- [digest.c digest.h hostfile.c kex.c kex.h kexc25519.c kexc25519c.c]
- [kexc25519s.c kexdh.c kexecdh.c kexecdhc.c kexecdhs.c kexgex.c kexgexc.c]
- [kexgexs.c key.c key.h roaming_client.c roaming_common.c schnorr.c]
- [schnorr.h ssh-dss.c ssh-ecdsa.c ssh-rsa.c sshconnect2.c]
- Introduce digest API and use it to perform all hashing operations
- rather than calling OpenSSL EVP_Digest* directly. Will make it easier
- to build a reduced-feature OpenSSH without OpenSSL in future;
- feedback, ok markus@
- - djm at cvs.openbsd.org 2014/01/09 23:26:48
- [sshconnect.c sshd.c]
- ban clients/servers that suffer from SSH_BUG_DERIVEKEY, they are ancient,
- deranged and might make some attacks on KEX easier; ok markus@
+commit fcd135c9df440bcd2d5870405ad3311743d78d97
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Jul 21 01:39:35 2016 +0000
-20140108
- - (djm) [regress/.cvsignore] Ignore regress test droppings; ok dtucker@
+ upstream commit
+
+ Skip passwords longer than 1k in length so clients can't
+ easily DoS sshd by sending very long passwords, causing it to spend CPU
+ hashing them. feedback djm@, ok markus at .
+
+ Brought to our attention by tomas.kuthan at oracle.com, shilei-c at
+ 360.cn and coredump at autistici.org
+
+ Upstream-ID: d0af7d4a2190b63ba1d38eec502bc4be0be9e333
-20131231
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/12/30 23:52:28
- [auth2-hostbased.c auth2-pubkey.c compat.c compat.h ssh-rsa.c]
- [sshconnect.c sshconnect2.c sshd.c]
- refuse RSA keys from old proprietary clients/servers that use the
- obsolete RSA+MD5 signature scheme. it will still be possible to connect
- with these clients/servers but only DSA keys will be accepted, and we'll
- deprecate them entirely in a future release. ok markus@
+commit 324583e8fb3935690be58790425793df619c6d4d
+Author: naddy at openbsd.org <naddy at openbsd.org>
+Date: Wed Jul 20 10:45:27 2016 +0000
-20131229
- - (djm) [loginrec.c] Check for username truncation when looking up lastlog
- entries
- - (djm) [regress/Makefile] Add some generated files for cleaning
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/12/19 00:10:30
- [ssh-add.c]
- skip requesting smartcard PIN when removing keys from agent; bz#2187
- patch from jay AT slushpupie.com; ok dtucker
- - dtucker at cvs.openbsd.org 2013/12/19 00:19:12
- [serverloop.c]
- Cast client_alive_interval to u_int64_t before assinging to
- max_time_milliseconds to avoid potential integer overflow in the timeout.
- bz#2170, patch from Loganaden Velvindron, ok djm@
- - djm at cvs.openbsd.org 2013/12/19 00:27:57
- [auth-options.c]
- simplify freeing of source-address certificate restriction
- - djm at cvs.openbsd.org 2013/12/19 01:04:36
- [channels.c]
- bz#2147: fix multiple remote forwardings with dynamically assigned
- listen ports. In the s->c message to open the channel we were sending
- zero (the magic number to request a dynamic port) instead of the actual
- listen port. The client therefore had no way of discriminating between
- them.
-
- Diagnosis and fix by ronf AT timeheart.net
- - djm at cvs.openbsd.org 2013/12/19 01:19:41
- [ssh-agent.c]
- bz#2186: don't crash (NULL deref) when deleting PKCS#11 keys from an agent
- that has a mix of normal and PKCS#11 keys; fix from jay AT slushpupie.com;
- ok dtucker
- - djm at cvs.openbsd.org 2013/12/19 22:57:13
- [poly1305.c poly1305.h]
- use full name for author, with his permission
- - tedu at cvs.openbsd.org 2013/12/21 07:10:47
- [ssh-keygen.1]
- small typo
- - djm at cvs.openbsd.org 2013/12/27 22:30:17
- [ssh-dss.c ssh-ecdsa.c ssh-rsa.c]
- make the original RSA and DSA signing/verification code look more like
- the ECDSA/Ed25519 ones: use key_type_plain() when checking the key type
- rather than tediously listing all variants, use __func__ for debug/
- error messages
- - djm at cvs.openbsd.org 2013/12/27 22:37:18
- [ssh-rsa.c]
- correct comment
- - djm at cvs.openbsd.org 2013/12/29 02:28:10
- [key.c]
- allow ed25519 keys to appear as certificate authorities
- - djm at cvs.openbsd.org 2013/12/29 02:37:04
- [key.c]
- correct comment for key_to_certified()
- - djm at cvs.openbsd.org 2013/12/29 02:49:52
- [key.c]
- correct comment for key_drop_cert()
- - djm at cvs.openbsd.org 2013/12/29 04:20:04
- [key.c]
- to make sure we don't omit any key types as valid CA keys again,
- factor the valid key type check into a key_type_is_valid_ca()
- function
- - djm at cvs.openbsd.org 2013/12/29 04:29:25
- [authfd.c]
- allow deletion of ed25519 keys from the agent
- - djm at cvs.openbsd.org 2013/12/29 04:35:50
- [authfile.c]
- don't refuse to load Ed25519 certificates
- - djm at cvs.openbsd.org 2013/12/29 05:42:16
- [ssh.c]
- don't forget to load Ed25519 certs too
- - djm at cvs.openbsd.org 2013/12/29 05:57:02
- [sshconnect.c]
- when showing other hostkeys, don't forget Ed25519 keys
+ upstream commit
+
+ Do not clobber the global jump_host variables when
+ parsing an inactive configuration. ok djm@
+
+ Upstream-ID: 5362210944d91417d5976346d41ac0b244350d31
-20131221
- - (dtucker) [regress/keytype.sh] Actually test ecdsa key types.
+commit 32d921c323b989d28405e78d0a8923d12913d737
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Tue Jul 19 12:59:16 2016 +0000
-20131219
- - (dtucker) [configure.ac] bz#2178: Don't try to use BSM on Solaris versions
- greater than 11 either rather than just 11. Patch from Tomas Kuthan.
- - (dtucker) [auth-pam.c] bz#2163: check return value from pam_get_item().
- Patch from Loganaden Velvindron.
+ upstream commit
+
+ tweak previous;
+
+ Upstream-ID: f3c1a5b3f05dff366f60c028728a2b43f15ff534
-20131218
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/12/07 08:08:26
- [ssh-keygen.1]
- document -a and -o wrt new key format
- - naddy at cvs.openbsd.org 2013/12/07 11:58:46
- [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh-keysign.8 ssh.1]
- [ssh_config.5 sshd.8 sshd_config.5]
- add missing mentions of ed25519; ok djm@
- - dtucker at cvs.openbsd.org 2013/12/08 09:53:27
- [sshd_config.5]
- Use a literal for the default value of KEXAlgorithms. ok deraadt jmc
- - markus at cvs.openbsd.org 2013/12/09 11:03:45
- [blocks.c ed25519.c fe25519.c fe25519.h ge25519.c ge25519.h]
- [ge25519_base.data hash.c sc25519.c sc25519.h verify.c]
- Add Authors for the public domain ed25519/nacl code.
- see also http://nacl.cr.yp.to/features.html
- All of the NaCl software is in the public domain.
- and http://ed25519.cr.yp.to/software.html
- The Ed25519 software is in the public domain.
- - markus at cvs.openbsd.org 2013/12/09 11:08:17
- [crypto_api.h]
- remove unused defines
- - pascal at cvs.openbsd.org 2013/12/15 18:17:26
- [ssh-add.c]
- Make ssh-add also add .ssh/id_ed25519; fixes lie in manual page.
+commit d7eabc86fa049a12ba2c3fb198bd1d51b37f7025
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue Jul 19 11:38:53 2016 +0000
+
+ upstream commit
+
+ Allow wildcard for PermitOpen hosts as well as ports.
+ bz#2582, patch from openssh at mzpqnxow.com and jjelen at redhat.com. ok
+ markus@
+
+ Upstream-ID: af0294e9b9394c4e16e991424ca0a47a7cc605f2
+
+commit b98a2a8348e907b3d71caafd80f0be8fdd075943
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jul 18 11:35:33 2016 +0000
+
+ upstream commit
+
+ Reduce timing attack against obsolete CBC modes by always
+ computing the MAC over a fixed size of data. Reported by Jean Paul
+ Degabriele, Kenny Paterson, Torben Hansen and Martin Albrecht. ok djm@
+
+ Upstream-ID: f20a13279b00ba0afbacbcc1f04e62e9d41c2912
+
+commit dbf788b4d9d9490a5fff08a7b09888272bb10fcc
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Jul 21 14:17:31 2016 +1000
+
+ Search users for one with a valid salt.
+
+ If the root account is locked (eg password "!!" or "*LK*") keep looking
+ until we find a user with a valid salt to use for crypting passwords of
+ invalid users. ok djm@
+
+commit e8b58f48fbb1b524fb4f0d4865fa0005d6a4b782
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jul 18 17:22:49 2016 +1000
+
+ Explicitly specify source files for regress tools.
+
+ Since adding $(REGRESSLIBS), $? is wrong because it includes only the
+ changed source files. $< seems like it'd be right however it doesn't
+ seem to work on some non-GNU makes, so do what works everywhere.
+
+commit eac1bbd06872c273f16ac0f9976b0aef026b701b
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jul 18 17:12:22 2016 +1000
+
+ Conditionally include err.h.
+
+commit 0a454147568746c503f669e1ba861f76a2e7a585
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jul 18 16:26:26 2016 +1000
+
+ Remove local implementation of err, errx.
+
+ We now have a shared implementation in libopenbsd-compat.
+
+commit eb999a4590846ba4d56ddc90bd07c23abfbab7b1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jul 18 06:08:01 2016 +0000
+
+ upstream commit
+
+ Add some unsigned overflow checks for extra_pad. None of
+ these are reachable with the amount of padding that we use internally.
+ bz#2566, pointed out by Torben Hansen. ok markus@
+
+ Upstream-ID: 4d4be8450ab2fc1b852d5884339f8e8c31c3fd76
+
+commit c71ba790c304545464bb494de974cdf0f4b5cf1e
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jul 18 15:43:25 2016 +1000
+
+ Add dependency on libs for unit tests.
+
+ Makes "./configure && make tests" work again. ok djm@
+
+commit 8199d0311aea3e6fd0284c9025e7a83f4ece79e8
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jul 18 13:47:39 2016 +1000
+
+ Correct location for kexfuzz in clean target.
+
+commit 01558b7b07af43da774d3a11a5c51fa9c310849d
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jul 18 09:33:25 2016 +1000
+
+ Handle PAM_MAXTRIES from modules.
+
+ bz#2249: handle the case where PAM returns PAM_MAXTRIES by ceasing to offer
+ password and keyboard-interative authentication methods. Should prevent
+ "sshd ignoring max retries" warnings in the log. ok djm@
+
+ It probably won't trigger with keyboard-interactive in the default
+ configuration because the retry counter is stored in module-private
+ storage which goes away with the sshd PAM process (see bz#688). On the
+ other hand, those cases probably won't log a warning either.
+
+commit 65c6c6b567ab5ab12945a5ad8e0ab3a8c26119cc
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jul 17 04:20:16 2016 +0000
+
+ upstream commit
+
+ support UTF-8 characters in ssh(1) banners using
+ schwarze@'s safe fmprintf printer; bz#2058
+
+ feedback schwarze@ ok dtucker@
+
+ Upstream-ID: a72ce4e3644c957643c9524eea2959e41b91eea7
+
+commit e4eb7d910976fbfc7ce3e90c95c11b07b483d0d7
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Sat Jul 16 06:57:55 2016 +0000
+
+ upstream commit
+
+ - add proxyjump to the options list - formatting fixes -
+ update usage()
+
+ ok djm
+
+ Upstream-ID: 43d318e14ce677a2eec8f21ef5ba2f9f68a59457
+
+commit af1f084857621f14bd9391aba8033d35886c2455
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jul 15 05:01:58 2016 +0000
+
+ upstream commit
+
+ Reduce the syslog level of some relatively common protocol
+ events from LOG_CRIT by replacing fatal() calls with logdie(). Part of
+ bz#2585, ok djm@
+
+ Upstream-ID: 9005805227c94edf6ac02a160f0e199638d288e5
+
+commit bd5f2b78b69cf38d6049a0de445a79c8595e4a1f
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jul 15 19:14:48 2016 +1000
+
+ missing openssl/dh.h
+
+commit 4a984fd342effe5f0aad874a0d538c4322d973c0
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jul 15 18:47:07 2016 +1000
+
+ cast to avoid type warning in error message
+
+commit 5abfb15ced985c340359ae7fb65a625ed3692b3e
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Jul 15 14:48:30 2016 +1000
+
+ Move VA_COPY macro into compat header.
+
+ Some AIX compilers unconditionally undefine va_copy but don't set it back
+ to an internal function, causing link errors. In some compat code we
+ already use VA_COPY instead so move the two existing instances into the
+ shared header and use for sshbuf-getput-basic.c too. Should fix building
+ with at lease some versions of AIX's compiler. bz#2589, ok djm@
+
+commit 832b7443b7a8e181c95898bc5d73497b7190decd
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jul 15 14:45:34 2016 +1000
+
+ disable ciphers not supported by OpenSSL
+
+ bz#2466 ok dtucker@
+
+commit 5fbe93fc6fbb2fe211e035703dec759d095e3dd8
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jul 15 13:54:31 2016 +1000
+
+ add a --disable-pkcs11 knob
+
+commit 679ce88ec2a8e2fe6515261c489e8c1449bb9da9
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jul 15 13:44:38 2016 +1000
+
+ fix newline escaping for unsupported_algorithms
+
+ The hmac-ripemd160 was incorrect and could lead to broken
+ Makefiles on systems that lacked support for it, but I made
+ all the others consistent too.
+
+commit ed877ef653847d056bb433975d731b7a1132a979
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 15 00:24:30 2016 +0000
+
+ upstream commit
+
+ Add a ProxyJump ssh_config(5) option and corresponding -J
+ ssh(1) command-line flag to allow simplified indirection through a SSH
+ bastion or "jump host".
+
+ These options construct a proxy command that connects to the
+ specified jump host(s) (more than one may be specified) and uses
+ port-forwarding to establish a connection to the next destination.
+
+ This codifies the safest way of indirecting connections through SSH
+ servers and makes it easy to use.
+
+ ok markus@
+
+ Upstream-ID: fa899cb8b26d889da8f142eb9774c1ea36b04397
+
+commit 5c02dd126206a26785379e80f2d3848e4470b711
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Jul 15 12:56:39 2016 +1000
+
+ Map umac_ctx struct name too.
+
+ Prevents size mismatch linker warnings on Solaris 11.
+
+commit 283b97ff33ea2c641161950849931bd578de6946
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Jul 15 13:49:44 2016 +1000
+
+ Mitigate timing of disallowed users PAM logins.
+
+ When sshd decides to not allow a login (eg PermitRootLogin=no) and
+ it's using PAM, it sends a fake password to PAM so that the timing for
+ the failure is not noticeably different whether or not the password
+ is correct. This behaviour can be detected by sending a very long
+ password string which is slower to hash than the fake password.
+
+ Mitigate by constructing an invalid password that is the same length
+ as the one from the client and thus takes the same time to hash.
+ Diff from djm@
+
+commit 9286875a73b2de7736b5e50692739d314cd8d9dc
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Jul 15 13:32:45 2016 +1000
+
+ Determine appropriate salt for invalid users.
+
+ When sshd is processing a non-PAM login for a non-existent user it uses
+ the string from the fakepw structure as the salt for crypt(3)ing the
+ password supplied by the client. That string has a Blowfish prefix, so on
+ systems that don't understand that crypt will fail fast due to an invalid
+ salt, and even on those that do it may have significantly different timing
+ from the hash methods used for real accounts (eg sha512). This allows
+ user enumeration by, eg, sending large password strings. This was noted
+ by EddieEzra.Harari at verint.com (CVE-2016-6210).
+
+ To mitigate, use the same hash algorithm that root uses for hashing
+ passwords for users that do not exist on the system. ok djm@
+
+commit a162dd5e58ca5b224d7500abe35e1ef32b5de071
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Jul 14 21:19:59 2016 +1000
+
+ OpenSSL 1.1.x not currently supported.
+
+commit 7df91b01fc558a33941c5c5f31abbcdc53a729fb
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Jul 14 12:25:24 2016 +1000
+
+ Check for VIS_ALL.
+
+ If we don't have it, set BROKEN_STRNVIS to activate the compat replacement.
+
+commit ee67716f61f1042d5e67f91c23707cca5dcdd7d0
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Jul 14 01:24:21 2016 +0000
+
+ upstream commit
+
+ Correct equal in test.
+
+ Upstream-Regress-ID: 4e32f7a5c57a619c4e8766cb193be2a1327ec37a
+
+commit 372807c2065c8572fdc6478b25cc5ac363743073
+Author: tb at openbsd.org <tb at openbsd.org>
+Date: Mon Jul 11 21:38:13 2016 +0000
+
+ upstream commit
+
+ Add missing "recvfd" pledge promise: Raf Czlonka reported
+ ssh coredumps when Control* keywords were set in ssh_config. This patch also
+ fixes similar problems with scp and sftp.
+
+ ok deraadt, looks good to millert
+
+ Upstream-ID: ca2099eade1ef3e87a79614fefa26a0297ad8a3b
+
+commit e0453f3df64bf485c61c7eb6bd12893eee9fe2cd
+Author: tedu at openbsd.org <tedu at openbsd.org>
+Date: Mon Jul 11 03:19:44 2016 +0000
+
+ upstream commit
+
+ obsolete note about fascistloggin is obsolete. ok djm
+ dtucker
+
+ Upstream-ID: dae60df23b2bb0e89f42661ddd96a7b0d1b7215a
+
+commit a2333584170a565adf4f209586772ef8053b10b8
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Jul 14 10:59:09 2016 +1000
+
+ Add compat code for missing wcwidth.
+
+ If we don't have wcwidth force fallback implementations of nl_langinfo
+ and mbtowc. Based on advice from Ingo Schwarze.
+
+commit 8aaec7050614494014c47510b7e94daf6e644c62
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jul 14 09:48:48 2016 +1000
+
+ fix missing include for systems with err.h
+
+commit 6310ef27a2567cda66d6cf0c1ad290ee1167f243
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Jul 13 14:42:35 2016 +1000
+
+ Move err.h replacements into compat lib.
+
+ Move implementations of err.h replacement functions into their own file
+ in the libopenbsd-compat so we can use them in kexfuzz.c too. ok djm@
+
+commit f3f2cc8386868f51440c45210098f65f9787449a
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jul 11 17:23:38 2016 +1000
+
+ Check for wchar.h and langinfo.h
+
+ Wrap includes in the appropriate #ifdefs.
+
+commit b9c50614eba9d90939b2b119b6e1b7e03b462278
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jul 8 13:59:13 2016 +1000
+
+ whitelist more architectures for seccomp-bpf
+
+ bz#2590 - testing and patch from Jakub Jelen
+
+commit 18813a32b6fd964037e0f5e1893cb4468ac6a758
+Author: guenther at openbsd.org <guenther at openbsd.org>
+Date: Mon Jul 4 18:01:44 2016 +0000
+
+ upstream commit
+
+ DEBUGLIBS has been broken since the gcc4 switch, so delete
+ it. CFLAGS contains -g by default anyway
+
+ problem noted by Edgar Pettijohn (edgar (at) pettijohn-web.com)
+ ok millert@ kettenis@ deraadt@
+
+ Upstream-Regress-ID: 4a0bb72f95c63f2ae9daa8a040ac23914bddb542
+
+commit 6d31193d0baa3da339c196ac49625b7ba1c2ecc7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 8 03:44:42 2016 +0000
+
+ upstream commit
+
+ Improve crypto ordering for Encrypt-then-MAC (EtM) mode
+ MAC algorithms.
+
+ Previously we were computing the MAC, decrypting the packet and then
+ checking the MAC. This gave rise to the possibility of creating a
+ side-channel oracle in the decryption step, though no such oracle has
+ been identified.
+
+ This adds a mac_check() function that computes and checks the MAC in
+ one pass, and uses it to advance MAC checking for EtM algorithms to
+ before payload decryption.
+
+ Reported by Jean Paul Degabriele, Kenny Paterson, Torben Hansen and
+ Martin Albrecht. feedback and ok markus@
+
+ Upstream-ID: 1999bb67cab47dda5b10b80d8155fe83d4a1867b
+
+commit 71f5598f06941f645a451948c4a5125c83828e1c
+Author: guenther at openbsd.org <guenther at openbsd.org>
+Date: Mon Jul 4 18:01:44 2016 +0000
+
+ upstream commit
+
+ DEBUGLIBS has been broken since the gcc4 switch, so
+ delete it. CFLAGS contains -g by default anyway
+
+ problem noted by Edgar Pettijohn (edgar (at) pettijohn-web.com)
+ ok millert@ kettenis@ deraadt@
+
+ Upstream-ID: 96c5054e3e1f170c6276902d5bc65bb3b87a2603
+
+commit e683fc6f1c8c7295648dbda679df8307786ec1ce
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Jun 30 05:17:05 2016 +0000
+
+ upstream commit
+
+ Explicitly check for 100% completion to avoid potential
+ floating point rounding error, which could cause progressmeter to report 99%
+ on completion. While there invert the test so the 100% case is clearer. with
+ & ok djm@
+
+ Upstream-ID: a166870c5878e422f3c71ff802e2ccd7032f715d
+
+commit 772e6cec0ed740fc7db618dc30b4134f5a358b43
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Wed Jun 29 17:14:28 2016 +0000
+
+ upstream commit
+
+ sort the -o list;
+
+ Upstream-ID: 1a97465ede8790b4d47cb618269978e07f41f8ac
+
+commit 46ecd19e554ccca15a7309cd1b6b44bc8e6b84af
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jun 23 05:17:51 2016 +0000
+
+ upstream commit
+
+ fix AuthenticationMethods during configuration re-parse;
+ reported by Juan Francisco Cantero Hurtado
+
+ Upstream-ID: 8ffa1dac25c7577eca8238e825317ab20848f9b4
+
+commit 3147e7595d0f2f842a666c844ac53e6c7a253d7e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jun 19 07:48:02 2016 +0000
+
+ upstream commit
+
+ revert 1.34; causes problems loading public keys
+
+ reported by semarie@
+
+ Upstream-ID: b393794f8935c8b15d98a407fe7721c62d2ed179
+
+commit ad23a75509f4320d43f628c50f0817e3ad12bfa7
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Fri Jun 17 06:33:30 2016 +0000
+
+ upstream commit
+
+ grammar fix;
+
+ Upstream-ID: 5d5b21c80f1e81db367333ce0bb3e5874fb3e463
+
+commit 5e28b1a2a3757548b40018cc2493540a17c82e27
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jun 17 05:06:23 2016 +0000
+
+ upstream commit
+
+ translate OpenSSL error codes to something more
+ meaninful; bz#2522 reported by Jakub Jelen, ok dtucker@
+
+ Upstream-ID: 4cb0795a366381724314e6515d57790c5930ffe5
+
+commit b64faeb5eda7eff8210c754d00464f9fe9d23de5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jun 17 05:03:40 2016 +0000
+
+ upstream commit
+
+ ban AuthenticationMethods="" and accept
+ AuthenticationMethods=any for the default behaviour of not requiring multiple
+ authentication
+
+ bz#2398 from Jakub Jelen; ok dtucker@
+
+ Upstream-ID: fabd7f44d59e4518d241d0d01e226435cc23cf27
+
+commit 9816fc5daee5ca924dd5c4781825afbaab728877
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Jun 16 11:00:17 2016 +0000
+
+ upstream commit
+
+ Include stdarg.h for va_copy as per man page.
+
+ Upstream-ID: 105d6b2f1af2fbd9d91c893c436ab121434470bd
+
+commit b6cf84b51bc0f5889db48bf29a0c771954ade283
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Thu Jun 16 06:10:45 2016 +0000
+
+ upstream commit
+
+ keys stored in openssh format can have comments too; diff
+ from yonas yanfa, tweaked a bit;
+
+ ok djm
+
+ Upstream-ID: 03d48536da6e51510d73ade6fcd44ace731ceb27
+
+commit aa37768f17d01974b6bfa481e5e83841b6c76f86
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jun 20 15:55:34 2016 +1000
+
+ get_remote_name_or_ip inside LOGIN_NEEDS_UTMPX
+
+ Apply the same get_remote_name_or_ip -> session_get_remote_name_or_ip
+ change as commit 95767262 to the code inside #ifdef LOGIN_NEEDS_UTMPX.
+ Fixes build on AIX.
+
+commit 009891afc8df37bc2101e15d1e0b6433cfb90549
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Jun 17 14:34:09 2016 +1000
+
+ Remove duplicate code from PAM. ok djm@
+
+commit e690fe85750e93fca1fb7c7c8587d4130a4f7aba
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Jun 15 00:40:40 2016 +0000
+
+ upstream commit
+
+ Remove "POSSIBLE BREAK-IN ATTEMPT!" from log message
+ about forward and reverse DNS not matching. We haven't supported IP-based
+ auth methods for a very long time so it's now misleading. part of bz#2585,
+ ok markus@
+
+ Upstream-ID: 5565ef0ee0599b27f0bd1d3bb1f8a323d8274e29
+
+commit 57b4ee04cad0d3e0fec1194753b0c4d31e39a1cd
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Jun 15 11:22:38 2016 +1000
+
+ Move platform_disable_tracing into its own file.
+
+ Prevents link errors resolving the extern "options" when platform.o
+ gets linked into ssh-agent when building --with-pam.
+
+commit 78dc8e3724e30ee3e1983ce013e80277dc6ca070
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Jun 14 13:55:12 2016 +1000
+
+ Track skipped upstream commit IDs.
+
+ There are a small number of "upstream" commits that do not correspond to
+ a file in -portable. This file tracks those so that we can reconcile
+ OpenBSD and Portable to ensure that no commits are accidentally missed.
+
+ If you add something to .skipped-commit-ids please also add an upstream
+ ID line in the following format when you commit it.
+
+ Upstream-ID: 321065a95a7ccebdd5fd08482a1e19afbf524e35
+ Upstream-ID: d4f699a421504df35254cf1c6f1a7c304fb907ca
+ Upstream-ID: aafe246655b53b52bc32c8a24002bc262f4230f7
+ Upstream-ID: 8fa9cd1dee3c3339ae329cf20fb591db6d605120
+ Upstream-ID: f31327a48dd4103333cc53315ec53fe65ed8a17a
+ Upstream-ID: edbfde98c40007b7752a4ac106095e060c25c1ef
+ Upstream-ID: 052fd565e3ff2d8cec3bc957d1788f50c827f8e2
+ Upstream-ID: 7cf73737f357492776223da1c09179fa6ba74660
+ Upstream-ID: 180d84674be1344e45a63990d60349988187c1ae
+ Upstream-ID: f6ae971186ba68d066cd102e57d5b0b2c211a5ee
+
+commit 9f919d1a3219d476d6a662d18df058e1c4f36a6f
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Jun 14 13:51:01 2016 +1000
+
+ Remove now-defunct .cvsignore files. ok djm
+
+commit 68777faf271efb2713960605c748f6c8a4b26d55
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Jun 8 02:13:01 2016 +0000
+
+ upstream commit
+
+ Back out rev 1.28 "Check min and max sizes sent by the
+ client" change. It caused "key_verify failed for server_host_key" in clients
+ that send a DH-GEX min value less that DH_GRP_MIN, eg old OpenSSH and PuTTY.
+ ok djm@
+
+ Upstream-ID: 452979d3ca5c1e9dff063287ea0a5314dd091f65
+
+commit a86ec4d0737ac5879223e7cd9d68c448df46e169
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Jun 14 10:48:27 2016 +1000
+
+ Use Solaris setpflags(__PROC_PROTECT, ...).
+
+ Where possible, use Solaris setpflags to disable process tracing on
+ ssh-agent and sftp-server. bz#2584, based on a patch from huieying.lee
+ at oracle.com, ok djm.
+
+commit 0f916d39b039fdc0b5baf9b5ab0754c0f11ec573
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Jun 14 10:43:53 2016 +1000
+
+ Shorten prctl code a tiny bit.
+
+commit 0fb7f5985351fbbcd2613d8485482c538e5123be
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Jun 9 16:23:07 2016 +1000
+
+ Move prctl PR_SET_DUMPABLE into platform.c.
+
+ This should make it easier to add additional platform support such as
+ Solaris (bz#2584).
+
+commit e6508898c3cd838324ecfe1abd0eb8cf802e7106
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jun 3 04:10:41 2016 +0000
+
+ upstream commit
+
+ Add a test for ssh(1)'s config file parsing.
+
+ Upstream-Regress-ID: 558b7f4dc45cc3761cc3d3e889b9f3c5bc91e601
+
+commit ab0a536066dfa32def0bd7272c096ebb5eb25b11
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jun 3 03:47:59 2016 +0000
+
+ upstream commit
+
+ Add 'sshd' to the test ID as I'm about to add a similar
+ set for ssh.
+
+ Upstream-Regress-ID: aea7a9c3bac638530165c801ce836875b228ae7a
+
+commit a5577c1ed3ecdfe4b7b1107c526cae886fc91afb
+Author: schwarze at openbsd.org <schwarze at openbsd.org>
+Date: Mon May 30 12:14:08 2016 +0000
+
+ upstream commit
+
+ stricter malloc.conf(5) options for utf8 tests
+
+ Upstream-Regress-ID: 111efe20a0fb692fa1a987f6e823310f9b25abf6
+
+commit 75f0844b4f29d62ec3a5e166d2ee94b02df819fc
+Author: schwarze at openbsd.org <schwarze at openbsd.org>
+Date: Mon May 30 12:05:56 2016 +0000
+
+ upstream commit
+
+ Fix two rare edge cases: 1. If vasprintf() returns < 0,
+ do not access a NULL pointer in snmprintf(), and do not free() the pointer
+ returned from vasprintf() because on some systems other than OpenBSD, it
+ might be a bogus pointer. 2. If vasprintf() returns == 0, return 0 and ""
+ rather than -1 and NULL.
+
+ Besides, free(dst) is pointless after failure (not a bug).
+
+ One half OK martijn@, the other half OK deraadt@;
+ committing quickly before people get hurt.
+
+ Upstream-Regress-ID: b164f20923812c9bac69856dbc1385eb1522cba4
+
+commit 016881eb33a7948028848c90f4c7ac42e3af0e87
+Author: schwarze at openbsd.org <schwarze at openbsd.org>
+Date: Thu May 26 19:14:25 2016 +0000
+
+ upstream commit
+
+ test the new utf8 module
+
+ Upstream-Regress-ID: c923d05a20e84e4ef152cbec947fdc4ce6eabbe3
+
+commit d4219028bdef448e089376f3afe81ef6079da264
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue May 3 15:30:46 2016 +0000
+
+ upstream commit
+
+ Set umask to prevent "Bad owner or permissions" errors.
+
+ Upstream-Regress-ID: 8fdf2fc4eb595ccd80c443f474d639f851145417
+
+commit 07d5608bb237e9b3fe86a2aeaa429392230faebf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue May 3 14:41:04 2016 +0000
+
+ upstream commit
+
+ support doas
+
+ Upstream-Regress-ID: 8d5572b27ea810394eeda432d8b4e9e1064a7c38
+
+commit 01cabf10adc7676cba5f40536a34d3b246edb73f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue May 3 13:48:33 2016 +0000
+
+ upstream commit
+
+ unit tests for sshbuf_dup_string()
+
+ Upstream-Regress-ID: 7521ff150dc7f20511d1c2c48fd3318e5850a96d
+
+commit 6915f1698e3d1dd4e22eac20f435e1dfc1d46372
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Fri Jun 3 06:44:12 2016 +0000
+
+ upstream commit
+
+ tweak previous;
+
+ Upstream-ID: 92979f1a0b63e041a0e5b08c9ed0ba9b683a3698
+
+commit 0cb2f4c2494b115d0f346ed2d8b603ab3ba643f4
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jun 3 04:09:38 2016 +0000
+
+ upstream commit
+
+ Allow ExitOnForwardFailure and ClearAllForwardings to be
+ overridden when using ssh -W (but still default to yes in that case).
+ bz#2577, ok djm at .
+
+ Upstream-ID: 4b20c419e93ca11a861c81c284090cfabc8c54d4
+
+commit 8543ff3f5020fe659839b15f05b8c522bde6cee5
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jun 3 03:14:41 2016 +0000
+
+ upstream commit
+
+ Move the host and port used by ssh -W into the Options
+ struct. This will make future changes a bit easier. ok djm@
+
+ Upstream-ID: 151bce5ecab2fbedf0d836250a27968d30389382
+
+commit 6b87311d3acdc460f926b2c40f4c4f3fd345f368
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Jun 1 04:19:49 2016 +0000
+
+ upstream commit
+
+ Check min and max sizes sent by the client against what
+ we support before passing them to the monitor. ok djm@
+
+ Upstream-ID: 750627e8117084215412bff00a25b1586ab17ece
+
+commit 564cd2a8926ccb1dca43a535073540935b5e0373
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue May 31 23:46:14 2016 +0000
+
+ upstream commit
+
+ Ensure that the client's proposed DH-GEX max value is at
+ least as big as the minimum the server will accept. ok djm@
+
+ Upstream-ID: b4b84fa04aab2de7e79a6fee4a6e1c189c0fe775
+
+commit df820722e40309c9b3f360ea4ed47a584ed74333
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jun 6 11:36:13 2016 +1000
+
+ Add compat bits to utf8.c.
+
+commit 05c6574652571becfe9d924226c967a3f4b3f879
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jun 6 11:33:43 2016 +1000
+
+ Fix utf->utf8 typo.
+
+commit 6c1717190b4d5ddd729cd9e24e8ed71ed4f087ce
+Author: schwarze at openbsd.org <schwarze at openbsd.org>
+Date: Mon May 30 18:34:41 2016 +0000
+
+ upstream commit
+
+ Backout rev. 1.43 for now.
+
+ The function update_progress_meter() calls refresh_progress_meter()
+ which calls snmprintf() which calls malloc(); but update_progress_meter()
+ acts as the SIGALRM signal handler.
+
+ "malloc(): error: recursive call" reported by sobrado at .
+
+ Upstream-ID: aaae57989431e5239c101f8310f74ccc83aeb93e
+
+commit cd9e1eabeb4137182200035ab6fa4522f8d24044
+Author: schwarze at openbsd.org <schwarze at openbsd.org>
+Date: Mon May 30 12:57:21 2016 +0000
+
+ upstream commit
+
+ Even when only writing an unescaped character, the dst
+ buffer may need to grow, or it would be overrun; issue found by tb@ with
+ malloc.conf(5) 'C'.
+
+ While here, reserve an additional byte for the terminating NUL
+ up front such that we don't have to realloc() later just for that.
+
+ OK tb@
+
+ Upstream-ID: 30ebcc0c097c4571b16f0a78b44969f170db0cff
+
+commit ac284a355f8065eaef2a16f446f3c44cdd17371d
+Author: schwarze at openbsd.org <schwarze at openbsd.org>
+Date: Mon May 30 12:05:56 2016 +0000
+
+ upstream commit
+
+ Fix two rare edge cases: 1. If vasprintf() returns < 0,
+ do not access a NULL pointer in snmprintf(), and do not free() the pointer
+ returned from vasprintf() because on some systems other than OpenBSD, it
+ might be a bogus pointer. 2. If vasprintf() returns == 0, return 0 and ""
+ rather than -1 and NULL.
+
+ Besides, free(dst) is pointless after failure (not a bug).
+
+ One half OK martijn@, the other half OK deraadt@;
+ committing quickly before people get hurt.
+
+ Upstream-ID: b7bcd2e82fc168a8eff94e41f5db336ed986fed0
+
+commit 0e059cdf5fd86297546c63fa8607c24059118832
+Author: schwarze at openbsd.org <schwarze at openbsd.org>
+Date: Wed May 25 23:48:45 2016 +0000
+
+ upstream commit
+
+ To prevent screwing up terminal settings when printing to
+ the terminal, for ASCII and UTF-8, escape bytes not forming characters and
+ bytes forming non-printable characters with vis(3) VIS_OCTAL. For other
+ character sets, abort printing of the current string in these cases. In
+ particular, * let scp(1) respect the local user's LC_CTYPE locale(1); *
+ sanitize data received from the remote host; * sanitize filenames, usernames,
+ and similar data even locally; * take character display widths into account
+ for the progressmeter.
+
+ This is believed to be sufficient to keep the local terminal safe
+ on OpenBSD, but bad things can still happen on other systems with
+ state-dependent locales because many places in the code print
+ unencoded ASCII characters into the output stream.
+
+ Using feedback from djm@ and martijn@,
+ various aspects discussed with many others.
+
+ deraadt@ says it should go in now, i probably already hesitated too long
+
+ Upstream-ID: e66afbc94ee396ddcaffd433b9a3b80f387647e0
+
+commit 8c02e3639acefe1e447e293dbe23a0917abd3734
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue May 24 04:43:45 2016 +0000
+
+ upstream commit
+
+ KNF compression proposal and simplify the client side a
+ little. ok djm@
+
+ Upstream-ID: aa814b694efe9e5af8a26e4c80a05526ae6d6605
+
+commit 7ec4946fb686813eb5f8c57397e465f5485159f4
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue May 24 02:31:57 2016 +0000
+
+ upstream commit
+
+ Back out 'plug memleak'.
+
+ Upstream-ID: 4faacdde136c24a961e24538de373660f869dbc0
+
+commit 82f24c3ddc52053aeb7beb3332fa94c92014b0c5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon May 23 23:30:50 2016 +0000
+
+ upstream commit
+
+ prefer agent-hosted keys to keys from PKCS#11; ok markus
+
+ Upstream-ID: 7417f7653d58d6306d9f8c08d0263d050e2fd8f4
+
+commit a0cb7778fbc9b43458f7072eb68dd858766384d1
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Mon May 23 00:17:27 2016 +0000
+
+ upstream commit
+
+ Plug mem leak in filter_proposal. ok djm@
+
+ Upstream-ID: bf968da7cfcea2a41902832e7d548356a4e2af34
+
+commit ae9c0d4d5c581b3040d1f16b5c5f4b1cd1616743
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Jun 3 16:03:44 2016 +1000
+
+ Update vis.h and vis.c from OpenBSD.
+
+ This will be needed for the upcoming utf8 changes.
+
+commit e1d93705f8f48f519433d6ca9fc3d0abe92a1b77
+Author: Tim Rice <tim at multitalents.net>
+Date: Tue May 31 11:13:22 2016 -0700
+
+ modified: configure.ac
+ whitspace clean up. No code changes.
+
+commit 604a037d84e41e31f0aec9075df0b8740c130200
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue May 31 16:45:28 2016 +1000
+
+ whitespace at EOL
+
+commit 18424200160ff5c923113e0a37ebe21ab7bcd17c
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon May 30 19:35:28 2016 +1000
+
+ Add missing ssh-host-config --name option
+
+ Patch from vinschen at redhat.com.
+
+commit 39c0cecaa188a37a2e134795caa68e03f3ced592
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri May 20 10:01:58 2016 +1000
+
+ Fix comment about sshpam_const and AIX.
+
+ From mschwager via github.
+
+commit f64062b1f74ad5ee20a8a49aab2732efd0f7ce30
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri May 20 09:56:53 2016 +1000
+
+ Deny lstat syscalls in seccomp sandbox
+
+ Avoids sandbox violations for some krb/gssapi libraries.
+
+commit 531c135409b8d8810795b1f3692a4ebfd5c9cae0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 19 07:45:32 2016 +0000
+
+ upstream commit
+
+ fix type of ed25519 values
+
+ Upstream-ID: b32d0cb372bbe918ca2de56906901eae225a59b0
+
+commit 75e21688f523799c9e0cc6601d76a9c5ca79f787
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed May 4 14:32:26 2016 +0000
+
+ upstream commit
+
+ add IdentityAgent; noticed & ok jmc@
+
+ Upstream-ID: 4ba9034b00a4cf1beae627f0728da897802df88a
+
+commit 1a75d14daf4b60db903e6103cf50e74e0cd0a76b
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed May 4 14:29:58 2016 +0000
+
+ upstream commit
+
+ allow setting IdentityAgent to SSH_AUTH_SOCK; ok djm@
+
+ Upstream-ID: 20c508480d8db3eef18942c0fc39b1fcf25652ac
+
+commit 0516454151ae722fc8256c3c56115c6baf24c5b0
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed May 4 14:22:33 2016 +0000
+
+ upstream commit
+
+ move SSH_MSG_NONE, so we don't have to include ssh1.h;
+ ok deraadt@
+
+ Upstream-ID: c2f97502efc761a41b18c17ddf460e138ca7994e
+
+commit 332ff3d770631e7513fea38cf0d3689f673f0e3f
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue May 10 09:51:06 2016 +1000
+
+ initialise salen in binresvport_sa
+
+ avoids failures with UsePrivilegedPort=yes
+
+ patch from Juan Gallego
+
+commit c5c1d5d2f04ce00d2ddd6647e61b32f28be39804
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed May 4 14:04:40 2016 +0000
+
+ upstream commit
+
+ missing const in prototypes (ssh1)
+
+ Upstream-ID: 789c6ad4928b5fa557369b88c3a6a34926082c05
+
+commit 9faae50e2e82ba42eb0cb2726bf6830fe7948f28
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed May 4 14:00:09 2016 +0000
+
+ upstream commit
+
+ Fix inverted logic for updating StreamLocalBindMask which
+ would cause the server to set an invalid mask. ok djm@
+
+ Upstream-ID: 8a4404c8307a5ef9e07ee2169fc6d8106b527587
+
+commit b02ad1ce9105bfa7394ac7590c0729dd52e26a81
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed May 4 12:21:53 2016 +0000
+
+ upstream commit
+
+ IdentityAgent for specifying specific agent sockets; ok
+ djm@
+
+ Upstream-ID: 3e6a15eb89ea0fd406f108826b7dc7dec4fbfac1
+
+commit 910e59bba09ac309d78ce61e356da35292212935
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed May 4 12:16:39 2016 +0000
+
+ upstream commit
+
+ fix junk characters after quotes
+
+ Upstream-ID: cc4d0cd32cb6b55a2ef98975d2f7ae857d0dc578
+
+commit 9283884e647b8be50ccd2997537af0065672107d
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Tue May 3 18:38:12 2016 +0000
+
+ upstream commit
+
+ correct article;
+
+ Upstream-ID: 1fbd5b7ab16d2d9834ec79c3cedd4738fa42a168
+
+commit cfefbcea1057c2623e76c579174a4107a0b6e6cd
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue May 3 15:57:39 2016 +0000
+
+ upstream commit
+
+ fix overriding of StreamLocalBindMask and
+ StreamLocalBindUnlink in Match blocks; found the hard way Rogan Dawes
+
+ Upstream-ID: 940bc69ec0249ab428d24ccd0722ce35cb932ee2
+
+commit 771c2f51ffc0c9a2877b7892fada0c77bd1f6549
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue May 3 15:25:06 2016 +0000
+
+ upstream commit
+
+ don't forget to include StreamLocalBindUnlink in the
+ config dump output
+
+ Upstream-ID: 14a6d970b3b45c8e94272e3c661e9a0b2a0ee7cb
+
+commit cdcd941994dc430f50d0a4e6a712d32b66e6199e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue May 3 14:54:08 2016 +0000
+
+ upstream commit
+
+ make nethack^wrandomart fingerprint flag more readily
+ searchable pointed out by Matt Johnston
+
+ Upstream-ID: cb40d0235dc153c478c1aad3bc60b195422a54fb
+
+commit 05855bf2ce7d5cd0a6db18bc0b4214ed5ef7516d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue May 3 13:10:24 2016 +0000
+
+ upstream commit
+
+ clarify ordering of subkeys; pointed out by ietf-ssh AT
+ stbuehler.de
+
+ Upstream-ID: 05ebe9f949449a555ebce8e0aad7c8c9acaf8463
+
+commit cca3b4395807bfb7aaeb83d2838f5c062ce30566
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue May 3 12:15:49 2016 +0000
+
+ upstream commit
+
+ Use a subshell for constructing key types to work around
+ different sed behaviours for -portable.
+
+ Upstream-Regress-ID: 0f6eb673162df229eda9a134a0f10da16151552d
+
+commit fa58208c6502dcce3e0daac0ca991ee657daf1f5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue May 3 10:27:59 2016 +0000
+
+ upstream commit
+
+ correct some typos and remove a long-stale XXX note.
+
+ add specification for ed25519 certificates
+
+ mention no host certificate options/extensions are currently defined
+
+ pointed out by Simon Tatham
+
+ Upstream-ID: 7b535ab7dba3340b7d8210ede6791fdaefdf839a
+
+commit b466f956c32cbaff4200bfcd5db6739fe4bc7d04
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue May 3 10:24:27 2016 +0000
+
+ upstream commit
+
+ add ed25519 keys that are supported but missing from this
+ documents; from Peter Moody
+
+ Upstream-ID: 8caac2d8e8cfd2fca6dc304877346e0a064b014b
+
+commit 7f3d76319a69dab2efe3a520a8fef5b97e923636
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue May 3 09:03:49 2016 +0000
+
+ upstream commit
+
+ Implement IUTF8 as per draft-sgtatham-secsh-iutf8-00. Patch
+ from Simon Tatham, ok markus@
+
+ Upstream-ID: 58268ebdf37d9d467f78216c681705a5e10c58e8
+
+commit 31bc01c05d9f51bee3ebe33dc57c4fafb059fb62
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon May 2 14:10:58 2016 +0000
+
+ upstream commit
+
+ unbreak config parsing on reexec from previous commit
+
+ Upstream-ID: bc69932638a291770955bd05ca55a32660a613ab
+
+commit 67f1459efd2e85bf03d032539283fa8107218936
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon May 2 09:52:00 2016 +0000
+
+ upstream commit
+
+ unit and regress tests for SHA256/512; ok markus
+
+ Upstream-Regress-ID: a0cd1a92dc824067076a5fcef83c18df9b0bf2c6
+
+commit 0e8eeec8e75f6d0eaf33317376f773160018a9c7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon May 2 10:26:04 2016 +0000
+
+ upstream commit
+
+ add support for additional fixed DH groups from
+ draft-ietf-curdle-ssh-kex-sha2-03
+
+ diffie-hellman-group14-sha256 (2K group)
+ diffie-hellman-group16-sha512 (4K group)
+ diffie-hellman-group18-sha512 (8K group)
+
+ based on patch from Mark D. Baushke and Darren Tucker
+ ok markus@
+
+ Upstream-ID: ac00406ada4f0dfec41585ca0839f039545bc46f
+
+commit 57464e3934ba53ad8590ee3ccd840f693407fc1e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon May 2 09:36:42 2016 +0000
+
+ upstream commit
+
+ support SHA256 and SHA512 RSA signatures in certificates;
ok markus@
- - djm at cvs.openbsd.org 2013/12/15 21:42:35
- [cipher-chachapoly.c]
- add some comments and constify a constant
- - markus at cvs.openbsd.org 2013/12/17 10:36:38
- [crypto_api.h]
- I've assempled the header file by cut&pasting from generated headers
- and the source files.
+
+ Upstream-ID: b45be2f2ce8cacd794dc5730edaabc90e5eb434a
-20131208
- - (djm) [openbsd-compat/bsd-setres_id.c] Missing header; from Corinna
- Vinschen
- - (djm) [Makefile.in regress/Makefile regress/agent-ptrace.sh]
- [regress/setuid-allowed.c] Check that ssh-agent is not on a no-setuid
- filesystem before running agent-ptrace.sh; ok dtucker
+commit 1a31d02b2411c4718de58ce796dbb7b5e14db93e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon May 2 08:49:03 2016 +0000
-20131207
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/12/05 22:59:45
- [sftp-client.c]
- fix memory leak in error path in do_readdir(); pointed out by
- Loganaden Velvindron @ AfriNIC in bz#2163
- - djm at cvs.openbsd.org 2013/12/06 03:40:51
- [ssh-keygen.c]
- remove duplicated character ('g') in getopt() string;
- document the (few) remaining option characters so we don't have to
- rummage next time.
- - markus at cvs.openbsd.org 2013/12/06 13:30:08
- [authfd.c key.c key.h ssh-agent.c]
- move private key (de)serialization to key.c; ok djm
- - markus at cvs.openbsd.org 2013/12/06 13:34:54
- [authfile.c authfile.h cipher.c cipher.h key.c packet.c ssh-agent.c]
- [ssh-keygen.c PROTOCOL.key] new private key format, bcrypt as KDF by
- default; details in PROTOCOL.key; feedback and lots help from djm;
- ok djm@
- - markus at cvs.openbsd.org 2013/12/06 13:39:49
- [authfd.c authfile.c key.c key.h myproposal.h pathnames.h readconf.c]
- [servconf.c ssh-agent.c ssh-keygen.c ssh-keyscan.1 ssh-keyscan.c]
- [ssh-keysign.c ssh.c ssh_config.5 sshd.8 sshd.c verify.c ssh-ed25519.c]
- [sc25519.h sc25519.c hash.c ge25519_base.data ge25519.h ge25519.c]
- [fe25519.h fe25519.c ed25519.c crypto_api.h blocks.c]
- support ed25519 keys (hostkeys and user identities) using the public
- domain ed25519 reference code from SUPERCOP, see
- http://ed25519.cr.yp.to/software.html
- feedback, help & ok djm@
- - jmc at cvs.openbsd.org 2013/12/06 15:29:07
- [sshd.8]
- missing comma;
- - djm at cvs.openbsd.org 2013/12/07 00:19:15
- [key.c]
- set k->cert = NULL after freeing it
- - markus at cvs.openbsd.org 2013/12/06 13:52:46
- [regress/Makefile regress/agent.sh regress/cert-hostkey.sh]
- [regress/cert-userkey.sh regress/keytype.sh]
- test ed25519 support; from djm@
- - (djm) [blocks.c ed25519.c fe25519.c fe25519.h ge25519.c ge25519.h]
- [ge25519_base.data hash.c sc25519.c sc25519.h verify.c] Fix RCS idents
- - (djm) [Makefile.in] Add ed25519 sources
- - (djm) [authfile.c] Conditionalise inclusion of util.h
- - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bcrypt_pbkdf.c]
- [openbsd-compat/blf.h openbsd-compat/blowfish.c]
- [openbsd-compat/openbsd-compat.h] Start at supporting bcrypt_pbkdf in
- portable.
- - (djm) [ed25519.c ssh-ed25519.c openbsd-compat/Makefile.in]
- [openbsd-compat/bcrypt_pbkdf.c] Make ed25519/new key format compile on
- Linux
- - (djm) [regress/cert-hostkey.sh] Fix merge botch
- - (djm) [Makefile.in] PATHSUBS and keygen bits for Ed25519; from
- Loganaden Velvindron @ AfriNIC in bz#2179
+ upstream commit
+
+ fix signed/unsigned errors reported by clang-3.7; add
+ sshbuf_dup_string() to replace a common idiom of strdup(sshbuf_ptr()) with
+ better safety checking; feedback and ok markus@
+
+ Upstream-ID: 71f926d9bb3f1efed51319a6daf37e93d57c8820
-20131205
- - (djm) OpenBSD CVS Sync
- - jmc at cvs.openbsd.org 2013/11/21 08:05:09
- [ssh_config.5 sshd_config.5]
- no need for .Pp before displays;
- - deraadt at cvs.openbsd.org 2013/11/25 18:04:21
- [ssh.1 ssh.c]
- improve -Q usage and such. One usage change is that the option is now
- case-sensitive
- ok dtucker markus djm
- - jmc at cvs.openbsd.org 2013/11/26 12:14:54
- [ssh.1 ssh.c]
- - put -Q in the right place
- - Ar was a poor choice for the arguments to -Q. i've chosen an
- admittedly equally poor Cm, at least consistent with the rest
- of the docs. also no need for multiple instances
- - zap a now redundant Nm
- - usage() sync
- - deraadt at cvs.openbsd.org 2013/11/26 19:15:09
- [pkcs11.h]
- cleanup 1 << 31 idioms. Resurrection of this issue pointed out by
- Eitan Adler ok markus for ssh, implies same change in kerberosV
- - djm at cvs.openbsd.org 2013/12/01 23:19:05
- [PROTOCOL]
- mention curve25519-sha256 at libssh.org key exchange algorithm
- - djm at cvs.openbsd.org 2013/12/02 02:50:27
- [PROTOCOL.chacha20poly1305]
- typo; from Jon Cave
- - djm at cvs.openbsd.org 2013/12/02 02:56:17
- [ssh-pkcs11-helper.c]
- use-after-free; bz#2175 patch from Loganaden Velvindron @ AfriNIC
- - djm at cvs.openbsd.org 2013/12/02 03:09:22
- [key.c]
- make key_to_blob() return a NULL blob on failure; part of
- bz#2175 from Loganaden Velvindron @ AfriNIC
- - djm at cvs.openbsd.org 2013/12/02 03:13:14
- [cipher.c]
- correct bzero of chacha20+poly1305 key context. bz#2177 from
- Loganaden Velvindron @ AfriNIC
-
- Also make it a memset for consistency with the rest of cipher.c
- - djm at cvs.openbsd.org 2013/12/04 04:20:01
- [sftp-client.c]
- bz#2171: don't leak local_fd on error; from Loganaden Velvindron @
- AfriNIC
- - djm at cvs.openbsd.org 2013/12/05 01:16:41
- [servconf.c servconf.h]
- bz#2161 - fix AuthorizedKeysCommand inside a Match block and
- rearrange things so the same error is harder to make next time;
- with and ok dtucker@
- - (dtucker) [configure.ac] bz#2173: use pkg-config --libs to include correct
- -L location for libedit. Patch from Serge van den Boom.
+commit d2d6bf864e52af8491a60dd507f85b74361f5da3
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 29 08:07:53 2016 +0000
-20131121
- - (djm) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/11/08 11:15:19
- [bufaux.c bufbn.c buffer.c sftp-client.c sftp-common.c sftp-glob.c]
- [uidswap.c] Include stdlib.h for free() as per the man page.
- - markus at cvs.openbsd.org 2013/11/13 13:48:20
- [ssh-pkcs11.c]
- add missing braces found by pedro
- - djm at cvs.openbsd.org 2013/11/20 02:19:01
- [sshd.c]
- delay closure of in/out fds until after "Bad protocol version
- identification..." message, as get_remote_ipaddr/get_remote_port
- require them open.
- - deraadt at cvs.openbsd.org 2013/11/20 20:53:10
- [scp.c]
- unsigned casts for ctype macros where neccessary
- ok guenther millert markus
- - deraadt at cvs.openbsd.org 2013/11/20 20:54:10
- [canohost.c clientloop.c match.c readconf.c sftp.c]
- unsigned casts for ctype macros where neccessary
- ok guenther millert markus
- - djm at cvs.openbsd.org 2013/11/21 00:45:44
- [Makefile.in PROTOCOL PROTOCOL.chacha20poly1305 authfile.c chacha.c]
- [chacha.h cipher-chachapoly.c cipher-chachapoly.h cipher.c cipher.h]
- [dh.c myproposal.h packet.c poly1305.c poly1305.h servconf.c ssh.1]
- [ssh.c ssh_config.5 sshd_config.5] Add a new protocol 2 transport
- cipher "chacha20-poly1305 at openssh.com" that combines Daniel
- Bernstein's ChaCha20 stream cipher and Poly1305 MAC to build an
- authenticated encryption mode.
-
- Inspired by and similar to Adam Langley's proposal for TLS:
- http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-03
- but differs in layout used for the MAC calculation and the use of a
- second ChaCha20 instance to separately encrypt packet lengths.
- Details are in the PROTOCOL.chacha20poly1305 file.
-
- Feedback markus@, naddy@; manpage bits Loganden Velvindron @ AfriNIC
- ok markus@ naddy@
- - naddy at cvs.openbsd.org 2013/11/18 05:09:32
- [regress/forward-control.sh]
- bump timeout to 10 seconds to allow slow machines (e.g. Alpha PC164)
- to successfully run this; ok djm@
- - djm at cvs.openbsd.org 2013/11/21 03:15:46
- [regress/krl.sh]
- add some reminders for additional tests that I'd like to implement
- - djm at cvs.openbsd.org 2013/11/21 03:16:47
- [regress/modpipe.c]
- use unsigned long long instead of u_int64_t here to avoid warnings
- on some systems portable OpenSSH is built on.
- - djm at cvs.openbsd.org 2013/11/21 03:18:51
- [regress/cipher-speed.sh regress/integrity.sh regress/rekey.sh]
- [regress/try-ciphers.sh]
- use new "ssh -Q cipher-auth" query to obtain lists of authenticated
- encryption ciphers instead of specifying them manually; ensures that
- the new chacha20poly1305 at openssh.com mode is tested;
-
- ok markus@ and naddy@ as part of the diff to add
- chacha20poly1305 at openssh.com
+ upstream commit
+
+ close ControlPersist background process stderr when not
+ in debug mode or when logging to a file or syslog. bz#1988 ok dtucker
+
+ Upstream-ID: 4fb726f0fdcb155ad419913cea10dc4afd409d24
-20131110
- - (dtucker) [regress/keytype.sh] Populate ECDSA key types to be tested by
- querying the ones that are compiled in.
+commit 9ee692fa1146e887e008a2b9a3d3ea81770c9fc8
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Apr 28 14:30:21 2016 +0000
-20131109
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/11/09 05:41:34
- [regress/test-exec.sh regress/rekey.sh]
- Use smaller test data files to speed up tests. Grow test datafiles
- where necessary for a specific test.
- - (dtucker) [configure.ac kex.c key.c myproposal.h] Test for the presence of
- NID_X9_62_prime256v1, NID_secp384r1 and NID_secp521r1 and test that the
- latter actually works before using it. Fedora (at least) has NID_secp521r1
- that doesn't work (see https://bugzilla.redhat.com/show_bug.cgi?id=1021897).
- - (dtucker) [configure.ac] Fix brackets in NID_secp521r1 test.
- - (dtucker) [configure.ac] Add missing "test".
- - (dtucker) [key.c] Check for the correct defines for NID_secp521r1.
+ upstream commit
+
+ fix comment
+
+ Upstream-ID: 313a385bd7b69a82f8e28ecbaf5789c774457b15
-20131108
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/11/08 01:06:14
- [regress/rekey.sh]
- Rekey less frequently during tests to speed them up
- - (djm) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/11/07 11:58:27
- [cipher.c cipher.h kex.c kex.h mac.c mac.h servconf.c ssh.c]
- Output the effective values of Ciphers, MACs and KexAlgorithms when
- the default has not been overridden. ok markus@
- - djm at cvs.openbsd.org 2013/11/08 00:39:15
- [auth-options.c auth2-chall.c authfd.c channels.c cipher-3des1.c]
- [clientloop.c gss-genr.c monitor_mm.c packet.c schnorr.c umac.c]
- [sftp-client.c sftp-glob.c]
- use calloc for all structure allocations; from markus@
- - djm at cvs.openbsd.org 2013/11/08 01:38:11
- [version.h]
- openssh-6.4
- - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
- [contrib/suse/openssh.spec] Update version numbers following release.
- - (dtucker) [openbsd-compat/openbsd-compat.h] Add null implementation of
- arc4random_stir for platforms that have arc4random but don't have
- arc4random_stir (right now this is only OpenBSD -current).
- - (dtucker) [kex.c] Only enable CURVE25519_SHA256 if we actually have
- EVP_sha256.
- - (dtucker) [myproposal.h] Conditionally enable CURVE25519_SHA256.
- - (dtucker) [openbsd-compat/bsd-poll.c] Add headers to prevent compile
- warnings.
- - (dtucker) [Makefile.in configure.ac] Set MALLOC_OPTIONS per platform
- and pass in TEST_ENV. use stderr to get polluted
- and the stderr-data test to fail.
- - (dtucker) [contrib/cygwin/ssh-host-config] Simplify host key generation:
- rather than testing and generating each key, call ssh-keygen -A.
- Patch from vinschen at redhat.com.
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/11/09 05:41:34
- [regress/test-exec.sh regress/rekey.sh]
- Use smaller test data files to speed up tests. Grow test datafiles
- where necessary for a specific test.
+commit ee1e0a16ff2ba41a4d203c7670b54644b6c57fa6
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Wed Apr 27 13:53:48 2016 +0000
-20131107
- - (djm) [ssh-pkcs11.c] Bring back "non-constant initialiser" fix (rev 1.5)
- that got lost in recent merge.
- - (djm) [Makefile.in monitor.c] Missed chunks of curve25519 KEX diff
- - (djm) [regress/modpipe.c regress/rekey.sh] Never intended to commit these
- - (djm) [configure.ac defines.h] Skip arc4random_stir() calls on platforms
- that lack it but have arc4random_uniform()
- - (djm) OpenBSD CVS Sync
- - markus at cvs.openbsd.org 2013/11/04 11:51:16
- [monitor.c]
- fix rekeying for KEX_C25519_SHA256; noted by dtucker@
- RCSID sync only; I thought this was a merge botch and fixed it already
- - markus at cvs.openbsd.org 2013/11/06 16:52:11
- [monitor_wrap.c]
- fix rekeying for AES-GCM modes; ok deraadt
- - djm at cvs.openbsd.org 2013/11/06 23:05:59
- [ssh-pkcs11.c]
- from portable: s/true/true_val/ to avoid name collisions on dump platforms
- RCSID sync only
- - (dtucker) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/10/09 23:44:14
- [regress/Makefile] (ID sync only)
- regression test for sftp request white/blacklisting and readonly mode.
- - markus at cvs.openbsd.org 2013/11/02 22:39:53
- [regress/kextype.sh]
- add curve25519-sha256 at libssh.org
- - dtucker at cvs.openbsd.org 2013/11/04 12:27:42
- [regress/rekey.sh]
- Test rekeying with all KexAlgorithms.
- - dtucker at cvs.openbsd.org 2013/11/07 00:12:05
- [regress/rekey.sh]
- Test rekeying for every Cipher, MAC and KEX, plus test every KEX with
- the GCM ciphers.
- - dtucker at cvs.openbsd.org 2013/11/07 01:12:51
- [regress/rekey.sh]
- Factor out the data transfer rekey tests
- - dtucker at cvs.openbsd.org 2013/11/07 02:48:38
- [regress/integrity.sh regress/cipher-speed.sh regress/try-ciphers.sh]
- Use ssh -Q instead of hardcoding lists of ciphers or MACs.
- - dtucker at cvs.openbsd.org 2013/11/07 03:55:41
- [regress/kextype.sh]
- Use ssh -Q to get kex types instead of a static list.
- - dtucker at cvs.openbsd.org 2013/11/07 04:26:56
- [regress/kextype.sh]
- trailing space
- - (dtucker) [Makefile.in configure.ac] Remove TEST_SSH_SHA256 environment
- variable. It's no longer used now that we get the supported MACs from
- ssh -Q.
+ upstream commit
+
+ cidr permitted for {allow,deny}users; from lars nooden ok djm
+
+ Upstream-ID: 13e7327fe85f6c63f3f7f069e0fdc8c351515d11
-20131104
- - (djm) OpenBSD CVS Sync
- - markus at cvs.openbsd.org 2013/11/02 20:03:54
- [ssh-pkcs11.c]
- support pkcs#11 tokes that only provide x509 zerts instead of raw pubkeys;
- fixes bz#1908; based on patch from Laurent Barbe; ok djm
- - markus at cvs.openbsd.org 2013/11/02 21:59:15
- [kex.c kex.h myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
- use curve25519 for default key exchange (curve25519-sha256 at libssh.org);
- initial patch from Aris Adamantiadis; ok djm@
- - markus at cvs.openbsd.org 2013/11/02 22:10:15
- [kexdhs.c kexecdhs.c]
- no need to include monitor_wrap.h
- - markus at cvs.openbsd.org 2013/11/02 22:24:24
- [kexdhs.c kexecdhs.c]
- no need to include ssh-gss.h
- - markus at cvs.openbsd.org 2013/11/02 22:34:01
- [auth-options.c]
- no need to include monitor_wrap.h and ssh-gss.h
- - markus at cvs.openbsd.org 2013/11/02 22:39:19
- [ssh_config.5 sshd_config.5]
- the default kex is now curve25519-sha256 at libssh.org
- - djm at cvs.openbsd.org 2013/11/03 10:37:19
- [roaming_common.c]
- fix a couple of function definitions foo() -> foo(void)
- (-Wold-style-definition)
- - (djm) [kexc25519.c kexc25519c.c kexc25519s.c] Import missed files from
- KEX/curve25519 change
+commit b6e0140a5aa883c27b98415bd8aa9f65fc04ee22
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Apr 21 06:08:02 2016 +0000
-20131103
- - (dtucker) [openbsd-compat/bsd-misc.c] Include time.h for nanosleep.
- From OpenSMTPD where it prevents "implicit declaration" warnings (it's
- a no-op in OpenSSH). From chl at openbsd.
- - (dtucker) [openbsd-compat/setproctitle.c] Handle error case form the 2nd
- vsnprintf. From eric at openbsd via chl at .
- - (dtucker) [configure.ac defines.h] Add typedefs for intmax_t and uintmax_t
- for platforms that don't have them.
+ upstream commit
+
+ make argument == NULL tests more consistent
+
+ Upstream-ID: dc4816678704aa5cbda3a702e0fa2033ff04581d
-20131030
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/10/29 09:42:11
- [key.c key.h]
- fix potential stack exhaustion caused by nested certificates;
- report by Mateusz Kocielski; ok dtucker@ markus@
- - djm at cvs.openbsd.org 2013/10/29 09:48:02
- [servconf.c servconf.h session.c sshd_config sshd_config.5]
- shd_config PermitTTY to disallow TTY allocation, mirroring the
- longstanding no-pty authorized_keys option;
- bz#2070, patch from Teran McKinney; ok markus@
- - jmc at cvs.openbsd.org 2013/10/29 18:49:32
- [sshd_config.5]
- pty(4), not pty(7);
+commit 6aaabc2b610e44bae473457ad9556ffb43d90ee3
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Sun Apr 17 14:34:46 2016 +0000
-20131026
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/10/25 23:04:51
- [ssh.c]
- fix crash when using ProxyCommand caused by previous commit - was calling
- freeaddrinfo(NULL); spotted by sthen@ and Tim Ruehsen, patch by sthen@
+ upstream commit
+
+ tweak previous;
+
+ Upstream-ID: 46c1bab91c164078edbccd5f7d06b9058edd814f
-20131025
- - (djm) [ssh-keygen.c ssh-keysign.c sshconnect1.c sshd.c] Remove
- unnecessary arc4random_stir() calls. The only ones left are to ensure
- that the PRNG gets a different state after fork() for platforms that
- have broken the API.
+commit 0f839e5969efa3bda615991be8a9d9311554c573
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 15 02:57:10 2016 +0000
-20131024
- - (djm) [auth-krb5.c] bz#2032 - use local username in krb5_kuserok check
- rather than full client name which may be of form user at REALM;
- patch from Miguel Sanders; ok dtucker@
- - (djm) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/10/23 05:40:58
- [servconf.c]
- fix comment
- - djm at cvs.openbsd.org 2013/10/23 23:35:32
- [sshd.c]
- include local address and port in "Connection from ..." message (only
- shown at loglevel>=verbose)
- - dtucker at cvs.openbsd.org 2013/10/24 00:49:49
- [moduli.c]
- Periodically print progress and, if possible, expected time to completion
- when screening moduli for DH groups. ok deraadt djm
- - dtucker at cvs.openbsd.org 2013/10/24 00:51:48
- [readconf.c servconf.c ssh_config.5 sshd_config.5]
- Disallow empty Match statements and add "Match all" which matches
- everything. ok djm, man page help jmc@
- - djm at cvs.openbsd.org 2013/10/24 08:19:36
- [ssh.c]
- fix bug introduced in hostname canonicalisation commit: don't try to
- resolve hostnames when a ProxyCommand is set unless the user has forced
- canonicalisation; spotted by Iain Morgan
- - (tim) [regress/sftp-perm.sh] We need a shell that understands "! somecmd"
+ upstream commit
+
+ missing bit of Include regress
+
+ Upstream-Regress-ID: 1063595f7f40f8489a1b7a27230b9e8acccea34f
-20131023
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/10/20 04:39:28
- [ssh_config.5]
- document % expansions performed by "Match command ..."
- - djm at cvs.openbsd.org 2013/10/20 06:19:28
- [readconf.c ssh_config.5]
- rename "command" subclause of the recently-added "Match" keyword to
- "exec"; it's shorter, clearer in intent and we might want to add the
- ability to match against the command being executed at the remote end in
- the future.
- - djm at cvs.openbsd.org 2013/10/20 09:51:26
- [scp.1 sftp.1]
- add canonicalisation options to -o lists
- - jmc at cvs.openbsd.org 2013/10/20 18:00:13
- [ssh_config.5]
- tweak the "exec" description, as worded by djm;
- - djm at cvs.openbsd.org 2013/10/23 03:03:07
- [readconf.c]
- Hostname may have %h sequences that should be expanded prior to Match
- evaluation; spotted by Iain Morgan
- - djm at cvs.openbsd.org 2013/10/23 03:05:19
- [readconf.c ssh.c]
- comment
- - djm at cvs.openbsd.org 2013/10/23 04:16:22
- [ssh-keygen.c]
- Make code match documentation: relative-specified certificate expiry time
- should be relative to current time and not the validity start time.
- Reported by Petr Lautrbach; ok deraadt@
+commit 12e4ac46aed681da55c2bba3cd11dfcab23591be
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 15 02:55:53 2016 +0000
-20131018
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/10/09 23:44:14
- [regress/Makefile regress/sftp-perm.sh]
- regression test for sftp request white/blacklisting and readonly mode.
- - jmc at cvs.openbsd.org 2013/10/17 07:35:48
- [sftp.1 sftp.c]
- tweak previous;
- - djm at cvs.openbsd.org 2013/10/17 22:08:04
- [sshd.c]
- include remote port in bad banner message; bz#2162
+ upstream commit
+
+ remove redundant CLEANFILES section
+
+ Upstream-Regress-ID: 29ef1b267fa56daa60a1463396635e7d53afb587
-20131017
- - (djm) OpenBSD CVS Sync
- - jmc at cvs.openbsd.org 2013/10/15 14:10:25
- [ssh.1 ssh_config.5]
- tweak previous;
- - djm at cvs.openbsd.org 2013/10/16 02:31:47
- [readconf.c readconf.h roaming_client.c ssh.1 ssh.c ssh_config.5]
- [sshconnect.c sshconnect.h]
- Implement client-side hostname canonicalisation to allow an explicit
- search path of domain suffixes to use to convert unqualified host names
- to fully-qualified ones for host key matching.
- This is particularly useful for host certificates, which would otherwise
- need to list unqualified names alongside fully-qualified ones (and this
- causes a number of problems).
- "looks fine" markus@
- - jmc at cvs.openbsd.org 2013/10/16 06:42:25
- [ssh_config.5]
- tweak previous;
- - djm at cvs.openbsd.org 2013/10/16 22:49:39
- [readconf.c readconf.h ssh.1 ssh.c ssh_config.5]
- s/canonicalise/canonicalize/ for consistency with existing spelling,
- e.g. authorized_keys; pointed out by naddy@
- - djm at cvs.openbsd.org 2013/10/16 22:58:01
- [ssh.c ssh_config.5]
- one I missed in previous: s/isation/ization/
- - djm at cvs.openbsd.org 2013/10/17 00:30:13
- [PROTOCOL sftp-client.c sftp-client.h sftp-server.c sftp.1 sftp.c]
- fsync at openssh.com protocol extension for sftp-server
- client support to allow calling fsync() faster successful transfer
- patch mostly by imorgan AT nas.nasa.gov; bz#1798
- "fine" markus@ "grumble OK" deraadt@ "doesn't sound bad to me" millert@
- - djm at cvs.openbsd.org 2013/10/17 00:46:49
- [ssh.c]
- rearrange check to reduce diff against -portable
- (Id sync only)
+commit b1d05aa653ae560c44baf8e8a9756e33f98ea75c
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 15 00:48:01 2016 +0000
-20131015
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/10/09 23:42:17
- [sftp-server.8 sftp-server.c]
- Add ability to whitelist and/or blacklist sftp protocol requests by name.
- Refactor dispatch loop and consolidate read-only mode checks.
- Make global variables static, since sftp-server is linked into sshd(8).
- ok dtucker@
- - djm at cvs.openbsd.org 2013/10/10 00:53:25
- [sftp-server.c]
- add -Q, -P and -p to usage() before jmc@ catches me
- - djm at cvs.openbsd.org 2013/10/10 01:43:03
- [sshd.c]
- bz#2139: fix re-exec fallback by ensuring that startup_pipe is correctly
- updated; ok dtucker@
- - djm at cvs.openbsd.org 2013/10/11 02:45:36
- [sftp-client.c]
- rename flag arguments to be more clear and consistent.
- reorder some internal function arguments to make adding additional flags
- easier.
- no functional change
- - djm at cvs.openbsd.org 2013/10/11 02:52:23
- [sftp-client.c]
- missed one arg reorder
- - djm at cvs.openbsd.org 2013/10/11 02:53:45
- [sftp-client.h]
- obsolete comment
- - jmc at cvs.openbsd.org 2013/10/14 14:18:56
- [sftp-server.8 sftp-server.c]
- tweak previous;
- ok djm
- - djm at cvs.openbsd.org 2013/10/14 21:20:52
- [session.c session.h]
- Add logging of session starts in a useful format; ok markus@ feedback and
- ok dtucker@
- - djm at cvs.openbsd.org 2013/10/14 22:22:05
- [readconf.c readconf.h ssh-keysign.c ssh.c ssh_config.5]
- add a "Match" keyword to ssh_config that allows matching on hostname,
- user and result of arbitrary commands. "nice work" markus@
- - djm at cvs.openbsd.org 2013/10/14 23:28:23
- [canohost.c misc.c misc.h readconf.c sftp-server.c ssh.c]
- refactor client config code a little:
- add multistate option partsing to readconf.c, similar to servconf.c's
- existing code.
- move checking of options that accept "none" as an argument to readconf.c
- add a lowercase() function and use it instead of explicit tolower() in
- loops
- part of a larger diff that was ok markus@
- - djm at cvs.openbsd.org 2013/10/14 23:31:01
- [ssh.c]
- whitespace at EOL; pointed out by markus@
- - [ssh.c] g/c unused variable.
+ upstream commit
+
+ sync CLEANFILES with portable, sort
+
+ Upstream-Regress-ID: cb782f4f1ab3e079efbc335c6b64942f790766ed
-20131010
- - (dtucker) OpenBSD CVS Sync
- - sthen at cvs.openbsd.org 2013/09/16 11:35:43
- [ssh_config]
- Remove gssapi config parts from ssh_config, as was already done for
- sshd_config. Req by/ok ajacoutot@
- ID SYNC ONLY for portable; kerberos/gssapi is still pretty popular
- - djm at cvs.openbsd.org 2013/09/19 00:24:52
- [progressmeter.c]
- store the initial file offset so the progress meter doesn't freak out
- when resuming sftp transfers. bz#2137; patch from Iain Morgan; ok dtucker@`
- - djm at cvs.openbsd.org 2013/09/19 00:49:12
- [sftp-client.c]
- fix swapped pflag and printflag in sftp upload_dir; from Iain Morgan
- - djm at cvs.openbsd.org 2013/09/19 01:24:46
- [channels.c]
- bz#1297 - tell the client (via packet_send_debug) when their preferred
- listen address has been overridden by the server's GatewayPorts;
- ok dtucker@
- - djm at cvs.openbsd.org 2013/09/19 01:26:29
- [sshconnect.c]
- bz#1211: make BindAddress work with UsePrivilegedPort=yes; patch from
- swp AT swp.pp.ru; ok dtucker@
- - dtucker at cvs.openbsd.org 2013/10/08 11:42:13
- [dh.c dh.h]
- Increase the size of the Diffie-Hellman groups requested for a each
- symmetric key size. New values from NIST Special Publication 800-57 with
- the upper limit specified by RFC4419. Pointed out by Peter Backes, ok
- djm at .
+commit 35f22dad263cce5c61d933ae439998cb965b8748
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 15 00:31:10 2016 +0000
-20131009
- - (djm) [openbsd-compat/arc4random.c openbsd-compat/chacha_private.h] Pull
- in OpenBSD implementation of arc4random, shortly to replace the existing
- bsd-arc4random.c
- - (djm) [openbsd-compat/Makefile.in openbsd-compat/arc4random.c]
- [openbsd-compat/bsd-arc4random.c] Replace old RC4-based arc4random
- implementation with recent OpenBSD's ChaCha-based PRNG. ok dtucker@,
- tested tim@
+ upstream commit
+
+ regression test for ssh_config Include directive
+
+ Upstream-Regress-ID: 46a38c8101f635461c506d1aac2d96af80f97f1e
-20130922
- - (dtucker) [platform.c platform.h sshd.c] bz#2156: restore Linux oom_adj
- setting when handling SIGHUP to maintain behaviour over retart. Patch
- from Matthew Ife.
+commit 6b8a1a87005818d4700ce8b42faef746e82c1f51
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Apr 14 23:57:17 2016 +0000
-20130918
- - (dtucker) [sshd_config] Trailing whitespace; from jstjohn at purdue edu.
+ upstream commit
+
+ unbreak test for recent ssh de-duplicated forwarding
+ change
+
+ Upstream-Regress-ID: 6b2b115d99acd7cff13986e6739ea214cf2a3da3
-20130914
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/08/22 19:02:21
- [sshd.c]
- Stir PRNG after post-accept fork. The child gets a different PRNG state
- anyway via rexec and explicit privsep reseeds, but it's good to be sure.
- ok markus@
- - mikeb at cvs.openbsd.org 2013/08/28 12:34:27
- [ssh-keygen.c]
- improve batch processing a bit by making use of the quite flag a bit
- more often and exit with a non zero code if asked to find a hostname
- in a known_hosts file and it wasn't there;
- originally from reyk@, ok djm
- - djm at cvs.openbsd.org 2013/08/31 00:13:54
- [sftp.c]
- make ^w match ksh behaviour (delete previous word instead of entire line)
- - deraadt at cvs.openbsd.org 2013/09/02 22:00:34
- [ssh-keygen.c sshconnect1.c sshd.c]
- All the instances of arc4random_stir() are bogus, since arc4random()
- does this itself, inside itself, and has for a very long time.. Actually,
- this was probably reducing the entropy available.
- ok djm
- ID SYNC ONLY for portable; we don't trust other arc4random implementations
- to do this right.
- - sthen at cvs.openbsd.org 2013/09/07 13:53:11
- [sshd_config]
- Remove commented-out kerberos/gssapi config options from sample config,
- kerberos support is currently not enabled in ssh in OpenBSD. Discussed with
- various people; ok deraadt@
- ID SYNC ONLY for portable; kerberos/gssapi is still pretty popular
- - djm at cvs.openbsd.org 2013/09/12 01:41:12
- [clientloop.c]
- fix connection crash when sending break (~B) on ControlPersist'd session;
+commit 076787702418985a2cc6808212dc28ce7afc01f0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Apr 14 23:21:42 2016 +0000
+
+ upstream commit
+
+ add test knob and warning for StrictModes
+
+ Upstream-Regress-ID: 8cd10952ce7898655ee58945904f2a0a3bdf7682
+
+commit dc7990be865450574c7940c9880567f5d2555b37
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 15 00:30:19 2016 +0000
+
+ upstream commit
+
+ Include directive for ssh_config(5); feedback & ok markus@
+
+ Upstream-ID: ae3b76e2e343322b9f74acde6f1e1c5f027d5fff
+
+commit 85bdcd7c92fe7ff133bbc4e10a65c91810f88755
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Apr 13 10:39:57 2016 +1000
+
+ ignore PAM environment vars when UseLogin=yes
+
+ If PAM is configured to read user-specified environment variables
+ and UseLogin=yes in sshd_config, then a hostile local user may
+ attack /bin/login via LD_PRELOAD or similar environment variables
+ set via PAM.
+
+ CVE-2015-8325, found by Shayan Sadigh, via Colin Watson
+
+commit dce19bf6e4a2a3d0b13a81224de63fc316461ab9
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Apr 9 12:39:30 2016 +0000
+
+ upstream commit
+
+ make private key loading functions consistently handle NULL
+ key pointer arguments; ok markus@
+
+ Upstream-ID: 92038726ef4a338169c35dacc9c5a07fcc7fa761
+
+commit 5f41f030e2feb5295657285aa8c6602c7810bc4b
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Apr 8 21:14:13 2016 +1000
+
+ Remove NO_IPPORT_RESERVED_CONCEPT
+
+ Replace by defining IPPORT_RESERVED to zero on Cygwin, which should have
+ the same effect without causing problems syncing patches with OpenBSD.
+ Resync the two affected functions with OpenBSD. ok djm, sanity checked
+ by Corinna.
+
+commit 34a01b2cf737d946ddb140618e28c3048ab7a229
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 8 08:19:17 2016 +0000
+
+ upstream commit
+
+ whitespace at EOL
+
+ Upstream-ID: 5beffd4e001515da12851b974e2323ae4aa313b6
+
+commit 90ee563fa6b54c59896c6c332c5188f866c5e75f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 8 06:35:54 2016 +0000
+
+ upstream commit
+
+ We accidentally send an empty string and a zero uint32 with
+ every direct-streamlocal at openssh.com channel open, in contravention of our
+ own spec.
+
+ Fixing this is too hard wrt existing versions that expect these
+ fields to be present and fatal() if they aren't, so document them
+ as "reserved" fields in the PROTOCOL spec as though we always
+ intended this and let us never speak of it again.
+
+ bz#2529, reported by Ron Frederick
+
+ Upstream-ID: 34cd326a4d236ca6e39084c4ff796bd97ab833e7
+
+commit 0ccbd5eca0f0dd78e71a4b69c66f03a66908d558
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Apr 6 06:42:17 2016 +0000
+
+ upstream commit
+
+ don't record duplicate LocalForward and RemoteForward
+ entries; fixes failure with ExitOnForwardFailure+hostname canonicalisation
+ where the same forwards are added on the second pass through the
+ configuration file. bz#2562; ok dtucker@
+
+ Upstream-ID: 40a51d68b6300f1cc61deecdb7d4847b8b7b0de1
+
+commit 574def0eb493cd6efeffd4ff2e9257abcffee0c8
+Author: krw at openbsd.org <krw at openbsd.org>
+Date: Sat Apr 2 14:37:42 2016 +0000
+
+ upstream commit
+
+ Another use for fcntl() and thus of the superfluous 3rd
+ parameter is when sanitising standard fd's before calling daemon().
+
+ Use a tweaked version of the ssh(1) function in all three places
+ found using fcntl() this way.
+
+ ok jca@ beck@
+
+ Upstream-ID: f16811ffa19a1c5f4ef383c5f0fecb843c84e218
+
+commit b3413534aa9d71a941005df2760d1eec2c2b0854
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Apr 4 11:09:21 2016 +1000
+
+ Tidy up openssl header test.
+
+commit 815bcac0b94bb448de5acdd6ba925b8725240b4f
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Apr 4 11:07:59 2016 +1000
+
+ Fix configure-time warnings for openssl test.
+
+commit 95687f5831ae680f7959446d8ae4b52452ee05dd
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 1 02:34:10 2016 +0000
+
+ upstream commit
+
+ whitespace at EOL
+
+ Upstream-ID: 40ae2203d07cb14e0a89e1a0d4c6120ee8fd8c3a
+
+commit fdfbf4580de09d84a974211715e14f88a5704b8e
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Mar 31 05:24:06 2016 +0000
+
+ upstream commit
+
+ Remove fallback from moduli to "primes" file that was
+ deprecated in 2001 and fix log messages referring to primes file. Based on
+ patch from xnox at ubuntu.com via bz#2559. "kill it" deraadt@
+
+ Upstream-ID: 0d4f8c70e2fa7431a83b95f8ca81033147ba8713
+
+commit 0235a5fa67fcac51adb564cba69011a535f86f6b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Mar 17 17:19:43 2016 +0000
+
+ upstream commit
+
+ UseDNS affects ssh hostname processing in authorized_keys,
+ not known_hosts; bz#2554 reported by jjelen AT redhat.com
+
+ Upstream-ID: c1c1bb895dde46095fc6d81d8653703928437591
+
+commit 8c4739338f5e379d05b19d6e544540114965f07e
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Mar 15 09:24:43 2016 +1100
+
+ Don't call Solaris setproject() with UsePAM=yes.
+
+ When Solaris Projects are enabled along with PAM setting the project
+ is PAM's responsiblity. bz#2425, based on patch from
+ brent.paulson at gmail.com.
+
+commit cff26f373c58457a32cb263e212cfff53fca987b
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Mar 15 04:30:21 2016 +1100
+
+ remove slogin from *.spec
+
+commit c38905ba391434834da86abfc988a2b8b9b62477
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Mar 14 16:20:54 2016 +0000
+
+ upstream commit
+
+ unbreak authentication using lone certificate keys in
+ ssh-agent: when attempting pubkey auth with a certificate, if no separate
+ private key is found among the keys then try with the certificate key itself.
+
+ bz#2550 reported by Peter Moody
+
+ Upstream-ID: f939cd76d68e6a9a3d1711b5a943d6ed1e623966
+
+commit 4b4bfb01cd40b9ddb948e6026ddd287cc303d871
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Mar 10 11:47:57 2016 +0000
+
+ upstream commit
+
+ sanitise characters destined for xauth reported by
+ github.com/tintinweb feedback and ok deraadt and markus
+
+ Upstream-ID: 18ad8d0d74cbd2ea3306a16595a306ee356aa261
+
+commit 732b463d37221722b1206f43aa59563766a6a968
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Mar 14 16:04:23 2016 +1100
+
+ Pass supported malloc options to connect-privsep.
+
+ This allows us to activate only the supported options during the malloc
+ option portion of the connect-privsep test.
+
+commit d29c5b9b3e9f27394ca97a364ed4bb4a55a59744
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Mar 14 09:30:58 2016 +1100
+
+ Remove leftover roaming.h file.
+
+ Pointed out by des at des.no.
+
+commit 8ff20ec95f4377021ed5e9b2331320f5c5a34cea
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Mar 14 09:24:03 2016 +1100
+
+ Quote variables that may contain whitespace.
+
+ The variable $L_TMP_ID_FILE needs to be surrounded by quotes in order to
+ survive paths containing whitespace. bz#2551, from Corinna Vinschen via
+ Philip Hands.
+
+commit 627824480c01f0b24541842c7206ab9009644d02
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Mar 11 14:47:41 2016 +1100
+
+ Include priv.h for priv_set_t.
+
+ From alex at cooperi.net.
+
+commit e960051f9a264f682c4d2fefbeecffcfc66b0ddf
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Mar 9 13:14:18 2016 +1100
+
+ Wrap stdint.h inside #ifdef HAVE_STDINT_H.
+
+commit 2c48bd344d2c4b5e08dae9aea5ff44fc19a5e363
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Mar 9 12:46:50 2016 +1100
+
+ Add compat to monotime_double().
+
+ Apply all of the portability changes in monotime() to monotime() double.
+ Fixes build on at least older FreeBSD systems.
+
+commit 7b40ef6c2eef40c339f6ea8920cb8a44838e10c9
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Mar 8 14:12:58 2016 -0800
+
+ make a regress-binaries target
+
+ Easier to build all the regression/unit test binaries in one pass
+ than going through all of ${REGRESS_BINARIES}
+
+commit c425494d6b6181beb54a1b3763ef9e944fd3c214
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Mar 8 14:03:54 2016 -0800
+
+ unbreak kexfuzz for -Werror without __bounded__
+
+commit 3ed9218c336607846563daea5d5ab4f701f4e042
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Mar 8 14:01:29 2016 -0800
+
+ unbreak PAM after canohost refactor
+
+commit 885fb2a44ff694f01e4f6470f803629e11f62961
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Mar 8 11:58:43 2016 +1100
+
+ auth_get_canonical_hostname in portable code.
+
+ "refactor canohost.c" replaced get_canonical_hostname, this makes the
+ same change to some portable-specific code.
+
+commit 95767262caa6692eff1e1565be1f5cb297949a89
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Mar 7 19:02:43 2016 +0000
+
+ upstream commit
+
+ refactor canohost.c: move functions that cache results closer
+ to the places that use them (authn and session code). After this, no state is
+ cached in canohost.c
+
+ feedback and ok markus@
+
+ Upstream-ID: 5f2e4df88d4803fc8ec59ec53629105e23ce625e
+
+commit af0bb38ffd1f2c4f9f43b0029be2efe922815255
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Mar 4 15:11:55 2016 +1100
+
+ hook unittests/misc/kexfuzz into build
+
+commit 331b8e07ee5bcbdca12c11cc8f51a7e8de09b248
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Mar 4 02:48:06 2016 +0000
+
+ upstream commit
+
+ Filter debug messages out of log before picking the last
+ two lines. Should prevent problems if any more debug output is added late in
+ the connection.
+
+ Upstream-Regress-ID: 345d0a9589c381e7d640a4ead06cfaadf4db1363
+
+commit 0892edaa3ce623381d3a7635544cbc69b31cf9cb
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Mar 4 02:30:36 2016 +0000
+
+ upstream commit
+
+ add KEX fuzzer harness; ok deraadt@
+
+ Upstream-Regress-ID: 3df5242d30551b12b828aa9ba4a4cec0846be8d1
+
+commit ae2562c47d41b68dbb00240fd6dd60bed205367a
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Mar 3 00:46:53 2016 +0000
+
+ upstream commit
+
+ Look back 3 lines for possible error messages. Changes
+ to the code mean that "Bad packet length" errors are 3 lines back instead of
+ the previous two, which meant we didn't skip some offsets that we intended
+ to.
+
+ Upstream-Regress-ID: 24f36912740a634d509a3144ebc8eb7c09b9c684
+
+commit 988e429d903acfb298bfddfd75e7994327adfed0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Mar 4 03:35:44 2016 +0000
+
+ upstream commit
+
+ fix ClientAliveInterval when a time-based RekeyLimit is
+ set; previously keepalive packets were not being sent. bz#2252 report and
+ analysis by Christian Wittenhorst and Garrett Lee feedback and ok dtucker@
+
+ Upstream-ID: d48f9deadd35fdacdd5106b41bb07630ddd4aa81
+
+commit 8ef04d7a94bcdb8b0085fdd2a79a844b7d40792d
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Mar 2 22:43:52 2016 +0000
+
+ upstream commit
+
+ Improve accuracy of reported transfer speeds by waiting
+ for the ack from the other end. Pointed out by mmcc@, ok deraadt@ markus@
+
+ Upstream-ID: 99f1cf15c9a8f161086b814d414d862795ae153d
+
+commit b8d4eafe29684fe4f5bb587f7eab948e6ed62723
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Mar 2 22:42:40 2016 +0000
+
+ upstream commit
+
+ Improve precision of progressmeter for sftp and scp by
+ storing sub-second timestamps. Pointed out by mmcc@, ok deraadt@ markus@
+
+ Upstream-ID: 38fd83a3d83dbf81c8ff7b5d1302382fe54970ab
+
+commit 18f64b969c70ed00e74b9d8e50359dbe698ce4c0
+Author: jca at openbsd.org <jca at openbsd.org>
+Date: Mon Feb 29 20:22:36 2016 +0000
+
+ upstream commit
+
+ Print ssize_t with %zd; ok deraadt@ mmcc@
+
+ Upstream-ID: 0590313bbb013ff6692298c98f7e0be349d124bd
+
+commit 6e7f68ce38130c794ec1fb8d2a6091fbe982628d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Feb 28 22:27:00 2016 +0000
+
+ upstream commit
+
+ rearrange DH public value tests to be a little more clear
+
+ rearrange DH private value generation to explain rationale more
+ clearly and include an extra sanity check.
+
+ ok deraadt
+
+ Upstream-ID: 9ad8a07e1a12684e1b329f9bd88941b249d4b2ad
+
+commit 2ed17aa34008bdfc8db674315adc425a0712be11
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Mar 1 15:24:20 2016 +1100
+
+ Import updated moduli file from OpenBSD.
+
+ Note that 1.5k bit groups have been removed.
+
+commit 72b061d4ba0f909501c595d709ea76e06b01e5c9
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Feb 26 14:40:04 2016 +1100
+
+ Add a note about using xlc on AIX.
+
+commit fd4e4f2416baa2e6565ea49d52aade296bad3e28
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Feb 24 10:44:25 2016 +1100
+
+ Skip PrintLastLog in config dump mode.
+
+ When DISABLE_LASTLOG is set, do not try to include PrintLastLog in the
+ config dump since it'll be reported as UNKNOWN.
+
+commit 99135c764fa250801da5ec3b8d06cbd0111caae8
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 23 20:17:23 2016 +1100
+
+ update spec/README versions ahead of release
+
+commit b86a334aaaa4d1e643eb1fd71f718573d6d948b5
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 23 20:16:53 2016 +1100
+
+ put back portable patchlevel to p1
+
+commit 555dd35ff176847e3c6bd068ba2e8db4022eb24f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Feb 23 09:14:34 2016 +0000
+
+ upstream commit
+
+ openssh-7.2
+
+ Upstream-ID: 9db776b26014147fc907ece8460ef2bcb0f11e78
+
+commit 1acc058d0a7913838c830ed998a1a1fb5b7864bf
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 23 16:12:13 2016 +1100
+
+ Disable tests where fs perms are incorrect
+
+ Some tests have strict requirements on the filesystem permissions
+ for certain files and directories. This adds a regress/check-perm
+ tool that copies the relevant logic from sshd to exactly test
+ the paths in question. This lets us skip tests when the local
+ filesystem doesn't conform to our expectations rather than
+ continuing and failing the test run.
+
+ ok dtucker@
+
+commit 39f303b1f36d934d8410b05625f25c7bcb75db4d
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 23 12:56:59 2016 +1100
+
+ fix sandbox on OSX Lion
+
+ sshd was failing with:
+
+ ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261):cw
+ image not found [preauth]
+
+ caused by chroot before sandboxing. Avoid by explicitly linking libsandbox
+ to sshd. Spotted by Darren.
+
+commit 0d1451a32c7436e6d3d482351e776bc5e7824ce4
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Feb 23 01:34:14 2016 +0000
+
+ upstream commit
+
+ fix spurious error message when incorrect passphrase
+ entered for keys; reported by espie@ ok deraadt@
+
+ Upstream-ID: 58b2e46e63ed6912ed1ee780bd3bd8560f9a5899
+
+commit 09d87d79741beb85768b5e788d7dfdf4bc3543dc
+Author: sobrado at openbsd.org <sobrado at openbsd.org>
+Date: Sat Feb 20 23:06:23 2016 +0000
+
+ upstream commit
+
+ set ssh(1) protocol version to 2 only.
+
+ ok djm@
+
+ Upstream-ID: e168daf9d27d7e392e3c9923826bd8e87b2b3a10
+
+commit 9262e07826ba5eebf8423f7ac9e47ec488c47869
+Author: sobrado at openbsd.org <sobrado at openbsd.org>
+Date: Sat Feb 20 23:02:39 2016 +0000
+
+ upstream commit
+
+ add missing ~/.ssh/id_ecdsa and ~/.ssh/id_ed25519 to
+ IdentityFile.
+
+ ok djm@
+
+ Upstream-ID: 6ce99466312e4ae7708017c3665e3edb976f70cf
+
+commit c12f0fdce8f985fca8d71829fd64c5b89dc777f5
+Author: sobrado at openbsd.org <sobrado at openbsd.org>
+Date: Sat Feb 20 23:01:46 2016 +0000
+
+ upstream commit
+
+ AddressFamily defaults to any.
+
+ ok djm@
+
+ Upstream-ID: 0d94aa06a4b889bf57a7f631c45ba36d24c13e0c
+
+commit 907091acb188b1057d50c2158f74c3ecf1c2302b
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Feb 19 09:05:39 2016 +1100
+
+ Make Solaris privs code build on older systems.
+
+ Not all systems with Solaris privs have priv_basicset so factor that
+ out and provide backward compatibility code. Similarly, not all have
+ PRIV_NET_ACCESS so wrap that in #ifdef. Based on code from
+ alex at cooperi.net and djm@ with help from carson at taltos.org and
+ wieland at purdue.edu.
+
+commit 292a8dee14e5e67dcd1b49ba5c7b9023e8420d59
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Feb 17 22:20:14 2016 +0000
+
+ upstream commit
+
+ rekey refactor broke SSH1; spotted by Tom G. Christensen
+
+ Upstream-ID: 43f0d57928cc077c949af0bfa71ef574dcb58243
+
+commit 3a13cb543df9919aec2fc6b75f3dd3802facaeca
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Feb 17 08:57:34 2016 +0000
+
+ upstream commit
+
+ rsa-sha2-512,rsa-sha2-256 cannot be selected explicitly
+ in *KeyTypes options yet. Remove them from the lists of algorithms for now.
+ committing on behalf of markus@ ok djm@
+
+ Upstream-ID: c6e8820eb8e610ac21551832c0c89684a9a51bb7
+
+commit a685ae8d1c24fb7c712c55a4f3280ee76f5f1e4b
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Wed Feb 17 07:38:19 2016 +0000
+
+ upstream commit
+
+ since these pages now clearly tell folks to avoid v1,
+ normalise the docs from a v2 perspective (i.e. stop pointing out which bits
+ are v2 only);
+
+ ok/tweaks djm ok markus
+
+ Upstream-ID: eb474f8c36fb6a532dc05c282f7965e38dcfa129
+
+commit c5c3f3279a0e4044b8de71b70d3570d692d0f29d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Feb 17 05:29:04 2016 +0000
+
+ upstream commit
+
+ make sandboxed privilege separation the default, not just
+ for new installs; "absolutely" deraadt@
+
+ Upstream-ID: 5221ef3b927d2df044e9aa3f5db74ae91743f69b
+
+commit eb3f7337a651aa01d5dec019025e6cdc124ed081
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Tue Feb 16 07:47:54 2016 +0000
+
+ upstream commit
+
+ no need to state that protocol 2 is the default twice;
+
+ Upstream-ID: b1e4c36b0c2e12e338e5b66e2978f2ac953b95eb
+
+commit e7901efa9b24e5b0c7e74f2c5520d47eead4d005
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Feb 16 05:11:04 2016 +0000
+
+ upstream commit
+
+ Replace list of ciphers and MACs adjacent to -1/-2 flag
+ descriptions in ssh(1) with a strong recommendation not to use protocol 1.
+ Add a similar warning to the Protocol option descriptions in ssh_config(5)
+ and sshd_config(5);
+
+ prompted by and ok mmcc@
+
+ Upstream-ID: 961f99e5437d50e636feca023978950a232ead5e
+
+commit 5a0fcb77287342e2fc2ba1cee79b6af108973dc2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Feb 16 03:37:48 2016 +0000
+
+ upstream commit
+
+ add a "Close session" log entry (at loglevel=verbose) to
+ correspond to the existing "Starting session" one. Also include the session
+ id number to make multiplexed sessions more apparent.
+
+ feedback and ok dtucker@
+
+ Upstream-ID: e72d2ac080e02774376325136e532cb24c2e617c
+
+commit 624fd395b559820705171f460dd33d67743d13d6
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Feb 17 02:24:17 2016 +0000
+
+ upstream commit
+
+ include bad $SSH_CONNECTION in failure output
+
+ Upstream-Regress-ID: b22d72edfde78c403aaec2b9c9753ef633cc0529
+
+commit 60d860e54b4f199e5e89963b1c086981309753cb
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Feb 17 13:37:09 2016 +1100
+
+ Rollback addition of va_start.
+
+ va_start was added in 0f754e29dd3760fc0b172c1220f18b753fb0957e, however
+ it has the wrong number of args and it's not usable in non-variadic
+ functions anyway so it breaks things (for example Solaris 2.6 as
+ reported by Tom G. Christensen).i ok djm@
+
+commit 2fee909c3cee2472a98b26eb82696297b81e0d38
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Feb 17 09:48:15 2016 +1100
+
+ Look for gethostbyname in libresolv and libnsl.
+
+ Should fix build problem on Solaris 2.6 reported by Tom G. Christensen.
+
+commit 5ac712d81a84396aab441a272ec429af5b738302
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 16 10:45:02 2016 +1100
+
+ make existing ssh_malloc_init only for __OpenBSD__
+
+commit 24c9bded569d9f2449ded73f92fb6d12db7a9eec
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 15 23:32:37 2016 +0000
+
+ upstream commit
+
+ memleak of algorithm name in mm_answer_sign; reported by
+ Jakub Jelen
+
+ Upstream-ID: ccd742cd25952240ebd23d7d4d6b605862584d08
+
+commit ffb1e7e896139a42ceb78676f637658f44612411
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Mon Feb 15 09:47:49 2016 +0000
+
+ upstream commit
+
+ Add a function to enable security-related malloc_options.
+ With and ok deraadt@, something similar has been in the snaps for a while.
+
+ Upstream-ID: 43a95523b832b7f3b943d2908662191110c380ed
+
+commit ef39e8c0497ff0564990a4f9e8b7338b3ba3507c
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 16 10:34:39 2016 +1100
+
+ sync ssh-copy-id with upstream 783ef08b0a75
+
+commit d2d772f55b19bb0e8d03c2fe1b9bb176d9779efd
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Feb 12 00:20:30 2016 +0000
+
+ upstream commit
+
+ avoid fatal() for PKCS11 tokens that present empty key IDs
+ bz#1773, ok markus@
+
+ Upstream-ID: 044a764fee526f2c4a9d530bd10695422d01fc54
+
+commit e4c918a6c721410792b287c9fd21356a1bed5805
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Feb 11 02:56:32 2016 +0000
+
+ upstream commit
+
+ sync crypto algorithm lists in ssh_config(5) and
+ sshd_config(5) with current reality. bz#2527
+
+ Upstream-ID: d7fd1b6c1ed848d866236bcb1d7049d2bb9b2ff6
+
+commit e30cabfa4ab456a30b3224f7f545f1bdfc4a2517
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Feb 11 02:21:34 2016 +0000
+
+ upstream commit
+
+ fix regression in openssh-6.8 sftp client: existing
+ destination directories would incorrectly terminate recursive uploads;
+ bz#2528
+
+ Upstream-ID: 3306be469f41f26758e3d447987ac6d662623e18
+
+commit 714e367226ded4dc3897078be48b961637350b05
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Feb 9 05:30:04 2016 +0000
+
+ upstream commit
+
+ turn off more old crypto in the client: hmac-md5, ripemd,
+ truncated HMACs, RC4, blowfish. ok markus@ dtucker@
+
+ Upstream-ID: 96aa11c2c082be45267a690c12f1d2aae6acd46e
+
+commit 5a622844ff7f78dcb75e223399f9ef0977e8d0a3
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 8 23:40:12 2016 +0000
+
+ upstream commit
+
+ don't attempt to percent_expand() already-canonicalised
+ addresses, avoiding unnecessary failures when attempting to connect to scoped
+ IPv6 addresses (that naturally contain '%' characters)
+
+ Upstream-ID: f24569cffa1a7cbde5f08dc739a72f4d78aa5c6a
+
+commit 19bcf2ea2d17413f2d9730dd2a19575ff86b9b6a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 8 10:57:07 2016 +0000
+
+ upstream commit
+
+ refactor activation of rekeying
+
+ This makes automatic rekeying internal to the packet code (previously
+ the server and client loops needed to assist). In doing to it makes
+ application of rekey limits more accurate by accounting for packets
+ about to be sent as well as packets queued during rekeying events
+ themselves.
+
+ Based on a patch from dtucker@ which was in turn based on a patch
+ Aleksander Adamowski in bz#2521; ok markus@
+
+ Upstream-ID: a441227fd64f9739850ca97b4cf794202860fcd8
+
+commit 603ba41179e4b53951c7b90ee95b6ef3faa3f15d
+Author: naddy at openbsd.org <naddy at openbsd.org>
+Date: Fri Feb 5 13:28:19 2016 +0000
+
+ upstream commit
+
+ Only check errno if read() has returned an error. EOF is
+ not an error. This fixes a problem where the mux master would sporadically
+ fail to notice that the client had exited. ok mikeb@ djm@
+
+ Upstream-ID: 3c2dadc21fac6ef64665688aac8a75fffd57ae53
+
+commit 56d7dac790693ce420d225119283bc355cff9185
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Fri Feb 5 04:31:21 2016 +0000
+
+ upstream commit
+
+ avoid an uninitialised value when NumberOfPasswordPrompts
+ is 0 ok markus@ djm@
+
+ Upstream-ID: 11b068d83c2865343aeb46acf1e9eec00f829b6b
+
+commit deae7d52d59c5019c528f977360d87fdda15d20b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Feb 5 03:07:06 2016 +0000
+
+ upstream commit
+
+ mention internal DH-GEX fallback groups; bz#2302
+
+ Upstream-ID: e7b395fcca3122cd825515f45a2e41c9a157e09e
+
+commit cac3b6665f884d46192c0dc98a64112e8b11a766
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Feb 5 02:37:56 2016 +0000
+
+ upstream commit
+
+ better description for MaxSessions; bz#2531
+
+ Upstream-ID: e2c0d74ee185cd1a3e9d4ca1f1b939b745b354da
+
+commit 5ef4b0fdcc7a239577a754829b50022b91ab4712
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jan 27 17:45:56 2016 +1100
+
+ avoid FreeBSD RCS Id in comment
+
+ Change old $FreeBSD version string in comment so it doesn't
+ become an RCS ident downstream; requested by des AT des.no
+
+commit 696d12683c90d20a0a9c5f4275fc916b7011fb04
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Feb 4 23:43:48 2016 +0000
+
+ upstream commit
+
+ printf argument casts to avoid warnings on strict
+ compilers
+
+ Upstream-ID: 7b9f6712cef01865ad29070262d366cf13587c9c
+
+commit 5658ef2501e785fbbdf5de2dc33b1ff7a4dca73a
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Mon Feb 1 21:18:17 2016 +0000
+
+ upstream commit
+
+ Avoid ugly "DISPLAY "(null)" invalid; disabling X11
+ forwarding" message when DISPLAY is not set. This could also result in a
+ crash on systems with a printf that doesn't handle NULL. OK djm@
+
+ Upstream-ID: 20ee0cfbda678a247264c20ed75362042b90b412
+
+commit 537f88ec7bcf40bd444ac5584c707c5588c55c43
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jan 29 05:18:15 2016 +0000
+
+ upstream commit
+
+ Add regression test for RekeyLimit parsing of >32bit values
+ (4G and 8G).
+
+ Upstream-Regress-ID: 548390350c62747b6234f522a99c319eee401328
+
+commit 4c6cb8330460f94e6c7ae28a364236d4188156a3
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jan 29 23:04:46 2016 +0000
+
+ upstream commit
+
+ Remove leftover roaming dead code. ok djm markus.
+
+ Upstream-ID: 13d1f9c8b65a5109756bcfd3b74df949d53615be
+
+commit 28136471809806d6246ef41e4341467a39fe2f91
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 29 05:46:01 2016 +0000
+
+ upstream commit
+
+ include packet type of non-data packets in debug3 output;
+ ok markus dtucker
+
+ Upstream-ID: 034eaf639acc96459b9c5ce782db9fcd8bd02d41
+
+commit 6fd6e28daccafaa35f02741036abe64534c361a1
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jan 29 03:31:03 2016 +0000
+
+ upstream commit
+
+ Revert "account for packets buffered but not yet
+ processed" change as it breaks for very small RekeyLimit values due to
+ continuous rekeying. ok djm@
+
+ Upstream-ID: 7e03f636cb45ab60db18850236ccf19079182a19
+
+commit 921ff00b0ac429666fb361d2d6cb1c8fff0006cb
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jan 29 02:54:45 2016 +0000
+
+ upstream commit
+
+ Allow RekeyLimits in excess of 4G up to 2**63 bits
+ (limited by the return type of scan_scaled). Part of bz#2521, ok djm.
+
+ Upstream-ID: 13bea82be566b9704821b1ea05bf7804335c7979
+
+commit c0060a65296f01d4634f274eee184c0e93ba0f23
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Jan 29 02:42:46 2016 +0000
+
+ upstream commit
+
+ Account for packets buffered but not yet processed when
+ computing whether or not it is time to perform rekeying. bz#2521, based
+ loosely on a patch from olo at fb.com, ok djm@
+
+ Upstream-ID: 67e268b547f990ed220f3cb70a5624d9bda12b8c
+
+commit 44cf930e670488c85c9efeb373fa5f4b455692ac
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 27 06:44:58 2016 +0000
+
+ upstream commit
+
+ change old $FreeBSD version string in comment so it doesn't
+ become an RCS ident downstream; requested by des AT des.no
+
+ Upstream-ID: 8ca558c01f184e596b45e4fc8885534b2c864722
+
+commit ebacd377769ac07d1bf3c75169644336056b7060
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 27 00:53:12 2016 +0000
+
+ upstream commit
+
+ make the debug messages a bit more useful here
+
+ Upstream-ID: 478ccd4e897e0af8486b294aa63aa3f90ab78d64
+
+commit 458abc2934e82034c5c281336d8dc0f910aecad3
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Sat Jan 23 05:31:35 2016 +0000
+
+ upstream commit
+
+ Zero a stack buffer with explicit_bzero() instead of
+ memset() when returning from client_loop() for consistency with
+ buffer_free()/sshbuf_free().
+
+ ok dtucker@ deraadt@ djm@
+
+ Upstream-ID: bc9975b2095339811c3b954694d7d15ea5c58f66
+
+commit 65a3c0dacbc7dbb75ddb6a70ebe22d8de084d0b0
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Jan 20 09:22:39 2016 +0000
+
+ upstream commit
+
+ Include sys/time.h for gettimeofday. From sortie at
+ maxsi.org.
+
+ Upstream-ID: 6ed0c33b836d9de0a664cd091e86523ecaa2fb3b
+
+commit fc77ccdc2ce6d5d06628b8da5048a6a5f6ffca5a
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Thu Jan 14 22:56:56 2016 +0000
+
+ upstream commit
+
+ fd leaks; report Qualys Security Advisory team; ok
+ deraadt@
+
+ Upstream-ID: 4ec0f12b9d8fa202293c9effa115464185aa071d
+
+commit a306863831c57ec5fad918687cc5d289ee8e2635
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Thu Jan 14 16:17:39 2016 +0000
+
+ upstream commit
+
+ remove roaming support; ok djm@
+
+ Upstream-ID: 2cab8f4b197bc95776fb1c8dc2859dad0c64dc56
+
+commit 6ef49e83e30688504552ac10875feabd5521565f
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Thu Jan 14 14:34:34 2016 +0000
+
+ upstream commit
+
+ Disable experimental client-side roaming support. Server
+ side was disabled/gutted for years already, but this aspect was surprisingly
+ forgotten. Thanks for report from Qualys
+
+ Upstream-ID: 2328004b58f431a554d4c1bf67f5407eae3389df
+
+commit 8d7b523b96d3be180572d9d338cedaafc0570f60
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 14 11:08:19 2016 +1100
+
+ bump version numbers
+
+commit 8c3d512a1fac8b9c83b4d0c9c3f2376290bd84ca
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 14 11:04:04 2016 +1100
+
+ openssh-7.1p2
+
+commit e6c85f8889c5c9eb04796fdb76d2807636b9eef5
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jan 15 01:30:36 2016 +1100
+
+ forcibly disable roaming support in the client
+
+commit ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 13 23:04:47 2016 +0000
+
+ upstream commit
+
+ eliminate fallback from untrusted X11 forwarding to trusted
+ forwarding when the X server disables the SECURITY extension; Reported by
+ Thomas Hoger; ok deraadt@
+
+ Upstream-ID: f76195bd2064615a63ef9674a0e4096b0713f938
+
+commit 9a728cc918fad67c8a9a71201088b1e150340ba4
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 12 23:42:54 2016 +0000
+
+ upstream commit
+
+ use explicit_bzero() more liberally in the buffer code; ok
+ deraadt
+
+ Upstream-ID: 0ece37069fd66bc6e4f55eb1321f93df372b65bf
+
+commit 4626cbaf78767fc8e9c86dd04785386c59ae0839
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jan 8 14:24:56 2016 +1100
+
+ Support Illumos/Solaris fine-grained privileges
+
+ Includes a pre-auth privsep sandbox and several pledge()
+ emulations. bz#2511, patch by Alex Wilson.
+
+ ok dtucker@
+
+commit 422d1b3ee977ff4c724b597fb2e437d38fc8de9d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 31 00:33:52 2015 +0000
+
+ upstream commit
+
+ fix three bugs in KRL code related to (unused) signature
+ support: verification length was being incorrectly calculated, multiple
+ signatures were being incorrectly processed and a NULL dereference that
+ occurred when signatures were verified. Reported by Carl Jackson
+
+ Upstream-ID: e705e97ad3ccce84291eaa651708dd1b9692576b
+
+commit 6074c84bf95d00f29cc7d5d3cd3798737851aa1a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Dec 30 23:46:14 2015 +0000
+
+ upstream commit
+
+ unused prototype
+
+ Upstream-ID: f3eef4389d53ed6c0d5c77dcdcca3060c745da97
+
+commit 6213f0e180e54122bb1ba928e11c784e2b4e5380
+Author: guenther at openbsd.org <guenther at openbsd.org>
+Date: Sat Dec 26 20:51:35 2015 +0000
+
+ upstream commit
+
+ Use pread/pwrite instead separate lseek+read/write for
+ lastlog. Cast to off_t before multiplication to avoid truncation on ILP32
+
+ ok kettenis@ mmcc@
+
+ Upstream-ID: fc40092568cd195719ddf1a00aa0742340d616cf
+
+commit d7d2bc95045a43dd56ea696cc1d030ac9d77e81f
+Author: semarie at openbsd.org <semarie at openbsd.org>
+Date: Sat Dec 26 07:46:03 2015 +0000
+
+ upstream commit
+
+ adjust pledge promises for ControlMaster: when using
+ "ask" or "autoask", the process will use ssh-askpass for asking confirmation.
+
+ problem found by halex@
+
+ ok halex@
+
+ Upstream-ID: 38a58b30ae3eef85051c74d3c247216ec0735f80
+
+commit 271df8185d9689b3fb0523f58514481b858f6843
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Dec 13 22:42:23 2015 +0000
+
+ upstream commit
+
+ unbreak connections with peers that set
+ first_kex_follows; fix from Matt Johnston va bz#2515
+
+ Upstream-ID: decc88ec4fc7515594fdb42b04aa03189a44184b
+
+commit 43849a47c5f8687699eafbcb5604f6b9c395179f
+Author: doug at openbsd.org <doug at openbsd.org>
+Date: Fri Dec 11 17:41:37 2015 +0000
+
+ upstream commit
+
+ Add "id" to ssh-agent pledge for subprocess support.
+
+ Found the hard way by Jan Johansson when using ssh-agent with X. Also,
+ rearranged proc/exec and retval to match other pledge calls in the tree.
+
+ ok djm@
+
+ Upstream-ID: 914255f6850e5e7fa830a2de6c38605333b584db
+
+commit 52d7078421844b2f88329f5be3de370b0a938636
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Fri Dec 11 04:21:11 2015 +0000
+
+ upstream commit
+
+ Remove NULL-checks before sshbuf_free().
+
+ ok djm@
+
+ Upstream-ID: 5ebed00ed5f9f03b119a345085e8774565466917
+
+commit a4b9e0f4e4a6980a0eb8072f76ea611cab5b77e7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Dec 11 03:24:25 2015 +0000
+
+ upstream commit
+
+ include remote port number in a few more messages; makes
+ tying log messages together into a session a bit easier; bz#2503 ok dtucker@
+
+ Upstream-ID: 9300dc354015f7a7368d94a8ff4a4266a69d237e
+
+commit 6091c362e89079397e68744ae30df121b0a72c07
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Dec 11 03:20:09 2015 +0000
+
+ upstream commit
+
+ don't try to load SSHv1 private key when compiled without
+ SSHv1 support. From Iain Morgan bz#2505
+
+ Upstream-ID: 8b8e7b02a448cf5e5635979df2d83028f58868a7
+
+commit cce6a36bb95e81fa8bfb46daf22eabcf13afc352
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Dec 11 03:19:09 2015 +0000
+
+ upstream commit
+
+ use SSH_MAX_PUBKEY_BYTES consistently as buffer size when
+ reading key files. Increase it to match the size of the buffers already being
+ used.
+
+ Upstream-ID: 1b60586b484b55a947d99a0b32bd25e0ced56fae
+
+commit 89540b6de025b80404a0cb8418c06377f3f98848
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Fri Dec 11 02:31:47 2015 +0000
+
+ upstream commit
+
+ Remove NULL-checks before sshkey_free().
+
+ ok djm@
+
+ Upstream-ID: 3e35afe8a25e021216696b5d6cde7f5d2e5e3f52
+
+commit 79394ed6d74572c2d2643d73937dad33727fc240
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Dec 11 02:29:03 2015 +0000
+
+ upstream commit
+
+ fflush stdout so that output is seen even when running in
+ debug mode when output may otherwise not be flushed. Patch from dustin at
+ null-ptr.net.
+
+ Upstream-ID: b0c6b4cd2cdb01d7e9eefbffdc522e35b5bc4acc
+
+commit ee607cccb6636eb543282ba90e0677b0604d8b7a
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Dec 15 15:23:49 2015 +1100
+
+ Increase robustness of redhat/openssh.spec
+
+ - remove configure --with-rsh, because this option isn't supported anymore
+ - replace last occurrence of BuildPreReq by BuildRequires
+ - update grep statement to query the krb5 include directory
+
+ Patch from CarstenGrohmann via github, ok djm.
+
+commit b5fa0cd73555b991a543145603658d7088ec6b60
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Dec 15 15:10:32 2015 +1100
+
+ Allow --without-ssl-engine with --without-openssl
+
+ Patch from Mike Frysinger via github.
+
+commit c1d7e546f6029024f3257cc25c92f2bddf163125
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Dec 15 14:27:09 2015 +1100
+
+ Include openssl crypto.h for SSLeay.
+
+ Patch from doughdemon via github.
+
+commit c6f5f01651526e88c00d988ce59d71f481ebac62
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Dec 15 13:59:12 2015 +1100
+
+ Add sys/time.h for gettimeofday.
+
+ Should allow it it compile with MUSL libc. Based on patch from
+ doughdemon via github.
+
+commit 39736be06c7498ef57d6970f2d85cf066ae57c82
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Dec 11 02:20:28 2015 +0000
+
+ upstream commit
+
+ correct error messages; from Tomas Kuthan bz#2507
+
+ Upstream-ID: 7454a0affeab772398052954c79300aa82077093
+
+commit 94141b7ade24afceeb6762a3f99e09e47a6c42b6
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Fri Dec 11 00:20:04 2015 +0000
+
+ upstream commit
+
+ Pass (char *)NULL rather than (char *)0 to execl and
+ execlp.
+
+ ok dtucker@
+
+ Upstream-ID: 56c955106cbddba86c3dd9bbf786ac0d1b361492
+
+commit d59ce08811bf94111c2f442184cf7d1257ffae24
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Thu Dec 10 17:08:40 2015 +0000
+
+ upstream commit
+
+ Remove NULL-checks before free().
+
+ ok dtucker@
+
+ Upstream-ID: e3d3cb1ce900179906af36517b5eea0fb15e6ef8
+
+commit 8e56dd46cb37879c73bce2d6032cf5e7f82d5a71
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Thu Dec 10 07:01:35 2015 +0000
+
+ upstream commit
+
+ Fix a couple "the the" typos. ok dtucker@
+
+ Upstream-ID: ec364c5af32031f013001fd28d1bd3dfacfe9a72
+
+commit 6262a0522ddc2c0f2e9358dcb68d59b46e9c533e
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Dec 7 20:04:09 2015 +0000
+
+ upstream commit
+
+ stricter encoding type checks for ssh-rsa; ok djm@
+
+ Upstream-ID: 8cca7c787599a5e8391e184d0b4f36fdc3665650
+
+commit d86a3ba7af160c13496102aed861ae48a4297072
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Dec 9 09:18:45 2015 +1100
+
+ Don't set IPV6_V6ONLY on OpenBSD
+
+ It isn't necessary and runs afoul of pledge(2) restrictions.
+
+commit da98c11d03d819a15429d8fff9688acd7505439f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 7 02:20:46 2015 +0000
+
+ upstream commit
+
+ basic unit tests for rsa-sha2-* signature types
+
+ Upstream-Regress-ID: 7dc4b9db809d578ff104d591b4d86560c3598d3c
+
+commit 3da893fdec9936dd2c23739cdb3c0c9d4c59fca0
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Sat Dec 5 20:53:21 2015 +0000
+
+ upstream commit
+
+ prefer rsa-sha2-512 over -256 for hostkeys, too; noticed
+ by naddy@
+
+ Upstream-ID: 685f55f7ec566a8caca587750672723a0faf3ffe
+
+commit 8b56e59714d87181505e4678f0d6d39955caf10e
+Author: tobias at openbsd.org <tobias at openbsd.org>
+Date: Fri Dec 4 21:51:06 2015 +0000
+
+ upstream commit
+
+ Properly handle invalid %-format by calling fatal.
+
+ ok deraadt, djm
+
+ Upstream-ID: 5692bce7d9f6eaa9c488cb93d3b55e758bef1eac
+
+commit 76c9fbbe35aabc1db977fb78e827644345e9442e
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Fri Dec 4 16:41:28 2015 +0000
+
+ upstream commit
+
+ implement SHA2-{256,512} for RSASSA-PKCS1-v1_5 signatures
+ (user and host auth) based on draft-rsa-dsa-sha2-256-03.txt and
+ draft-ssh-ext-info-04.txt; with & ok djm@
+
+ Upstream-ID: cf82ce532b2733e5c4b34bb7b7c94835632db309
+
+commit 6064a8b8295cb5a17b5ebcfade53053377714f40
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Dec 4 00:24:55 2015 +0000
+
+ upstream commit
+
+ clean up agent_fd handling; properly initialise it to -1
+ and make tests consistent
+
+ ok markus@
+
+ Upstream-ID: ac9554323d5065745caf17b5e37cb0f0d4825707
+
+commit b91926a97620f3e51761c271ba57aa5db790f48d
+Author: semarie at openbsd.org <semarie at openbsd.org>
+Date: Thu Dec 3 17:00:18 2015 +0000
+
+ upstream commit
+
+ pledges ssh client: - mux client: which is used when
+ ControlMaster is in use. will end with "stdio proc tty" (proc is to
+ permit sending SIGWINCH to mux master on window resize)
+
+ - client loop: several levels of pledging depending of your used options
+
+ ok deraadt@
+
+ Upstream-ID: 21676155a700e51f2ce911e33538e92a2cd1d94b
+
+commit bcce47466bbc974636f588b5e4a9a18ae386f64a
+Author: doug at openbsd.org <doug at openbsd.org>
+Date: Wed Dec 2 08:30:50 2015 +0000
+
+ upstream commit
+
+ Add "cpath" to the ssh-agent pledge so the cleanup
+ handler can unlink().
+
+ ok djm@
+
+ Upstream-ID: 9e632991d48241d56db645602d381253a3d8c29d
+
+commit a90d001543f46716b6590c6dcc681d5f5322f8cf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Dec 2 08:00:58 2015 +0000
+
+ upstream commit
+
+ ssh-agent pledge needs proc for askpass; spotted by todd@
+
+ Upstream-ID: 349aa261b29cc0e7de47ef56167769c432630b2a
+
+commit d952162b3c158a8f23220587bb6c8fcda75da551
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Dec 1 23:29:24 2015 +0000
+
+ upstream commit
+
+ basic pledge() for ssh-agent, more refinement needed
+
+ Upstream-ID: 5b5b03c88162fce549e45e1b6dd833f20bbb5e13
+
+commit f0191d7c8e76e30551084b79341886d9bb38e453
+Author: Damien Miller <djm at mindrot.org>
+Date: Mon Nov 30 10:53:25 2015 +1100
+
+ Revert "stub for pledge(2) for systems that lack it"
+
+ This reverts commit 14c887c8393adde2d9fd437d498be30f8c98535c.
+
+ dtucker beat me to it :/
+
+commit 6283cc72eb0e49a3470d30e07ca99a1ba9e89676
+Author: Damien Miller <djm at mindrot.org>
+Date: Mon Nov 30 10:37:03 2015 +1100
+
+ revert 7d4c7513: bring back S/Key prototypes
+
+ (but leave RCSID changes)
+
+commit 14c887c8393adde2d9fd437d498be30f8c98535c
+Author: Damien Miller <djm at mindrot.org>
+Date: Mon Nov 30 09:45:29 2015 +1100
+
+ stub for pledge(2) for systems that lack it
+
+commit 452c0b6af5d14c37553e30059bf74456012493f3
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Nov 29 22:18:37 2015 +0000
+
+ upstream commit
+
+ pledge, better fatal() messages; feedback deraadt@
+
+ Upstream-ID: 3e00f6ccfe2b9a7a2d1dbba5409586180801488f
+
+commit 6da413c085dba37127687b2617a415602505729b
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Sat Nov 28 06:50:52 2015 +0000
+
+ upstream commit
+
+ do not leak temp file if there is no known_hosts file
+ from craig leres, ok djm
+
+ Upstream-ID: c820497fd5574844c782e79405c55860f170e426
+
+commit 3ddd15e1b63a4d4f06c8ab16fbdd8a5a61764f16
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Nov 30 07:23:53 2015 +1100
+
+ Add a null implementation of pledge.
+
+ Fixes builds on almost everything.
+
+commit b1d6b3971ef256a08692efc409fc9ada719111cc
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Nov 28 06:41:03 2015 +0000
+
+ upstream commit
+
+ don't include port number in tcpip-forward replies for
+ requests that don't allocate a port; bz#2509 diagnosed by Ron Frederick ok
+ markus
+
+ Upstream-ID: 77efad818addb61ec638b5a2362f1554e21a970a
+
+commit 9080bd0b9cf10d0f13b1f642f20cb84285cb8d65
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Nov 27 00:49:31 2015 +0000
+
+ upstream commit
+
+ pledge "stdio rpath wpath cpath fattr tty proc exec"
+ except for the -p option (which sadly has insane semantics...) ok semarie
+ dtucker
+
+ Upstream-ID: 8854bbd58279abe00f6c33f8094bdc02c8c65059
+
+commit 4d90625b229cf6b3551d81550a9861897509a65f
+Author: halex at openbsd.org <halex at openbsd.org>
+Date: Fri Nov 20 23:04:01 2015 +0000
+
+ upstream commit
+
+ allow comment change for all supported formats
+
+ ok djm@
+
+ Upstream-ID: 5fc477cf2f119b2d44aa9c683af16cb00bb3744b
+
+commit 8ca915fc761519dd1f7766a550ec597a81db5646
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Nov 20 01:45:29 2015 +0000
+
+ upstream commit
+
+ add cast to make -Werror clean
+
+ Upstream-ID: 288db4f8f810bd475be01320c198250a04ff064d
+
+commit ac9473580dcd401f8281305af98635cdaae9bf96
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Nov 20 12:35:41 2015 +1100
+
+ fix multiple authentication using S/Key w/ privsep
+
+ bz#2502, patch from Kevin Korb and feandil_
+
+commit 88b6fcdeb87a2fb76767854d9eb15006662dca57
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Nov 19 08:23:27 2015 +0000
+
+ upstream commit
+
+ ban ConnectionAttempts=0, it makes no sense and would cause
+ ssh_connect_direct() to print an uninitialised stack variable; bz#2500
+ reported by dvw AT phas.ubc.ca
+
+ Upstream-ID: 32b5134c608270583a90b93a07b3feb3cbd5f7d5
+
+commit 964ab3ee7a8f96bdbc963d5b5a91933d6045ebe7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Nov 19 01:12:32 2015 +0000
+
+ upstream commit
+
+ trailing whitespace
+
+ Upstream-ID: 31fe0ad7c4d08e87f1d69c79372f5e3c5cd79051
+
+commit f96516d052dbe38561f6b92b0e4365d8e24bb686
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Nov 19 01:09:38 2015 +0000
+
+ upstream commit
+
+ print host certificate contents at debug level
+
+ Upstream-ID: 39354cdd8a2b32b308fd03f98645f877f540f00d
+
+commit 499cf36fecd6040e30e2912dd25655bc574739a7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Nov 19 01:08:55 2015 +0000
+
+ upstream commit
+
+ move the certificate validity formatting code to
+ sshkey.[ch]
+
+ Upstream-ID: f05f7c78fab20d02ff1d5ceeda533ef52e8fe523
+
+commit bcb7bc77bbb1535d1008c7714085556f3065d99d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Nov 18 08:37:28 2015 +0000
+
+ upstream commit
+
+ fix "ssh-keygen -l" of private key, broken in support for
+ multiple plain keys on stdin
+
+ Upstream-ID: 6b3132d2c62d03d0bad6f2bcd7e2d8b7dab5cd9d
+
+commit 259adb6179e23195c8f6913635ea71040d1ccd63
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Mon Nov 16 23:47:52 2015 +0000
+
+ upstream commit
+
+ Replace remaining calls to index(3) with strchr(3). OK
+ jca@ krw@
+
+ Upstream-ID: 33837d767a0cf1db1489b96055f9e330bc0bab6d
+
+commit c56a255162c2166884539c0a1f7511575325b477
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Nov 16 22:53:07 2015 +0000
+
+ upstream commit
+
+ Allow fingerprinting from standard input "ssh-keygen -lf
+ -"
+
+ Support fingerprinting multiple plain keys in a file and authorized_keys
+ files too (bz#1319)
+
+ ok markus@
+
+ Upstream-ID: 903f8b4502929d6ccf53509e4e07eae084574b77
+
+commit 5b4010d9b923cf1b46c9c7b1887c013c2967e204
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Nov 16 22:51:05 2015 +0000
+
+ upstream commit
+
+ always call privsep_preauth_child() regardless of whether
+ sshd was started by root; it does important priming before sandboxing and
+ failing to call it could result in sandbox violations later; ok markus@
+
+ Upstream-ID: c8a6d0d56c42f3faab38460dc917ca0d1705d383
+
+commit 3a9f84b58b0534bbb485f1eeab75665e2d03371f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Nov 16 22:50:01 2015 +0000
+
+ upstream commit
+
+ improve sshkey_read() semantics; only update *cpp when a
+ key is successfully read; ok markus@
+
+ Upstream-ID: f371e78e8f4fab366cf69a42bdecedaed5d1b089
+
+commit db6f8dc5dd5655b59368efd074994d4568bc3556
+Author: logan at openbsd.org <logan at openbsd.org>
+Date: Mon Nov 16 06:13:04 2015 +0000
+
+ upstream commit
+
+ 1) Use xcalloc() instead of xmalloc() to check for
+ potential overflow. (Feedback from both mmcc@ and djm@) 2) move set_size
+ just before the for loop. (suggested by djm@)
+
+ OK djm@
+
+ Upstream-ID: 013534c308187284756c3141f11d2c0f33c47213
+
+commit 383f10fb84a0fee3c01f9d97594f3e22aa3cd5e0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Nov 16 00:30:02 2015 +0000
+
+ upstream commit
+
+ Add a new authorized_keys option "restrict" that
+ includes all current and future key restrictions (no-*-forwarding, etc). Also
+ add permissive versions of the existing restrictions, e.g. "no-pty" -> "pty".
+ This simplifies the task of setting up restricted keys and ensures they are
+ maximally-restricted, regardless of any permissions we might implement in the
+ future.
+
+ Example:
+
+ restrict,pty,command="nethack" ssh-ed25519 AAAAC3NzaC1lZDI1...
+
+ Idea from Jann Horn; ok markus@
+
+ Upstream-ID: 04ceb9d448e46e67e13887a7ae5ea45b4f1719d0
+
+commit e41a071f7bda6af1fb3f081bed0151235fa61f15
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Sun Nov 15 23:58:04 2015 +0000
+
+ upstream commit
+
+ correct section number for ssh-agent;
+
+ Upstream-ID: 44be72fd8bcc167635c49b357b1beea8d5674bd6
+
+commit 1a11670286acddcc19f5eff0966c380831fc4638
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Sun Nov 15 23:54:15 2015 +0000
+
+ upstream commit
+
+ do not confuse mandoc by presenting "Dd";
+
+ Upstream-ID: 1470fce171c47b60bbc7ecd0fc717a442c2cfe65
+
+commit f361df474c49a097bfcf16d1b7b5c36fcd844b4b
+Author: jcs at openbsd.org <jcs at openbsd.org>
+Date: Sun Nov 15 22:26:49 2015 +0000
+
+ upstream commit
+
+ Add an AddKeysToAgent client option which can be set to
+ 'yes', 'no', 'ask', or 'confirm', and defaults to 'no'. When enabled, a
+ private key that is used during authentication will be added to ssh-agent if
+ it is running (with confirmation enabled if set to 'confirm').
+
+ Initial version from Joachim Schipper many years ago.
+
+ ok markus@
+
+ Upstream-ID: a680db2248e8064ec55f8be72d539458c987d5f4
+
+commit d87063d9baf5479b6e813d47dfb694a97df6f6f5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Nov 13 04:39:35 2015 +0000
+
+ upstream commit
+
+ send SSH2_MSG_UNIMPLEMENTED replies to unexpected
+ messages during KEX; bz#2949, ok dtucker@
+
+ Upstream-ID: 2b3abdff344d53c8d505f45c83a7b12e84935786
+
+commit 9fd04681a1e9b0af21e08ff82eb674cf0a499bfc
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Nov 13 04:38:06 2015 +0000
+
+ upstream commit
+
+ Support "none" as an argument for sshd_config
+ ForceCommand and ChrootDirectory. Useful inside Match blocks to override a
+ global default. bz#2486 ok dtucker@
+
+ Upstream-ID: 7ef478d6592bc7db5c7376fc33b4443e63dccfa5
+
+commit 94bc0b72c29e511cbbc5772190d43282e5acfdfe
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Nov 13 04:34:15 2015 +0000
+
+ upstream commit
+
+ support multiple certificates (one per line) and
+ reading from standard input (using "-f -") for "ssh-keygen -L"; ok dtucker@
+
+ Upstream-ID: ecbadeeef3926e5be6281689b7250a32a80e88db
+
+commit b6b9108f5b561c83612cb97ece4134eb59fde071
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Nov 13 02:57:46 2015 +0000
+
+ upstream commit
+
+ list a couple more options usable in Match blocks;
+ bz#2489
+
+ Upstream-ID: e4d03f39d254db4c0cc54101921bb89fbda19879
+
+commit a7994b3f5a5a5a33b52b0a6065d08e888f0a99fb
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Nov 11 04:56:39 2015 +0000
+
+ upstream commit
+
+ improve PEEK/POKE macros: better casts, don't multiply
+ evaluate arguments; ok deraadt@
+
+ Upstream-ID: 9a1889e19647615ededbbabab89064843ba92d3e
+
+commit 7d4c7513a7f209cb303a608ac6e46b3f1dfc11ec
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Nov 11 01:48:01 2015 +0000
+
+ upstream commit
+
+ remove prototypes for long-gone s/key support; ok
+ dtucker@
+
+ Upstream-ID: db5bed3c57118af986490ab23d399df807359a79
+
+commit 07889c75926c040b8e095949c724e66af26441cb
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Nov 14 18:44:49 2015 +1100
+
+ read back from libcrypto RAND when privdropping
+
+ makes certain libcrypto implementations cache a /dev/urandom fd
+ in preparation of sandboxing. Based on patch by Greg Hartman.
+
+commit 1560596f44c01bb0cef977816410950ed17b8ecd
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Nov 10 11:14:47 2015 +1100
+
+ Fix compiler warnings in the openssl header check.
+
+ Noted by Austin English.
+
+commit e72a8575ffe1d8adff42c9abe9ca36938acc036b
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Sun Nov 8 23:24:03 2015 +0000
+
+ upstream commit
+
+ -c before -H, in SYNOPSIS and usage();
+
+ Upstream-ID: 25e8c58a69e1f37fcd54ac2cd1699370acb5e404
+
+commit 3a424cdd21db08c7b0ded902f97b8f02af5aa485
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Nov 8 22:30:20 2015 +0000
+
+ upstream commit
+
+ Add "ssh-keyscan -c ..." flag to allow fetching
+ certificates instead of plain keys; ok markus@
+
+ Upstream-ID: 0947e2177dba92339eced9e49d3c5bf7dda69f82
+
+commit 69fead5d7cdaa73bdece9fcba80f8e8e70b90346
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Sun Nov 8 22:08:38 2015 +0000
+
+ upstream commit
+
+ remove slogin links; ok deraadt markus djm
+
+ Upstream-ID: 39ba08548acde4c54f2d4520c202c2a863a3c730
+
+commit 2fecfd486bdba9f51b3a789277bb0733ca36e1c0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Nov 8 21:59:11 2015 +0000
+
+ upstream commit
+
+ fix OOB read in packet code caused by missing return
+ statement found by Ben Hawkes; ok markus@ deraadt@
+
+ Upstream-ID: a3e3a85434ebfa0690d4879091959591f30efc62
+
+commit 5e288923a303ca672b686908320bc5368ebec6e6
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Fri Nov 6 00:31:41 2015 +0000
+
+ upstream commit
+
+ 1. rlogin and rsh are long gone 2. protocol version isn't
+ of core relevance here, and v1 is going away
+
+ ok markus@, deraadt@
+
+ Upstream-ID: 8b46bc94cf1ca7c8c1a75b1c958b2bb38d7579c8
+
+commit 8b29008bbe97f33381d9b4b93fcfa304168d0286
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Thu Nov 5 09:48:05 2015 +0000
+
+ upstream commit
+
+ "commandline" -> "command line", since there are so few
+ examples of the former in the pages, so many of the latter, and in some of
+ these pages we had multiple spellings;
+
+ prompted by tj
+
+ Upstream-ID: 78459d59bff74223f8139d9001ccd56fc4310659
+
+commit 996b24cebf20077fbe5db07b3a2c20c2d9db736e
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Oct 29 20:57:34 2015 +1100
+
+ (re)wrap SYS_sendsyslog in ifdef.
+
+ Replace ifdef that went missing in commit
+ c61b42f2678f21f05653ac2d3d241b48ab5d59ac. Fixes build on older
+ OpenBSDs.
+
+commit b67e2e76fcf1ae7c802eb27ca927e16c91a513ff
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Oct 29 08:05:17 2015 +0000
+
+ upstream commit
+
+ regress test for "PubkeyAcceptedKeyTypes +..." inside a
+ Match block
+
+ Upstream-Regress-ID: 246c37ed64a2e5704d4c158ccdca1ff700e10647
+
+commit abd9dbc3c0d8c8c7561347cfa22166156e78c077
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Mon Oct 26 02:50:58 2015 +0000
+
+ upstream commit
+
+ Fix typo certopt->certopts in shell variable. This would
+ cause the test to hang at a host key prompt if you have an A or CNAME for
+ "proxy" in your local domain.
+
+ Upstream-Regress-ID: 6ea03bcd39443a83c89e2c5606392ceb9585836a
+
+commit ed08510d38aef930a061ae30d10f2a9cf233bafa
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Oct 29 08:05:01 2015 +0000
+
+ upstream commit
+
+ Fix "PubkeyAcceptedKeyTypes +..." inside a Match block;
ok dtucker@
- - djm at cvs.openbsd.org 2013/09/13 06:54:34
- [channels.c]
- avoid unaligned access in code that reused a buffer to send a
- struct in_addr in a reply; simpler just use use buffer_put_int();
- from portable; spotted by and ok dtucker@
+
+ Upstream-ID: 853662c4036730b966aab77684390c47b9738c69
-20130828
- - (djm) [openbsd-compat/bsd-snprintf.c] teach our local snprintf code the
- 'j' (intmax_t/uintmax_t) and 'z' (size_t/ssize_t) conversions in case we
- start to use them in the future.
- - (djm) [openbsd-compat/bsd-snprintf.c] #ifdef noytet for intmax_t bits
- until we have configure support.
+commit a4aef3ed29071719b2af82fdf1ac3c2514f82bc5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Oct 27 08:54:52 2015 +0000
-20130821
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/08/06 23:03:49
- [sftp.c]
- fix some whitespace at EOL
- make list of commands an enum rather than a long list of defines
- add -a to usage()
- - djm at cvs.openbsd.org 2013/08/06 23:05:01
- [sftp.1]
- document top-level -a option (the -a option to 'get' was already
- documented)
- - djm at cvs.openbsd.org 2013/08/06 23:06:01
- [servconf.c]
- add cast to avoid format warning; from portable
- - jmc at cvs.openbsd.org 2013/08/07 06:24:51
- [sftp.1 sftp.c]
- sort -a;
- - djm at cvs.openbsd.org 2013/08/08 04:52:04
- [sftp.c]
- fix two year old regression: symlinking a file would incorrectly
- canonicalise the target path. bz#2129 report from delphij AT freebsd.org
- - djm at cvs.openbsd.org 2013/08/08 05:04:03
- [sftp-client.c sftp-client.h sftp.c]
- add a "-l" flag for the rename command to force it to use the silly
- standard SSH_FXP_RENAME command instead of the POSIX-rename- like
- posix-rename at openssh.com extension.
+ upstream commit
+
+ fix execv arguments in a way less likely to cause grief
+ for -portable; ok dtucker@
+
+ Upstream-ID: 5902bf0ea0371f39f1300698dc3b8e4105fc0fc5
- intended for use in regress tests, so no documentation.
- - djm at cvs.openbsd.org 2013/08/09 03:37:25
- [sftp.c]
- do getopt parsing for all sftp commands (with an empty optstring for
- commands without arguments) to ensure consistent behaviour
- - djm at cvs.openbsd.org 2013/08/09 03:39:13
- [sftp-client.c]
- two problems found by a to-be-committed regress test: 1) msg_id was not
- being initialised so was starting at a random value from the heap
- (harmless, but confusing). 2) some error conditions were not being
- propagated back to the caller
- - djm at cvs.openbsd.org 2013/08/09 03:56:42
- [sftp.c]
- enable ctrl-left-arrow and ctrl-right-arrow to move forward/back a word;
- matching ksh's relatively recent change.
- - djm at cvs.openbsd.org 2013/08/13 18:32:08
- [ssh-keygen.c]
- typo in error message; from Stephan Rickauer
- - djm at cvs.openbsd.org 2013/08/13 18:33:08
- [ssh-keygen.c]
- another of the same typo
- - jmc at cvs.openbsd.org 2013/08/14 08:39:27
- [scp.1 ssh.1]
- some Bx/Ox conversion;
- From: Jan Stary
- - djm at cvs.openbsd.org 2013/08/20 00:11:38
- [readconf.c readconf.h ssh_config.5 sshconnect.c]
- Add a ssh_config ProxyUseFDPass option that supports the use of
- ProxyCommands that establish a connection and then pass a connected
- file descriptor back to ssh(1). This allows the ProxyCommand to exit
- rather than have to shuffle data back and forth and enables ssh to use
- getpeername, etc. to obtain address information just like it does with
- regular directly-connected sockets. ok markus@
- - jmc at cvs.openbsd.org 2013/08/20 06:56:07
- [ssh.1 ssh_config.5]
- some proxyusefdpass tweaks;
+commit 63d188175accea83305e89fafa011136ff3d96ad
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Oct 27 01:44:45 2015 +0000
-20130808
- - (dtucker) [regress/Makefile regress/test-exec.sh] Don't try to use test -nt
- since some platforms (eg really old FreeBSD) don't have it. Instead,
- run "make clean" before a complete regress run. ok djm.
- - (dtucker) [misc.c] Fall back to time(2) at runtime if clock_gettime(
- CLOCK_MONOTONIC...) fails. Some older versions of RHEL have the
- CLOCK_MONOTONIC define but don't actually support it. Found and tested
- by Kevin Brott, ok djm.
- - (dtucker) [misc.c] Remove define added for fallback testing that was
- mistakenly included in the previous commit.
- - (dtucker) [regress/Makefile regress/test-exec.sh] Roll back the -nt
- removal. The "make clean" removes modpipe which is built by the top-level
- directory before running the tests. Spotted by tim@
- - (djm) Release 6.3p1
+ upstream commit
+
+ log certificate serial in verbose() messages to match the
+ main auth success/fail message; ok dtucker@
+
+ Upstream-ID: dfc48b417c320b97c36ff351d303c142f2186288
-20130804
- - (dtucker) [auth-krb5.c configure.ac openbsd-compat/bsd-misc.h] Add support
- for building with older Heimdal versions. ok djm.
+commit 2aaba0cfd560ecfe92aa50c00750e6143842cf1f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Oct 27 00:49:53 2015 +0000
-20130801
- - (djm) [channels.c channels.h] bz#2135: On Solaris, isatty() on a non-
- blocking connecting socket will clear any stored errno that might
- otherwise have been retrievable via getsockopt(). A hack to limit writes
- to TTYs on AIX was triggering this. Since only AIX needs the hack, wrap
- it in an #ifdef. Diagnosis and patch from Ivo Raisr.
- - (djm) [sshlogin.h] Fix prototype merge botch from 2006; bz#2134
+ upstream commit
+
+ avoid de-const warning & shrink; ok dtucker@
+
+ Upstream-ID: 69a85ef94832378952a22c172009cbf52aaa11db
-20130725
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/07/20 22:20:42
- [krl.c]
- fix verification error in (as-yet usused) KRL signature checking path
- - djm at cvs.openbsd.org 2013/07/22 05:00:17
- [umac.c]
- make MAC key, data to be hashed and nonce for final hash const;
- checked with -Wcast-qual
- - djm at cvs.openbsd.org 2013/07/22 12:20:02
- [umac.h]
- oops, forgot to commit corresponding header change;
- spotted by jsg and jasper
- - djm at cvs.openbsd.org 2013/07/25 00:29:10
- [ssh.c]
- daemonise backgrounded (ControlPersist'ed) multiplexing master to ensure
- it is fully detached from its controlling terminal. based on debugging
- - djm at cvs.openbsd.org 2013/07/25 00:56:52
- [sftp-client.c sftp-client.h sftp.1 sftp.c]
- sftp support for resuming partial downloads; patch mostly by Loganaden
- Velvindron/AfriNIC with some tweaks by me; feedback and ok dtucker@
- "Just be careful" deraadt@
- - djm at cvs.openbsd.org 2013/07/25 00:57:37
- [version.h]
- openssh-6.3 for release
- - dtucker at cvs.openbsd.org 2013/05/30 20:12:32
- [regress/test-exec.sh]
- use ssh and sshd as testdata since it needs to be >256k for the rekey test
- - dtucker at cvs.openbsd.org 2013/06/10 21:56:43
- [regress/forwarding.sh]
- Add test for forward config parsing
- - djm at cvs.openbsd.org 2013/06/21 02:26:26
- [regress/sftp-cmds.sh regress/test-exec.sh]
- unbreak sftp-cmds for renamed test data (s/ls/data/)
- - (tim) [sftp-client.c] Use of a gcc extension trips up native compilers on
- Solaris and UnixWare. Feedback and OK djm@
- - (tim) [regress/forwarding.sh] Fix for building outside source tree.
+commit 03239c18312b9bab7d1c3b03062c61e8bbc1ca6e
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Sun Oct 25 23:42:00 2015 +0000
-20130720
- - (djm) OpenBSD CVS Sync
- - markus at cvs.openbsd.org 2013/07/19 07:37:48
- [auth.h kex.h kexdhs.c kexecdhs.c kexgexs.c monitor.c servconf.c]
- [servconf.h session.c sshd.c sshd_config.5]
- add ssh-agent(1) support to sshd(8); allows encrypted hostkeys,
- or hostkeys on smartcards; most of the work by Zev Weiss; bz #1974
+ upstream commit
+
+ Expand tildes in filenames passed to -i before checking
+ whether or not the identity file exists. This means that if the shell
+ doesn't do the expansion (eg because the option and filename were given as a
+ single argument) then we'll still add the key. bz#2481, ok markus@
+
+ Upstream-ID: db1757178a14ac519e9a3e1a2dbd21113cb3bfc6
+
+commit 97e184e508dd33c37860c732c0eca3fc57698b40
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Sun Oct 25 23:14:03 2015 +0000
+
+ upstream commit
+
+ Do not prepend "exec" to the shell command run by "Match
+ exec" in a config file. It's an unnecessary optimization from repurposed
+ ProxyCommand code and prevents some things working with some shells.
+ bz#2471, pointed out by res at qoxp.net. ok markus@
+
+ Upstream-ID: a1ead25ae336bfa15fb58d8c6b5589f85b4c33a3
+
+commit 8db134e7f457bcb069ec72bc4ee722e2af557c69
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Oct 29 10:48:23 2015 +1100
+
+ Prevent name collisions with system glob (bz#2463)
+
+ Move glob.h from includes.h to the only caller (sftp) and override the
+ names for the symbols. This prevents name collisions with the system glob
+ in the case where something other than ssh uses it (eg kerberos). With
+ jjelen at redhat.com, ok djm@
+
+commit 86c10dbbef6a5800d2431a66cf7f41a954bb62b5
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Oct 23 02:22:01 2015 +0000
+
+ upstream commit
+
+ Update expected group sizes to match recent code changes.
+
+ Upstream-Regress-ID: 0004f0ea93428969fe75bcfff0d521c553977794
+
+commit 9ada37d36003a77902e90a3214981e417457cf13
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Oct 24 22:56:19 2015 +0000
+
+ upstream commit
+
+ fix keyscan output for multiple hosts/addrs on one line
+ when host hashing or a non standard port is in use; bz#2479 ok dtucker@
+
+ Upstream-ID: 5321dabfaeceba343da3c8a8b5754c6f4a0a307b
+
+commit 44fc7cd7dcef6c52c6b7e9ff830dfa32879bd319
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Oct 24 22:52:22 2015 +0000
+
+ upstream commit
+
+ skip "Could not chdir to home directory" message when
+ chrooted
+
+ patch from Christian Hesse in bz#2485 ok dtucker@
+
+ Upstream-ID: 86783c1953da426dff5b03b03ce46e699d9e5431
+
+commit a820a8618ec44735dabc688fab96fba38ad66bb2
+Author: sthen at openbsd.org <sthen at openbsd.org>
+Date: Sat Oct 24 08:34:09 2015 +0000
+
+ upstream commit
+
+ Handle the split of tun(4) "link0" into tap(4) in ssh
+ tun-forwarding. Adapted from portable (using separate devices for this is the
+ normal case in most OS). ok djm@
+
+ Upstream-ID: 90facf4c59ce73d6741db1bc926e578ef465cd39
+
+commit 66d2e229baa9fe57b868c373b05f7ff3bb20055b
+Author: gsoares at openbsd.org <gsoares at openbsd.org>
+Date: Wed Oct 21 11:33:03 2015 +0000
+
+ upstream commit
+
+ fix memory leak in error path ok djm@
+
+ Upstream-ID: dd2f402b0a0029b755df029fc7f0679e1365ce35
+
+commit 7d6c0362039ceacdc1366b5df29ad5d2693c13e5
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Tue Oct 20 23:24:25 2015 +0000
+
+ upstream commit
+
+ Compare pointers to NULL rather than 0.
+
+ ok djm@
+
+ Upstream-ID: 21616cfea27eda65a06e772cc887530b9a1a27f8
+
+commit f98a09cacff7baad8748c9aa217afd155a4d493f
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Tue Oct 20 03:36:35 2015 +0000
+
+ upstream commit
+
+ Replace a function-local allocation with stack memory.
+
+ ok djm@
+
+ Upstream-ID: c09fbbab637053a2ab9f33ca142b4e20a4c5a17e
+
+commit ac908c1eeacccfa85659594d92428659320fd57e
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Oct 22 09:35:24 2015 +1100
+
+ turn off PrintLastLog when --disable-lastlog
+
+ bz#2278 from Brent Paulson
+
+commit b56deb847f4a0115a8bf488bf6ee8524658162fd
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Oct 16 22:32:22 2015 +0000
+
+ upstream commit
+
+ increase the minimum modulus that we will send or accept in
+ diffie-hellman-group-exchange to 2048 bits; ok markus@
+
+ Upstream-ID: 06dce7a24c17b999a0f5fadfe95de1ed6a1a9b6a
+
+commit 5ee0063f024bf5b3f3ffb275b8cd20055d62b4b9
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Oct 16 18:40:49 2015 +0000
+
+ upstream commit
+
+ better handle anchored FQDNs (e.g. 'cvs.openbsd.org.') in
+ hostname canonicalisation - treat them as already canonical and remove the
+ trailing '.' before matching ssh_config; ok markus@
+
+ Upstream-ID: f7619652e074ac3febe8363f19622aa4853b679a
+
+commit e92c499a75477ecfe94dd7b4aed89f20b1fac5a7
+Author: mmcc at openbsd.org <mmcc at openbsd.org>
+Date: Fri Oct 16 17:07:24 2015 +0000
+
+ upstream commit
+
+ 0 -> NULL when comparing with a char*.
+
+ ok dtucker@, djm at .
+
+ Upstream-ID: a928e9c21c0a9020727d99738ff64027c1272300
+
+commit b1d38a3cc6fe349feb8d16a5f520ef12d1de7cb2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Oct 15 23:51:40 2015 +0000
+
+ upstream commit
+
+ fix some signed/unsigned integer type mismatches in
+ format strings; reported by Nicholas Lemonias
+
+ Upstream-ID: 78cd55420a0eef68c4095bdfddd1af84afe5f95c
+
+commit 1a2663a15d356bb188196b6414b4c50dc12fd42b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Oct 15 23:08:23 2015 +0000
+
+ upstream commit
+
+ argument to sshkey_from_private() and sshkey_demote()
+ can't be NULL
+
+ Upstream-ID: 0111245b1641d387977a9b38da15916820a5fd1f
+
+commit 0f754e29dd3760fc0b172c1220f18b753fb0957e
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Oct 16 10:53:14 2015 +1100
+
+ need va_copy before va_start
+
+ reported by Nicholas Lemonias
+
+commit eb6c50d82aa1f0d3fc95f5630ea69761e918bfcd
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Oct 15 15:48:28 2015 -0700
+
+ fix compilation on systems without SYMLOOP_MAX
+
+commit fafe1d84a210fb3dae7744f268059cc583db8c12
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 14 09:22:15 2015 -0700
+
+ s/SANDBOX_TAME/SANDBOX_PLEDGE/g
+
+commit 8f22911027ff6c17d7226d232ccd20727f389310
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 14 08:28:19 2015 +1100
+
+ upstream commit
+
+ revision 1.20
+ date: 2015/10/13 20:55:37; author: millert; state: Exp; lines: +2 -2; commitid: X39sl5ay1czgFIgp;
+ In rev 1.15 the sizeof argument was fixed in a strlcat() call but
+ the truncation check immediately following it was not updated to
+ match. Not an issue in practice since the buffers are the same
+ size. OK deraadt@
+
+commit 23fa695bb735f54f04d46123662609edb6c76767
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 14 08:27:51 2015 +1100
+
+ upstream commit
+
+ revision 1.19
+ date: 2015/01/16 16:48:51; author: deraadt; state: Exp; lines: +3 -3; commitid: 0DYulI8hhujBHMcR;
+ Move to the <limits.h> universe.
+ review by millert, binary checking process with doug, concept with guenther
+
+commit c71be375a69af00c2d0a0c24d8752bec12d8fd1b
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 14 08:27:08 2015 +1100
+
+ upstream commit
+
+ revision 1.18
+ date: 2014/10/19 03:56:28; author: doug; state: Exp; lines: +9 -9; commitid: U6QxmtbXrGoc02S5;
+ Revert last commit due to changed semantics found by make release.
+
+commit c39ad23b06e9aecc3ff788e92f787a08472905b1
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 14 08:26:24 2015 +1100
+
+ upstream commit
+
+ revision 1.17
+ date: 2014/10/18 20:43:52; author: doug; state: Exp; lines: +10 -10; commitid: I74hI1tVZtsspKEt;
+ Better POSIX compliance in realpath(3).
+
+ millert@ made changes to realpath.c based on FreeBSD's version. I merged
+ Todd's changes into dl_realpath.c.
+
+ ok millert@, guenther@
+
+commit e929a43f957dbd1254aca2aaf85c8c00cbfc25f4
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 14 08:25:55 2015 +1100
+
+ upstream commit
+
+ revision 1.16
+ date: 2013/04/05 12:59:54; author: kurt; state: Exp; lines: +3 -1;
+ - Add comments regarding copies of these files also in libexec/ld.so
+ okay guenther@
+
+commit 5225db68e58a1048cb17f0e36e0d33bc4a8fc410
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 14 08:25:32 2015 +1100
+
+ upstream commit
+
+ revision 1.15
+ date: 2012/09/13 15:39:05; author: deraadt; state: Exp; lines: +2 -2;
+ specify the bounds of the dst to strlcat (both values were static and
+ equal, but it is more correct)
+ from Michal Mazurek
+
+commit 7365fe5b4859de2305e40ea132da3823830fa710
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 14 08:25:09 2015 +1100
+
+ upstream commit
+
+ revision 1.14
+ date: 2011/07/24 21:03:00; author: miod; state: Exp; lines: +35 -13;
+ Recent Single Unix will malloc memory if the second argument of realpath()
+ is NULL, and third-party software is starting to rely upon this.
+ Adapted from FreeBSD via Jona Joachim (jaj ; hcl-club , .lu), with minor
+ tweaks from nicm@ and yours truly.
+
+commit e679c09cd1951f963793aa3d9748d1c3fdcf808f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Oct 13 16:15:21 2015 +0000
+
+ upstream commit
+
+ apply PubkeyAcceptedKeyTypes filtering earlier, so all
+ skipped keys are noted before pubkey authentication starts. ok dtucker@
+
+ Upstream-ID: ba4f52f54268a421a2a5f98bb375403f4cb044b8
+
+commit 179c353f564ec7ada64b87730b25fb41107babd7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Oct 13 00:21:27 2015 +0000
+
+ upstream commit
+
+ free the correct IV length, don't assume it's always the
+ cipher blocksize; ok dtucker@
+
+ Upstream-ID: c260d9e5ec73628d9ff4b067fbb060eff5a7d298
+
+commit 2539dce2a049a8f6bb0d44cac51f07ad48e691d3
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Oct 9 01:37:08 2015 +0000
+
+ upstream commit
+
+ Change all tame callers to namechange to pledge(2).
+
+ Upstream-ID: 17e654fc27ceaf523c60f4ffd9ec7ae4e7efc7f2
+
+commit 9846a2f4067383bb76b4e31a9d2303e0a9c13a73
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Oct 8 04:30:48 2015 +1100
+
+ hook tame(2) sandbox up to build
+
+ OpenBSD only for now
+
+commit 0c46bbe68b70bdf0d6d20588e5847e71f3739fe6
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Oct 7 15:59:12 2015 +0000
+
+ upstream commit
+
+ include PubkeyAcceptedKeyTypes in ssh -G config dump
+
+ Upstream-ID: 6c097ce6ffebf6fe393fb7988b5d152a5d6b36bb
+
+commit bdcb73fb7641b1cf73c0065d1a0dd57b1e8b778e
+Author: sobrado at openbsd.org <sobrado at openbsd.org>
+Date: Wed Oct 7 14:45:30 2015 +0000
+
+ upstream commit
+
+ UsePrivilegeSeparation defaults to sandbox now.
+
+ ok djm@
+
+ Upstream-ID: bff136c38bcae89df82e044d2f42de21e1ad914f
+
+commit 2905d6f99c837bb699b6ebc61711b19acd030709
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Oct 7 00:54:06 2015 +0000
+
+ upstream commit
+
+ don't try to change tun device flags if they are already
+ what we need; makes it possible to use tun/tap networking as non- root user
+ if device permissions and interface flags are pre-established; based on patch
+ by Ossi Herrala
+
+ Upstream-ID: 89099ac4634cd477b066865acf54cb230780fd21
+
+commit 0dc74512bdb105b048883f07de538b37e5e024d4
+Author: Damien Miller <djm at mindrot.org>
+Date: Mon Oct 5 18:33:05 2015 -0700
+
+ unbreak merge botch
+
+commit fdd020e86439afa7f537e2429d29d4b744c94331
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Oct 6 01:20:59 2015 +0000
+
+ upstream commit
+
+ adapt to recent sshkey_parse_private_fileblob() API
+ change
+
+ Upstream-Regress-ID: 5c0d818da511e33e0abf6a92a31bd7163b7ad988
+
+commit 21ae8ee3b630b0925f973db647a1b9aa5fcdd4c5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Sep 24 07:15:39 2015 +0000
+
+ upstream commit
+
+ fix command-line option to match what was actually
+ committed
+
+ Upstream-Regress-ID: 3e8c24a2044e8afd37e7ce17b69002ca817ac699
+
+commit e14ac43b75e68f1ffbd3e1a5e44143c8ae578dcd
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Sep 24 06:16:53 2015 +0000
+
+ upstream commit
+
+ regress test for CertificateFile; patch from Meghana Bhat
+ via bz#2436
+
+ Upstream-Regress-ID: e7a6e980cbe0f8081ba2e83de40d06c17be8bd25
+
+commit 905b054ed24e0d5b4ef226ebf2c8bfc02ae6d4ad
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Oct 5 17:11:21 2015 +0000
+
+ upstream commit
+
+ some more bzero->explicit_bzero, from Michael McConville
+
+ Upstream-ID: 17f19545685c33327db2efdc357c1c9225ff00d0
+
+commit b007159a0acdbcf65814b3ee05dbe2cf4ea46011
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Oct 2 15:52:55 2015 +0000
+
+ upstream commit
+
+ fix email
+
+ Upstream-ID: 72150f2d54b94de14ebef1ea054ef974281bf834
+
+commit b19e1b4ab11884c4f62aee9f8ab53127a4732658
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Oct 2 01:39:52 2015 +0000
+
+ upstream commit
+
+ a sandbox using tame ok djm
+
+ Upstream-ID: 4ca24e47895e72f5daaa02f3e3d3e5ca2d820fa3
+
+commit c61b42f2678f21f05653ac2d3d241b48ab5d59ac
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Oct 2 01:39:26 2015 +0000
+
+ upstream commit
+
+ re-order system calls in order of risk, ok i'll be
+ honest, ordered this way they look like tame... ok djm
+
+ Upstream-ID: 42a1e6d251fd8be13c8262bee026059ae6328813
+
+commit c5f7c0843cb6e6074a93c8ac34e49ce33a6f5546
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Fri Sep 25 18:19:54 2015 +0000
+
+ upstream commit
+
+ some certificatefile tweaks; ok djm
+
+ Upstream-ID: 0e5a7852c28c05fc193419cc7e50e64c1c535af0
+
+commit 4e44a79a07d4b88b6a4e5e8c1bed5f58c841b1b8
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Sep 24 06:15:11 2015 +0000
+
+ upstream commit
+
+ add ssh_config CertificateFile option to explicitly list
+ a certificate; patch from Meghana Bhat on bz#2436; ok markus@
+
+ Upstream-ID: 58648ec53c510b41c1f46d8fe293aadc87229ab8
+
+commit e3cbb06ade83c72b640a53728d362bbefa0008e2
+Author: sobrado at openbsd.org <sobrado at openbsd.org>
+Date: Tue Sep 22 08:33:23 2015 +0000
+
+ upstream commit
+
+ fix two typos.
+
+ Upstream-ID: 424402c0d8863a11b51749bacd7f8d932083b709
+
+commit 8408218c1ca88cb17d15278174a24a94a6f65fe1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Sep 21 04:31:00 2015 +0000
+
+ upstream commit
+
+ fix possible hang on closed output; bz#2469 reported by Tomas
+ Kuthan ok markus@
+
+ Upstream-ID: f7afd41810f8540f524284f1be6b970859f94fe3
+
+commit 0097248f90a00865082e8c146b905a6555cc146f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 11 04:55:01 2015 +0000
+
+ upstream commit
+
+ skip if running as root; many systems (inc OpenBSD) allow
+ root to ptrace arbitrary processes
+
+ Upstream-Regress-ID: be2b925df89360dff36f972951fa0fa793769038
+
+commit 9c06c814aff925e11a5cc592c06929c258a014f6
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 11 03:44:21 2015 +0000
+
+ upstream commit
+
+ try all supported key types here; bz#2455 reported by
+ Jakub Jelen
+
+ Upstream-Regress-ID: 188cb7d9031cdbac3a0fa58b428b8fa2b2482bba
+
+commit 3c019a936b43f3e2773f3edbde7c114d73caaa4c
+Author: tim at openbsd.org <tim at openbsd.org>
+Date: Sun Sep 13 14:39:16 2015 +0000
+
+ upstream commit
+
+ - Fix error message: passphrase needs to be at least 5
+ characters, not 4. - Remove unused function argument. - Remove two
+ unnecessary variables.
+
+ OK djm@
+
+ Upstream-ID: 13010c05bfa8b523da1c0dc19e81dd180662bc30
+
+commit 2681cdb6e0de7c1af549dac37a9531af202b4434
+Author: tim at openbsd.org <tim at openbsd.org>
+Date: Sun Sep 13 13:48:19 2015 +0000
+
+ upstream commit
+
+ When adding keys to the agent, don't ignore the comment
+ of keys for which the user is prompted for a passphrase.
+
+ Tweak and OK djm@
+
+ Upstream-ID: dc737c620a5a8d282cc4f66e3b9b624e9abefbec
+
+commit 14692f7b8251cdda847e648a82735eef8a4d2a33
+Author: guenther at openbsd.org <guenther at openbsd.org>
+Date: Fri Sep 11 08:50:04 2015 +0000
+
+ upstream commit
+
+ Use explicit_bzero() when zeroing before free()
+
+ from Michael McConville (mmcconv1 (at) sccs.swarthmore.edu)
+ ok millert@ djm@
+
+ Upstream-ID: 2e3337db046c3fe70c7369ee31515ac73ec00f50
+
+commit 846f6fa4cfa8483a9195971dbdd162220f199d85
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Fri Sep 11 06:55:46 2015 +0000
+
+ upstream commit
+
+ sync -Q in usage() to SYNOPSIS; since it's drastically
+ shorter, i've reformatted the block to sync with the man (80 cols) and saved
+ a line;
+
+ Upstream-ID: 86e2c65c3989a0777a6258a77e589b9f6f354abd
+
+commit 95923e0520a8647417ee6dcdff44694703dfeef0
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Fri Sep 11 06:51:39 2015 +0000
+
+ upstream commit
+
+ tweak previous;
+
+ Upstream-ID: f29b3cfcfd9aa31fa140c393e7bd48c1c74139d6
+
+commit 86ac462f833b05d8ed9de9c50ccb295d7faa79ff
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Sep 11 05:27:02 2015 +0000
+
+ upstream commit
+
+ Update usage to match man page.
+
+ Upstream-ID: 9e85aefaecfb6aaf34c7cfd0700cd21783a35675
+
+commit 674b3b68c1d36b2562324927cd03857b565e05e8
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 11 03:47:28 2015 +0000
+
+ upstream commit
+
+ expand %i in ControlPath to UID; bz#2449
+
+ patch from Christian Hesse w/ feedback from dtucker@
+
+ Upstream-ID: 2ba8d303e555a84e2f2165ab4b324b41e80ab925
+
+commit c0f55db7ee00c8202b05cb4b9ad4ce72cc45df41
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 11 03:42:32 2015 +0000
+
+ upstream commit
+
+ mention -Q key-plain and -Q key-cert; bz#2455 pointed out
+ by Jakub Jelen
+
+ Upstream-ID: c8f1f8169332e4fa73ac96b0043e3b84e01d4896
+
+commit cfffbdb10fdf0f02d3f4232232eef7ec3876c383
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Sep 14 16:24:21 2015 +1000
+
+ Use ssh-keygen -A when generating host keys.
+
+ Use ssh-keygen -A instead of per-keytype invocations when generating host
+ keys. Add tests when doing host-key-force since we can't use ssh-keygen -A
+ since it can't specify alternate locations. bz#2459, ok djm@
+
+commit 366bada1e9e124654aac55b72b6ccf878755b0dc
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Sep 11 13:29:22 2015 +1000
+
+ Correct default value for --with-ssh1.
+
+ bz#2457, from konto-mindrot.org at walimnieto.com.
+
+commit 2bca8a43e7dd9b04d7070824ffebb823c72587b2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 11 03:13:36 2015 +0000
+
+ upstream commit
+
+ more clarity on what AuthorizedKeysFile=none does; based
+ on diff by Thiebaud Weksteen
+
+ Upstream-ID: 78ab87f069080f0cc3bc353bb04eddd9e8ad3704
+
+commit 61942ea4a01e6db4fdf37ad61de81312ffe310e9
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Sep 9 00:52:44 2015 +0000
+
+ upstream commit
+
+ openssh_RSA_verify return type is int, so don't make it
+ size_t within the function itself with only negative numbers or zero assigned
+ to it. bz#2460
+
+ Upstream-ID: b6e794b0c7fc4f9f329509263c8668d35f83ea55
+
+commit 4f7cc2f8cc861a21e6dbd7f6c25652afb38b9b96
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Sep 4 08:21:47 2015 +0000
+
+ upstream commit
+
+ Plug minor memory leaks when options are used more than
+ once. bz#2182, patch from Tiago Cunha, ok deraadt djm
+
+ Upstream-ID: 5b84d0401e27fe1614c10997010cc55933adb48e
+
+commit 7ad8b287c8453a3e61dbc0d34d467632b8b06fc8
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Sep 11 13:11:02 2015 +1000
+
+ Force resolution of _res for correct detection.
+
+ bz#2259, from sconeu at yahoo.com.
+
+commit 26ad18247213ff72b4438abe7fc660c958810fa2
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Sep 10 10:57:41 2015 +1000
+
+ allow getrandom syscall; from Felix von Leitner
+
+commit 5245bc1e6b129a10a928f73f11c3aa32656c44b4
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Fri Sep 4 06:40:45 2015 +0000
+
+ upstream commit
+
+ full stop belongs outside the brackets, not inside;
+
+ Upstream-ID: 99d098287767799ac33d2442a05b5053fa5a551a
+
+commit a85768a9321d74b41219eeb3c9be9f1702cbf6a5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 4 04:56:09 2015 +0000
+
+ upstream commit
+
+ add a debug2() right before DNS resolution; it's a place
+ where ssh could previously silently hang for a while. bz#2433
+
+ Upstream-ID: 52a1a3e0748db66518e7598352c427145692a6a0
+
+commit 46152af8d27aa34d5d26ed1c371dc8aa142d4730
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 4 04:55:24 2015 +0000
+
+ upstream commit
+
+ correct function name in error messages
+
+ Upstream-ID: 92fb2798617ad9561370897f4ab60adef2ff4c0e
+
+commit a954cdb799a4d83c2d40fbf3e7b9f187fbfd72fc
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 4 04:47:50 2015 +0000
+
+ upstream commit
+
+ better document ExitOnForwardFailure; bz#2444, ok
+ dtucker@
+
+ Upstream-ID: a126209b5a6d9cb3117ac7ab5bc63d284538bfc2
+
+commit f54d8ac2474b6fc3afa081cf759b48a6c89d3319
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 4 04:44:08 2015 +0000
+
+ upstream commit
+
+ don't record hostbased authentication hostkeys as user
+ keys in test for multiple authentication with the same key
+
+ Upstream-ID: 26b368fa2cff481f47f37e01b8da1ae5b57b1adc
+
+commit ac3451dd65f27ecf85dc045c46d49e2bbcb8dddd
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 4 03:57:38 2015 +0000
+
+ upstream commit
+
+ remove extra newline in nethack-mode hostkey; from
+ Christian Hesse bz#2686
+
+ Upstream-ID: 4f56368b1cc47baeea0531912186f66007fd5b92
+
+commit 9e3ed9ebb1a7e47c155c28399ddf09b306ea05df
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Sep 4 04:23:10 2015 +0000
+
+ upstream commit
+
+ trim junk from end of file; bz#2455 from Jakub Jelen
+
+ Upstream-Regress-ID: a4e64e8931e40d23874b047074444eff919cdfe6
+
+commit f3a3ea180afff080bab82087ee0b60db9fd84f6c
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Wed Sep 2 07:51:12 2015 +0000
+
+ upstream commit
+
+ Fix occurrences of "r = func() != 0" which result in the
+ wrong error codes being returned due to != having higher precedence than =.
+
+ ok deraadt@ markus@
+
+ Upstream-ID: 5fc35c9fc0319cc6fca243632662d2f06b5fd840
+
+commit f498a98cf83feeb7ea01c15cd1c98b3111361f3a
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Sep 3 09:11:22 2015 +1000
+
+ don't check for yp_match; ok tim@
+
+commit 9690b78b7848b0b376980a61d51b1613e187ddb5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Aug 21 23:57:48 2015 +0000
+
+ upstream commit
+
+ Improve printing of KEX offers and decisions
+
+ The debug output now labels the client and server offers and the
+ negotiated options. ok markus@
+
+ Upstream-ID: 8db921b3f92a4565271b1c1fbce6e7f508e1a2cb
+
+commit 60a92470e21340e1a3fc10f9c7140d8e1519dc55
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Aug 21 23:53:08 2015 +0000
+
+ upstream commit
+
+ Fix printing (ssh -G ...) of HostKeyAlgorithms=+...
+ Reported by Bryan Drewery
+
+ Upstream-ID: 19ad20c41bd5971e006289b6f9af829dd46c1293
+
+commit 6310f60fffca2d1e464168e7d1f7e3b6b0268897
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Aug 21 23:52:30 2015 +0000
+
+ upstream commit
+
+ Fix expansion of HostkeyAlgorithms=+...
+
+ Reported by Bryan Drewery
+
+ Upstream-ID: 70ca1deea39d758ba36d36428ae832e28566f78d
+
+commit e774e5ea56237fd626a8161f9005023dff3e76c9
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Aug 21 23:29:31 2015 +0000
+
+ upstream commit
+
+ Improve size == 0, count == 0 checking in mm_zalloc,
+ which is "array" like. Discussed with tedu, millert, otto.... and ok djm
+
+ Upstream-ID: 899b021be43b913fad3eca1aef44efe710c53e29
+
+commit 189de02d9ad6f3645417c0ddf359b923aae5f926
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 21 15:45:02 2015 +1000
+
+ expose POLLHUP and POLLNVAL for netcat.c
+
+commit e91346dc2bbf460246df2ab591b7613908c1b0ad
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 21 14:49:03 2015 +1000
+
+ we don't use Github for issues/pull-requests
+
+commit a4f5b507c708cc3dc2c8dd2d02e4416d7514dc23
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 21 14:43:55 2015 +1000
+
+ fix URL for connect.c
+
+commit d026a8d3da0f8186598442997c7d0a28e7275414
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 21 13:47:10 2015 +1000
+
+ update version numbers for 7.1
+
+commit 78f8f589f0ca1c9f41e5a9bae3cda5ce8a6b42ed
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Aug 21 03:45:26 2015 +0000
+
+ upstream commit
+
+ openssh-7.1
+
+ Upstream-ID: ff7b1ef4b06caddfb45e08ba998128c88be3d73f
+
+commit 32a181980c62fce94f7f9ffaf6a79d90f0c309cf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Aug 21 03:42:19 2015 +0000
+
+ upstream commit
+
+ fix inverted logic that broke PermitRootLogin; reported
+ by Mantas Mikulenas; ok markus@
+
+ Upstream-ID: 260dd6a904c1bb7e43267e394b1c9cf70bdd5ea5
+
+commit ce445b0ed927e45bd5bdce8f836eb353998dd65c
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Thu Aug 20 22:32:42 2015 +0000
+
+ upstream commit
+
+ Do not cast result of malloc/calloc/realloc* if stdlib.h
+ is in scope ok krw millert
+
+ Upstream-ID: 5e50ded78cadf3841556649a16cc4b1cb6c58667
+
+commit 05291e5288704d1a98bacda269eb5a0153599146
+Author: naddy at openbsd.org <naddy at openbsd.org>
+Date: Thu Aug 20 19:20:06 2015 +0000
+
+ upstream commit
+
+ In the certificates section, be consistent about using
+ "host_key" and "user_key" for the respective key types. ok sthen@ deraadt@
+
+ Upstream-ID: 9e037ea3b15577b238604c5533e082a3947f13cb
+
+commit 8543d4ef6f2e9f98c3e6b77c894ceec30c5e4ae4
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Aug 19 23:21:42 2015 +0000
+
+ upstream commit
+
+ Better compat matching for WinSCP, add compat matching
+ for FuTTY (fork of PuTTY); ok markus@ deraadt@
+
+ Upstream-ID: 24001d1ac115fa3260fbdc329a4b9aeb283c5389
+
+commit ec6eda16ebab771aa3dfc90629b41953b999cb1e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Aug 19 23:19:01 2015 +0000
+
+ upstream commit
+
+ fix double-free() in error path of DSA key generation
+ reported by Mateusz Kocielski; ok markus@
+
+ Upstream-ID: 4735d8f888b10599a935fa1b374787089116713c
+
+commit 45b0eb752c94954a6de046bfaaf129e518ad4b5b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Aug 19 23:18:26 2015 +0000
+
+ upstream commit
+
+ fix free() of uninitialised pointer reported by Mateusz
+ Kocielski; ok markus@
+
+ Upstream-ID: 519552b050618501a06b7b023de5cb104e2c5663
+
+commit c837643b93509a3ef538cb6624b678c5fe32ff79
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Aug 19 23:17:51 2015 +0000
+
+ upstream commit
+
+ fixed unlink([uninitialised memory]) reported by Mateusz
+ Kocielski; ok markus@
+
+ Upstream-ID: 14a0c4e7d891f5a8dabc4b89d4f6b7c0d5a20109
+
+commit 1f8d3d629cd553031021068eb9c646a5f1e50994
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Fri Aug 14 15:32:41 2015 +0000
+
+ upstream commit
+
+ match myproposal.h order; from brian conway (i snuck in a
+ tweak while here)
+
+ ok dtucker
+
+ Upstream-ID: 35174a19b5237ea36aa3798f042bf5933b772c67
+
+commit 1dc8d93ce69d6565747eb44446ed117187621b26
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Thu Aug 6 14:53:21 2015 +0000
+
+ upstream commit
+
+ add prohibit-password as a synonymn for without-password,
+ since the without-password is causing too many questions. Harden it to ban
+ all but pubkey, hostbased, and GSSAPI auth (when the latter is enabled) from
+ djm, ok markus
+
+ Upstream-ID: d53317d7b28942153e6236d3fd6e12ceb482db7a
+
+commit 90a95a4745a531b62b81ce3b025e892bdc434de5
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 11 13:53:41 2015 +1000
+
+ update version in README
+
+commit 318c37743534b58124f1bab37a8a0087a3a9bd2f
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 11 13:53:09 2015 +1000
+
+ update versions in *.spec
+
+commit 5e75f5198769056089fb06c4d738ab0e5abc66f7
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 11 13:34:12 2015 +1000
+
+ set sshpam_ctxt to NULL after free
+
+ Avoids use-after-free in monitor when privsep child is compromised.
+ Reported by Moritz Jodeit; ok dtucker@
+
+commit d4697fe9a28dab7255c60433e4dd23cf7fce8a8b
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 11 13:33:24 2015 +1000
+
+ Don't resend username to PAM; it already has it.
+
+ Pointed out by Moritz Jodeit; ok dtucker@
+
+commit 88763a6c893bf3dfe951ba9271bf09715e8d91ca
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Jul 27 12:14:25 2015 +1000
+
+ Import updated moduli file from OpenBSD.
+
+commit 55b263fb7cfeacb81aaf1c2036e0394c881637da
+Author: Damien Miller <djm at mindrot.org>
+Date: Mon Aug 10 11:13:44 2015 +1000
+
+ let principals-command.sh work for noexec /var/run
+
+commit 2651e34cd11b1aac3a0fe23b86d8c2ff35c07897
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Aug 6 11:43:42 2015 +1000
+
+ work around echo -n / sed behaviour in tests
+
+commit d85dad81778c1aa8106acd46930b25fdf0d15b2a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Aug 5 05:27:33 2015 +0000
+
+ upstream commit
+
+ adjust for RSA minimum modulus switch; ok deraadt@
+
+ Upstream-Regress-ID: 5a72c83431b96224d583c573ca281cd3a3ebfdae
+
+commit 57e8e229bad5fe6056b5f1199665f5f7008192c6
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Aug 4 05:23:06 2015 +0000
+
+ upstream commit
+
+ backout SSH_RSA_MINIMUM_MODULUS_SIZE increase for this
+ release; problems spotted by sthen@ ok deraadt@ markus@
+
+ Upstream-ID: d0bd60dde9e8c3cd7030007680371894c1499822
+
+commit f097d0ea1e0889ca0fa2e53a00214e43ab7fa22a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Aug 2 09:56:42 2015 +0000
+
+ upstream commit
+
+ openssh 7.0; ok deraadt@
+
+ Upstream-ID: c63afdef537f57f28ae84145c5a8e29e9250221f
+
+commit 3d5728a0f6874ce4efb16913a12963595070f3a9
+Author: chris at openbsd.org <chris at openbsd.org>
+Date: Fri Jul 31 15:38:09 2015 +0000
+
+ upstream commit
+
+ Allow PermitRootLogin to be overridden by config
+
+ ok markus@ deeradt@
+
+ Upstream-ID: 5cf3e26ed702888de84e2dc9d0054ccf4d9125b4
+
+commit 6f941396b6835ad18018845f515b0c4fe20be21a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jul 30 23:09:15 2015 +0000
+
+ upstream commit
+
+ fix pty permissions; patch from Nikolay Edigaryev; ok
+ deraadt
+
+ Upstream-ID: 40ff076d2878b916fbfd8e4f45dbe5bec019e550
+
+commit f4373ed1e8fbc7c8ce3fc4ea97d0ba2e0c1d7ef0
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Thu Jul 30 19:23:02 2015 +0000
+
+ upstream commit
+
+ change default: PermitRootLogin without-password matching
+ install script changes coming as well ok djm markus
+
+ Upstream-ID: 0e2a6c4441daf5498b47a61767382bead5eb8ea6
+
+commit 0c30ba91f87fcda7e975e6ff8a057f624e87ea1c
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jul 30 12:31:39 2015 +1000
+
+ downgrade OOM adjustment logging: verbose -> debug
+
+commit f9eca249d4961f28ae4b09186d7dc91de74b5895
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jul 30 00:01:34 2015 +0000
+
+ upstream commit
+
+ Allow ssh_config and sshd_config kex parameters options be
+ prefixed by a '+' to indicate that the specified items be appended to the
+ default rather than replacing it.
+
+ approach suggested by dtucker@, feedback dlg@, ok markus@
+
+ Upstream-ID: 0f901137298fc17095d5756ff1561a7028e8882a
+
+commit 5cefe769105a2a2e3ca7479d28d9a325d5ef0163
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 29 08:34:54 2015 +0000
+
+ upstream commit
+
+ fix bug in previous; was printing incorrect string for
+ failed host key algorithms negotiation
+
+ Upstream-ID: 22c0dc6bc61930513065d92e11f0753adc4c6e6e
+
+commit f319912b0d0e1675b8bb051ed8213792c788bcb2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 29 04:43:06 2015 +0000
+
+ upstream commit
+
+ include the peer's offer when logging a failure to
+ negotiate a mutual set of algorithms (kex, pubkey, ciphers, etc.) ok markus@
+
+ Upstream-ID: bbb8caabf5c01790bb845f5ce135565248d7c796
+
+commit b6ea0e573042eb85d84defb19227c89eb74cf05a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jul 28 23:20:42 2015 +0000
+
+ upstream commit
+
+ add Cisco to the list of clients that choke on the
+ hostkeys update extension. Pointed out by Howard Kash
+
+ Upstream-ID: c9eadde28ecec056c73d09ee10ba4570dfba7e84
+
+commit 3f628c7b537291c1019ce86af90756fb4e66d0fd
+Author: guenther at openbsd.org <guenther at openbsd.org>
+Date: Mon Jul 27 16:29:23 2015 +0000
+
+ upstream commit
+
+ Permit kbind(2) use in the sandbox now, to ease testing
+ of ld.so work using it
+
+ reminded by miod@, ok deraadt@
+
+ Upstream-ID: 523922e4d1ba7a091e3824e77a8a3c818ee97413
+
+commit ebe27ebe520098bbc0fe58945a87ce8490121edb
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Mon Jul 20 18:44:12 2015 +0000
+
+ upstream commit
+
+ Move .Pp before .Bl, not after to quiet mandoc -Tlint.
+ Noticed by jmc@
+
+ Upstream-ID: 59fadbf8407cec4e6931e50c53cfa0214a848e23
+
+commit d5d91d0da819611167782c66ab629159169d94d4
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Mon Jul 20 18:42:35 2015 +0000
+
+ upstream commit
+
+ Sync usage with SYNOPSIS
+
+ Upstream-ID: 7a321a170181a54f6450deabaccb6ef60cf3f0b7
+
+commit 79ec2142fbc68dd2ed9688608da355fc0b1ed743
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Mon Jul 20 15:39:52 2015 +0000
+
+ upstream commit
+
+ Better desciption of Unix domain socket forwarding.
+ bz#2423; ok jmc@
+
+ Upstream-ID: 85e28874726897e3f26ae50dfa2e8d2de683805d
+
+commit d56fd1828074a4031b18b8faa0bf949669eb18a0
+Author: Damien Miller <djm at mindrot.org>
+Date: Mon Jul 20 11:19:51 2015 +1000
+
+ make realpath.c compile -Wsign-compare clean
+
+commit c63c9a691dca26bb7648827f5a13668832948929
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jul 20 00:30:01 2015 +0000
+
+ upstream commit
+
+ mention that the default of UseDNS=no implies that
+ hostnames cannot be used for host matching in sshd_config and
+ authorized_keys; bz#2045, ok dtucker@
+
+ Upstream-ID: 0812705d5f2dfa59aab01f2764ee800b1741c4e1
+
+commit 63ebcd0005e9894fcd6871b7b80aeea1fec0ff76
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Jul 18 08:02:17 2015 +0000
+
+ upstream commit
+
+ don't ignore PKCS#11 hosted keys that return empty
+ CKA_ID; patch by Jakub Jelen via bz#2429; ok markus
+
+ Upstream-ID: 2f7c94744eb0342f8ee8bf97b2351d4e00116485
+
+commit b15fd989c8c62074397160147a8d5bc34b3f3c63
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Jul 18 08:00:21 2015 +0000
+
+ upstream commit
+
+ skip uninitialised PKCS#11 slots; patch from Jakub Jelen
+ in bz#2427 ok markus@
+
+ Upstream-ID: 744c1e7796e237ad32992d0d02148e8a18f27d29
+
+commit 5b64f85bb811246c59ebab70aed331f26ba37b18
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Jul 18 07:57:14 2015 +0000
+
+ upstream commit
+
+ only query each keyboard-interactive device once per
+ authentication request regardless of how many times it is listed; ok markus@
+
+ Upstream-ID: d73fafba6e86030436ff673656ec1f33d9ffeda1
+
+commit cd7324d0667794eb5c236d8a4e0f236251babc2d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 17 03:34:27 2015 +0000
+
+ upstream commit
+
+ remove -u flag to diff (only used for error output) to make
+ things easier for -portable
+
+ Upstream-Regress-ID: a5d6777d2909540d87afec3039d9bb2414ade548
+
+commit deb8d99ecba70b67f4af7880b11ca8768df9ec3a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 17 03:09:19 2015 +0000
+
+ upstream commit
+
+ direct-streamlocal at openssh.com Unix domain foward
+ messages do not contain a "reserved for future use" field and in fact,
+ serverloop.c checks that there isn't one. Remove erroneous mention from
+ PROTOCOL description. bz#2421 from Daniel Black
+
+ Upstream-ID: 3d51a19e64f72f764682f1b08f35a8aa810a43ac
+
+commit 356b61f365405b5257f5b2ab446e5d7bd33a7b52
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 17 03:04:27 2015 +0000
+
+ upstream commit
+
+ describe magic for setting up Unix domain socket fowards
+ via the mux channel; bz#2422 patch from Daniel Black
+
+ Upstream-ID: 943080fe3864715c423bdeb7c920bb30c4eee861
+
+commit d3e2aee41487d55b8d7d40f538b84ff1db7989bc
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Jul 17 12:52:34 2015 +1000
+
+ Check if realpath works on nonexistent files.
+
+ On some platforms the native realpath doesn't work with non-existent
+ files (this is actually specified in some versions of POSIX), however
+ the sftp spec says its realpath with "canonicalize any given path name".
+ On those platforms, use realpath from the compat library.
+
+ In addition, when compiling with -DFORTIFY_SOURCE, glibc redefines
+ the realpath symbol to the checked version, so redefine ours to
+ something else so we pick up the compat version we want.
+
+ bz#2428, ok djm@
+
+commit 25b14610dab655646a109db5ef8cb4c4bf2a48a0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 17 02:47:45 2015 +0000
+
+ upstream commit
+
+ fix incorrect test for SSH1 keys when compiled without SSH1
+ support
+
+ Upstream-ID: 6004d720345b8e481c405e8ad05ce2271726e451
+
+commit df56a8035d429b2184ee94aaa7e580c1ff67f73a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 15 08:00:11 2015 +0000
+
+ upstream commit
+
+ fix NULL-deref when SSH1 reenabled
+
+ Upstream-ID: f22fd805288c92b3e9646782d15b48894b2d5295
+
+commit 41e38c4d49dd60908484e6703316651333f16b93
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 15 07:19:50 2015 +0000
+
+ upstream commit
+
+ regen RSA1 test keys; the last batch was missing their
+ private parts
+
+ Upstream-Regress-ID: 7ccf437305dd63ff0b48dd50c5fd0f4d4230c10a
+
+commit 5bf0933184cb622ca3f96d224bf3299fd2285acc
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Fri Jul 10 06:23:25 2015 +0000
+
+ upstream commit
+
+ Adapt tests, now that DSA if off by default; use
+ PubkeyAcceptedKeyTypes and PubkeyAcceptedKeyTypes to test DSA.
+
+ Upstream-Regress-ID: 0ff2a3ff5ac1ce5f92321d27aa07b98656efcc5c
+
+commit 7a6e3fd7b41dbd3756b6bf9acd67954c0b1564cc
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Jul 7 14:54:16 2015 +0000
+
+ upstream commit
+
+ regen test data after mktestdata.sh changes
+
+ Upstream-Regress-ID: 3495ecb082b9a7c048a2d7c5c845d3bf181d25a4
+
+commit 7c8c174c69f681d4910fa41c37646763692b28e2
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Jul 7 14:53:30 2015 +0000
+
+ upstream commit
+
+ adapt tests to new minimum RSA size and default FP format
+
+ Upstream-Regress-ID: a4b30afd174ce82b96df14eb49fb0b81398ffd0e
+
+commit 6a977a4b68747ade189e43d302f33403fd4a47ac
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 3 04:39:23 2015 +0000
+
+ upstream commit
+
+ legacy v00 certificates are gone; adapt and don't try to
+ test them; "sure" markus@ dtucker@
+
+ Upstream-Regress-ID: c57321e69b3cd4a3b3396dfcc43f0803d047da12
+
+commit 0c4123ad5e93fb90fee9c6635b13a6cdabaac385
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 1 23:11:18 2015 +0000
+
+ upstream commit
+
+ don't expect SSH v.1 in unittests
+
+ Upstream-Regress-ID: f8812b16668ba78e6a698646b2a652b90b653397
+
+commit 3c099845798a817cdde513c39074ec2063781f18
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jun 15 06:38:50 2015 +0000
+
+ upstream commit
+
+ turn SSH1 back on to match src/usr.bin/ssh being tested
+
+ Upstream-Regress-ID: 6c4f763a2f0cc6893bf33983919e9030ae638333
+
+commit b1dc2b33689668c75e95f873a42d5aea1f4af1db
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Mon Jul 13 04:57:14 2015 +0000
+
+ upstream commit
+
+ Add "PuTTY_Local:" to the clients to which we do not
+ offer DH-GEX. This was the string that was used for development versions
+ prior to September 2014 and they don't do RFC4419 DH-GEX, but unfortunately
+ there are some extant products based on those versions. bx2424 from Jay
+ Rouman, ok markus@ djm@
+
+ Upstream-ID: be34d41e18b966832fe09ca243d275b81882e1d5
+
+commit 3a1638dda19bbc73d0ae02b4c251ce08e564b4b9
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Fri Jul 10 06:21:53 2015 +0000
+
+ upstream commit
+
+ Turn off DSA by default; add HostKeyAlgorithms to the
+ server and PubkeyAcceptedKeyTypes to the client side, so it still can be
+ tested or turned back on; feedback and ok djm@
+
+ Upstream-ID: 8450a9e6d83f80c9bfed864ff061dfc9323cec21
+
+commit 16db0a7ee9a87945cc594d13863cfcb86038db59
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Thu Jul 9 09:49:46 2015 +0000
+
+ upstream commit
+
+ re-enable ed25519-certs if compiled w/o openssl; ok djm
+
+ Upstream-ID: e10c90808b001fd2c7a93778418e9b318f5c4c49
+
+commit c355bf306ac33de6545ce9dac22b84a194601e2f
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jul 8 20:24:02 2015 +0000
+
+ upstream commit
+
+ no need to include the old buffer/key API
+
+ Upstream-ID: fb13c9f7c0bba2545f3eb0a0e69cb0030819f52b
+
+commit a3cc48cdf9853f1e832d78cb29bedfab7adce1ee
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jul 8 19:09:25 2015 +0000
+
+ upstream commit
+
+ typedefs for Cipher&CipherContext are unused
+
+ Upstream-ID: 50e6a18ee92221d23ad173a96d5b6c42207cf9a7
+
+commit a635bd06b5c427a57c3ae760d3a2730bb2c863c0
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jul 8 19:04:21 2015 +0000
+
+ upstream commit
+
+ xmalloc.h is unused
+
+ Upstream-ID: afb532355b7fa7135a60d944ca1e644d1d63cb58
+
+commit 2521cf0e36c7f3f6b19f206da0af134f535e4a31
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jul 8 19:01:15 2015 +0000
+
+ upstream commit
+
+ compress.c is gone
+
+ Upstream-ID: 174fa7faa9b9643cba06164b5e498591356fbced
+
+commit c65a7aa6c43aa7a308ee1ab8a96f216169ae9615
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 3 04:05:54 2015 +0000
+
+ upstream commit
+
+ another SSH_RSA_MINIMUM_MODULUS_SIZE that needed
+ cranking
+
+ Upstream-ID: 9d8826cafe96aab4ae8e2f6fd22800874b7ffef1
+
+commit b1f383da5cd3cb921fc7776f17a14f44b8a31757
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 3 03:56:25 2015 +0000
+
+ upstream commit
+
+ add an XXX reminder for getting correct key paths from
+ sshd_config
+
+ Upstream-ID: feae52b209d7782ad742df04a4260e9fe41741db
+
+commit 933935ce8d093996c34d7efa4d59113163080680
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 3 03:49:45 2015 +0000
+
+ upstream commit
+
+ refuse to generate or accept RSA keys smaller than 1024
+ bits; feedback and ok dtucker@
+
+ Upstream-ID: 7ea3d31271366ba264f06e34a3539bf1ac30f0ba
+
+commit bdfd29f60b74f3e678297269dc6247a5699583c1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 3 03:47:00 2015 +0000
+
+ upstream commit
+
+ turn off 1024 bit diffie-hellman-group1-sha1 key
+ exchange method (already off in server, this turns it off in the client by
+ default too) ok dtucker@
+
+ Upstream-ID: f59b88f449210ab7acf7d9d88f20f1daee97a4fa
+
+commit c28fc62d789d860c75e23a9fa9fb250eb2beca57
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jul 3 03:43:18 2015 +0000
+
+ upstream commit
+
+ delete support for legacy v00 certificates; "sure"
+ markus@ dtucker@
+
+ Upstream-ID: b5b9bb5f9202d09e88f912989d74928601b6636f
+
+commit 564d63e1b4a9637a209d42a9d49646781fc9caef
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 1 23:10:47 2015 +0000
+
+ upstream commit
+
+ Compile-time disable SSH v.1 again
+
+ Upstream-ID: 1d4b513a3a06232f02650b73bad25100d1b800af
+
+commit 868109b650504dd9bcccdb1f51d0906f967c20ff
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 1 02:39:06 2015 +0000
+
+ upstream commit
+
+ twiddle PermitRootLogin back
+
+ Upstream-ID: 2bd23976305d0512e9f84d054e1fc23cd70b89f2
+
+commit 7de4b03a6e4071d454b72927ffaf52949fa34545
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 1 02:32:17 2015 +0000
+
+ upstream commit
+
+ twiddle; (this commit marks the openssh-6.9 release)
+
+ Upstream-ID: 78500582819f61dd8adee36ec5cc9b9ac9351234
+
+commit 1bf477d3cdf1a864646d59820878783d42357a1d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 1 02:26:31 2015 +0000
+
+ upstream commit
+
+ better refuse ForwardX11Trusted=no connections attempted
+ after ForwardX11Timeout expires; reported by Jann Horn
+
+ Upstream-ID: bf0fddadc1b46a0334e26c080038313b4b6dea21
+
+commit 47aa7a0f8551b471fcae0447c1d78464f6dba869
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 1 01:56:13 2015 +0000
+
+ upstream commit
+
+ put back default PermitRootLogin=no
+
+ Upstream-ID: 7bdedd5cead99c57ed5571f3b6b7840922d5f728
+
+commit 984b064fe2a23733733262f88d2e1b2a1a501662
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 1 01:55:13 2015 +0000
+
+ upstream commit
+
+ openssh-6.9
+
+ Upstream-ID: 6cfe8e1904812531080e6ab6e752d7001b5b2d45
+
+commit d921082ed670f516652eeba50705e1e9f6325346
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jul 1 01:55:00 2015 +0000
+
+ upstream commit
+
+ reset default PermitRootLogin to 'yes' (momentarily, for
+ release)
+
+ Upstream-ID: cad8513527066e65dd7a1c16363d6903e8cefa24
+
+commit 66295e0e1ba860e527f191b6325d2d77dec4dbce
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jul 1 11:49:12 2015 +1000
+
+ crank version numbers for release
+
+commit 37035c07d4f26bb1fbe000d2acf78efdb008681d
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jul 1 10:49:37 2015 +1000
+
+ s/--with-ssh1/--without-ssh1/
+
+commit 629df770dbadc2accfbe1c81b3f31f876d0acd84
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jun 30 05:25:07 2015 +0000
+
+ upstream commit
+
+ fatal() when a remote window update causes the window
+ value to overflow. Reported by Georg Wicherski, ok markus@
+
+ Upstream-ID: ead397a9aceb3bf74ebfa5fcaf259d72e569f351
+
+commit f715afebe735d61df3fd30ad72d9ac1c8bd3b5f2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jun 30 05:23:25 2015 +0000
+
+ upstream commit
+
+ Fix math error in remote window calculations that causes
+ eventual stalls for datagram channels. Reported by Georg Wicherski, ok
+ markus@
+
+ Upstream-ID: be54059d11bf64e0d85061f7257f53067842e2ab
+
+commit 52fb6b9b034fcfd24bf88cc7be313e9c31de9889
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Jun 30 16:05:40 2015 +1000
+
+ skip IPv6-related portions on hosts without IPv6
+
+ with Tim Rice
+
+commit 512caddf590857af6aa12218461b5c0441028cf5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jun 29 22:35:12 2015 +0000
+
+ upstream commit
+
+ add getpid to sandbox, reachable by grace_alarm_handler
+
+ reported by Jakub Jelen; bz#2419
+
+ Upstream-ID: d0da1117c16d4c223954995d35b0f47c8f684cd8
+
+commit 78c2a4f883ea9aba866358e2acd9793a7f42ca93
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jun 26 05:13:20 2015 +0000
+
+ upstream commit
+
+ Fix \-escaping bug that caused forward path parsing to skip
+ two characters and skip past the end of the string.
+
+ Based on patch by Salvador Fandino; ok dtucker@
+
+ Upstream-ID: 7b879dc446335677cbe4cb549495636a0535f3bd
+
+commit bc20205c91c9920361d12b15d253d4997dba494a
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jun 25 09:51:39 2015 +1000
+
+ add missing pselect6
+
+ patch from Jakub Jelen
+
+commit 9d27fb73b4a4e5e99cb880af790d5b1ce44f720a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jun 24 23:47:23 2015 +0000
+
+ upstream commit
+
+ correct test to sshkey_sign(); spotted by Albert S.
+
+ Upstream-ID: 5f7347f40f0ca6abdaca2edb3bd62f4776518933
+
+commit 7ed01a96a1911d8b4a9ef4f3d064e1923bfad7e3
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Jun 24 01:49:19 2015 +0000
+
+ upstream commit
+
+ Revert previous commit. We still want to call setgroups
+ in the case where there are zero groups to remove any that we might otherwise
+ inherit (as pointed out by grawity at gmail.com) and since the 2nd argument
+ to setgroups is always a static global it's always valid to dereference in
+ this case. ok deraadt@ djm@
+
+ Upstream-ID: 895b5ac560a10befc6b82afa778641315725fd01
+
+commit 882f8bf94f79528caa65b0ba71c185d705bb7195
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Jun 24 01:49:19 2015 +0000
+
+ upstream commit
+
+ Revert previous commit. We still want to call setgroups in
+ the case where there are zero groups to remove any that we might otherwise
+ inherit (as pointed out by grawity at gmail.com) and since the 2nd argument
+ to setgroups is always a static global it's always valid to dereference in
+ this case. ok deraadt@ djm@
+
+ Upstream-ID: 895b5ac560a10befc6b82afa778641315725fd01
+
+commit 9488538a726951e82b3a4374f3c558d72c80a89b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jun 22 23:42:16 2015 +0000
+
+ upstream commit
+
+ Don't count successful partial authentication as failures
+ in monitor; this may have caused the monitor to refuse multiple
+ authentications that would otherwise have successfully completed; ok markus@
+
+ Upstream-ID: eb74b8e506714d0f649bd5c300f762a527af04a3
+
+commit 63b78d003bd8ca111a736e6cea6333da50f5f09b
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Mon Jun 22 12:29:57 2015 +0000
+
+ upstream commit
+
+ Don't call setgroups if we have zero groups; there's no
+ guarantee that it won't try to deref the pointer. Based on a patch from mail
+ at quitesimple.org, ok djm deraadt
+
+ Upstream-ID: 2fff85e11d7a9a387ef7fddf41fbfaf566708ab1
+
+commit 5c15e22c691c79a47747bcf5490126656f97cecd
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jun 18 15:07:56 2015 +1000
+
+ fix syntax error
+
+commit 596dbca82f3f567fb3d2d69af4b4e1d3ba1e6403
+Author: jsing at openbsd.org <jsing at openbsd.org>
+Date: Mon Jun 15 18:44:22 2015 +0000
+
+ upstream commit
+
+ If AuthorizedPrincipalsCommand is specified, however
+ AuthorizedPrincipalsFile is not (or is set to "none"), authentication will
+ potentially fail due to key_cert_check_authority() failing to locate a
+ principal that matches the username, even though an authorized principal has
+ already been matched in the output of the subprocess. Fix this by using the
+ same logic to determine if pw->pw_name should be passed, as is used to
+ determine if a authorized principal must be matched earlier on.
+
+ ok djm@
+
+ Upstream-ID: 43b42302ec846b0ea68aceb40677245391b9409d
+
+commit aff3e94c0d75d0d0fa84ea392b50ab04f8c57905
+Author: jsing at openbsd.org <jsing at openbsd.org>
+Date: Mon Jun 15 18:42:19 2015 +0000
+
+ upstream commit
+
+ Make the arguments to match_principals_command() similar
+ to match_principals_file(), by changing the last argument a struct
+ sshkey_cert * and dereferencing key->cert in the caller.
+
+ No functional change.
+
+ ok djm@
+
+ Upstream-ID: 533f99b844b21b47342b32b62e198dfffcf8651c
+
+commit 97e2e1596c202a4693468378b16b2353fd2d6c5e
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jun 17 14:36:54 2015 +1000
+
+ trivial optimisation for seccomp-bpf
+
+ When doing arg inspection and the syscall doesn't match, skip
+ past the instruction that reloads the syscall into the accumulator,
+ since the accumulator hasn't been modified at this point.
+
+commit 99f33d7304893bd9fa04d227cb6e870171cded19
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jun 17 10:50:51 2015 +1000
+
+ aarch64 support for seccomp-bpf sandbox
+
+ Also resort and tidy syscall list. Based on patches by Jakub Jelen
+ bz#2361; ok dtucker@
+
+commit 4ef702e1244633c1025ec7cfe044b9ab267097bf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jun 15 01:32:50 2015 +0000
+
+ upstream commit
+
+ return failure on RSA signature error; reported by Albert S
+
+ Upstream-ID: e61bb93dbe0349625807b0810bc213a6822121fa
+
+commit a170f22baf18af0b1acf2788b8b715605f41a1f9
+Author: Tim Rice <tim at multitalents.net>
+Date: Tue Jun 9 22:41:13 2015 -0700
+
+ Fix t12 rules for out of tree builds.
+
+commit ec04dc4a5515c913121bc04ed261857e68fa5c18
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Fri Jun 5 15:13:13 2015 +0000
+
+ upstream commit
+
+ For "ssh -L 12345:/tmp/sock" don't fail with "No forward host
+ name." (we have a path, not a host name). Based on a diff from Jared
+ Yanovich. OK djm@
+
+ Upstream-ID: 2846b0a8c7de037e33657f95afbd282837fc213f
+
+commit 732d61f417a6aea0aa5308b59cb0f563bcd6edd6
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jun 5 03:44:14 2015 +0000
+
+ upstream commit
+
+ typo: accidental repetition; bz#2386
+
+ Upstream-ID: 45e620d99f6bc301e5949d34a54027374991c88b
+
+commit adfb24c69d1b6f5e758db200866c711e25a2ba73
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Jun 5 14:51:40 2015 +1000
+
+ Add Linux powerpc64le and powerpcle entries.
+
+ Stopgap to resolve bz#2409 because we are so close to release and will
+ update config.guess and friends shortly after the release. ok djm@
+
+commit a1195a0fdc9eddddb04d3e9e44c4775431cb77da
+Merge: 6397eed d2480bc
+Author: Tim Rice <tim at multitalents.net>
+Date: Wed Jun 3 21:43:13 2015 -0700
+
+ Merge branch 'master' of git.mindrot.org:/var/git/openssh
+
+commit 6397eedf953b2b973d2d7cbb504ab501a07f8ddc
+Author: Tim Rice <tim at multitalents.net>
+Date: Wed Jun 3 21:41:11 2015 -0700
+
+ Remove unneeded backslashes. Patch from Ángel González
+
+commit d2480bcac1caf31b03068de877a47d6e1027bf6d
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Jun 4 14:10:55 2015 +1000
+
+ Remove redundant include of stdarg.h. bz#2410
+
+commit 5e67859a623826ccdf2df284cbb37e2d8e2787eb
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jun 2 09:10:40 2015 +0000
+
+ upstream commit
+
+ mention CheckHostIP adding addresses to known_hosts;
+ bz#1993; ok dtucker@
+
+ Upstream-ID: fd44b68440fd0dc29abf9f2d3f703d74a2396cb7
+
+commit d7a58bbac6583e33fd5eca8e2c2cc70c57617818
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Jun 2 20:15:26 2015 +1000
+
+ Replace strcpy with strlcpy.
+
+ ok djm, sanity check by Corinna Vinschen.
+
+commit 51a1c2115265c6e80ede8a5c9dccada9aeed7143
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri May 29 18:27:21 2015 +1000
+
+ skip, rather than fatal when run without SUDO set
+
+commit 599f01142a376645b15cbc9349d7e8975e1cf245
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri May 29 18:03:15 2015 +1000
+
+ fix merge botch that left ",," in KEX algs
+
+commit 0c2a81dfc21822f2423edd30751e5ec53467b347
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri May 29 17:08:28 2015 +1000
+
+ re-enable SSH protocol 1 at compile time
+
+commit db438f9285d64282d3ac9e8c0944f59f037c0151
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 29 03:05:13 2015 +0000
+
+ upstream commit
+
+ make this work without SUDO set; ok dtucker@
+
+ Upstream-Regress-ID: bca88217b70bce2fe52b23b8e06bdeb82d98c715
+
+commit 1d9a2e2849c9864fe75daabf433436341c968e14
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 28 07:37:31 2015 +0000
+
+ upstream commit
+
+ wrap all moduli-related code in #ifdef WITH_OPENSSL.
+ based on patch from Reuben Hawkins; bz#2388 feedback and ok dtucker@
+
+ Upstream-ID: d80cfc8be3e6ec65b3fac9e87c4466533b31b7cf
+
+commit 496aeb25bc2d6c434171292e4714771b594bd00e
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu May 28 05:41:29 2015 +0000
+
+ upstream commit
+
+ Increase the allowed length of the known host file name
+ in the log message to be consistent with other cases. Part of bz#1993, ok
+ deraadt.
+
+ Upstream-ID: a9e97567be49f25daf286721450968251ff78397
+
+commit dd2cfeb586c646ff8d70eb93567b2e559ace5b14
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu May 28 05:09:45 2015 +0000
+
+ upstream commit
+
+ Fix typo (keywork->keyword)
+
+ Upstream-ID: 8aacd0f4089c0a244cf43417f4f9045dfaeab534
+
+commit 9cc6842493fbf23025ccc1edab064869640d3bec
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 28 04:50:53 2015 +0000
+
+ upstream commit
+
+ add error message on ftruncate failure; bz#2176
+
+ Upstream-ID: cbcc606e0b748520c74a210d8f3cc9718d3148cf
+
+commit d1958793a0072c22be26d136dbda5ae263e717a0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 28 04:40:13 2015 +0000
+
+ upstream commit
+
+ make ssh-keygen default to ed25519 keys when compiled
+ without OpenSSL; bz#2388, ok dtucker@
+
+ Upstream-ID: 85a471fa6d3fa57a7b8e882d22cfbfc1d84cdc71
+
+commit 3ecde664c9fc5fb3667aedf9e6671462600f6496
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed May 27 23:51:10 2015 +0000
+
+ upstream commit
+
+ Reorder client proposal to prefer
+ diffie-hellman-group-exchange-sha1 over diffie-hellman-group14-sha1. ok djm@
+
+ Upstream-ID: 552c08d47347c3ee1a9a57d88441ab50abe17058
+
+commit 40f64292b907afd0a674fdbf3e4c2356d17a7d68
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed May 27 23:39:18 2015 +0000
+
+ upstream commit
+
+ Add a stronger (4k bit) fallback group that sshd can use
+ when the moduli file is missing or broken, sourced from RFC3526. bz#2302, ok
+ markus@ (earlier version), djm@
+
+ Upstream-ID: b635215746a25a829d117673d5e5a76d4baee7f4
+
+commit 5ab7d5fa03ad55bc438fab45dfb3aeb30a3c237a
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu May 28 10:03:40 2015 +1000
+
+ New moduli file from OpenBSD, removing 1k groups.
+
+ Remove 1k bit groups. ok deraadt@, markus@
+
+commit a71ba58adf34e599f30cdda6e9b93ae6e3937eea
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed May 27 05:15:02 2015 +0000
+
+ upstream commit
+
+ support PKCS#11 devices with external PIN entry devices
+ bz#2240, based on patch from Dirk-Willem van Gulik; feedback and ok dtucker@
+
+ Upstream-ID: 504568992b55a8fc984375242b1bd505ced61b0d
+
+commit b282fec1aa05246ed3482270eb70fc3ec5f39a00
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue May 26 23:23:40 2015 +0000
+
+ upstream commit
+
+ Cap DH-GEX group size at 4kbits for Cisco implementations.
+ Some of them will choke when asked for preferred sizes >4k instead of
+ returning the 4k group that they do have. bz#2209, ok djm@
+
+ Upstream-ID: 54b863a19713446b7431f9d06ad0532b4fcfef8d
+
+commit 3e91b4e8b0dc2b4b7e7d42cf6e8994a32e4cb55e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun May 24 23:39:16 2015 +0000
+
+ upstream commit
+
+ add missing 'c' option to getopt(), case statement was
+ already there; from Felix Bolte
+
+ Upstream-ID: 9b19b4e2e0b54d6fefa0dfac707c51cf4bae3081
+
+commit 64a89ec07660abba4d0da7c0095b7371c98bab62
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Sat May 23 14:28:37 2015 +0000
+
+ upstream commit
+
+ fix a memory leak in an error path ok markus@ dtucker@
+
+ Upstream-ID: bc1da0f205494944918533d8780fde65dff6c598
+
+commit f948737449257d2cb83ffcfe7275eb79b677fd4a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 22 05:28:45 2015 +0000
+
+ upstream commit
+
+ mention ssh-keygen -E for comparing legacy MD5
+ fingerprints; bz#2332
+
+ Upstream-ID: 079a3669549041dbf10dbc072d9563f0dc3b2859
+
+commit 0882332616e4f0272c31cc47bf2018f9cb258a4e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 22 04:45:52 2015 +0000
+
+ upstream commit
+
+ Reorder EscapeChar option parsing to avoid a single-byte
+ out- of-bounds read. bz#2396 from Jaak Ristioja; ok dtucker@
+
+ Upstream-ID: 1dc6b5b63d1c8d9a88619da0b27ade461d79b060
+
+commit d7c31da4d42c115843edee2074d7d501f8804420
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 22 03:50:02 2015 +0000
+
+ upstream commit
+
+ add knob to relax GSSAPI host credential check for
+ multihomed hosts bz#928, patch by Simon Wilkinson; ok dtucker
+ (kerberos/GSSAPI is not compiled by default on OpenBSD)
+
+ Upstream-ID: 15ddf1c6f7fd9d98eea9962f480079ae3637285d
+
+commit aa72196a00be6e0b666215edcffbc10af234cb0e
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri May 22 17:49:46 2015 +1000
+
+ Include signal.h for sig_atomic_t, used by kex.h.
+
+ bz#2402, from tomas.kuthan at oracle com.
+
+commit 8b02481143d75e91c49d1bfae0876ac1fbf9511a
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri May 22 12:47:24 2015 +1000
+
+ Import updated moduli file from OpenBSD.
+
+commit 4739e8d5e1c0be49624082bd9f6b077e9e758db9
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 21 12:01:19 2015 +0000
+
+ upstream commit
+
+ Support "ssh-keygen -lF hostname" to find search known_hosts
+ and print key hashes. Already advertised by ssh-keygen(1), but not delivered
+ by code; ok dtucker@
+
+ Upstream-ID: 459e0e2bf39825e41b0811c336db2d56a1c23387
+
+commit e97201feca10b5196da35819ae516d0b87cf3a50
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu May 21 17:55:15 2015 +1000
+
+ conditionalise util.h inclusion
+
+commit 13640798c7dd011ece0a7d02841fe48e94cfa0e0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 21 06:44:25 2015 +0000
+
+ upstream commit
+
+ regress test for AuthorizedPrincipalsCommand
+
+ Upstream-Regress-ID: c658fbf1ab6b6011dc83b73402322e396f1e1219
+
+commit 84452c5d03c21f9bfb28c234e0dc1dc67dd817b1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 21 06:40:02 2015 +0000
+
+ upstream commit
+
+ regress test for AuthorizedKeysCommand arguments
+
+ Upstream-Regress-ID: bbd65c13c6b3be9a442ec115800bff9625898f12
+
+commit bcc50d816187fa9a03907ac1f3a52f04a52e10d1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 21 06:43:30 2015 +0000
+
+ upstream commit
+
+ add AuthorizedPrincipalsCommand that allows getting
+ authorized_principals from a subprocess rather than a file, which is quite
+ useful in deployments with large userbases
+
+ feedback and ok markus@
+
+ Upstream-ID: aa1bdac7b16fc6d2fa3524ef08f04c7258d247f6
+
+commit 24232a3e5ab467678a86aa67968bbb915caffed4
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 21 06:38:35 2015 +0000
+
+ upstream commit
+
+ support arguments to AuthorizedKeysCommand
+
+ bz#2081 loosely based on patch by Sami Hartikainen
+ feedback and ok markus@
+
+ Upstream-ID: b080387a14aa67dddd8ece67c00f268d626541f7
+
+commit d80fbe41a57c72420c87a628444da16d09d66ca7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu May 21 04:55:51 2015 +0000
+
+ upstream commit
+
+ refactor: split base64 encoding of pubkey into its own
+ sshkey_to_base64() function and out of sshkey_write(); ok markus@
+
+ Upstream-ID: 54fc38f5832e9b91028900819bda46c3959a0c1a
+
+commit 7cc44ef74133a473734bbcbd3484f24d6a7328c5
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Mon May 18 15:06:05 2015 +0000
+
+ upstream commit
+
+ getentropy() and sendsyslog() have been around long
+ enough. openssh-portable may want the #ifdef's but not base. discussed with
+ djm few weeks back
+
+ Upstream-ID: 0506a4334de108e3fb6c66f8d6e0f9c112866926
+
+commit 9173d0fbe44de7ebcad8a15618e13a8b8d78902e
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri May 15 05:44:21 2015 +0000
+
+ upstream commit
+
+ Use a salted hash of the lock passphrase instead of plain
+ text and do constant-time comparisons of it. Should prevent leaking any
+ information about it via timing, pointed out by Ryan Castellucci. Add a 0.1s
+ incrementing delay for each failed unlock attempt up to 10s. ok markus@
+ (earlier version), djm@
+
+ Upstream-ID: c599fcc325aa1cc65496b25220b622d22208c85f
+
+commit d028d5d3a697c71b21e4066d8672cacab3caa0a8
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue May 5 19:10:58 2015 +1000
+
+ upstream commit
+
+ - tedu at cvs.openbsd.org 2015/01/12 03:20:04
+ [bcrypt_pbkdf.c]
+ rename blocks to words. bcrypt "blocks" are unrelated to blowfish blocks,
+ nor are they the same size.
+
+commit f6391d4e59b058984163ab28f4e317e7a72478f1
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue May 5 19:10:23 2015 +1000
+
+ upstream commit
+
+ - deraadt at cvs.openbsd.org 2015/01/08 00:30:07
+ [bcrypt_pbkdf.c]
+ declare a local version of MIN(), call it MINIMUM()
+
+commit 8ac6b13cc9113eb47cd9e86c97d7b26b4b71b77f
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue May 5 19:09:46 2015 +1000
+
+ upstream commit
+
+ - djm at cvs.openbsd.org 2014/12/30 01:41:43
+ [bcrypt_pbkdf.c]
+ typo in comment: ouput => output
+
+commit 1f792489d5cf86a4f4e3003e6e9177654033f0f2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon May 4 06:10:48 2015 +0000
+
+ upstream commit
+
+ Remove pattern length argument from match_pattern_list(), we
+ only ever use it for strlen(pattern).
+
+ Prompted by hanno AT hboeck.de pointing an out-of-bound read
+ error caused by an incorrect pattern length found using AFL
+ and his own tools.
+
+ ok markus@
+
+commit 639d6bc57b1942393ed12fb48f00bc05d4e093e4
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 1 07:10:01 2015 +0000
+
+ upstream commit
+
+ refactor ssh_dispatch_run_fatal() to use sshpkt_fatal()
+ to better report error conditions. Teach sshpkt_fatal() about ECONNRESET.
+
+ Improves error messages on TCP connection resets. bz#2257
+
+ ok dtucker@
+
+commit 9559d7de34c572d4d3fd990ca211f8ec99f62c4d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 1 07:08:08 2015 +0000
+
+ upstream commit
+
+ a couple of parse targets were missing activep checks,
+ causing them to be misapplied in match context; bz#2272 diagnosis and
+ original patch from Sami Hartikainen ok dtucker@
+
+commit 7e8528cad04b2775c3b7db08abf8fb42e47e6b2a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 1 04:17:51 2015 +0000
+
+ upstream commit
+
+ make handling of AuthorizedPrincipalsFile=none more
+ consistent with other =none options; bz#2288 from Jakub Jelen; ok dtucker@
+
+commit ca430d4d9cc0f62eca3b1fb1e2928395b7ce80f7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 1 04:03:20 2015 +0000
+
+ upstream commit
+
+ remove failed remote forwards established by muliplexing
+ from the list of active forwards; bz#2363, patch mostly by Yoann Ricordel; ok
+ dtucker@
+
+commit 8312cfb8ad88657517b3e23ac8c56c8e38eb9792
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 1 04:01:58 2015 +0000
+
+ upstream commit
+
+ reduce stderr spam when using ssh -S /path/mux -O forward
+ -R 0:... ok dtucker@
+
+commit 179be0f5e62f1f492462571944e45a3da660d82b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 1 03:23:51 2015 +0000
+
+ upstream commit
+
+ prevent authorized_keys options picked up on public key
+ tests without a corresponding private key authentication being applied to
+ other authentication methods. Reported by halex@, ok markus@
+
+commit a42d67be65b719a430b7fcaba2a4e4118382723a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 1 03:20:54 2015 +0000
+
+ upstream commit
+
+ Don't make parsing of authorized_keys' environment=
+ option conditional on PermitUserEnv - always parse it, but only use the
+ result if the option is enabled. This prevents the syntax of authorized_keys
+ changing depending on which sshd_config options were enabled.
+
+ bz#2329; based on patch from coladict AT gmail.com, ok dtucker@
+
+commit e661a86353e11592c7ed6a847e19a83609f49e77
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon May 4 06:10:48 2015 +0000
+
+ upstream commit
+
+ Remove pattern length argument from match_pattern_list(), we
+ only ever use it for strlen(pattern).
+
+ Prompted by hanno AT hboeck.de pointing an out-of-bound read
+ error caused by an incorrect pattern length found using AFL
+ and his own tools.
+
+ ok markus@
+
+commit 0ef1de742be2ee4b10381193fe90730925b7f027
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Apr 23 05:01:19 2015 +0000
+
+ upstream commit
+
+ Add a simple regression test for sshd's configuration
+ parser. Right now, all it does is run the output of sshd -T back through
+ itself and ensure the output is valid and invariant.
+
+commit 368f83c793275faa2c52f60eaa9bdac155c4254b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Apr 22 01:38:36 2015 +0000
+
+ upstream commit
+
+ use correct key for nested certificate test
+
+commit 8d4d1bfddbbd7d21f545dc6997081d1ea1fbc99a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 1 07:11:47 2015 +0000
+
+ upstream commit
+
+ mention that the user's shell from /etc/passwd is used
+ for commands too; bz#1459 ok dtucker@
+
+commit 5ab283d0016bbc9d4d71e8e5284d011bc5a930cf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 8 07:29:00 2015 +0000
+
+ upstream commit
+
+ whitespace
+
+ Upstream-Regress-ID: 6b708a3e709d5b7fd37890f874bafdff1f597519
+
+commit 8377d5008ad260048192e1e56ad7d15a56d103dd
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 8 07:26:13 2015 +0000
+
+ upstream commit
+
+ whitespace at EOL
+
+ Upstream-Regress-ID: 9c48911643d5b05173b36a012041bed4080b8554
+
+commit c28a3436fa8737709ea88e4437f8f23a6ab50359
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 8 06:45:13 2015 +0000
+
+ upstream commit
+
+ moar whitespace at eol
+
+ Upstream-ID: 64eaf872a3ba52ed41e494287e80d40aaba4b515
+
+commit 2b64c490468fd4ca35ac8d5cc31c0520dc1508bb
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 8 06:41:56 2015 +0000
+
+ upstream commit
+
+ whitespace at EOL
+
+ Upstream-ID: 57bcf67d666c6fc1ad798aee448fdc3f70f7ec2c
+
+commit 4e636cf201ce6e7e3b9088568218f9d4e2c51712
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 8 03:56:51 2015 +0000
+
+ upstream commit
+
+ whitespace at EOL
+
+commit 38b8272f823dc1dd4e29dbcee83943ed48bb12fa
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Mon May 4 01:47:53 2015 +0000
+
+ upstream commit
+
+ Use diff w/out -u for better portability
+
+commit 297060f42d5189a4065ea1b6f0afdf6371fb0507
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri May 8 03:25:07 2015 +0000
+
+ upstream commit
+
+ Use xcalloc for permitted_adm_opens instead of xmalloc to
+ ensure it's zeroed. Fixes post-auth crash with permitopen=none. bz#2355, ok
+ djm@
+
+commit 63ebf019be863b2d90492a85e248cf55a6e87403
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri May 8 03:17:49 2015 +0000
+
+ upstream commit
+
+ don't choke on new-format private keys encrypted with an
+ AEAD cipher; bz#2366, patch from Ron Frederick; ok markus@
+
+commit f8484dac678ab3098ae522a5f03bb2530f822987
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed May 6 05:45:17 2015 +0000
+
+ upstream commit
+
+ Clarify pseudo-terminal request behaviour and use
+ "pseudo-terminal" consistently. bz#1716, ok jmc@ "I like it" deraadt at .
+
+commit ea139507bef8bad26e86ed99a42c7233ad115c38
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed May 6 04:07:18 2015 +0000
+
+ upstream commit
+
+ Blacklist DH-GEX for specific PuTTY versions known to
+ send non-RFC4419 DH-GEX messages rather than all versions of PuTTY.
+ According to Simon Tatham, 0.65 and newer versions will send RFC4419 DH-GEX
+ messages. ok djm@
+
+commit b58234f00ee3872eb84f6e9e572a9a34e902e36e
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue May 5 10:17:49 2015 +0000
+
+ upstream commit
+
+ WinSCP doesn't implement RFC4419 DH-GEX so flag it so we
+ don't offer that KEX method. ok markus@
+
+commit d5b1507a207253b39e810e91e68f9598691b7a29
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Tue May 5 02:48:17 2015 +0000
+
+ upstream commit
+
+ use the sizeof the struct not the sizeof a pointer to the
+ struct in ssh_digest_start()
+
+ This file is only used if ssh is built with OPENSSL=no
+
+ ok markus@
+
+commit a647b9b8e616c231594b2710c925d31b1b8afea3
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri May 8 11:07:27 2015 +1000
+
+ Put brackets around mblen() compat constant.
+
+ This might help with the reported problem cross compiling for Android
+ ("error: expected identifier or '(' before numeric constant") but
+ shouldn't hurt in any case.
+
+commit d1680d36e17244d9af3843aeb5025cb8e40d6c07
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Apr 30 09:18:11 2015 +1000
+
+ xrealloc -> xreallocarray in portable code too.
+
+commit 531a57a3893f9fcd4aaaba8c312b612bbbcc021e
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Apr 29 03:48:56 2015 +0000
+
+ upstream commit
+
+ Allow ListenAddress, Port and AddressFamily in any
+ order. bz#68, ok djm@, jmc@ (for the man page bit).
+
+commit c1d5bcf1aaf1209af02f79e48ba1cbc76a87b56f
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Tue Apr 28 13:47:38 2015 +0000
+
+ upstream commit
+
+ enviroment -> environment: apologies to darren for not
+ spotting that first time round...
+
+commit 43beea053db191cac47c2cd8d3dc1930158aff1a
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue Apr 28 10:25:15 2015 +0000
+
+ upstream commit
+
+ Fix typo in previous
+
+commit 85b96ef41374f3ddc9139581f87da09b2cd9199e
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue Apr 28 10:17:58 2015 +0000
+
+ upstream commit
+
+ Document that the TERM environment variable is not
+ subject to SendEnv and AcceptEnv. bz#2386, based loosely on a patch from
+ jjelen at redhat, help and ok jmc@
+
+commit 88a7c598a94ff53f76df228eeaae238d2d467565
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Apr 27 21:42:48 2015 +0000
+
+ upstream commit
+
+ Make sshd default to PermitRootLogin=no; ok deraadt@
+ rpe@
+
+commit 734226b4480a6c736096c729fcf6f391400599c7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Apr 27 01:52:30 2015 +0000
+
+ upstream commit
+
+ fix compilation with OPENSSL=no; ok dtucker@
+
+commit a4b9d2ce1eb7703eaf0809b0c8a82ded8aa4f1c6
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Mon Apr 27 00:37:53 2015 +0000
+
+ upstream commit
+
+ Include stdio.h for FILE (used in sshkey.h) so it
+ compiles with OPENSSL=no.
+
+commit dbcc652f4ca11fe04e5930c7ef18a219318c6cda
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Apr 27 00:21:21 2015 +0000
+
+ upstream commit
+
+ allow "sshd -f none" to skip reading the config file,
+ much like "ssh -F none" does. ok dtucker
+
+commit b7ca276fca316c952f0b90f5adb1448c8481eedc
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Fri Apr 24 06:26:49 2015 +0000
+
+ upstream commit
+
+ combine -Dd onto one line and update usage();
+
+commit 2ea974630d7017e4c7666d14d9dc939707613e96
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 24 05:26:44 2015 +0000
+
+ upstream commit
+
+ add ssh-agent -D to leave ssh-agent in foreground
+ without enabling debug mode; bz#2381 ok dtucker@
+
+commit 8ac2ffd7aa06042f6b924c87139f2fea5c5682f7
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Apr 24 01:36:24 2015 +0000
+
+ upstream commit
+
+ 2*len -> use xreallocarray() ok djm
+
+commit 657a5fbc0d0aff309079ff8fb386f17e964963c2
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Apr 24 01:36:00 2015 +0000
+
+ upstream commit
+
+ rename xrealloc() to xreallocarray() since it follows
+ that form. ok djm
+
+commit 1108ae242fdd2c304307b68ddf46aebe43ebffaa
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Apr 23 04:59:10 2015 +0000
+
+ upstream commit
+
+ Two small fixes for sshd -T: ListenAddress'es are added
+ to a list head so reverse the order when printing them to ensure the
+ behaviour remains the same, and print StreamLocalBindMask as octal with
+ leading zero. ok deraadt@
+
+commit bd902b8473e1168f19378d5d0ae68d0c203525df
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Apr 23 04:53:53 2015 +0000
+
+ upstream commit
+
+ Check for and reject missing arguments for
+ VersionAddendum and ForceCommand. bz#2281, patch from plautrba at redhat com,
ok djm@
- - djm at cvs.openbsd.org 2013/07/20 01:43:46
- [umac.c]
- use a union to ensure correct alignment; ok deraadt
- - djm at cvs.openbsd.org 2013/07/20 01:44:37
- [ssh-keygen.c ssh.c]
- More useful error message on missing current user in /etc/passwd
- - djm at cvs.openbsd.org 2013/07/20 01:50:20
- [ssh-agent.c]
- call cleanup_handler on SIGINT when in debug mode to ensure sockets
- are cleaned up on manual exit; bz#2120
- - djm at cvs.openbsd.org 2013/07/20 01:55:13
- [auth-krb5.c gss-serv-krb5.c gss-serv.c]
- fix kerberos/GSSAPI deprecation warnings and linking; "looks okay" millert@
-20130718
- - (djm) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/06/10 19:19:44
- [readconf.c]
- revert 1.203 while we investigate crashes reported by okan@
- - guenther at cvs.openbsd.org 2013/06/17 04:48:42
- [scp.c]
- Handle time_t values as long long's when formatting them and when
- parsing them from remote servers.
- Improve error checking in parsing of 'T' lines.
- ok dtucker@ deraadt@
- - markus at cvs.openbsd.org 2013/06/20 19:15:06
- [krl.c]
- don't leak the rdata blob on errors; ok djm@
- - djm at cvs.openbsd.org 2013/06/21 00:34:49
- [auth-rsa.c auth.h auth2-hostbased.c auth2-pubkey.c monitor.c]
- for hostbased authentication, print the client host and user on
- the auth success/failure line; bz#2064, ok dtucker@
- - djm at cvs.openbsd.org 2013/06/21 00:37:49
- [ssh_config.5]
- explicitly mention that IdentitiesOnly can be used with IdentityFile
- to control which keys are offered from an agent.
- - djm at cvs.openbsd.org 2013/06/21 05:42:32
- [dh.c]
- sprinkle in some error() to explain moduli(5) parse failures
- - djm at cvs.openbsd.org 2013/06/21 05:43:10
- [scp.c]
- make this -Wsign-compare clean after time_t conversion
- - djm at cvs.openbsd.org 2013/06/22 06:31:57
- [scp.c]
- improved time_t overflow check suggested by guenther@
- - jmc at cvs.openbsd.org 2013/06/27 14:05:37
- [ssh-keygen.1 ssh.1 ssh_config.5 sshd.8 sshd_config.5]
- do not use Sx for sections outwith the man page - ingo informs me that
- stuff like html will render with broken links;
- issue reported by Eric S. Raymond, via djm
- - markus at cvs.openbsd.org 2013/07/02 12:31:43
- [dh.c]
- remove extra whitespace
- - djm at cvs.openbsd.org 2013/07/12 00:19:59
- [auth-options.c auth-rsa.c bufaux.c buffer.h channels.c hostfile.c]
- [hostfile.h mux.c packet.c packet.h roaming_common.c serverloop.c]
- fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@
- - djm at cvs.openbsd.org 2013/07/12 00:20:00
- [sftp.c ssh-keygen.c ssh-pkcs11.c]
- fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@
- - djm at cvs.openbsd.org 2013/07/12 00:43:50
- [misc.c]
- in ssh_gai_strerror() don't fallback to strerror for EAI_SYSTEM when
- errno == 0. Avoids confusing error message in some broken resolver
- cases. bz#2122 patch from plautrba AT redhat.com; ok dtucker
- - djm at cvs.openbsd.org 2013/07/12 05:42:03
- [ssh-keygen.c]
- do_print_resource_record() can never be called with a NULL filename, so
- don't attempt (and bungle) asking for one if it has not been specified
- bz#2127 ok dtucker@
- - djm at cvs.openbsd.org 2013/07/12 05:48:55
- [ssh.c]
- set TCP nodelay for connections started with -N; bz#2124 ok dtucker@
- - schwarze at cvs.openbsd.org 2013/07/16 00:07:52
- [scp.1 sftp-server.8 ssh-keyscan.1 ssh-keysign.8 ssh-pkcs11-helper.8]
- use .Mt for email addresses; from Jan Stary <hans at stare dot cz>; ok jmc@
- - djm at cvs.openbsd.org 2013/07/18 01:12:26
- [ssh.1]
- be more exact wrt perms for ~/.ssh/config; bz#2078
+commit ca42c1758575e592239de1d5755140e054b91a0d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Apr 22 01:24:01 2015 +0000
-20130702
- - (dtucker) [contrib/cygwin/README contrib/cygwin/ssh-host-config
- contrib/cygwin/ssh-user-config] Modernizes and improve readability of
- the Cygwin README file (which hasn't been updated for ages), drop
- unsupported OSes from the ssh-host-config help text, and drop an
- unneeded option from ssh-user-config. Patch from vinschen at redhat com.
+ upstream commit
+
+ unknown certificate extensions are non-fatal, so don't
+ fatal when they are encountered; bz#2387 reported by Bob Van Zant; ok
+ dtucker@
-20130610
- - (djm) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/06/07 15:37:52
- [channels.c channels.h clientloop.c]
- Add an "ABANDONED" channel state and use for mux sessions that are
- disconnected via the ~. escape sequence. Channels in this state will
- be able to close if the server responds, but do not count as active channels.
- This means that if you ~. all of the mux clients when using ControlPersist
- on a broken network, the backgrounded mux master will exit when the
- Control Persist time expires rather than hanging around indefinitely.
- bz#1917, also reported and tested by tedu at . ok djm@ markus at .
- - (dtucker) [Makefile.in configure.ac fixalgorithms] Remove unsupported
- algorithms (Ciphers, MACs and HostKeyAlgorithms) from man pages.
- - (dtucker) [myproposal.h] Do not advertise AES GSM ciphers if we don't have
- the required OpenSSL support. Patch from naddy at freebsd.
- - (dtucker) [myproposal.h] Make the conditional algorithm support consistent
- and add some comments so it's clear what goes where.
+commit 39bfbf7caad231cc4bda6909fb1af0705bca04d8
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Tue Apr 21 07:01:00 2015 +0000
-20130605
- - (dtucker) [myproposal.h] Enable sha256 kex methods based on the presence of
- the necessary functions, not from the openssl version.
- - (dtucker) [contrib/ssh-copy-id] bz#2117: Use portable operator in test.
- Patch from cjwatson at debian.
- - (dtucker) [regress/forwarding.sh] For (as yet unknown) reason, the
- forwarding test is extremely slow copying data on some machines so switch
- back to copying the much smaller ls binary until we can figure out why
- this is.
- - (dtucker) [Makefile.in] append $CFLAGS to compiler options when building
- modpipe in case there's anything in there we need.
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/06/02 21:01:51
- [channels.h]
- typo in comment
- - dtucker at cvs.openbsd.org 2013/06/02 23:36:29
- [clientloop.h clientloop.c mux.c]
- No need for the mux cleanup callback to be visible so restore it to static
- and call it through the detach_user function pointer. ok djm@
- - dtucker at cvs.openbsd.org 2013/06/03 00:03:18
- [mac.c]
- force the MAC output to be 64-bit aligned so umac won't see unaligned
- accesses on strict-alignment architectures. bz#2101, patch from
- tomas.kuthan at oracle.com, ok djm@
- - dtucker at cvs.openbsd.org 2013/06/04 19:12:23
- [scp.c]
- use MAXPATHLEN for buffer size instead of fixed value. ok markus
- - dtucker at cvs.openbsd.org 2013/06/04 20:42:36
- [sftp.c]
- Make sftp's libedit interface marginally multibyte aware by building up
- the quoted string by character instead of by byte. Prevents failures
- when linked against a libedit built with wide character support (bz#1990).
- "looks ok" djm
- - dtucker at cvs.openbsd.org 2013/06/05 02:07:29
- [mux.c]
- fix leaks in mux error paths, from Zhenbo Xu, found by Melton. bz#1967,
- ok djm
- - dtucker at cvs.openbsd.org 2013/06/05 02:27:50
- [sshd.c]
- When running sshd -D, close stderr unless we have explicitly requesting
- logging to stderr. From james.hunt at ubuntu.com via bz#1976, djm's patch
- so, err, ok dtucker.
- - dtucker at cvs.openbsd.org 2013/06/05 12:52:38
- [sshconnect2.c]
- Fix memory leaks found by Zhenbo Xu and the Melton tool. bz#1967, ok djm
- - dtucker at cvs.openbsd.org 2013/06/05 22:00:28
- [readconf.c]
- plug another memleak. bz#1967, from Zhenbo Xu, detected by Melton, ok djm
- - (dtucker) [configure.ac sftp.c openbsd-compat/openbsd-compat.h] Cater for
- platforms that don't have multibyte character support (specifically,
- mblen).
+ upstream commit
+
+ Add back a backslash removed in rev 1.42 so
+ KEX_SERVER_ENCRYPT will include aes again.
+
+ ok deraadt@
-20130602
- - (tim) [Makefile.in] Make Solaris, UnixWare, & OpenServer linkers happy
- linking regress/modpipe.
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/06/02 13:33:05
- [progressmeter.c]
- Add misc.h for monotime prototype. (ID sync only).
- - dtucker at cvs.openbsd.org 2013/06/02 13:35:58
- [ssh-agent.c]
- Make parent_alive_interval time_t to avoid signed/unsigned comparison
- - (dtucker) [configure.ac] sys/un.h needs sys/socket.h on some platforms
- to prevent noise from configure. Patch from Nathan Osman. (bz#2114).
- - (dtucker) [configure.ac] bz#2111: don't try to use lastlog on Android.
- Patch from Nathan Osman.
- - (tim) [configure.ac regress/Makefile] With rev 1.47 of test-exec.sh we
- need a shell that can handle "[ file1 -nt file2 ]". Rather than keep
- dealing with shell portability issues in regression tests, we let
- configure find us a capable shell on those platforms with an old /bin/sh.
- - (tim) [aclocal.m4] Enhance OSSH_CHECK_CFLAG_COMPILE to check stderr.
- feedback and ok dtucker
- - (tim) [regress/sftp-chroot.sh] skip if no sudo. ok dtucker
- - (dtucker) [configure.ac] Some platforms need sys/types.h before sys/un.h.
- - (dtucker) [configure.ac] Some other platforms need sys/types.h before
- sys/socket.h.
+commit 6b0d576bb87eca3efd2b309fcfe4edfefc289f9c
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 17 13:32:09 2015 +0000
-20130601
- - (dtucker) [configure.ac openbsd-compat/xcrypt.c] bz#2112: fall back to
- using openssl's DES_crypt function on platorms that don't have a native
- one, eg Android. Based on a patch from Nathan Osman.
- - (dtucker) [configure.ac defines.h] Test for fd_mask, howmany and NFDBITS
- rather than trying to enumerate the plaforms that don't have them.
- Based on a patch from Nathan Osman, with help from tim at .
- - (dtucker) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/05/17 00:13:13
- [xmalloc.h cipher.c sftp-glob.c ssh-keyscan.c ssh.c sftp-common.c
- ssh-ecdsa.c auth2-chall.c compat.c readconf.c kexgexs.c monitor.c
- gss-genr.c cipher-3des1.c kex.c monitor_wrap.c ssh-pkcs11-client.c
- auth-options.c rsa.c auth2-pubkey.c sftp.c hostfile.c auth2.c
- servconf.c auth.c authfile.c xmalloc.c uuencode.c sftp-client.c
- auth2-gss.c sftp-server.c bufaux.c mac.c session.c jpake.c kexgexc.c
- sshconnect.c auth-chall.c auth2-passwd.c sshconnect1.c buffer.c
- kexecdhs.c kexdhs.c ssh-rsa.c auth1.c ssh-pkcs11.c auth2-kbdint.c
- kexdhc.c sshd.c umac.c ssh-dss.c auth2-jpake.c bufbn.c clientloop.c
- monitor_mm.c scp.c roaming_client.c serverloop.c key.c auth-rsa.c
- ssh-pkcs11-helper.c ssh-keysign.c ssh-keygen.c match.c channels.c
- sshconnect2.c addrmatch.c mux.c canohost.c kexecdhc.c schnorr.c
- ssh-add.c misc.c auth2-hostbased.c ssh-agent.c bufec.c groupaccess.c
- dns.c packet.c readpass.c authfd.c moduli.c]
- bye, bye xfree(); ok markus@
- - djm at cvs.openbsd.org 2013/05/19 02:38:28
- [auth2-pubkey.c]
- fix failure to recognise cert-authority keys if a key of a different type
- appeared in authorized_keys before it; ok markus@
- - djm at cvs.openbsd.org 2013/05/19 02:42:42
- [auth.h auth.c key.c monitor.c auth-rsa.c auth2.c auth1.c key.h]
- Standardise logging of supplemental information during userauth. Keys
- and ruser is now logged in the auth success/failure message alongside
- the local username, remote host/port and protocol in use. Certificates
- contents and CA are logged too.
- Pushing all logging onto a single line simplifies log analysis as it is
- no longer necessary to relate information scattered across multiple log
- entries. "I like it" markus@
- - dtucker at cvs.openbsd.org 2013/05/31 12:28:10
- [ssh-agent.c]
- Use time_t where appropriate. ok djm
- - dtucker at cvs.openbsd.org 2013/06/01 13:15:52
- [ssh-agent.c clientloop.c misc.h packet.c progressmeter.c misc.c
- channels.c sandbox-systrace.c]
- Use clock_gettime(CLOCK_MONOTONIC ...) for ssh timers so that things like
- keepalives and rekeying will work properly over clock steps. Suggested by
- markus@, "looks good" djm at .
- - dtucker at cvs.openbsd.org 2013/06/01 20:59:25
- [scp.c sftp-client.c]
- Replace S_IWRITE, which isn't standardized, with S_IWUSR, which is. Patch
- from Nathan Osman via bz#2085. ok deraadt.
- - dtucker at cvs.openbsd.org 2013/06/01 22:34:50
- [sftp-client.c]
- Update progressmeter when data is acked, not when it's sent. bz#2108, from
- Debian via Colin Watson, ok djm@
- - (dtucker) [M auth-chall.c auth-krb5.c auth-pam.c cipher-aes.c cipher-ctr.c
- groupaccess.c loginrec.c monitor.c monitor_wrap.c session.c sshd.c
- sshlogin.c uidswap.c openbsd-compat/bsd-cygwin_util.c
- openbsd-compat/getrrsetbyname-ldns.c openbsd-compat/port-aix.c
- openbsd-compat/port-linux.c] Replace portable-specific instances of xfree
- with the equivalent calls to free.
- - (dtucker) [configure.ac misc.c] Look for clock_gettime in librt and fall
- back to time(NULL) if we can't find it anywhere.
- - (dtucker) [sandbox-seccomp-filter.c] Allow clock_gettimeofday.
+ upstream commit
+
+ s/recommended/required/ that private keys be og-r this
+ wording change was made a while ago but got accidentally reverted
-20130529
- - (dtucker) [configure.ac openbsd-compat/bsd-misc.h] bz#2087: Add a null
- implementation of endgrent for platforms that don't have it (eg Android).
- Loosely based on a patch from Nathan Osman, ok djm
+commit 44a8e7ce6f3ab4c2eb1ae49115c210b98e53c4df
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 17 13:25:52 2015 +0000
- 20130517
- - (dtucker) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/03/07 00:20:34
- [regress/proxy-connect.sh]
- repeat test with a style appended to the username
- - dtucker at cvs.openbsd.org 2013/03/23 11:09:43
- [regress/test-exec.sh]
- Only regenerate host keys if they don't exist or if ssh-keygen has changed
- since they were. Reduces test runtime by 5-30% depending on machine
- speed.
- - dtucker at cvs.openbsd.org 2013/04/06 06:00:22
- [regress/rekey.sh regress/test-exec.sh regress/integrity.sh
- regress/multiplex.sh Makefile regress/cfgmatch.sh]
- Split the regress log into 3 parts: the debug output from ssh, the debug
- log from sshd and the output from the client command (ssh, scp or sftp).
- Somewhat functional now, will become more useful when ssh/sshd -E is added.
- - dtucker at cvs.openbsd.org 2013/04/07 02:16:03
- [regress/Makefile regress/rekey.sh regress/integrity.sh
- regress/sshd-log-wrapper.sh regress/forwarding.sh regress/test-exec.sh]
- use -E option for ssh and sshd to write debuging logs to ssh{,d}.log and
- save the output from any failing tests. If a test fails the debug output
- from ssh and sshd for the failing tests (and only the failing tests) should
- be available in failed-ssh{,d}.log.
- - djm at cvs.openbsd.org 2013/04/18 02:46:12
- [regress/Makefile regress/sftp-chroot.sh]
- test sshd ChrootDirectory+internal-sftp; feedback & ok dtucker@
- - dtucker at cvs.openbsd.org 2013/04/22 07:23:08
- [regress/multiplex.sh]
- Write mux master logs to regress.log instead of ssh.log to keep separate
- - djm at cvs.openbsd.org 2013/05/10 03:46:14
- [regress/modpipe.c]
- sync some portability changes from portable OpenSSH (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/16 02:10:35
- [regress/rekey.sh]
- Add test for time-based rekeying
- - dtucker at cvs.openbsd.org 2013/05/16 03:33:30
- [regress/rekey.sh]
- test rekeying when there's no data being transferred
- - dtucker at cvs.openbsd.org 2013/05/16 04:26:10
- [regress/rekey.sh]
- add server-side rekey test
- - dtucker at cvs.openbsd.org 2013/05/16 05:48:31
- [regress/rekey.sh]
- add tests for RekeyLimit parsing
- - dtucker at cvs.openbsd.org 2013/05/17 00:37:40
- [regress/agent.sh regress/keytype.sh regress/cfgmatch.sh
- regress/forcecommand.sh regress/proto-version.sh regress/test-exec.sh
- regress/cipher-speed.sh regress/cert-hostkey.sh regress/cert-userkey.sh
- regress/ssh-com.sh]
- replace 'echo -n' with 'printf' since it's more portable
- also remove "echon" hack.
- - dtucker at cvs.openbsd.org 2013/05/17 01:16:09
- [regress/agent-timeout.sh]
- Pull back some portability changes from -portable:
- - TIMEOUT is a read-only variable in some shells
- - not all greps have -q so redirect to /dev/null instead.
- (ID sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 01:32:11
- [regress/integrity.sh]
- don't print output from ssh before getting it (it's available in ssh.log)
- - dtucker at cvs.openbsd.org 2013/05/17 04:29:14
- [regress/sftp.sh regress/putty-ciphers.sh regress/cipher-speed.sh
- regress/test-exec.sh regress/sftp-batch.sh regress/dynamic-forward.sh
- regress/putty-transfer.sh regress/conch-ciphers.sh regress/sftp-cmds.sh
- regress/scp.sh regress/ssh-com-sftp.sh regress/rekey.sh
- regress/putty-kex.sh regress/stderr-data.sh regress/stderr-after-eof.sh
- regress/sftp-badcmds.sh regress/reexec.sh regress/ssh-com-client.sh
- regress/sftp-chroot.sh regress/forwarding.sh regress/transfer.sh
- regress/multiplex.sh]
- Move the setting of DATA and COPY into test-exec.sh
- - dtucker at cvs.openbsd.org 2013/05/17 10:16:26
- [regress/try-ciphers.sh]
- use expr for math to keep diffs vs portable down
- (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 10:23:52
- [regress/login-timeout.sh regress/reexec.sh regress/test-exec.sh]
- Use SUDO when cat'ing pid files and running the sshd log wrapper so that
- it works with a restrictive umask and the pid files are not world readable.
- Changes from -portable. (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 10:24:48
- [regress/localcommand.sh]
- use backticks for portability. (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 10:26:26
- [regress/sftp-badcmds.sh]
- remove unused BATCH variable. (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 10:28:11
- [regress/sftp.sh]
- only compare copied data if sftp succeeds. from portable (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 10:30:07
- [regress/test-exec.sh]
- wait a bit longer for startup and use case for absolute path.
- from portable (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 10:33:09
- [regress/agent-getpeereid.sh]
- don't redirect stdout from sudo. from portable (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 10:34:30
- [regress/portnum.sh]
- use a more portable negated if structure. from portable (id sync only)
- - dtucker at cvs.openbsd.org 2013/05/17 10:35:43
- [regress/scp.sh]
- use a file extention that's not special on some platforms. from portable
- (id sync only)
- - (dtucker) [regress/bsd.regress.mk] Remove unused file. We've never used it
- in portable and it's long gone in openbsd.
- - (dtucker) [regress/integrity.sh]. Force fixed Diffie-Hellman key exchange
- methods. When the openssl version doesn't support ECDH then next one on
- the list is DH group exchange, but that causes a bit more traffic which can
- mean that the tests flip bits in the initial exchange rather than the MACed
- traffic and we get different errors to what the tests look for.
- - (dtucker) [openbsd-compat/getopt.h] Remove unneeded bits.
- - (dtucker) [regress/cfgmatch.sh] Resync config file setup with openbsd.
- - (dtucker) [regress/agent-getpeereid.sh] Resync spaces with openbsd.
- - (dtucker) [regress/integrity.sh regress/krl.sh regress/test-exec.sh]
- Move the jot helper function to portable-specific part of test-exec.sh.
- - (dtucker) [regress/test-exec.sh] Move the portable-specific functions
- together and add a couple of missing lines from openbsd.
- - (dtucker) [regress/stderr-after-eof.sh regress/test-exec.sh] Move the md5
- helper function to the portable part of test-exec.sh.
- - (dtucker) [regress/runtests.sh] Remove obsolete test driver script.
- - (dtucker) [regress/cfgmatch.sh] Remove unneeded sleep renderd obsolete by
- rev 1.6 which calls wait.
+ upstream commit
+
+ don't try to cleanup NULL KEX proposals in
+ kex_prop_free(); found by Jukka Taimisto and Markus Hietava
-20130516
- - (djm) [contrib/ssh-copy-id] Fix bug that could cause "rm *" to be
- executed if mktemp failed; bz#2105 ok dtucker@
- - (dtucker) OpenBSD CVS Sync
- - tedu at cvs.openbsd.org 2013/04/23 17:49:45
- [misc.c]
- use xasprintf instead of a series of strlcats and strdup. ok djm
- - tedu at cvs.openbsd.org 2013/04/24 16:01:46
- [misc.c]
- remove extra parens noticed by nicm
- - dtucker at cvs.openbsd.org 2013/05/06 07:35:12
- [sftp-server.8]
- Reference the version of the sftp draft we actually implement. ok djm@
- - djm at cvs.openbsd.org 2013/05/10 03:40:07
- [sshconnect2.c]
- fix bzero(ptr_to_struct, sizeof(ptr_to_struct)); bz#2100 from
- Colin Watson
- - djm at cvs.openbsd.org 2013/05/10 04:08:01
- [key.c]
- memleak in cert_free(), wasn't actually freeing the struct;
- bz#2096 from shm AT digitalsun.pl
- - dtucker at cvs.openbsd.org 2013/05/10 10:13:50
- [ssh-pkcs11-helper.c]
- remove unused extern optarg. ok markus@
- - dtucker at cvs.openbsd.org 2013/05/16 02:00:34
- [ssh_config sshconnect2.c packet.c readconf.h readconf.c clientloop.c
- ssh_config.5 packet.h]
- Add an optional second argument to RekeyLimit in the client to allow
- rekeying based on elapsed time in addition to amount of traffic.
- with djm@ jmc@, ok djm
- - dtucker at cvs.openbsd.org 2013/05/16 04:09:14
- [sshd_config.5 servconf.c servconf.h packet.c serverloop.c monitor.c sshd_config
- sshd.c] Add RekeyLimit to sshd with the same syntax as the client allowing
- rekeying based on traffic volume or time. ok djm@, help & ok jmc@ for the man
- page.
- - djm at cvs.openbsd.org 2013/05/16 04:27:50
- [ssh_config.5 readconf.h readconf.c]
- add the ability to ignore specific unrecognised ssh_config options;
- bz#866; ok markus@
- - jmc at cvs.openbsd.org 2013/05/16 06:28:45
- [ssh_config.5]
- put IgnoreUnknown in the right place;
- - jmc at cvs.openbsd.org 2013/05/16 06:30:06
- [sshd_config.5]
- oops! avoid Xr to self;
- - dtucker at cvs.openbsd.org 2013/05/16 09:08:41
- [log.c scp.c sshd.c serverloop.c schnorr.c sftp.c]
- Fix some "unused result" warnings found via clang and -portable.
- ok markus@
- - dtucker at cvs.openbsd.org 2013/05/16 09:12:31
- [readconf.c servconf.c]
- switch RekeyLimit traffic volume parsing to scan_scaled. ok djm@
- - dtucker at cvs.openbsd.org 2013/05/16 10:43:34
- [servconf.c readconf.c]
- remove now-unused variables
- - dtucker at cvs.openbsd.org 2013/05/16 10:44:06
- [servconf.c]
- remove another now-unused variable
- - (dtucker) [configure.ac readconf.c servconf.c
- openbsd-compat/openbsd-compat.h] Add compat bits for scan_scaled.
+commit 3038a191872d2882052306098c1810d14835e704
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 17 13:19:22 2015 +0000
-20130510
- - (dtucker) [configure.ac] Enable -Wsizeof-pointer-memaccess if the compiler
- supports it. Mentioned by Colin Watson in bz#2100, ok djm.
- - (dtucker) [openbsd-compat/getopt.c] Factor out portibility changes to
- getopt.c. Preprocessed source is identical other than line numbers.
- - (dtucker) [openbsd-compat/getopt_long.c] Import from OpenBSD. No
- portability changes yet.
- - (dtucker) [openbsd-compat/Makefile.in openbsd-compat/getopt.c
- openbsd-compat/getopt_long.c regress/modpipe.c] Remove getopt.c, add
- portability code to getopt_long.c and switch over Makefile and the ugly
- hack in modpipe.c. Fixes bz#1448.
- - (dtucker) [openbsd-compat/getopt.h openbsd-compat/getopt_long.c
- openbsd-compat/openbsd-compat.h] pull in getopt.h from openbsd and plumb
- in to use it when we're using our own getopt.
- - (dtucker) [kex.c] Only include sha256 and ECC key exchange methods when the
- underlying libraries support them.
- - (dtucker) [configure.ac] Add -Werror to the -Qunused-arguments test so
- we don't get a warning on compilers that *don't* support it. Add
- -Wno-unknown-warning-option. Move both to the start of the list for
- maximum noise suppression. Tested with gcc 4.6.3, gcc 2.95.4 and clang 2.9.
+ upstream commit
+
+ use error/logit/fatal instead of fprintf(stderr, ...)
+ and exit(0), fix a few errors that were being printed to stdout instead of
+ stderr and a few non-errors that were going to stderr instead of stdout
+ bz#2325; ok dtucker
-20130423
- - (djm) [auth.c configure.ac misc.c monitor.c monitor_wrap.c] Support
- platforms, such as Android, that lack struct passwd.pw_gecos. Report
- and initial patch from Nathan Osman bz#2086; feedback tim@ ok dtucker@
- - (djm) OpenBSD CVS Sync
- - markus at cvs.openbsd.org 2013/03/05 20:16:09
- [sshconnect2.c]
- reset pubkey order on partial success; ok djm@
- - djm at cvs.openbsd.org 2013/03/06 23:35:23
- [session.c]
- fatal() when ChrootDirectory specified by running without root privileges;
- ok markus@
- - djm at cvs.openbsd.org 2013/03/06 23:36:53
- [readconf.c]
- g/c unused variable (-Wunused)
- - djm at cvs.openbsd.org 2013/03/07 00:19:59
- [auth2-pubkey.c monitor.c]
- reconstruct the original username that was sent by the client, which may
- have included a style (e.g. "root:skey") when checking public key
- signatures. Fixes public key and hostbased auth when the client specified
- a style; ok markus@
- - markus at cvs.openbsd.org 2013/03/07 19:27:25
- [auth.h auth2-chall.c auth2.c monitor.c sshd_config.5]
- add submethod support to AuthenticationMethods; ok and freedback djm@
- - djm at cvs.openbsd.org 2013/03/08 06:32:58
- [ssh.c]
- allow "ssh -f none ..." ok markus@
- - djm at cvs.openbsd.org 2013/04/05 00:14:00
- [auth2-gss.c krl.c sshconnect2.c]
- hush some {unused, printf type} warnings
- - djm at cvs.openbsd.org 2013/04/05 00:31:49
- [pathnames.h]
- use the existing _PATH_SSH_USER_RC define to construct the other
- pathnames; bz#2077, ok dtucker@ (no binary change)
- - djm at cvs.openbsd.org 2013/04/05 00:58:51
- [mux.c]
- cleanup mux-created channels that are in SSH_CHANNEL_OPENING state too
- (in addition to ones already in OPEN); bz#2079, ok dtucker@
- - markus at cvs.openbsd.org 2013/04/06 16:07:00
- [channels.c sshd.c]
- handle ECONNABORTED for accept(); ok deraadt some time ago...
- - dtucker at cvs.openbsd.org 2013/04/07 02:10:33
- [log.c log.h ssh.1 ssh.c sshd.8 sshd.c]
- Add -E option to ssh and sshd to append debugging logs to a specified file
- instead of stderr or syslog. ok markus@, man page help jmc@
- - dtucker at cvs.openbsd.org 2013/04/07 09:40:27
- [sshd.8]
- clarify -e text. suggested by & ok jmc@
- - djm at cvs.openbsd.org 2013/04/11 02:27:50
- [packet.c]
- quiet disconnect notifications on the server from error() back to logit()
- if it is a normal client closure; bz#2057 ok+feedback dtucker@
- - dtucker at cvs.openbsd.org 2013/04/17 09:04:09
- [session.c]
- revert rev 1.262; it fails because uid is already set here. ok djm@
- - djm at cvs.openbsd.org 2013/04/18 02:16:07
- [sftp.c]
- make "sftp -q" do what it says on the sticker: hush everything but errors;
- ok dtucker@
- - djm at cvs.openbsd.org 2013/04/19 01:00:10
- [sshd_config.5]
- document the requirment that the AuthorizedKeysCommand be owned by root;
- ok dtucker@ markus@
- - djm at cvs.openbsd.org 2013/04/19 01:01:00
- [ssh-keygen.c]
- fix some memory leaks; bz#2088 ok dtucker@
- - djm at cvs.openbsd.org 2013/04/19 01:03:01
- [session.c]
- reintroduce 1.262 without the connection-killing bug:
- fatal() when ChrootDirectory specified by running without root privileges;
- ok markus@
- - djm at cvs.openbsd.org 2013/04/19 01:06:50
- [authfile.c cipher.c cipher.h kex.c kex.h kexecdh.c kexecdhc.c kexecdhs.c]
- [key.c key.h mac.c mac.h packet.c ssh.1 ssh.c]
- add the ability to query supported ciphers, MACs, key type and KEX
- algorithms to ssh. Includes some refactoring of KEX and key type handling
- to be table-driven; ok markus@
- - djm at cvs.openbsd.org 2013/04/19 11:10:18
- [ssh.c]
- add -Q to usage; reminded by jmc@
- - djm at cvs.openbsd.org 2013/04/19 12:07:08
- [kex.c]
- remove duplicated list entry pointed out by naddy@
- - dtucker at cvs.openbsd.org 2013/04/22 01:17:18
- [mux.c]
- typo in debug output: evitval->exitval
+commit a58be33cb6cd24441fa7e634db0e5babdd56f07f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 17 13:16:48 2015 +0000
-20130418
- - (djm) [config.guess config.sub] Update to last versions before they switch
- to GPL3. ok dtucker@
- - (dtucker) [configure.ac] Use -Qunused-arguments to suppress warnings from
- unused argument warnings (in particular, -fno-builtin-memset) from clang.
+ upstream commit
+
+ debug log missing DISPLAY environment when X11
+ forwarding requested; bz#1682 ok dtucker@
-20130404
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2013/02/17 23:16:57
- [readconf.c ssh.c readconf.h sshconnect2.c]
- Keep track of which IndentityFile options were manually supplied and which
- were default options, and don't warn if the latter are missing.
- ok markus@
- - dtucker at cvs.openbsd.org 2013/02/19 02:12:47
- [krl.c]
- Remove bogus include. ok djm
- - dtucker at cvs.openbsd.org 2013/02/22 04:45:09
- [ssh.c readconf.c readconf.h]
- Don't complain if IdentityFiles specified in system-wide configs are
- missing. ok djm, deraadt.
- - markus at cvs.openbsd.org 2013/02/22 19:13:56
- [sshconnect.c]
- support ProxyCommand=- (stdin/out already point to the proxy); ok djm@
- - djm at cvs.openbsd.org 2013/02/22 22:09:01
- [ssh.c]
- Allow IdenityFile=none; ok markus deraadt (and dtucker for an earlier
- version)
+commit 17d4d9d9fbc8fb80e322f94d95eecc604588a474
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 17 04:32:31 2015 +0000
-20130401
- - (dtucker) [openbsd-compat/bsd-cygwin_util.{c,h}] Don't include windows.h
- to avoid conflicting definitions of __int64, adding the required bits.
- Patch from Corinna Vinschen.
+ upstream commit
+
+ don't call record_login() in monitor when UseLogin is
+ enabled; bz#278 reported by drk AT sgi.com; ok dtucker
-20130323
- - (tim) [Makefile.in] remove some duplication introduced in 20130220 commit.
+commit 40132ff87b6cbc3dc05fb5df2e9d8e3afa06aafd
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Apr 17 04:12:35 2015 +0000
-20130322
- - (djm) [contrib/ssh-copy-id contrib/ssh-copy-id.1] Updated to Phil
- Hands' greatly revised version.
- - (djm) Release 6.2p1
- - (dtucker) [configure.ac] Add stdlib.h to zlib check for exit() prototype.
- - (dtucker) [includes.h] Check if _GNU_SOURCE is already defined before
- defining it again. Prevents warnings if someone, eg, sets it in CFLAGS.
+ upstream commit
+
+ Add some missing options to sshd -T and fix the output
+ of VersionAddendum HostCertificate. bz#2346, patch from jjelen at redhat
+ com, ok djm.
-20130318
- - (djm) [configure.ac log.c scp.c sshconnect2.c openbsd-compat/vis.c]
- [openbsd-compat/vis.h] FreeBSD's strnvis isn't compatible with OpenBSD's
- so mark it as broken. Patch from des AT des.no
+commit 6cc7cfa936afde2d829e56ee6528c7ea47a42441
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Apr 16 23:25:50 2015 +0000
-20130317
- - (tim) [configure.ac] OpenServer 5 wants lastlog even though it has none
- of the bits the configure test looks for.
+ upstream commit
+
+ Document "none" for PidFile XAuthLocation
+ TrustedUserCAKeys and RevokedKeys. bz#2382, feedback from jmc@, ok djm@
-20130316
- - (djm) [configure.ac] Disable utmp, wtmp and/or lastlog if the platform
- is unable to successfully compile them. Based on patch from des AT
- des.no
- - (djm) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
- Add a usleep replacement for platforms that lack it; ok dtucker
- - (djm) [session.c] FreeBSD needs setusercontext(..., LOGIN_SETUMASK) to
- occur after UID switch; patch from John Marshall via des AT des.no;
- ok dtucker@
+commit 15fdfc9b1c6808b26bc54d4d61a38b54541763ed
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Wed Apr 15 23:23:25 2015 +0000
-20130312
- - (dtucker) [regress/Makefile regress/cipher-speed.sh regress/test-exec.sh]
- Improve portability of cipher-speed test, based mostly on a patch from
- Iain Morgan.
- - (dtucker) [auth.c configure.ac platform.c platform.h] Accept uid 2 ("bin")
- in addition to root as an owner of system directories on AIX and HP-UX.
- ok djm@
+ upstream commit
+
+ Plug leak of address passed to logging. bz#2373, patch
+ from jjelen at redhat, ok markus@
-20130307
- - (dtucker) [INSTALL] Bump documented autoconf version to what we're
- currently using.
- - (dtucker) [defines.h] Remove SIZEOF_CHAR bits since the test for it
- was removed in configure.ac rev 1.481 as it was redundant.
- - (tim) [Makefile.in] Add another missing $(EXEEXT) I should have seen 3 days
- ago.
- - (djm) [configure.ac] Add a timeout to the select/rlimit test to give it a
- chance to complete on broken systems; ok dtucker@
+commit bb2289e2a47d465eaaaeff3dee2a6b7777b4c291
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Tue Apr 14 04:17:03 2015 +0000
-20130306
- - (dtucker) [regress/forward-control.sh] Wait longer for the forwarding
- connection to start so that the test works on slower machines.
- - (dtucker) [configure.ac] test that we can set number of file descriptors
- to zero with setrlimit before enabling the rlimit sandbox. This affects
- (at least) HPUX 11.11.
+ upstream commit
+
+ Output remote username in debug output since with Host
+ and Match it's not always obvious what it will be. bz#2368, ok djm@
-20130305
- - (djm) [regress/modpipe.c] Compilation fix for AIX and parsing fix for
- HP/UX. Spotted by Kevin Brott
- - (dtucker) [configure.ac] use "=" for shell test and not "==". Spotted by
- Amit Kulkarni and Kevin Brott.
- - (dtucker) [Makefile.in] Remove trailing "\" on PATHS, which caused obscure
- build breakage on (at least) HP-UX 11.11. Found by Amit Kulkarni and Kevin
- Brott.
- - (tim) [Makefile.in] Add missing $(EXEEXT). Found by Roumen Petrov.
+commit 70860b6d07461906730632f9758ff1b7c98c695a
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Apr 17 10:56:13 2015 +1000
-20130227
- - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
- [contrib/suse/openssh.spec] Crank version numbers
- - (tim) [regress/forward-control.sh] use sh in case login shell is csh.
- - (tim) [regress/integrity.sh] shell portability fix.
- - (tim) [regress/integrity.sh] keep old solaris awk from hanging.
- - (tim) [regress/krl.sh] keep old solaris awk from hanging.
+ Format UsePAM setting when using sshd -T.
+
+ Part of bz#2346, patch from jjelen at redhat com.
-20130226
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/02/20 08:27:50
- [integrity.sh]
- Add an option to modpipe that warns if the modification offset it not
- reached in it's stream and turn it on for t-integrity. This should catch
- cases where the session is not fuzzed for being too short (cf. my last
- "oops" commit)
- - (djm) [regress/integrity.sh] Run sshd via $SUDO; fixes tinderbox breakage
- for UsePAM=yes configuration
+commit ee15d9c9f0720f5a8b0b34e4b10ecf21f9824814
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Apr 17 10:40:23 2015 +1000
-20130225
- - (dtucker) [configure.ac ssh-gss.h] bz#2073: additional #includes needed
- to use Solaris native GSS libs. Patch from Pierre Ossman.
+ Wrap endian.h include inside ifdef (bz#2370).
-20130223
- - (djm) [configure.ac includes.h loginrec.c mux.c sftp.c] Prefer
- bsd/libutil.h to libutil.h to avoid deprecation warnings on Ubuntu.
- ok tim
+commit 408f4c2ad4a4c41baa7b9b2b7423d875abbfa70b
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Fri Apr 17 09:39:58 2015 +1000
-20130222
- - (dtucker) [Makefile.in configure.ac] bz#2072: don't link krb5 libs to
- ssh(1) since they're not needed. Patch from Pierre Ossman, ok djm.
- - (dtucker) [configure.ac] bz#2073: look for Solaris' differently-named
- libgss too. Patch from Pierre Ossman, ok djm.
- - (djm) [configure.ac sandbox-seccomp-filter.c] Support for Linux
- seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com;
- ok dtucker
+ Look for '${host}-ar' before 'ar'.
+
+ This changes configure.ac to look for '${host}-ar' as set by
+ AC_CANONICAL_HOST before looking for the unprefixed 'ar'.
+ Useful when cross-compiling when all your binutils are prefixed.
+
+ Patch from moben at exherbo org via astrand at lysator liu se and
+ bz#2352.
-20130221
- - (tim) [regress/forward-control.sh] shell portability fix.
+commit 673a1c16ad078d41558247ce739fe812c960acc8
+Author: Damien Miller <djm at google.com>
+Date: Thu Apr 16 11:40:20 2015 +1000
-20130220
- - (tim) [regress/cipher-speed.sh regress/try-ciphers.sh] shell portability fix.
- - (tim) [krl.c Makefile.in regress/Makefile regress/modpipe.c] remove unneeded
- err.h include from krl.c. Additional portability fixes for modpipe. OK djm
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/02/20 08:27:50
- [regress/integrity.sh regress/modpipe.c]
- Add an option to modpipe that warns if the modification offset it not
- reached in it's stream and turn it on for t-integrity. This should catch
- cases where the session is not fuzzed for being too short (cf. my last
- "oops" commit)
- - djm at cvs.openbsd.org 2013/02/20 08:29:27
- [regress/modpipe.c]
- s/Id/OpenBSD/ in RCS tag
+ remove dependency on arpa/telnet.h
-20130219
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/02/18 22:26:47
- [integrity.sh]
- crank the offset yet again; it was still fuzzing KEX one of Darren's
- portable test hosts at 2800
- - djm at cvs.openbsd.org 2013/02/19 02:14:09
- [integrity.sh]
- oops, forgot to increase the output of the ssh command to ensure that
- we actually reach $offset
- - (djm) [regress/integrity.sh] Skip SHA2-based MACs on configurations that
- lack support for SHA2.
- - (djm) [regress/modpipe.c] Add local err, and errx functions for platforms
- that do not have them.
+commit 202d443eeda1829d336595a3cfc07827e49f45ed
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Apr 15 15:59:49 2015 +1000
-20130217
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/02/17 23:16:55
- [integrity.sh]
- make the ssh command generates some output to ensure that there are at
- least offset+tries bytes in the stream.
+ Remove duplicate include of pwd.h. bz#2337, patch from Mordy Ovits.
-20130216
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/02/16 06:08:45
- [integrity.sh]
- make sure the fuzz offset is actually past the end of KEX for all KEX
- types. diffie-hellman-group-exchange-sha256 requires an offset around
- 2700. Noticed via test failures in portable OpenSSH on platforms that
- lack ECC and this the more byte-frugal ECDH KEX algorithms.
+commit 597986493412c499f2bc2209420cb195f97b3668
+Author: Damien Miller <djm at google.com>
+Date: Thu Apr 9 10:14:48 2015 +1000
-20130215
- - (djm) [contrib/suse/rc.sshd] Use SSHD_BIN consistently; bz#2056 from
- Iain Morgan
- - (dtucker) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
- Use getpgrp() if we don't have getpgid() (old BSDs, maybe others).
- - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoull.c
- openbsd-compat/openbsd-compat.h] Add strtoull to compat library for
- platforms that don't have it.
- - (dtucker) [openbsd-compat/openbsd-compat.h] Add prototype for strtoul,
- group strto* function prototypes together.
- - (dtucker) [openbsd-compat/bsd-misc.c] Handle the case where setpgrp() takes
- an argument. Pointed out by djm.
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/02/14 21:35:59
- [auth2-pubkey.c]
- Correct error message that had a typo and was logging the wrong thing;
- patch from Petr Lautrbach
- - dtucker at cvs.openbsd.org 2013/02/15 00:21:01
- [sshconnect2.c]
- Warn more loudly if an IdentityFile provided by the user cannot be read.
- bz #1981, ok djm@
+ platform's with openpty don't need pty_release
-20130214
- - (djm) [regress/krl.sh] Don't use ecdsa keys in environment that lack ECC.
- - (djm) [regress/krl.sh] typo; found by Iain Morgan
- - (djm) [regress/integrity.sh] Start fuzzing from offset 2500 (instead
- of 2300) to avoid clobbering the end of (non-MAC'd) KEX. Verified by
- Iain Morgan
+commit 318be28cda1fd9108f2e6f2f86b0b7589ba2aed0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Apr 13 02:04:08 2015 +0000
-20130212
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/01/24 21:45:37
- [krl.c]
- fix handling of (unused) KRL signatures; skip string in correct buffer
- - djm at cvs.openbsd.org 2013/01/24 22:08:56
- [krl.c]
- skip serial lookup when cert's serial number is zero
- - krw at cvs.openbsd.org 2013/01/25 05:00:27
- [krl.c]
- Revert last. Breaks due to likely typo. Let djm@ fix later.
- ok djm@ via dlg@
- - djm at cvs.openbsd.org 2013/01/25 10:22:19
- [krl.c]
- redo last commit without the vi-vomit that snuck in:
- skip serial lookup when cert's serial number is zero
- (now with 100% better comment)
- - djm at cvs.openbsd.org 2013/01/26 06:11:05
- [Makefile.in acss.c acss.h cipher-acss.c cipher.c]
- [openbsd-compat/openssl-compat.h]
- remove ACSS, now that it is gone from libcrypto too
- - djm at cvs.openbsd.org 2013/01/27 10:06:12
- [krl.c]
- actually use the xrealloc() return value; spotted by xi.wang AT gmail.com
- - dtucker at cvs.openbsd.org 2013/02/06 00:20:42
- [servconf.c sshd_config sshd_config.5]
- Change default of MaxStartups to 10:30:100 to start doing random early
- drop at 10 connections up to 100 connections. This will make it harder
- to DoS as CPUs have come a long way since the original value was set
- back in 2000. Prompted by nion at debian org, ok markus@
- - dtucker at cvs.openbsd.org 2013/02/06 00:22:21
- [auth.c]
- Fix comment, from jfree.e1 at gmail
- - djm at cvs.openbsd.org 2013/02/08 00:41:12
- [sftp.c]
- fix NULL deref when built without libedit and control characters
- entered as command; debugging and patch from Iain Morgan an
- Loganaden Velvindron in bz#1956
- - markus at cvs.openbsd.org 2013/02/10 21:19:34
- [version.h]
- openssh 6.2
- - djm at cvs.openbsd.org 2013/02/10 23:32:10
- [ssh-keygen.c]
- append to moduli file when screening candidates rather than overwriting.
- allows resumption of interrupted screen; patch from Christophe Garault
- in bz#1957; ok dtucker@
- - djm at cvs.openbsd.org 2013/02/10 23:35:24
- [packet.c]
- record "Received disconnect" messages at ERROR rather than INFO priority,
- since they are abnormal and result in a non-zero ssh exit status; patch
- from Iain Morgan in bz#2057; ok dtucker@
- - dtucker at cvs.openbsd.org 2013/02/11 21:21:58
- [sshd.c]
- Add openssl version to debug output similar to the client. ok markus@
- - djm at cvs.openbsd.org 2013/02/11 23:58:51
- [regress/try-ciphers.sh]
- remove acss here too
- - (djm) [regress/try-ciphers.sh] clean up CVS merge botch
+ upstream commit
+
+ deprecate ancient, pre-RFC4419 and undocumented
+ SSH2_MSG_KEX_DH_GEX_REQUEST_OLD message; ok markus@ deraadt@ "seems
+ reasonable" dtucker@
-20130211
- - (djm) [configure.ac openbsd-compat/openssl-compat.h] Repair build on old
- libcrypto that lacks EVP_CIPHER_CTX_ctrl
+commit d8f391caef62378463a0e6b36f940170dadfe605
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Fri Apr 10 05:16:50 2015 +0000
-20130208
- - (djm) [contrib/redhat/sshd.init] treat RETVAL as an integer;
- patch from Iain Morgan in bz#2059
- - (dtucker) [configure.ac openbsd-compat/sys-tree.h] Test if compiler allows
- __attribute__ on return values and work around if necessary. ok djm@
+ upstream commit
+
+ Don't send hostkey advertisments
+ (hostkeys-00 at openssh.com) to current versions of Tera Term as they can't
+ handle them. Newer versions should be OK. Patch from Bryan Drewery and
+ IWAMOTO Kouichi, ok djm@
-20130207
- - (djm) [configure.ac] Don't probe seccomp capability of running kernel
- at configure time; the seccomp sandbox will fall back to rlimit at
- runtime anyway. Patch from plautrba AT redhat.com in bz#2011
+commit 2c2cfe1a1c97eb9a08cc9817fd0678209680c636
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 10 00:08:55 2015 +0000
-20130120
- - (djm) [cipher-aes.c cipher-ctr.c openbsd-compat/openssl-compat.h]
- Move prototypes for replacement ciphers to openssl-compat.h; fix EVP
- prototypes for openssl-1.0.0-fips.
- - (djm) OpenBSD CVS Sync
- - jmc at cvs.openbsd.org 2013/01/18 07:57:47
- [ssh-keygen.1]
- tweak previous;
- - jmc at cvs.openbsd.org 2013/01/18 07:59:46
- [ssh-keygen.c]
- -u before -V in usage();
- - jmc at cvs.openbsd.org 2013/01/18 08:00:49
- [sshd_config.5]
- tweak previous;
- - jmc at cvs.openbsd.org 2013/01/18 08:39:04
- [ssh-keygen.1]
- add -Q to the options list; ok djm
- - jmc at cvs.openbsd.org 2013/01/18 21:48:43
- [ssh-keygen.1]
- command-line (adj.) -> command line (n.);
- - jmc at cvs.openbsd.org 2013/01/19 07:13:25
- [ssh-keygen.1]
- fix some formatting; ok djm
- - markus at cvs.openbsd.org 2013/01/19 12:34:55
- [krl.c]
- RB_INSERT does not remove existing elments; ok djm@
- - (djm) [openbsd-compat/sys-tree.h] Sync with OpenBSD. krl.c needs newer
- version.
- - (djm) [regress/krl.sh] replacement for jot; most platforms lack it
+ upstream commit
+
+ include port number if a non-default one has been
+ specified; based on patch from Michael Handler
-20130118
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/01/17 23:00:01
- [auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5]
- [krl.c krl.h PROTOCOL.krl]
- add support for Key Revocation Lists (KRLs). These are a compact way to
- represent lists of revoked keys and certificates, taking as little as
- a single bit of incremental cost to revoke a certificate by serial number.
- KRLs are loaded via the existing RevokedKeys sshd_config option.
- feedback and ok markus@
- - djm at cvs.openbsd.org 2013/01/18 00:45:29
- [regress/Makefile regress/cert-userkey.sh regress/krl.sh]
- Tests for Key Revocation Lists (KRLs)
- - djm at cvs.openbsd.org 2013/01/18 03:00:32
- [krl.c]
- fix KRL generation bug for list sections
+commit 4492a4f222da4cf1e8eab12689196322e27b08c4
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Apr 7 23:00:42 2015 +0000
-20130117
- - (djm) [regress/cipher-speed.sh regress/integrity.sh regress/try-ciphers.sh]
- check for GCM support before testing GCM ciphers.
+ upstream commit
+
+ treat Protocol=1,2|2,1 as Protocol=2 when compiled
+ without SSH1 support; ok dtucker@ millert@
-20130112
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2013/01/12 11:22:04
- [cipher.c]
- improve error message for integrity failure in AES-GCM modes; ok markus@
- - djm at cvs.openbsd.org 2013/01/12 11:23:53
- [regress/cipher-speed.sh regress/integrity.sh regress/try-ciphers.sh]
- test AES-GCM modes; feedback markus@
- - (djm) [regress/integrity.sh] repair botched merge
+commit c265e2e6e932efc6d86f6cc885dea33637a67564
+Author: miod at openbsd.org <miod at openbsd.org>
+Date: Sun Apr 5 15:43:43 2015 +0000
-20130109
- - (djm) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2012/12/14 05:26:43
- [auth.c]
- use correct string in error message; from rustybsd at gmx.fr
- - djm at cvs.openbsd.org 2013/01/02 00:32:07
- [clientloop.c mux.c]
- channel_setup_local_fwd_listener() returns 0 on failure, not -ve
- bz#2055 reported by mathieu.lacage AT gmail.com
- - djm at cvs.openbsd.org 2013/01/02 00:33:49
- [PROTOCOL.agent]
- correct format description for SSH_AGENTC_ADD_RSA_ID_CONSTRAINED
- bz#2051 from david AT lechnology.com
- - djm at cvs.openbsd.org 2013/01/03 05:49:36
- [servconf.h]
- add a couple of ServerOptions members that should be copied to the privsep
- child (for consistency, in this case they happen only to be accessed in
- the monitor); ok dtucker@
- - djm at cvs.openbsd.org 2013/01/03 12:49:01
- [PROTOCOL]
- fix description of MAC calculation for EtM modes; ok markus@
- - djm at cvs.openbsd.org 2013/01/03 12:54:49
- [sftp-server.8 sftp-server.c]
- allow specification of an alternate start directory for sftp-server(8)
- "I like this" markus@
- - djm at cvs.openbsd.org 2013/01/03 23:22:58
- [ssh-keygen.c]
- allow fingerprinting of keys hosted in PKCS#11 tokens: ssh-keygen -lD ...
- ok markus@
- - jmc at cvs.openbsd.org 2013/01/04 19:26:38
- [sftp-server.8 sftp-server.c]
- sftp-server.8: add argument name to -d
- sftp-server.c: add -d to usage()
- ok djm
- - markus at cvs.openbsd.org 2013/01/08 18:49:04
- [PROTOCOL authfile.c cipher.c cipher.h kex.c kex.h monitor_wrap.c]
- [myproposal.h packet.c ssh_config.5 sshd_config.5]
- support AES-GCM as defined in RFC 5647 (but with simpler KEX handling)
- ok and feedback djm@
- - djm at cvs.openbsd.org 2013/01/09 05:40:17
- [ssh-keygen.c]
- correctly initialise fingerprint type for fingerprinting PKCS#11 keys
- - (djm) [cipher.c configure.ac openbsd-compat/openssl-compat.h]
- Fix merge botch, automatically detect AES-GCM in OpenSSL, move a little
- cipher compat code to openssl-compat.h
+ upstream commit
+
+ Do not use int for sig_atomic_t; spotted by
+ christos at netbsd; ok markus@
-20121217
- - (dtucker) [Makefile.in] Add some scaffolding so that the new regress
- tests will work with VPATH directories.
+commit e7bf3a5eda6a1b02bef6096fed78527ee11e54cc
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Apr 7 10:48:04 2015 +1000
-20121213
- - (djm) OpenBSD CVS Sync
- - markus at cvs.openbsd.org 2012/12/12 16:45:52
- [packet.c]
- reset incoming_packet buffer for each new packet in EtM-case, too;
- this happens if packets are parsed only parially (e.g. ignore
- messages sent when su/sudo turn off echo); noted by sthen/millert
- - naddy at cvs.openbsd.org 2012/12/12 16:46:10
- [cipher.c]
- use OpenSSL's EVP_aes_{128,192,256}_ctr() API and remove our hand-rolled
- counter mode code; ok djm@
- - (djm) [configure.ac cipher-ctr.c] Adapt EVP AES CTR change to retain our
- compat code for older OpenSSL
- - (djm) [cipher.c] Fix missing prototype for compat code
+ Use do{}while(0) for no-op functions.
+
+ From FreeBSD.
-20121212
- - (djm) OpenBSD CVS Sync
- - markus at cvs.openbsd.org 2012/12/11 22:16:21
- [monitor.c]
- drain the log messages after receiving the keystate from the unpriv
- child. otherwise it might block while sending. ok djm@
- - markus at cvs.openbsd.org 2012/12/11 22:31:18
- [PROTOCOL authfile.c cipher.c cipher.h kex.h mac.c myproposal.h]
- [packet.c ssh_config.5 sshd_config.5]
- add encrypt-then-mac (EtM) modes to openssh by defining new mac algorithms
- that change the packet format and compute the MAC over the encrypted
- message (including the packet size) instead of the plaintext data;
- these EtM modes are considered more secure and used by default.
- feedback and ok djm@
- - sthen at cvs.openbsd.org 2012/12/11 22:51:45
- [mac.c]
- fix typo, s/tem/etm in hmac-ripemd160-tem. ok markus@
- - markus at cvs.openbsd.org 2012/12/11 22:32:56
- [regress/try-ciphers.sh]
- add etm modes
- - markus at cvs.openbsd.org 2012/12/11 22:42:11
- [regress/Makefile regress/modpipe.c regress/integrity.sh]
- test the integrity of the packets; with djm@
- - markus at cvs.openbsd.org 2012/12/11 23:12:13
- [try-ciphers.sh]
- add hmac-ripemd160-etm at openssh.com
- - (djm) [mac.c] fix merge botch
- - (djm) [regress/Makefile regress/integrity.sh] Make the integrity.sh test
- work on platforms without 'jot'
- - (djm) [regress/integrity.sh] Fix awk quoting, packet length skip
- - (djm) [regress/Makefile] fix t-exec rule
+commit bb99844abae2b6447272f79e7fa84134802eb4df
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Apr 7 10:47:15 2015 +1000
-20121207
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2012/12/06 06:06:54
- [regress/keys-command.sh]
- Fix some problems with the keys-command test:
- - use string comparison rather than numeric comparison
- - check for existing KEY_COMMAND file and don't clobber if it exists
- - clean up KEY_COMMAND file if we do create it.
- - check that KEY_COMMAND is executable (which it won't be if eg /var/run
- is mounted noexec).
- ok djm.
- - jmc at cvs.openbsd.org 2012/12/03 08:33:03
- [ssh-add.1 sshd_config.5]
- tweak previous;
- - markus at cvs.openbsd.org 2012/12/05 15:42:52
- [ssh-add.c]
- prevent double-free of comment; ok djm@
- - dtucker at cvs.openbsd.org 2012/12/07 01:51:35
- [serverloop.c]
- Cast signal to int for logging. A no-op on openbsd (they're always ints)
- but will prevent warnings in portable. ok djm@
+ Wrap blf.h include in ifdef. From FreeBSD.
-20121205
- - (tim) [defines.h] Some platforms are missing ULLONG_MAX. Feedback djm at .
+commit d9b9b43656091cf0ad55c122f08fadb07dad0abd
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Apr 7 09:10:00 2015 +1000
-20121203
- - (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD to get
- TAILQ_FOREACH_SAFE needed for upcoming changes.
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2012/12/02 20:26:11
- [ssh_config.5 sshconnect2.c]
- Make IdentitiesOnly apply to keys obtained from a PKCS11Provider.
- This allows control of which keys are offered from tokens using
- IdentityFile. ok markus@
- - djm at cvs.openbsd.org 2012/12/02 20:42:15
- [ssh-add.1 ssh-add.c]
- make deleting explicit keys "ssh-add -d" symmetric with adding keys -
- try to delete the corresponding certificate too and respect the -k option
- to allow deleting of the key only; feedback and ok markus@
- - djm at cvs.openbsd.org 2012/12/02 20:46:11
- [auth-options.c channels.c servconf.c servconf.h serverloop.c session.c]
- [sshd_config.5]
- make AllowTcpForwarding accept "local" and "remote" in addition to its
- current "yes"/"no" to allow the server to specify whether just local or
- remote TCP forwarding is enabled. ok markus@
- - dtucker at cvs.openbsd.org 2012/10/05 02:20:48
- [regress/cipher-speed.sh regress/try-ciphers.sh]
- Add umac-128 at openssh.com to the list of MACs to be tested
- - djm at cvs.openbsd.org 2012/10/19 05:10:42
- [regress/cert-userkey.sh]
- include a serial number when generating certs
- - djm at cvs.openbsd.org 2012/11/22 22:49:30
- [regress/Makefile regress/keys-command.sh]
- regress for AuthorizedKeysCommand; hints from markus@
- - djm at cvs.openbsd.org 2012/12/02 20:47:48
- [Makefile regress/forward-control.sh]
- regress for AllowTcpForwarding local/remote; ok markus@
- - djm at cvs.openbsd.org 2012/12/03 00:14:06
- [auth2-chall.c ssh-keygen.c]
- Fix compilation with -Wall -Werror (trivial type fixes)
- - (djm) [configure.ac] Turn on -g for gcc compilers. Helps pre-installation
- debugging. ok dtucker@
- - (djm) [configure.ac] Revert previous. configure.ac already does this
- for us.
+ Fix misspellings of regress CONFOPTS env variables.
+
+ Patch from Bryan Drewery.
-20121114
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2012/11/14 02:24:27
- [auth2-pubkey.c]
- fix username passed to helper program
- prepare stdio fds before closefrom()
- spotted by landry@
- - djm at cvs.openbsd.org 2012/11/14 02:32:15
- [ssh-keygen.c]
- allow the full range of unsigned serial numbers; 'fine' deraadt@
- - djm at cvs.openbsd.org 2012/12/02 20:34:10
- [auth.c auth.h auth1.c auth2-chall.c auth2-gss.c auth2-jpake.c auth2.c]
- [monitor.c monitor.h]
- Fixes logging of partial authentication when privsep is enabled
- Previously, we recorded "Failed xxx" since we reset authenticated before
- calling auth_log() in auth2.c. This adds an explcit "Partial" state.
-
- Add a "submethod" to auth_log() to report which submethod is used
- for keyboard-interactive.
-
- Fix multiple authentication when one of the methods is
- keyboard-interactive.
-
+commit 3f4ea3c9ab1d32d43c9222c4351f58ca11144156
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Apr 3 22:17:27 2015 +0000
+
+ upstream commit
+
+ correct return value in pubkey parsing, spotted by Ben Hawkes
ok markus@
- - dtucker at cvs.openbsd.org 2012/10/05 02:05:30
- [regress/multiplex.sh]
- Use 'kill -0' to test for the presence of a pid since it's more portable
-20121107
- - (djm) OpenBSD CVS Sync
- - eric at cvs.openbsd.org 2011/11/28 08:46:27
- [moduli.5]
- fix formula
+commit 7da2be0cb9601ed25460c83aa4d44052b967ba0f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 31 22:59:01 2015 +0000
+
+ upstream commit
+
+ adapt to recent hostfile.c change: when parsing
+ known_hosts without fully parsing the keys therein, hostkeys_foreach() will
+ now correctly identify KEY_RSA1 keys; ok markus@ miod@
+
+commit 9e1777a0d1c706714b055811c12ab8cc21033e4a
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Mar 24 20:19:15 2015 +0000
+
+ upstream commit
+
+ use ${SSH} for -Q instead of installed ssh
+
+commit ce1b358ea414a2cc88e4430cd5a2ea7fecd9de57
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Mar 16 22:46:14 2015 +0000
+
+ upstream commit
+
+ make CLEANFILES clean up more of the tests' droppings
+
+commit 398f9ef192d820b67beba01ec234d66faca65775
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 31 22:57:06 2015 +0000
+
+ upstream commit
+
+ downgrade error() for known_hosts parse errors to debug()
+ to quiet warnings from ssh1 keys present when compiled !ssh1.
+
+ also identify ssh1 keys when scanning, even when compiled !ssh1
+
+ ok markus@ miod@
+
+commit 9a47ab80030a31f2d122b8fd95bd48c408b9fcd9
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 31 22:55:50 2015 +0000
+
+ upstream commit
+
+ fd leak for !ssh1 case; found by unittests; ok markus@
+
+commit c9a0805a6280681901c270755a7cd630d7c5280e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 31 22:55:24 2015 +0000
+
+ upstream commit
+
+ don't fatal when a !ssh1 sshd is reexeced from a w/ssh1
+ listener; reported by miod@; ok miod@ markus@
+
+commit 704d8c88988cae38fb755a6243b119731d223222
+Author: tobias at openbsd.org <tobias at openbsd.org>
+Date: Tue Mar 31 11:06:49 2015 +0000
+
+ upstream commit
+
+ Comments are only supported for RSA1 keys. If a user
+ tried to add one and entered his passphrase, explicitly clear it before exit.
+ This is done in all other error paths, too.
+
+ ok djm
+
+commit 78de1673c05ea2c33e0d4a4b64ecb5186b6ea2e9
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Mon Mar 30 18:28:37 2015 +0000
+
+ upstream commit
+
+ ssh-askpass(1) is the default, overridden by SSH_ASKPASS;
+ diff originally from jiri b;
+
+commit 26e0bcf766fadb4a44fb6199386fb1dcab65ad00
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Mar 30 00:00:29 2015 +0000
+
+ upstream commit
+
+ fix uninitialised memory read when parsing a config file
+ consisting of a single nul byte. Found by hanno AT hboeck.de using AFL; ok
+ dtucker
+
+commit fecede00a76fbb33a349f5121c0b2f9fbc04a777
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Thu Mar 26 19:32:19 2015 +0000
+
+ upstream commit
+
+ sigp and lenp are not optional in ssh_agent_sign(); ok
+ djm@
+
+commit 1b0ef3813244c78669e6d4d54c624f600945327d
+Author: naddy at openbsd.org <naddy at openbsd.org>
+Date: Thu Mar 26 12:32:38 2015 +0000
+
+ upstream commit
+
+ don't try to load .ssh/identity by default if SSH1 is
+ disabled; ok markus@
+
+commit f9b78852379b74a2d14e6fc94fe52af30b7e9c31
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Mar 26 07:00:04 2015 +0000
+
+ upstream commit
+
+ ban all-zero curve25519 keys as recommended by latest
+ CFRG curves draft; ok markus
+
+commit b8afbe2c1aaf573565e4da775261dfafc8b1ba9c
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Mar 26 06:59:28 2015 +0000
+
+ upstream commit
+
+ relax bits needed check to allow
+ diffie-hellman-group1-sha1 key exchange to complete for chacha20-poly1305 was
+ selected as symmetric cipher; ok markus
+
+commit 47842f71e31da130555353c1d57a1e5a8937f1c0
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Mar 25 19:29:58 2015 +0000
+
+ upstream commit
+
+ ignore v1 errors on ssh-add -D; only try v2 keys on
+ -l/-L (unless WITH_SSH1) ok djm@
+
+commit 5f57e77f91bf2230c09eca96eb5ecec39e5f2da6
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Mar 25 19:21:48 2015 +0000
+
+ upstream commit
+
+ unbreak ssh_agent_sign (lenp vs *lenp)
+
+commit 4daeb67181054f2a377677fac919ee8f9ed3490e
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Mar 24 20:10:08 2015 +0000
+
+ upstream commit
+
+ don't leak 'setp' on error; noted by Nicholas Lemonias;
ok djm@
- - jmc at cvs.openbsd.org 2012/09/26 17:34:38
- [moduli.5]
- last stage of rfc changes, using consistent Rs/Re blocks, and moving the
- references into a STANDARDS section;
-20121105
- - (dtucker) [uidswap.c openbsd-compat/Makefile.in
- openbsd-compat/bsd-setres_id.c openbsd-compat/bsd-setres_id.h
- openbsd-compat/openbsd-compat.h] Move the fallback code for setting uids
- and gids from uidswap.c to the compat library, which allows it to work with
- the new setresuid calls in auth2-pubkey. with tim@, ok djm@
- - (dtucker) [auth2-pubkey.c] wrap paths.h in an ifdef for platforms that
- don't have it. Spotted by tim at .
+commit 7d4f96f9de2a18af0d9fa75ea89a4990de0344f5
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Mar 24 20:09:11 2015 +0000
-20121104
- - (djm) OpenBSD CVS Sync
- - jmc at cvs.openbsd.org 2012/10/31 08:04:50
- [sshd_config.5]
- tweak previous;
- - djm at cvs.openbsd.org 2012/11/04 10:38:43
- [auth2-pubkey.c sshd.c sshd_config.5]
- Remove default of AuthorizedCommandUser. Administrators are now expected
- to explicitly specify a user. feedback and ok markus@
- - djm at cvs.openbsd.org 2012/11/04 11:09:15
- [auth.h auth1.c auth2.c monitor.c servconf.c servconf.h sshd.c]
- [sshd_config.5]
- Support multiple required authentication via an AuthenticationMethods
- option. This option lists one or more comma-separated lists of
- authentication method names. Successful completion of all the methods in
- any list is required for authentication to complete;
- feedback and ok markus@
+ upstream commit
+
+ consistent check for NULL as noted by Nicholas
+ Lemonias; ok djm@
-20121030
- - (djm) OpenBSD CVS Sync
- - markus at cvs.openbsd.org 2012/10/05 12:34:39
- [sftp.c]
- fix signed vs unsigned warning; feedback & ok: djm@
- - djm at cvs.openbsd.org 2012/10/30 21:29:55
- [auth-rsa.c auth.c auth.h auth2-pubkey.c servconf.c servconf.h]
- [sshd.c sshd_config sshd_config.5]
- new sshd_config option AuthorizedKeysCommand to support fetching
- authorized_keys from a command in addition to (or instead of) from
- the filesystem. The command is run as the target server user unless
- another specified via a new AuthorizedKeysCommandUser option.
-
- patch originally by jchadima AT redhat.com, reworked by me; feedback
+commit df100be51354e447d9345cf1ec22e6013c0eed50
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Mar 24 20:03:44 2015 +0000
+
+ upstream commit
+
+ correct fmt-string for size_t as noted by Nicholas
+ Lemonias; ok djm@
+
+commit a22b9ef21285e81775732436f7c84a27bd3f71e0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 24 09:17:21 2015 +0000
+
+ upstream commit
+
+ promote chacha20-poly1305 at openssh.com to be the default
+ cipher; ok markus
+
+commit 2aa9da1a3b360cf7b13e96fe1521534b91501fb5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 24 01:29:19 2015 +0000
+
+ upstream commit
+
+ Compile-time disable SSH protocol 1. You can turn it
+ back on using the Makefile.inc knob if you need it to talk to ancient
+ devices.
+
+commit 53097b2022154edf96b4e8526af5666f979503f7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 24 01:11:12 2015 +0000
+
+ upstream commit
+
+ fix double-negative error message "ssh1 is not
+ unsupported"
+
+commit 5c27e3b6ec2db711dfcd40e6359c0bcdd0b62ea9
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Mar 23 06:06:38 2015 +0000
+
+ upstream commit
+
+ for ssh-keygen -A, don't try (and fail) to generate ssh
+ v.1 keys when compiled without SSH1 support RSA/DSA/ECDSA keys when compiled
+ without OpenSSL based on patch by Mike Frysinger; bz#2369
+
+commit 725fd22a8c41db7de73a638539a5157b7e4424ae
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Mar 18 01:44:21 2015 +0000
+
+ upstream commit
+
+ KRL support doesn't need OpenSSL anymore, remove #ifdefs
+ from around call
+
+commit b07011c18e0b2e172c5fd09d21fb159a0bf5fcc7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Mar 16 11:09:52 2015 +0000
+
+ upstream commit
+
+ #if 0 some more arrays used only for decrypting (we don't
+ use since we only need encrypt for AES-CTR)
+
+commit 1cb3016635898d287e9d58b50c430995652d5358
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Wed Mar 11 00:48:39 2015 +0000
+
+ upstream commit
+
+ add back the changes from rev 1.206, djm reverted this by
+ mistake in rev 1.207
+
+commit 4d24b3b6a4a6383e05e7da26d183b79fa8663697
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Mar 20 09:11:59 2015 +1100
+
+ remove error() accidentally inserted for debugging
+
+ pointed out by Christian Hesse
+
+commit 9f82e5a9042f2d872e98f48a876fcab3e25dd9bb
+Author: Tim Rice <tim at multitalents.net>
+Date: Mon Mar 16 22:49:20 2015 -0700
+
+ portability fix: Solaris systems may not have a grep that understands -q
+
+commit 8ef691f7d9ef500257a549d0906d78187490668f
+Author: Damien Miller <djm at google.com>
+Date: Wed Mar 11 10:35:26 2015 +1100
+
+ fix compile with clang
+
+commit 4df590cf8dc799e8986268d62019b487a8ed63ad
+Author: Damien Miller <djm at google.com>
+Date: Wed Mar 11 10:02:39 2015 +1100
+
+ make unit tests work for !OPENSSH_HAS_ECC
+
+commit 307bb40277ca2c32e97e61d70d1ed74b571fd6ba
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Mar 7 04:41:48 2015 +0000
+
+ upstream commit
+
+ unbreak for w/SSH1 (default) case; ok markus@ deraadt@
+
+commit b44ee0c998fb4c5f3c3281f2398af5ce42840b6f
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Mar 5 18:39:20 2015 -0800
+
+ unbreak hostkeys test for w/ SSH1 case
+
+commit 55e5bdeb519cb60cc18b7ba0545be581fb8598b4
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Mar 6 01:40:56 2015 +0000
+
+ upstream commit
+
+ fix sshkey_certify() return value for unsupported key types;
+ ok markus@ deraadt@
+
+commit be8f658e550a434eac04256bfbc4289457a24e99
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Mar 4 15:38:03 2015 -0800
+
+ update version numbers to match version.h
+
+commit ac5e8acefa253eb5e5ba186e34236c0e8007afdc
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Mar 4 23:22:35 2015 +0000
+
+ upstream commit
+
+ make these work with !SSH1; ok markus@ deraadt@
+
+commit 2f04af92f036b0c87a23efb259c37da98cd81fe6
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Mar 4 21:12:59 2015 +0000
+
+ upstream commit
+
+ make ssh-add -D work with !SSH1 agent
+
+commit a05adf95d2af6abb2b7826ddaa7a0ec0cdc1726b
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Mar 4 00:55:48 2015 -0800
+
+ netcat needs poll.h portability goop
+
+commit dad2b1892b4c1b7e58df483a8c5b983c4454e099
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Mar 3 22:35:19 2015 +0000
+
+ upstream commit
+
+ make it possible to run tests w/o ssh1 support; ok djm@
+
+commit d48a22601bdd3eec054794c535f4ae8d8ae4c6e2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Mar 4 18:53:53 2015 +0000
+
+ upstream commit
+
+ crank; ok markus, deraadt
+
+commit bbffb23daa0b002dd9f296e396a9ab8a5866b339
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Mar 3 13:50:27 2015 -0800
+
+ more --without-ssh1 fixes
+
+commit 6c2039286f503e2012a58a1d109e389016e7a99b
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Mar 3 13:48:48 2015 -0800
+
+ fix merge both that broke --without-ssh1 compile
+
+commit 111dfb225478a76f89ecbcd31e96eaf1311b59d3
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 3 21:21:13 2015 +0000
+
+ upstream commit
+
+ add SSH1 Makefile knob to make it easier to build without
+ SSH1 support; ok markus@
+
+commit 3f7f5e6c5d2aa3f6710289c1a30119e534e56c5c
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 3 20:42:49 2015 +0000
+
+ upstream commit
+
+ expand __unused to full __attribute__ for better portability
+
+commit 2fab9b0f8720baf990c931e3f68babb0bf9949c6
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Mar 4 07:41:27 2015 +1100
+
+ avoid warning
+
+commit d1bc844322461f882b4fd2277ba9a8d4966573d2
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Mar 4 06:31:45 2015 +1100
+
+ Revert "define __unused to nothing if not already defined"
+
+ This reverts commit 1598419e38afbaa8aa5df8dd6b0af98301e2c908.
+
+ Some system headers have objects named __unused
+
+commit 00797e86b2d98334d1bb808f65fa1fd47f328ff1
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Mar 4 05:02:45 2015 +1100
+
+ check for crypt and DES_crypt in openssl block
+
+ fixes builds on systems that use DES_crypt; based on patch
+ from Roumen Petrov
+
+commit 1598419e38afbaa8aa5df8dd6b0af98301e2c908
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Mar 4 04:59:13 2015 +1100
+
+ define __unused to nothing if not already defined
+
+ fixes builds on BSD/OS
+
+commit d608a51daad4f14ad6ab43d7cf74ef4801cc3fe9
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 3 17:53:40 2015 +0000
+
+ upstream commit
+
+ reorder logic for better portability; patch from Roumen
+ Petrov
+
+commit 68d2dfc464fbcdf8d6387884260f9801f4352393
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Mar 3 06:48:58 2015 +0000
+
+ upstream commit
+
+ Allow "ssh -Q protocol-version" to list supported SSH
+ protocol versions. Useful for detecting builds without SSH v.1 support; idea
and ok markus@
-20121019
- - (tim) [buildpkg.sh.in] Double up on some backslashes so they end up in
- the generated file as intended.
+commit 39e2f1229562e1195169905607bc12290d21f021
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Sun Mar 1 15:44:40 2015 +0000
-20121005
- - (dtucker) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2012/09/17 09:54:44
- [sftp.c]
- an XXX for later
- - markus at cvs.openbsd.org 2012/09/17 13:04:11
- [packet.c]
- clear old keys on rekeing; ok djm
- - dtucker at cvs.openbsd.org 2012/09/18 10:36:12
- [sftp.c]
- Add bounds check on sftp tab-completion. Part of a patch from from
- Jean-Marc Robert via tech@, ok djm
- - dtucker at cvs.openbsd.org 2012/09/21 10:53:07
- [sftp.c]
- Fix improper handling of absolute paths when PWD is part of the completed
- path. Patch from Jean-Marc Robert via tech@, ok djm.
- - dtucker at cvs.openbsd.org 2012/09/21 10:55:04
- [sftp.c]
- Fix handling of filenames containing escaped globbing characters and
- escape "#" and "*". Patch from Jean-Marc Robert via tech@, ok djm.
- - jmc at cvs.openbsd.org 2012/09/26 16:12:13
- [ssh.1]
- last stage of rfc changes, using consistent Rs/Re blocks, and moving the
- references into a STANDARDS section;
- - naddy at cvs.openbsd.org 2012/10/01 13:59:51
- [monitor_wrap.c]
- pasto; ok djm@
- - djm at cvs.openbsd.org 2012/10/02 07:07:45
- [ssh-keygen.c]
- fix -z option, broken in revision 1.215
- - markus at cvs.openbsd.org 2012/10/04 13:21:50
- [myproposal.h ssh_config.5 umac.h sshd_config.5 ssh.1 sshd.8 mac.c]
- add umac128 variant; ok djm@ at n2k12
- - dtucker at cvs.openbsd.org 2012/09/06 04:11:07
- [regress/try-ciphers.sh]
- Restore missing space. (Id sync only).
- - dtucker at cvs.openbsd.org 2012/09/09 11:51:25
- [regress/multiplex.sh]
- Add test for ssh -Ostop
- - dtucker at cvs.openbsd.org 2012/09/10 00:49:21
- [regress/multiplex.sh]
- Log -O cmd output to the log file and make logging consistent with the
- other tests. Test clean shutdown of an existing channel when testing
- "stop".
- - dtucker at cvs.openbsd.org 2012/09/10 01:51:19
- [regress/multiplex.sh]
- use -Ocheck and waiting for completions by PID to make multiplexing test
- less racy and (hopefully) more reliable on slow hardware.
- - [Makefile umac.c] Add special-case target to build umac128.o.
- - [umac.c] Enforce allowed umac output sizes. From djm at .
- - [Makefile.in] "Using $< in a non-suffix rule context is a GNUmake idiom".
+ upstream commit
+
+ Make sure we only call getnameinfo() for AF_INET or AF_INET6
+ sockets. getpeername() of a Unix domain socket may return without error on
+ some systems without actually setting ss_family so getnameinfo() was getting
+ called with ss_family set to AF_UNSPEC. OK djm@
-20120917
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2012/09/13 23:37:36
- [servconf.c]
- Fix comment line length
- - markus at cvs.openbsd.org 2012/09/14 16:51:34
- [sshconnect.c]
- remove unused variable
+commit e47536ba9692d271b8ad89078abdecf0a1c11707
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Feb 28 08:20:11 2015 -0800
-20120907
- - (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2012/09/06 09:50:13
- [clientloop.c]
- Make the escape command help (~?) context sensitive so that only commands
- that will work in the current session are shown. ok markus@
- - jmc at cvs.openbsd.org 2012/09/06 13:57:42
- [ssh.1]
- missing letter in previous;
- - dtucker at cvs.openbsd.org 2012/09/07 00:30:19
- [clientloop.c]
- Print '^Z' instead of a raw ^Z when the sequence is not supported. ok djm@
- - dtucker at cvs.openbsd.org 2012/09/07 01:10:21
- [clientloop.c]
- Merge escape help text for ~v and ~V; ok djm@
- - dtucker at cvs.openbsd.org 2012/09/07 06:34:21
- [clientloop.c]
- when muxmaster is run with -N, make it shut down gracefully when a client
- sends it "-O stop" rather than hanging around (bz#1985). ok djm@
+ portability fixes for regress/netcat.c
+
+ Mostly avoiding "err(1, NULL)"
-20120906
- - (dtucker) OpenBSD CVS Sync
- - jmc at cvs.openbsd.org 2012/08/15 18:25:50
- [ssh-keygen.1]
- a little more info on certificate validity;
- requested by Ross L Richardson, and provided by djm
- - dtucker at cvs.openbsd.org 2012/08/17 00:45:45
- [clientloop.c clientloop.h mux.c]
- Force a clean shutdown of ControlMaster client sessions when the ~. escape
- sequence is used. This means that ~. should now work in mux clients even
- if the server is no longer responding. Found by tedu, ok djm.
- - djm at cvs.openbsd.org 2012/08/17 01:22:56
- [kex.c]
- add some comments about better handling first-KEX-follows notifications
- from the server. Nothing uses these right now. No binary change
- - djm at cvs.openbsd.org 2012/08/17 01:25:58
- [ssh-keygen.c]
- print details of which host lines were deleted when using
- "ssh-keygen -R host"; ok markus@
- - djm at cvs.openbsd.org 2012/08/17 01:30:00
- [compat.c sshconnect.c]
- Send client banner immediately, rather than waiting for the server to
- move first for SSH protocol 2 connections (the default). Patch based on
- one in bz#1999 by tls AT panix.com, feedback dtucker@ ok markus@
- - dtucker at cvs.openbsd.org 2012/09/06 04:37:39
- [clientloop.c log.c ssh.1 log.h]
- Add ~v and ~V escape sequences to raise and lower the logging level
- respectively. Man page help from jmc, ok deraadt jmc
+commit 02973ad5f6f49d8420e50a392331432b0396c100
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Feb 28 08:05:27 2015 -0800
-20120830
- - (dtucker) [moduli] Import new moduli file.
+ twiddle another test for portability
+
+ from Tom G. Christensen
-20120828
- - (djm) Release openssh-6.1
+commit f7f3116abf2a6e2f309ab096b08c58d19613e5d0
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Feb 27 15:52:49 2015 -0800
-20120828
- - (dtucker) [openbsd-compat/bsd-cygwin_util.h] define WIN32_LEAN_AND_MEAN
- for compatibility with future mingw-w64 headers. Patch from vinschen at
- redhat com.
+ twiddle test for portability
-20120822
- - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
- [contrib/suse/openssh.spec] Update version numbers
+commit 1ad3a77cc9d5568f5437ff99d377aa7a41859b83
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Feb 26 20:33:22 2015 -0800
-20120731
- - (djm) OpenBSD CVS Sync
- - jmc at cvs.openbsd.org 2012/07/06 06:38:03
- [ssh-keygen.c]
- missing full stop in usage();
- - djm at cvs.openbsd.org 2012/07/10 02:19:15
- [servconf.c servconf.h sshd.c sshd_config]
- Turn on systrace sandboxing of pre-auth sshd by default for new installs
- by shipping a config that overrides the current UsePrivilegeSeparation=yes
- default. Make it easier to flip the default in the future by adding too.
- prodded markus@ feedback dtucker@ "get it in" deraadt@
- - dtucker at cvs.openbsd.org 2012/07/13 01:35:21
- [servconf.c]
- handle long comments in config files better. bz#2025, ok markus
- - markus at cvs.openbsd.org 2012/07/22 18:19:21
- [version.h]
- openssh 6.1
+ make regress/netcat.c fd passing (more) portable
-20120720
- - (dtucker) Import regened moduli file.
+commit 9e1cfca7e1fe9cf8edb634fc894e43993e4da1ea
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Feb 26 20:32:58 2015 -0800
-20120706
- - (djm) [sandbox-seccomp-filter.c] fallback to rlimit if seccomp filter is
- not available. Allows use of sshd compiled on host with a filter-capable
- kernel on hosts that lack the support. bz#2011 ok dtucker@
- - (djm) [configure.ac] Recursively expand $(bindir) to ensure it has no
- unexpanded $(prefix) embedded. bz#2007 patch from nix-corp AT
- esperi.org.uk; ok dtucker@
-- (djm) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2012/07/06 00:41:59
- [moduli.c ssh-keygen.1 ssh-keygen.c]
- Add options to specify starting line number and number of lines to process
- when screening moduli candidates. This allows processing of different
- parts of a candidate moduli file in parallel. man page help jmc@, ok djm@
- - djm at cvs.openbsd.org 2012/07/06 01:37:21
- [mux.c]
- fix memory leak of passed-in environment variables and connection
- context when new session message is malformed; bz#2003 from Bert.Wesarg
- AT googlemail.com
- - djm at cvs.openbsd.org 2012/07/06 01:47:38
- [ssh.c]
- move setting of tty_flag to after config parsing so RequestTTY options
- are correctly picked up. bz#1995 patch from przemoc AT gmail.com;
- ok dtucker@
+ create OBJ/valgrind-out before running unittests
-20120704
- - (dtucker) [configure.ac openbsd-compat/bsd-misc.h] Add setlinebuf for
- platforms that don't have it. "looks good" tim@
+commit bd58853102cee739f0e115e6d4b5334332ab1442
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Feb 25 16:58:22 2015 -0800
-20120703
- - (dtucker) [configure.ac] Detect platforms that can't use select(2) with
- setrlimit(RLIMIT_NOFILE, rl_zero) and disable the rlimit sandbox on those.
- - (dtucker) [configure.ac sandbox-rlimit.c] Test whether or not
- setrlimit(RLIMIT_FSIZE, rl_zero) and skip it if it's not supported. Its
- benefit is minor, so it's not worth disabling the sandbox if it doesn't
- work.
+ valgrind support
-20120702
-- (dtucker) OpenBSD CVS Sync
- - naddy at cvs.openbsd.org 2012/06/29 13:57:25
- [ssh_config.5 sshd_config.5]
- match the documented MAC order of preference to the actual one;
- ok dtucker@
- - markus at cvs.openbsd.org 2012/06/30 14:35:09
- [sandbox-systrace.c sshd.c]
- fix a during the load of the sandbox policies (child can still make
- the read-syscall and wait forever for systrace-answers) by replacing
- the read/write synchronisation with SIGSTOP/SIGCONT;
- report and help hshoexer@; ok djm@, dtucker@
- - dtucker at cvs.openbsd.org 2012/07/02 08:50:03
- [ssh.c]
- set interactive ToS for forwarded X11 sessions. ok djm@
- - dtucker at cvs.openbsd.org 2012/07/02 12:13:26
- [ssh-pkcs11-helper.c sftp-client.c]
- fix a couple of "assigned but not used" warnings. ok markus@
- - dtucker at cvs.openbsd.org 2012/07/02 14:37:06
- [regress/connect-privsep.sh]
- remove exit from end of test since it prevents reporting failure
- - (dtucker) [regress/reexec.sh regress/sftp-cmds.sh regress/test-exec.sh]
- Move cygwin detection to test-exec and use to skip reexec test on cygwin.
- - (dtucker) [regress/test-exec.sh] Correct uname for cygwin/w2k.
+commit f43d17269194761eded9e89f17456332f4c83824
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Feb 26 20:45:47 2015 +0000
-20120629
- - OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2012/06/21 00:16:07
- [addrmatch.c]
- fix strlcpy truncation check. from carsten at debian org, ok markus
- - dtucker at cvs.openbsd.org 2012/06/22 12:30:26
- [monitor.c sshconnect2.c]
- remove dead code following 'for (;;)' loops.
- From Steve.McClellan at radisys com, ok markus@
- - dtucker at cvs.openbsd.org 2012/06/22 14:36:33
- [sftp.c]
- Remove unused variable leftover from tab-completion changes.
- From Steve.McClellan at radisys com, ok markus@
- - dtucker at cvs.openbsd.org 2012/06/26 11:02:30
- [sandbox-systrace.c]
- Add mquery to the list of allowed syscalls for "UsePrivilegeSeparation
- sandbox" since malloc now uses it. From johnw.mail at gmail com.
- - dtucker at cvs.openbsd.org 2012/06/28 05:07:45
- [mac.c myproposal.h ssh_config.5 sshd_config.5]
- Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs since they were removed
- from draft6 of the spec and will not be in the RFC when published. Patch
- from mdb at juniper net via bz#2023, ok markus.
- - naddy at cvs.openbsd.org 2012/06/29 13:57:25
- [ssh_config.5 sshd_config.5]
- match the documented MAC order of preference to the actual one; ok dtucker@
- - dtucker at cvs.openbsd.org 2012/05/13 01:42:32
- [regress/addrmatch.sh]
- Add "Match LocalAddress" and "Match LocalPort" to sshd and adjust tests
- to match. Feedback and ok djm@ markus at .
- - djm at cvs.openbsd.org 2012/06/01 00:47:35
- [regress/multiplex.sh regress/forwarding.sh]
- append to rather than truncate test log; bz#2013 from openssh AT
- roumenpetrov.info
- - djm at cvs.openbsd.org 2012/06/01 00:52:52
- [regress/sftp-cmds.sh]
- don't delete .* on cleanup due to unintended env expansion; pointed out in
- bz#2014 by openssh AT roumenpetrov.info
- - dtucker at cvs.openbsd.org 2012/06/26 12:06:59
- [regress/connect-privsep.sh]
- test sandbox with every malloc option
- - dtucker at cvs.openbsd.org 2012/06/28 05:07:45
- [regress/try-ciphers.sh regress/cipher-speed.sh]
- Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs since they were removed
- from draft6 of the spec and will not be in the RFC when published. Patch
- from mdb at juniper net via bz#2023, ok markus.
- - (dtucker) [myproposal.h] Remove trailing backslash to fix compile error.
- - (dtucker) [key.c] ifdef out sha256 key types on platforms that don't have
- the required functions in libcrypto.
+ upstream commit
+
+ don't printf NULL key comments; reported by Tom Christensen
-20120628
- - (dtucker) [openbsd-compat/getrrsetbyname-ldns.c] bz #2022: prevent null
- pointer deref in the client when built with LDNS and using DNSSEC with a
- CNAME. Patch from gregdlg+mr at hochet info.
+commit 6e6458b476ec854db33e3e68ebf4f489d0ab3df8
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Feb 25 23:05:47 2015 +0000
-20120622
- - (dtucker) [contrib/cygwin/ssh-host-config] Ensure that user sshd runs as
- can logon as a service. Patch from vinschen at redhat com.
+ upstream commit
+
+ zero cmsgbuf before use; we initialise the bits we use
+ but valgrind still spams warning on it
-20120620
- - (djm) OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2011/12/02 00:41:56
- [mux.c]
- fix bz#1948: ssh -f doesn't fork for multiplexed connection.
+commit a63cfa26864b93ab6afefad0b630e5358ed8edfa
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Feb 25 19:54:02 2015 +0000
+
+ upstream commit
+
+ fix small memory leak when UpdateHostkeys=no
+
+commit e6b950341dd75baa8526f1862bca39e52f5b879b
+Author: Tim Rice <tim at multitalents.net>
+Date: Wed Feb 25 09:56:48 2015 -0800
+
+ Revert "Work around finicky USL linker so netcat will build."
+
+ This reverts commit d1db656021d0cd8c001a6692f772f1de29b67c8b.
+
+ No longer needed with commit 678e473e2af2e4802f24dd913985864d9ead7fb3
+
+commit 6f621603f9cff2a5d6016a404c96cb2f8ac2dec0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Feb 25 17:29:38 2015 +0000
+
+ upstream commit
+
+ don't leak validity of user in "too many authentication
+ failures" disconnect message; reported by Sebastian Reitenbach
+
+commit 6288e3a935494df12519164f52ca5c8c65fc3ca5
+Author: naddy at openbsd.org <naddy at openbsd.org>
+Date: Tue Feb 24 15:24:05 2015 +0000
+
+ upstream commit
+
+ add -v (show ASCII art) to -l's synopsis; ok djm@
+
+commit 678e473e2af2e4802f24dd913985864d9ead7fb3
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Thu Feb 26 04:12:58 2015 +1100
+
+ Remove dependency on xmalloc.
+
+ Remove ssh_get_progname's dependency on xmalloc, which should reduce
+ link order problems. ok djm@
+
+commit 5d5ec165c5b614b03678afdad881f10e25832e46
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Feb 25 15:32:49 2015 +1100
+
+ Restrict ECDSA and ECDH tests.
+
+ ifdef out some more ECDSA and ECDH tests when built against an OpenSSL
+ that does not have eliptic curve functionality.
+
+commit 1734e276d99b17e92d4233fac7aef3a3180aaca7
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Feb 25 13:40:45 2015 +1100
+
+ Move definition of _NSIG.
+
+ _NSIG is only unsed in one file, so move it there prevent redefinition
+ warnings reported by Kevin Brott.
+
+commit a47ead7c95cfbeb72721066c4da2312e5b1b9f3d
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Feb 25 13:17:40 2015 +1100
+
+ Add includes.h for compatibility stuff.
+
+commit 38806bda6d2e48ad32812b461eebe17672ada771
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 24 16:50:06 2015 -0800
+
+ include netdb.h to look for MAXHOSTNAMELEN; ok tim
+
+commit d1db656021d0cd8c001a6692f772f1de29b67c8b
+Author: Tim Rice <tim at multitalents.net>
+Date: Tue Feb 24 10:42:08 2015 -0800
+
+ Work around finicky USL linker so netcat will build.
+
+commit cb030ce25f555737e8ba97bdd7883ac43f3ff2a3
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 24 09:23:04 2015 -0800
+
+ include includes.h to avoid build failure on AIX
+
+commit 13af342458f5064144abbb07e5ac9bbd4eb42567
+Author: Tim Rice <tim at multitalents.net>
+Date: Tue Feb 24 07:56:47 2015 -0800
+
+ Original portability patch from djm@ for platforms missing err.h.
+ Fix name space clash on Solaris 10. Still more to do for Solaris 10
+ to deal with msghdr structure differences. ok djm@
+
+commit 910209203d0cd60c5083901cbcc0b7b44d9f48d2
+Author: Tim Rice <tim at multitalents.net>
+Date: Mon Feb 23 22:06:56 2015 -0800
+
+ cleaner way fix dispatch.h portion of commit
+ a88dd1da119052870bb2654c1a32c51971eade16
+ (some systems have sig_atomic_t in signal.h, some in sys/signal.h)
+ Sounds good to me djm@
+
+commit 676c38d7cbe65b76bbfff796861bb6615cc6a596
+Author: Tim Rice <tim at multitalents.net>
+Date: Mon Feb 23 21:51:33 2015 -0800
+
+ portability fix: if we can't dind a better define for HOST_NAME_MAX, use 255
+
+commit 1221b22023dce38cbc90ba77eae4c5d78c77a5e6
+Author: Tim Rice <tim at multitalents.net>
+Date: Mon Feb 23 21:50:34 2015 -0800
+
+ portablity fix: s/__inline__/inline/
+
+commit 4c356308a88d309c796325bb75dce90ca16591d5
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Feb 24 13:49:31 2015 +1100
+
+ Wrap stdint.h includes in HAVE_STDINT_H.
+
+commit c9c88355c6a27a908e7d1e5003a2b35ea99c1614
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Feb 24 13:43:57 2015 +1100
+
+ Add AI_NUMERICSERV to fake-rfc2553.
+
+ Our getaddrinfo implementation always returns numeric values already.
+
+commit ef342ab1ce6fb9a4b30186c89c309d0ae9d0eeb4
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Feb 24 13:39:57 2015 +1100
+
+ Include OpenSSL's objects.h before bn.h.
+
+ Prevents compile errors on some platforms (at least old GCCs and AIX's
+ XLC compilers).
+
+commit dcc8997d116f615195aa7c9ec019fb36c28c6228
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Feb 24 12:30:59 2015 +1100
+
+ Convert two macros into functions.
+
+ Convert packet_send_debug and packet_disconnect from macros to
+ functions. Some older GCCs (2.7.x, 2.95.x) see to have problems with
+ variadic macros with only one argument so we convert these two into
+ functions. ok djm@
+
+commit 2285c30d51b7e2052c6526445abe7e7cc7e170a1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 23 22:21:21 2015 +0000
+
+ upstream commit
+
+ further silence spurious error message even when -v is
+ specified (e.g. to get visual host keys); reported by naddy@
+
+commit 9af21979c00652029e160295e988dea40758ece2
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 24 09:04:32 2015 +1100
+
+ don't include stdint.h unless HAVE_STDINT_H set
+
+commit 62f678dd51660d6f8aee1da33d3222c5de10a89e
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 24 09:02:54 2015 +1100
+
+ nother sys/queue.h -> sys-queue.h fix
+
+ spotted by Tom Christensen
+
+commit b3c19151cba2c0ed01b27f55de0d723ad07ca98f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 23 20:32:15 2015 +0000
+
+ upstream commit
+
+ fix a race condition by using a mux socket rather than an
+ ineffectual wait statement
+
+commit a88dd1da119052870bb2654c1a32c51971eade16
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Feb 24 06:30:29 2015 +1100
+
+ various include fixes for portable
+
+commit 5248429b5ec524d0a65507cff0cdd6e0cb99effd
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 23 16:55:51 2015 +0000
+
+ upstream commit
+
+ add an XXX to remind me to improve sshkey_load_public
+
+commit e94e4b07ef2eaead38b085a60535df9981cdbcdb
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 23 16:55:31 2015 +0000
+
+ upstream commit
+
+ silence a spurious error message when listing
+ fingerprints for known_hosts; bz#2342
+
+commit f2293a65392b54ac721f66bc0b44462e8d1d81f8
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 23 16:33:25 2015 +0000
+
+ upstream commit
+
+ fix setting/clearing of TTY raw mode around
+ UpdateHostKeys=ask confirmation question; reported by Herb Goldman
+
+commit f2004cd1adf34492eae0a44b1ef84e0e31b06088
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Feb 23 05:04:21 2015 +1100
+
+ Repair for non-ECC OpenSSL.
+
+ Ifdef out the ECC parts when building with an OpenSSL that doesn't have
+ it.
+
+commit 37f9220db8d1a52c75894c3de1e5f2ae5bd71b6f
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Mon Feb 23 03:07:24 2015 +1100
+
+ Wrap stdint.h includes in ifdefs.
+
+commit f81f1bbc5b892c8614ea740b1f92735652eb43f0
+Author: Tim Rice <tim at multitalents.net>
+Date: Sat Feb 21 18:12:10 2015 -0800
+
+ out of tree build fix
+
+commit 2e13a1e4d22f3b503c3bfc878562cc7386a1d1ae
+Author: Tim Rice <tim at multitalents.net>
+Date: Sat Feb 21 18:08:51 2015 -0800
+
+ mkdir kex unit test directory so testing out of tree builds works
+
+commit 1797f49b1ba31e8700231cd6b1d512d80bb50d2c
+Author: halex at openbsd.org <halex at openbsd.org>
+Date: Sat Feb 21 21:46:57 2015 +0000
+
+ upstream commit
+
+ make "ssh-add -d" properly remove a corresponding
+ certificate, and also not whine and fail if there is none
+
+ ok djm@
+
+commit 7faaa32da83a609059d95dbfcb0649fdb04caaf6
+Author: Damien Miller <djm at mindrot.org>
+Date: Sun Feb 22 07:57:27 2015 +1100
+
+ mkdir hostkey and bitmap unit test directories
+
+commit bd49da2ef197efac5e38f5399263a8b47990c538
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Feb 20 23:46:01 2015 +0000
+
+ upstream commit
+
+ sort options useable under Match case-insensitively; prodded
+ jmc@
+
+commit 1a779a0dd6cd8b4a1a40ea33b5415ab8408128ac
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Feb 21 20:51:02 2015 +0000
+
+ upstream commit
+
+ correct paths to configuration files being written/updated;
+ they live in $OBJ not cwd; some by Roumen Petrov
+
+commit 28ba006c1acddff992ae946d0bc0b500b531ba6b
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Sat Feb 21 15:41:07 2015 +1100
+
+ More correct checking of HAVE_DECL_AI_NUMERICSERV.
+
+commit e50e8c97a9cecae1f28febccaa6ca5ab3bc10f54
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Sat Feb 21 15:10:33 2015 +1100
+
+ Add null declaration of AI_NUMERICINFO.
+
+ Some platforms (older FreeBSD and DragonFly versions) do have
+ getaddrinfo() but do not have AI_NUMERICINFO. so define it to zero
+ in those cases.
+
+commit 18a208d6a460d707a45916db63a571e805f5db46
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Feb 20 22:40:32 2015 +0000
+
+ upstream commit
+
+ more options that are available under Match; bz#2353 reported
+ by calestyo AT scientia.net
+
+commit 44732de06884238049f285f1455b2181baa7dc82
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Feb 20 22:17:21 2015 +0000
+
+ upstream commit
+
+ UpdateHostKeys fixes:
+
+ I accidentally changed the format of the hostkeys at openssh.com messages
+ last week without changing the extension name, and this has been causing
+ connection failures for people who are running -current. First reported
+ by sthen@
+
+ s/hostkeys at openssh.com/hostkeys-00 at openssh.com/
+ Change the name of the proof message too, and reorder it a little.
+
+ Also, UpdateHostKeys=ask is incompatible with ControlPersist (no TTY
+ available to read the response) so disable UpdateHostKeys if it is in
+ ask mode and ControlPersist is active (and document this)
+
+commit 13a39414d25646f93e6d355521d832a03aaaffe2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Feb 17 00:14:05 2015 +0000
+
+ upstream commit
+
+ Regression: I broke logging of public key fingerprints in
+ 1.46. Pointed out by Pontus Lundkvist
+
+commit 773dda25e828c4c9a52f7bdce6e1e5924157beab
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Jan 30 23:10:17 2015 +1100
+
+ repair --without-openssl; broken in refactor
+
+commit e89c780886b23600de1e1c8d74aabd1ff61f43f0
+Author: Damien Miller <djm at google.com>
+Date: Tue Feb 17 10:04:55 2015 +1100
+
+ hook up hostkeys unittest to portable Makefiles
+
+commit 0abf41f99aa16ff09b263bead242d6cb2dbbcf99
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 16 22:21:03 2015 +0000
+
+ upstream commit
+
+ enable hostkeys unit tests
+
+commit 68a5d647ccf0fb6782b2f749433a1eee5bc9044b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 16 22:20:50 2015 +0000
+
+ upstream commit
+
+ check string/memory compare arguments aren't NULL
+
+commit ef575ef20d09f20722e26b45dab80b3620469687
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 16 22:18:34 2015 +0000
+
+ upstream commit
+
+ unit tests for hostfile.c code, just hostkeys_foreach so
+ far
+
+commit 8ea3365e6aa2759ccf5c76eaea62cbc8a280b0e7
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Sat Feb 14 12:43:16 2015 +0000
+
+ upstream commit
+
+ test server rekey limit
+
+commit ce63c4b063c39b2b22d4ada449c9e3fbde788cb3
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 16 22:30:03 2015 +0000
+
+ upstream commit
+
+ partial backout of:
+
+ revision 1.441
+ date: 2015/01/31 20:30:05; author: djm; state: Exp; lines: +17 -10; commitid
+ : x8klYPZMJSrVlt3O;
+ Let sshd load public host keys even when private keys are missing.
+ Allows sshd to advertise additional keys for future key rotation.
+ Also log fingerprint of hostkeys loaded; ok markus@
+
+ hostkey updates now require access to the private key, so we can't
+ load public keys only. The improved log messages (fingerprints of keys
+ loaded) are kept.
+
+commit 523463a3a2a9bfc6cfc5afa01bae9147f76a37cc
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 16 22:13:32 2015 +0000
+
+ upstream commit
+
+ Revise hostkeys at openssh.com hostkey learning extension.
+
+ The client will not ask the server to prove ownership of the private
+ halves of any hitherto-unseen hostkeys it offers to the client.
+
+ Allow UpdateHostKeys option to take an 'ask' argument to let the
+ user manually review keys offered.
+
+ ok markus@
+
+commit 6c5c949782d86a6e7d58006599c7685bfcd01685
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 16 22:08:57 2015 +0000
+
+ upstream commit
+
+ Refactor hostkeys_foreach() and dependent code Deal with
+ IP addresses (i.e. CheckHostIP) Don't clobber known_hosts when nothing
+ changed ok markus@ as part of larger commit
+
+commit 51b082ccbe633dc970df1d1f4c9c0497115fe721
+Author: miod at openbsd.org <miod at openbsd.org>
+Date: Mon Feb 16 18:26:26 2015 +0000
+
+ upstream commit
+
+ Declare ge25519_base as extern, to prevent it from
+ becoming a common. Gets us rid of ``lignment 4 of symbol
+ `crypto_sign_ed25519_ref_ge25519_base' in mod_ge25519.o is smaller than 16 in
+ mod_ed25519.o'' warnings at link time.
+
+commit 02db468bf7e3281a8e3c058ced571b38b6407c34
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Fri Feb 13 18:57:00 2015 +0000
+
+ upstream commit
+
+ make rekey_limit for sshd w/privsep work; ok djm@
+ dtucker@
+
+commit 8ec67d505bd23c8bf9e17b7a364b563a07a58ec8
+Author: dtucker at openbsd.org <dtucker at openbsd.org>
+Date: Thu Feb 12 20:34:19 2015 +0000
+
+ upstream commit
+
+ Prevent sshd spamming syslog with
+ "ssh_dispatch_run_fatal: disconnected". ok markus@
+
+commit d4c0295d1afc342057ba358237acad6be8af480b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Feb 11 01:20:38 2015 +0000
+
+ upstream commit
+
+ Some packet error messages show the address of the peer,
+ but might be generated after the socket to the peer has suffered a TCP reset.
+ In these cases, getpeername() won't work so cache the address earlier.
+
+ spotted in the wild via deraadt@ and tedu@
+
+commit 4af1709cf774475ce5d1bc3ddcc165f6c222897d
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Mon Feb 9 23:22:37 2015 +0000
+
+ upstream commit
+
+ fix some leaks in error paths ok markus@
+
+commit fd36834871d06a03e1ff8d69e41992efa1bbf85f
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Fri Feb 6 23:21:59 2015 +0000
+
+ upstream commit
+
+ SIZE_MAX is standard, we should be using it in preference to
+ the obsolete SIZE_T_MAX. OK miod@ beck@
+
+commit 1910a286d7771eab84c0b047f31c0a17505236fa
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Thu Feb 5 12:59:57 2015 +0000
+
+ upstream commit
+
+ Include stdint.h, not limits.h to get SIZE_MAX. OK guenther@
+
+commit ce4f59b2405845584f45e0b3214760eb0008c06c
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Tue Feb 3 08:07:20 2015 +0000
+
+ upstream commit
+
+ missing ; djm and mlarkin really having great
+ interactions recently
+
+commit 5d34aa94938abb12b877a25be51862757f25d54b
+Author: halex at openbsd.org <halex at openbsd.org>
+Date: Tue Feb 3 00:34:14 2015 +0000
+
+ upstream commit
+
+ slightly extend the passphrase prompt if running with -c
+ in order to give the user a chance to notice if unintentionally running
+ without it
+
+ wording tweak and ok djm@
+
+commit cb3bde373e80902c7d5d0db429f85068d19b2918
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 2 22:48:53 2015 +0000
+
+ upstream commit
+
+ handle PKCS#11 C_Login returning
+ CKR_USER_ALREADY_LOGGED_IN; based on patch from Yuri Samoilenko; ok markus@
+
+commit 15ad750e5ec3cc69765b7eba1ce90060e7083399
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Feb 2 07:41:40 2015 +0000
+
+ upstream commit
+
+ turn UpdateHostkeys off by default until I figure out
+ mlarkin@'s warning message; requested by deraadt@
+
+commit 3cd5103c1e1aaa59bd66f7f52f6ebbcd5deb12f9
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Mon Feb 2 01:57:44 2015 +0000
+
+ upstream commit
+
+ increasing encounters with difficult DNS setups in
+ darknets has convinced me UseDNS off by default is better ok djm
+
+commit 6049a548a8a68ff0bbe581ab1748ea6a59ecdc38
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Jan 31 20:30:05 2015 +0000
+
+ upstream commit
+
+ Let sshd load public host keys even when private keys are
+ missing. Allows sshd to advertise additional keys for future key rotation.
+ Also log fingerprint of hostkeys loaded; ok markus@
+
+commit 46347ed5968f582661e8a70a45f448e0179ca0ab
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 30 11:43:14 2015 +0000
+
+ upstream commit
+
+ Add a ssh_config HostbasedKeyType option to control which
+ host public key types are tried during hostbased authentication.
+
+ This may be used to prevent too many keys being sent to the server,
+ and blowing past its MaxAuthTries limit.
+
+ bz#2211 based on patch by Iain Morgan; ok markus@
+
+commit 802660cb70453fa4d230cb0233bc1bbdf8328de1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 30 10:44:49 2015 +0000
+
+ upstream commit
+
+ set a timeout to prevent hangs when talking to busted
+ servers; ok markus@
+
+commit 86936ec245a15c7abe71a0722610998b0a28b194
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 30 01:11:39 2015 +0000
+
+ upstream commit
+
+ regression test for 'wildcard CA' serial/key ID revocations
+
+commit 4509b5d4a4fa645a022635bfa7e86d09b285001f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 30 01:13:33 2015 +0000
+
+ upstream commit
+
+ avoid more fatal/exit in the packet.c paths that
+ ssh-keyscan uses; feedback and "looks good" markus@
+
+commit 669aee994348468af8b4b2ebd29b602cf2860b22
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 30 01:10:33 2015 +0000
+
+ upstream commit
+
+ permit KRLs that revoke certificates by serial number or
+ key ID without scoping to a particular CA; ok markus@
+
+commit 7a2c368477e26575d0866247d3313da4256cb2b5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 30 00:59:19 2015 +0000
+
+ upstream commit
+
+ missing parentheses after if in do_convert_from() broke
+ private key conversion from other formats some time in 2010; bz#2345 reported
+ by jjelen AT redhat.com
+
+commit 25f5f78d8bf5c22d9cea8b49de24ebeee648a355
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 30 00:22:25 2015 +0000
+
+ upstream commit
+
+ fix ssh protocol 1, spotted by miod@
+
+commit 9ce86c926dfa6e0635161b035e3944e611cbccf0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 28 22:36:00 2015 +0000
+
+ upstream commit
+
+ update to new API (key_fingerprint => sshkey_fingerprint)
+ check sshkey_fingerprint return values; ok markus
+
+commit 9125525c37bf73ad3ee4025520889d2ce9d10f29
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 28 22:05:31 2015 +0000
+
+ upstream commit
+
+ avoid fatal() calls in packet code makes ssh-keyscan more
+ reliable against server failures ok dtucker@ markus@
+
+commit fae7bbe544cba7a9e5e4ab47ff6faa3d978646eb
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 28 21:15:47 2015 +0000
+
+ upstream commit
+
+ avoid fatal() calls in packet code makes ssh-keyscan more
+ reliable against server failures ok dtucker@ markus@
+
+commit 1a3d14f6b44a494037c7deab485abe6496bf2c60
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 28 11:07:25 2015 +0000
+
+ upstream commit
+
+ remove obsolete comment
+
+commit 80c25b7bc0a71d75c43a4575d9a1336f589eb639
+Author: okan at openbsd.org <okan at openbsd.org>
+Date: Tue Jan 27 12:54:06 2015 +0000
+
+ upstream commit
+
+ Since r1.2 removed the use of PRI* macros, inttypes.h is
+ no longer required.
+
+ ok djm@
+
+commit 69ff64f69615c2a21c97cb5878a0996c21423257
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Jan 27 23:07:43 2015 +1100
+
+ compile on systems without TCP_MD5SIG (e.g. OSX)
+
+commit 358964f3082fb90b2ae15bcab07b6105cfad5a43
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Jan 27 23:07:25 2015 +1100
+
+ use ssh-keygen under test rather than system's
+
+commit a2c95c1bf33ea53038324d1fdd774bc953f98236
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Jan 27 23:06:59 2015 +1100
+
+ OSX lacks HOST_NAME_MAX, has _POSIX_HOST_NAME_MAX
+
+commit ade31d7b6f608a19b85bee29a7a00b1e636a2919
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Jan 27 23:06:23 2015 +1100
+
+ these need active_state defined to link on OSX
+
+ temporary measure until active_state goes away entirely
+
+commit e56aa87502f22c5844918c10190e8b4f785f067b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 27 12:01:36 2015 +0000
+
+ upstream commit
+
+ use printf instead of echo -n to reduce diff against
+ -portable
+
+commit 9f7637f56eddfaf62ce3c0af89c25480f2cf1068
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Mon Jan 26 13:55:29 2015 +0000
+
+ upstream commit
+
+ sort previous;
+
+commit 3076ee7d530d5b16842fac7a6229706c7e5acd26
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 26 13:36:53 2015 +0000
+
+ upstream commit
+
+ properly restore umask
+
+commit d411d395556b73ba1b9e451516a0bd6697c4b03d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 26 06:12:18 2015 +0000
+
+ upstream commit
+
+ regression test for host key rotation
+
+commit fe8a3a51699afbc6407a8fae59b73349d01e49f8
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 26 06:11:28 2015 +0000
+
+ upstream commit
+
+ adapt to sshkey API tweaks
+
+commit 7dd355fb1f0038a3d5cdca57ebab4356c7a5b434
+Author: miod at openbsd.org <miod at openbsd.org>
+Date: Sat Jan 24 10:39:21 2015 +0000
+
+ upstream commit
+
+ Move -lz late in the linker commandline for things to
+ build on static arches.
+
+commit 0dad3b806fddb93c475b30853b9be1a25d673a33
+Author: miod at openbsd.org <miod at openbsd.org>
+Date: Fri Jan 23 21:21:23 2015 +0000
+
+ upstream commit
+
+ -Wpointer-sign is supported by gcc 4 only.
+
+commit 2b3b1c1e4bd9577b6e780c255c278542ea66c098
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 20 22:58:57 2015 +0000
+
+ upstream commit
+
+ use SUBDIR to recuse into unit tests; makes "make obj"
+ actually work
+
+commit 1d1092bff8db27080155541212b420703f8b9c92
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 26 12:16:36 2015 +0000
+
+ upstream commit
+
+ correct description of UpdateHostKeys in ssh_config.5 and
+ add it to -o lists for ssh, scp and sftp; pointed out by jmc@
+
+commit 5104db7cbd6cdd9c5971f4358e74414862fc1022
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 26 06:10:03 2015 +0000
+
+ upstream commit
+
+ correctly match ECDSA subtype (== curve) for
+ offered/recevied host keys. Fixes connection-killing host key mismatches when
+ a server offers multiple ECDSA keys with different curve type (an extremely
+ unlikely configuration).
+
+ ok markus, "looks mechanical" deraadt@
+
+commit 8d4f87258f31cb6def9b3b55b6a7321d84728ff2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 26 03:04:45 2015 +0000
+
+ upstream commit
+
+ Host key rotation support.
+
+ Add a hostkeys at openssh.com protocol extension (global request) for
+ a server to inform a client of all its available host key after
+ authentication has completed. The client may record the keys in
+ known_hosts, allowing it to upgrade to better host key algorithms
+ and a server to gracefully rotate its keys.
+
+ The client side of this is controlled by a UpdateHostkeys config
+ option (default on).
+
+ ok markus@
+
+commit 60b1825262b1f1e24fc72050b907189c92daf18e
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 26 02:59:11 2015 +0000
+
+ upstream commit
+
+ small refactor and add some convenience functions; ok
+ markus
+
+commit a5a3e3328ddce91e76f71ff479022d53e35c60c9
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Thu Jan 22 21:00:42 2015 +0000
+
+ upstream commit
+
+ heirarchy -> hierarchy;
+
+commit dcff5810a11195c57e1b3343c0d6b6f2b9974c11
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Thu Jan 22 20:24:41 2015 +0000
+
+ upstream commit
+
+ Provide a warning about chroot misuses (which sadly, seem
+ to have become quite popular because shiny). sshd cannot detect/manage/do
+ anything about these cases, best we can do is warn in the right spot in the
+ man page. ok markus
+
+commit 087266ec33c76fc8d54ac5a19efacf2f4a4ca076
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Tue Jan 20 23:14:00 2015 +0000
+
+ upstream commit
+
+ Reduce use of <sys/param.h> and transition to <limits.h>
+ throughout. ok djm markus
+
+commit 57e783c8ba2c0797f93977e83b2a8644a03065d8
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Jan 20 20:16:21 2015 +0000
+
+ upstream commit
+
+ kex_setup errors are fatal()
+
+commit 1d6424a6ff94633c221297ae8f42d54e12a20912
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 20 08:02:33 2015 +0000
+
+ upstream commit
+
+ this test would accidentally delete agent.sh if run without
+ obj/
+
+commit 12b5f50777203e12575f1b08568281e447249ed3
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 20 07:56:44 2015 +0000
+
+ upstream commit
+
+ make this compile with KERBEROS5 enabled
+
+commit e2cc6bef08941256817d44d146115b3478586ad4
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 20 07:55:33 2015 +0000
+
+ upstream commit
+
+ fix hostkeys in agent; ok markus@
+
+commit 1ca3e2155aa5d3801a7ae050f85c71f41fcb95b1
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Jan 20 10:11:31 2015 +1100
+
+ fix kex test
+
+commit c78a578107c7e6dcf5d30a2f34cb6581bef14029
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 19 20:45:25 2015 +0000
+
+ upstream commit
+
+ finally enable the KEX tests I wrote some years ago...
+
+commit 31821d7217e686667d04935aeec99e1fc4a46e7e
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 19 20:42:31 2015 +0000
+
+ upstream commit
+
+ adapt to new error message (SSH_ERR_MAC_INVALID)
+
+commit d3716ca19e510e95d956ae14d5b367e364bff7f1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 19 17:31:13 2015 +0000
+
+ upstream commit
+
+ this test was broken in at least two ways, such that it
+ wasn't checking that a KRL was not excluding valid keys
+
+commit 3f797653748e7c2b037dacb57574c01d9ef3b4d3
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 19 20:32:39 2015 +0000
+
+ upstream commit
+
+ switch ssh-keyscan from setjmp to multiple ssh transport
+ layer instances ok djm@
+
+commit f582f0e917bb0017b00944783cd5f408bf4b0b5e
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 19 20:30:23 2015 +0000
+
+ upstream commit
+
+ add experimental api for packet layer; ok djm@
+
+commit 48b3b2ba75181f11fca7f327058a591f4426cade
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 19 20:20:20 2015 +0000
+
+ upstream commit
+
+ store compat flags in struct ssh; ok djm@
+
+commit 57d10cbe861a235dd269c74fb2fe248469ecee9d
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 19 20:16:15 2015 +0000
+
+ upstream commit
+
+ adapt kex to sshbuf and struct ssh; ok djm@
+
+commit 3fdc88a0def4f86aa88a5846ac079dc964c0546a
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 19 20:07:45 2015 +0000
+
+ upstream commit
+
+ move dispatch to struct ssh; ok djm@
+
+commit 091c302829210c41e7f57c3f094c7b9c054306f0
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 19 19:52:16 2015 +0000
+
+ upstream commit
+
+ update packet.c & isolate, introduce struct ssh a) switch
+ packet.c to buffer api and isolate per-connection info into struct ssh b)
+ (de)serialization of the state is moved from monitor to packet.c c) the old
+ packet.c API is implemented in opacket.[ch] d) compress.c/h is removed and
+ integrated into packet.c with and ok djm@
+
+commit 4e62cc68ce4ba20245d208b252e74e91d3785b74
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 19 17:35:48 2015 +0000
+
+ upstream commit
+
+ fix format strings in (disabled) debugging
+
+commit d85e06245907d49a2cd0cfa0abf59150ad616f42
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 19 06:01:32 2015 +0000
+
+ upstream commit
+
+ be a bit more careful in these tests to ensure that
+ known_hosts is clean
+
+commit 7947810eab5fe0ad311f32a48f4d4eb1f71be6cf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 22:00:18 2015 +0000
+
+ upstream commit
+
+ regression test for known_host file editing using
+ ssh-keygen (-H / -R / -F) after hostkeys_foreach() change; feedback and ok
+ markus@
+
+commit 3a2b09d147a565d8a47edf37491e149a02c0d3a3
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 19:54:46 2015 +0000
+
+ upstream commit
+
+ more and better key tests
+
+ test signatures and verification
+ test certificate generation
+ flesh out nested cert test
+
+ removes most of the XXX todo markers
+
+commit 589e69fd82724cfc9738f128e4771da2e6405d0d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 19:53:58 2015 +0000
+
+ upstream commit
+
+ make the signature fuzzing test much more rigorous:
+ ensure that the fuzzed input cases do not match the original (using new
+ fuzz_matches_original() function) and check that the verification fails in
+ each case
+
+commit 80603c0daa2538c349c1c152405580b164d5475f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 19:52:44 2015 +0000
+
+ upstream commit
+
+ add a fuzz_matches_original() function to the fuzzer to
+ detect fuzz cases that are identical to the original data. Hacky
+ implementation, but very useful when you need the fuzz to be different, e.g.
+ when verifying signature
+
+commit 87d5495bd337e358ad69c524fcb9495208c0750b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 19:50:55 2015 +0000
+
+ upstream commit
+
+ better dumps from the fuzzer (shown on errors) -
+ include the original data as well as the fuzzed copy.
+
+commit d59ec478c453a3fff05badbbfd96aa856364f2c2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 19:47:55 2015 +0000
+
+ upstream commit
+
+ enable hostkey-agent.sh test
+
+commit 26b3425170bf840e4b095e1c10bf25a0a3e3a105
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Jan 17 18:54:30 2015 +0000
+
+ upstream commit
+
+ unit test for hostkeys in ssh-agent
+
+commit 9e06a0fb23ec55d9223b26a45bb63c7649e2f2f2
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Thu Jan 15 23:41:29 2015 +0000
+
+ upstream commit
+
+ add kex unit tests
+
+commit d2099dec6da21ae627f6289aedae6bc1d41a22ce
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Mon Jan 19 00:32:54 2015 +0000
+
+ upstream commit
+
+ djm, your /usr/include tree is old
+
+commit 2b3c3c76c30dc5076fe09d590f5b26880f148a54
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 21:51:19 2015 +0000
+
+ upstream commit
+
+ some feedback from markus@: comment hostkeys_foreach()
+ context and avoid a member in it.
+
+commit cecb30bc2ba6d594366e657d664d5c494b6c8a7f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 21:49:42 2015 +0000
+
+ upstream commit
+
+ make ssh-keygen use hostkeys_foreach(). Removes some
+ horrendous code; ok markus@
+
+commit ec3d065df3a9557ea96b02d061fd821a18c1a0b9
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 21:48:09 2015 +0000
+
+ upstream commit
+
+ convert load_hostkeys() (hostkey ordering and
+ known_host matching) to use the new hostkey_foreach() iterator; ok markus
+
+commit c29811cc480a260e42fd88849fc86a80c1e91038
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 21:40:23 2015 +0000
+
+ upstream commit
+
+ introduce hostkeys_foreach() to allow iteration over a
+ known_hosts file or controlled subset thereof. This will allow us to pull out
+ some ugly and duplicated code, and will be used to implement hostkey rotation
+ later.
+
+ feedback and ok markus
+
+commit f101d8291da01bbbfd6fb8c569cfd0cc61c0d346
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Sun Jan 18 14:01:00 2015 +0000
+
+ upstream commit
+
+ string truncation due to sizeof(size) ok djm markus
+
+commit 35d6022b55b7969fc10c261cb6aa78cc4a5fcc41
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 13:33:34 2015 +0000
+
+ upstream commit
+
+ avoid trailing ',' in host key algorithms
+
+commit 7efb455789a0cb76bdcdee91c6060a3dc8f5c007
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Jan 18 13:22:28 2015 +0000
+
+ upstream commit
+
+ infer key length correctly when user specified a fully-
+ qualified key name instead of using the -b bits option; ok markus@
+
+commit 83f8ffa6a55ccd0ce9d8a205e3e7439ec18fedf5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sat Jan 17 18:53:34 2015 +0000
+
+ upstream commit
+
+ fix hostkeys on ssh agent; found by unit test I'm about
+ to commit
+
+commit 369d61f17657b814124268f99c033e4dc6e436c1
+Author: schwarze at openbsd.org <schwarze at openbsd.org>
+Date: Fri Jan 16 16:20:23 2015 +0000
+
+ upstream commit
+
+ garbage collect empty .No macros mandoc warns about
+
+commit bb8b442d32dbdb8521d610e10d8b248d938bd747
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 16 15:55:07 2015 +0000
+
+ upstream commit
+
+ regression: incorrect error message on
+ otherwise-successful ssh-keygen -A. Reported by Dmitry Orlov, via deraadt@
+
+commit 9010902954a40b59d0bf3df3ccbc3140a653e2bc
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Jan 16 07:19:48 2015 +0000
+
+ upstream commit
+
+ when hostname canonicalisation is enabled, try to parse
+ hostnames as addresses before looking them up for canonicalisation. fixes
+ bz#2074 and avoids needless DNS lookups in some cases; ok markus
+
+commit 2ae4f337b2a5fb2841b6b0053b49496fef844d1c
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Fri Jan 16 06:40:12 2015 +0000
+
+ upstream commit
+
+ Replace <sys/param.h> with <limits.h> and other less
+ dirty headers where possible. Annotate <sys/param.h> lines with their
+ current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1,
+ LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of
+ MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution.
+ These are the files confirmed through binary verification. ok guenther,
+ millert, doug (helped with the verification protocol)
+
+commit 3c4726f4c24118e8f1bb80bf75f1456c76df072c
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Thu Jan 15 21:38:50 2015 +0000
+
+ upstream commit
+
+ remove xmalloc, switch to sshbuf
+
+commit e17ac01f8b763e4b83976b9e521e90a280acc097
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Thu Jan 15 21:37:14 2015 +0000
+
+ upstream commit
+
+ switch to sshbuf
+
+commit ddef9995a1fa6c7a8ff3b38bfe6cf724bebf13d0
+Author: naddy at openbsd.org <naddy at openbsd.org>
+Date: Thu Jan 15 18:32:54 2015 +0000
+
+ upstream commit
+
+ handle UMAC128 initialization like UMAC; ok djm@ markus@
+
+commit f14564c1f7792446bca143580aef0e7ac25dcdae
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jan 15 11:04:36 2015 +0000
+
+ upstream commit
+
+ fix regression reported by brad@ for passworded keys without
+ agent present
+
+commit 45c0fd70bb2a88061319dfff20cb12ef7b1bc47e
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 22:08:23 2015 +1100
+
+ make bitmap test compile
+
+commit d333f89abf7179021e5c3f28673f469abe032062
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jan 15 07:36:28 2015 +0000
+
+ upstream commit
+
+ unit tests for KRL bitmap
+
+commit 7613f828f49c55ff356007ae9645038ab6682556
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jan 14 09:58:21 2015 +0000
+
+ upstream commit
+
+ re-add comment about full path
+
+commit 6c43b48b307c41cd656b415621a644074579a578
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jan 14 09:54:38 2015 +0000
+
+ upstream commit
+
+ don't reset to the installed sshd; connect before
+ reconfigure, too
+
+commit 771bb47a1df8b69061f09462e78aa0b66cd594bf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 13 14:51:51 2015 +0000
+
+ upstream commit
+
+ implement a SIGINFO handler so we can discern a stuck
+ fuzz test from a merely glacial one; prompted by and ok markus
+
+commit cfaa57962f8536f3cf0fd7daf4d6a55d6f6de45f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 13 08:23:26 2015 +0000
+
+ upstream commit
+
+ use $SSH instead of installed ssh to allow override;
+ spotted by markus@
+
+commit 0920553d0aee117a596b03ed5b49b280d34a32c5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 13 07:49:49 2015 +0000
+
+ upstream commit
+
+ regress test for PubkeyAcceptedKeyTypes; ok markus@
+
+commit 27ca1a5c0095eda151934bca39a77e391f875d17
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 12 20:13:27 2015 +0000
+
+ upstream commit
+
+ unbreak parsing of pubkey comments; with gerhard; ok
+ djm/deraadt
+
+commit 55358f0b4e0b83bc0df81c5f854c91b11e0bb4dc
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 12 11:46:32 2015 +0000
+
+ upstream commit
+
+ fatal if soft-PKCS11 library is missing rather (rather
+ than continue and fail with a more cryptic error)
+
+commit c3554cdd2a1a62434b8161017aa76fa09718a003
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 12 11:12:38 2015 +0000
+
+ upstream commit
+
+ let this test all supporte key types; pointed out/ok
+ markus@
+
+commit 1129dcfc5a3e508635004bcc05a3574cb7687167
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jan 15 09:40:00 2015 +0000
+
+ upstream commit
+
+ sync ssh-keysign, ssh-keygen and some dependencies to the
+ new buffer/key API; mostly mechanical, ok markus@
+
+commit e4ebf5586452bf512da662ac277aaf6ecf0efe7c
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jan 15 07:57:08 2015 +0000
+
+ upstream commit
+
+ remove commented-out test code now that it has moved to a
+ proper unit test
+
+commit e81cba066c1e9eb70aba0f6e7c0ff220611b370f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 14 20:54:29 2015 +0000
+
+ upstream commit
+
+ whitespace
+
+commit 141efe49542f7156cdbc2e4cd0a041d8b1aab622
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 14 20:05:27 2015 +0000
+
+ upstream commit
+
+ move authfd.c and its tentacles to the new buffer/key
+ API; ok markus@
+
+commit 0088c57af302cda278bd26d8c3ae81d5b6f7c289
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 14 19:33:41 2015 +0000
+
+ upstream commit
+
+ fix small regression: ssh-agent would return a success
+ message but an empty signature if asked to sign using an unknown key; ok
+ markus@
+
+commit b03ebe2c22b8166e4f64c37737f4278676e3488d
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 03:08:58 2015 +1100
+
+ more --without-openssl
+
+ fix some regressions caused by upstream merges
+
+ enable KRLs now that they no longer require BIGNUMs
+
+commit bc42cc6fe784f36df225c44c93b74830027cb5a2
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 03:08:29 2015 +1100
+
+ kludge around tun API mismatch betterer
+
+commit c332110291089b624fa0951fbf2d1ee6de525b9f
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 02:59:51 2015 +1100
+
+ some systems lack SO_REUSEPORT
+
+commit 83b9678a62cbdc74eb2031cf1e1e4ffd58e233ae
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 02:35:50 2015 +1100
+
+ fix merge botch
+
+commit 0cdc5a3eb6fb383569a4da2a30705d9b90428d6b
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 02:35:33 2015 +1100
+
+ unbreak across API change
+
+commit 6e2549ac2b5e7f96cbc2d83a6e0784b120444b47
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 02:30:18 2015 +1100
+
+ need includes.h for portable OpenSSH
+
+commit 72ef7c148c42db7d5632a29f137f8b87b579f2d9
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 02:21:31 2015 +1100
+
+ support --without-openssl at configure time
+
+ Disables and removes dependency on OpenSSL. Many features don't
+ work and the set of crypto options is greatly restricted. This
+ will only work on system with native arc4random or /dev/urandom.
+
+ Considered highly experimental for now.
+
+commit 4f38c61c68ae7e3f9ee4b3c38bc86cd39f65ece9
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Jan 15 02:28:00 2015 +1100
+
+ add files missed in last commit
+
+commit a165bab605f7be55940bb8fae977398e8c96a46d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 14 15:02:39 2015 +0000
+
+ upstream commit
+
+ avoid BIGNUM in KRL code by using a simple bitmap;
+ feedback and ok markus
+
+commit 7d845f4a0b7ec97887be204c3760e44de8bf1f32
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 14 13:54:13 2015 +0000
+
+ upstream commit
+
+ update sftp client and server to new buffer API. pretty
+ much just mechanical changes; with & ok markus
+
+commit 139ca81866ec1b219c717d17061e5e7ad1059e2a
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jan 14 13:09:09 2015 +0000
+
+ upstream commit
+
+ switch to sshbuf/sshkey; with & ok djm@
+
+commit 81bfbd0bd35683de5d7f2238b985e5f8150a9180
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Jan 14 21:48:18 2015 +1100
+
+ support --without-openssl at configure time
+
+ Disables and removes dependency on OpenSSL. Many features don't
+ work and the set of crypto options is greatly restricted. This
+ will only work on system with native arc4random or /dev/urandom.
+
+ Considered highly experimental for now.
+
+commit 54924b53af15ccdcbb9f89984512b5efef641a31
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 14 10:46:28 2015 +0000
+
+ upstream commit
+
+ avoid an warning for the !OPENSSL case
+
+commit ae8b463217f7c9b66655bfc3945c050ffdaeb861
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jan 14 10:30:34 2015 +0000
+
+ upstream commit
+
+ swith auth-options to new sshbuf/sshkey; ok djm@
+
+commit 540e891191b98b89ee90aacf5b14a4a68635e763
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Jan 14 10:29:45 2015 +0000
+
+ upstream commit
+
+ make non-OpenSSL aes-ctr work on sshd w/ privsep; ok
+ markus@
+
+commit 60c2c4ea5e1ad0ddfe8b2877b78ed5143be79c53
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Wed Jan 14 10:24:42 2015 +0000
+
+ upstream commit
+
+ remove unneeded includes, sync my copyright across files
+ & whitespace; ok djm@
+
+commit 128343bcdb0b60fc826f2733df8cf979ec1627b4
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Tue Jan 13 19:31:40 2015 +0000
+
+ upstream commit
+
+ adapt mac.c to ssherr.h return codes (de-fatal) and
+ simplify dependencies ok djm@
+
+commit e7fd952f4ea01f09ceb068721a5431ac2fd416ed
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 13 19:04:35 2015 +0000
+
+ upstream commit
+
+ sync changes from libopenssh; prepared by markus@ mostly
+ debug output tweaks, a couple of error return value changes and some other
+ minor stuff
+
+commit 76c0480a85675f03a1376167cb686abed01a3583
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Jan 13 19:38:18 2015 +1100
+
+ add --without-ssh1 option to configure
+
+ Allows disabling support for SSH protocol 1.
+
+commit 1f729f0614d1376c3332fa1edb6a5e5cec7e9e03
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Jan 13 07:39:19 2015 +0000
+
+ upstream commit
+
+ add sshd_config HostbasedAcceptedKeyTypes and
+ PubkeyAcceptedKeyTypes options to allow sshd to control what public key types
+ will be accepted. Currently defaults to all. Feedback & ok markus@
+
+commit 816d1538c24209a93ba0560b27c4fda57c3fff65
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 12 20:13:27 2015 +0000
+
+ upstream commit
+
+ unbreak parsing of pubkey comments; with gerhard; ok
+ djm/deraadt
+
+commit 0097565f849851812df610b7b6b3c4bd414f6c62
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 12 19:22:46 2015 +0000
+
+ upstream commit
+
+ missing error assigment on sshbuf_put_string()
+
+commit a7f49dcb527dd17877fcb8d5c3a9a6f550e0bba5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Jan 12 15:18:07 2015 +0000
+
+ upstream commit
+
+ apparently memcpy(x, NULL, 0) is undefined behaviour
+ according to C99 (cf. sections 7.21.1 and 7.1.4), so check skip memcpy calls
+ when length==0; ok markus@
+
+commit 905fe30fca82f38213763616d0d26eb6790bde33
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 12 14:05:19 2015 +0000
+
+ upstream commit
+
+ free->sshkey_free; ok djm@
+
+commit f067cca2bc20c86b110174c3fef04086a7f57b13
+Author: markus at openbsd.org <markus at openbsd.org>
+Date: Mon Jan 12 13:29:27 2015 +0000
+
+ upstream commit
+
+ allow WITH_OPENSSL w/o WITH_SSH1; ok djm@
+
+commit c4bfafcc2a9300d9cfb3c15e75572d3a7d74670d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jan 8 13:10:58 2015 +0000
+
+ upstream commit
+
+ adjust for sshkey_load_file() API change
+
+commit e752c6d547036c602b89e9e704851463bd160e32
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jan 8 13:44:36 2015 +0000
+
+ upstream commit
+
+ fix ssh_config FingerprintHash evaluation order; from Petr
+ Lautrbach
+
+commit ab24ab847b0fc94c8d5e419feecff0bcb6d6d1bf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jan 8 10:15:45 2015 +0000
+
+ upstream commit
+
+ reorder hostbased key attempts to better match the
+ default hostkey algorithms order in myproposal.h; ok markus@
+
+commit 1195f4cb07ef4b0405c839293c38600b3e9bdb46
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Jan 8 10:14:08 2015 +0000
+
+ upstream commit
+
+ deprecate key_load_private_pem() and
+ sshkey_load_private_pem() interfaces. Refactor the generic key loading API to
+ not require pathnames to be specified (they weren't really used).
+
+ Fixes a few other things en passant:
+
+ Makes ed25519 keys work for hostbased authentication (ssh-keysign
+ previously used the PEM-only routines).
+
+ Fixes key comment regression bz#2306: key pathnames were being lost as
+ comment fields.
+
+ ok markus@
+
+commit febbe09e4e9aff579b0c5cc1623f756862e4757d
+Author: tedu at openbsd.org <tedu at openbsd.org>
+Date: Wed Jan 7 18:15:07 2015 +0000
+
+ upstream commit
+
+ workaround for the Meyer, et al, Bleichenbacher Side
+ Channel Attack. fake up a bignum key before RSA decryption. discussed/ok djm
+ markus
+
+commit 5191df927db282d3123ca2f34a04d8d96153911a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Dec 23 22:42:48 2014 +0000
+
+ upstream commit
+
+ KNF and add a little more debug()
+
+commit 8abd80315d3419b20e6938f74d37e2e2b547f0b7
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Mon Dec 22 09:26:31 2014 +0000
+
+ upstream commit
+
+ add fingerprinthash to the options list;
+
+commit 296ef0560f60980da01d83b9f0e1a5257826536f
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Mon Dec 22 09:24:59 2014 +0000
+
+ upstream commit
+
+ tweak previous;
+
+commit 462082eacbd37778a173afb6b84c6f4d898a18b5
+Author: Damien Miller <djm at google.com>
+Date: Tue Dec 30 08:16:11 2014 +1100
+
+ avoid uninitialised free of ldns_res
+
+ If an invalid rdclass was passed to getrrsetbyname() then
+ this would execute a free on an uninitialised pointer.
+ OpenSSH only ever calls this with a fixed and valid rdclass.
+
+ Reported by Joshua Rogers
+
+commit 01b63498801053f131a0740eb9d13faf35d636c8
+Author: Damien Miller <djm at google.com>
+Date: Mon Dec 29 18:10:18 2014 +1100
+
+ pull updated OpenBSD BCrypt PBKDF implementation
+
+ Includes fix for 1 byte output overflow for large key length
+ requests (not reachable in OpenSSH).
+
+ Pointed out by Joshua Rogers
+
+commit c528c1b4af2f06712177b3de9b30705752f7cbcb
+Author: Damien Miller <djm at google.com>
+Date: Tue Dec 23 15:26:13 2014 +1100
+
+ fix variable name for IPv6 case in construct_utmpx
+
+ patch from writeonce AT midipix.org via bz#2296
+
+commit 293cac52dcda123244b2e594d15592e5e481c55e
+Author: Damien Miller <djm at google.com>
+Date: Mon Dec 22 16:30:42 2014 +1100
+
+ include and use OpenBSD netcat in regress/
+
+commit 8f6784f0cb56dc4fd00af3e81a10050a5785228d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 09:05:17 2014 +0000
+
+ upstream commit
+
+ mention ssh -Q feature to list supported { MAC, cipher,
+ KEX, key } algorithms in more places and include the query string used to
+ list the relevant information; bz#2288
+
+commit 449e11b4d7847079bd0a2daa6e3e7ea03d8ef700
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Mon Dec 22 08:24:17 2014 +0000
+
+ upstream commit
+
+ tweak previous;
+
+commit 4bea0ab3290c0b9dd2aa199e932de8e7e18062d6
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 08:06:03 2014 +0000
+
+ upstream commit
+
+ regression test for multiple required pubkey authentication;
+ ok markus@
+
+commit f1c4d8ec52158b6f57834b8cd839605b0a33e7f2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 08:04:23 2014 +0000
+
+ upstream commit
+
+ correct description of what will happen when a
+ AuthorizedKeysCommand is specified but AuthorizedKeysCommandUser is not (sshd
+ will refuse to start)
+
+commit 161cf419f412446635013ac49e8c660cadc36080
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 07:55:51 2014 +0000
+
+ upstream commit
+
+ make internal handling of filename arguments of "none"
+ more consistent with ssh. "none" arguments are now replaced with NULL when
+ the configuration is finalised.
+
+ Simplifies checking later on (just need to test not-NULL rather than
+ that + strcmp) and cleans up some inconsistencies. ok markus@
+
+commit f69b69b8625be447b8826b21d87713874dac25a6
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 07:51:30 2014 +0000
+
+ upstream commit
+
+ remember which public keys have been used for
+ authentication and refuse to accept previously-used keys.
+
+ This allows AuthenticationMethods=publickey,publickey to require
+ that users authenticate using two _different_ pubkeys.
+
+ ok markus@
+
+commit 46ac2ed4677968224c4ca825bc98fc68dae183f0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 07:24:11 2014 +0000
+
+ upstream commit
+
+ fix passing of wildcard forward bind addresses when
+ connection multiplexing is in use; patch from Sami Hartikainen via bz#2324;
ok dtucker@
- - djm at cvs.openbsd.org 2011/12/04 23:16:12
- [mux.c]
- revert:
- > revision 1.32
- > date: 2011/12/02 00:41:56; author: djm; state: Exp; lines: +4 -1
- > fix bz#1948: ssh -f doesn't fork for multiplexed connection.
- > ok dtucker@
- it interacts badly with ControlPersist
- - djm at cvs.openbsd.org 2012/01/07 21:11:36
- [mux.c]
- fix double-free in new session handler
- NB. Id sync only
- - djm at cvs.openbsd.org 2012/05/23 03:28:28
- [dns.c dns.h key.c key.h ssh-keygen.c]
- add support for RFC6594 SSHFP DNS records for ECDSA key types.
- patch from bugzilla-m67 AT nulld.me in bz#1978; ok + tweak markus@
- (Original authors Ondřej Surý, Ondřej Caletka and Daniel Black)
- - djm at cvs.openbsd.org 2012/06/01 00:49:35
- [PROTOCOL.mux]
- correct types of port numbers (integers, not strings); bz#2004 from
- bert.wesarg AT googlemail.com
- - djm at cvs.openbsd.org 2012/06/01 01:01:22
- [mux.c]
- fix memory leak when mux socket creation fails; bz#2002 from bert.wesarg
- AT googlemail.com
- - dtucker at cvs.openbsd.org 2012/06/18 11:43:53
- [jpake.c]
- correct sizeof usage. patch from saw at online.de, ok deraadt
- - dtucker at cvs.openbsd.org 2012/06/18 11:49:58
- [ssh_config.5]
- RSA instead of DSA twice. From Steve.McClellan at radisys com
- - dtucker at cvs.openbsd.org 2012/06/18 12:07:07
- [ssh.1 sshd.8]
- Remove mention of 'three' key files since there are now four. From
- Steve.McClellan at radisys com.
- - dtucker at cvs.openbsd.org 2012/06/18 12:17:18
- [ssh.1]
- Clarify description of -W. Noted by Steve.McClellan at radisys com,
- ok jmc
- - markus at cvs.openbsd.org 2012/06/19 18:25:28
- [servconf.c servconf.h sshd_config.5]
- sshd_config: extend Match to allow AcceptEnv and {Allow,Deny}{Users,Groups}
- this allows 'Match LocalPort 1022' combined with 'AllowUser bauer'
- ok djm@ (back in March)
- - jmc at cvs.openbsd.org 2012/06/19 21:35:54
- [sshd_config.5]
- tweak previous; ok markus
- - djm at cvs.openbsd.org 2012/06/20 04:42:58
- [clientloop.c serverloop.c]
- initialise accept() backoff timer to avoid EINVAL from select(2) in
- rekeying
-20120519
- - (dtucker) [configure.ac] bz#2010: fix non-portable shell construct. Patch
- from cjwatson at debian org.
- - (dtucker) [configure.ac contrib/Makefile] bz#1996: use AC_PATH_TOOL to find
- pkg-config so it does the right thing when cross-compiling. Patch from
- cjwatson at debian org.
-- (dtucker) OpenBSD CVS Sync
- - dtucker at cvs.openbsd.org 2012/05/13 01:42:32
- [servconf.h servconf.c sshd.8 sshd.c auth.c sshd_config.5]
- Add "Match LocalAddress" and "Match LocalPort" to sshd and adjust tests
- to match. Feedback and ok djm@ markus at .
- - dtucker at cvs.openbsd.org 2012/05/19 06:30:30
- [sshd_config.5]
- Document PermitOpen none. bz#2001, patch from Loganaden Velvindron
+commit 0d1b241a262e4d0a6bbfdd595489ab1b853c43a1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 06:14:29 2014 +0000
-20120504
- - (dtucker) [configure.ac] Include <sys/param.h> rather than <sys/types.h>
- to fix building on some plaforms. Fom bowman at math utah edu and
- des at des no.
+ upstream commit
+
+ make this slightly easier to diff against portable
-20120427
- - (dtucker) [regress/addrmatch.sh] skip tests when running on a non-ipv6
- platform rather than exiting early, so that we still clean up and return
- success or failure to test-exec.sh
+commit 0715bcdddbf68953964058f17255bf54734b8737
+Author: Damien Miller <djm at mindrot.org>
+Date: Mon Dec 22 13:47:07 2014 +1100
-20120426
- - (djm) [auth-passwd.c] Handle crypt() returning NULL; from Paul Wouters
- via Niels
- - (djm) [auth-krb5.c] Save errno across calls that might modify it;
- ok dtucker@
+ add missing regress output file
-20120423
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2012/04/23 08:18:17
- [channels.c]
- fix function proto/source mismatch
+commit 1e30483c8ad2c2f39445d4a4b6ab20c241e40593
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 02:15:52 2014 +0000
-20120422
- - OpenBSD CVS Sync
- - djm at cvs.openbsd.org 2012/02/29 11:21:26
- [ssh-keygen.c]
- allow conversion of RSA1 keys to public PEM and PKCS8; "nice" markus@
- - guenther at cvs.openbsd.org 2012/03/15 03:10:27
- [session.c]
- root should always be excluded from the test for /etc/nologin instead
- of having it always enforced even when marked as ignorenologin. This
- regressed when the logic was incompletely flipped around in rev 1.251
- ok halex@ millert@
- - djm at cvs.openbsd.org 2012/03/28 07:23:22
- [PROTOCOL.certkeys]
- explain certificate extensions/crit split rationale. Mention requirement
- that each appear at most once per cert.
- - dtucker at cvs.openbsd.org 2012/03/29 23:54:36
- [channels.c channels.h servconf.c]
- Add PermitOpen none option based on patch from Loganaden Velvindron
- (bz #1949). ok djm@
- - djm at cvs.openbsd.org 2012/04/11 13:16:19
- [channels.c channels.h clientloop.c serverloop.c]
- don't spin in accept() when out of fds (ENFILE/ENFILE) - back off for a
- while; ok deraadt@ markus@
- - djm at cvs.openbsd.org 2012/04/11 13:17:54
- [auth.c]
- Support "none" as an argument for AuthorizedPrincipalsFile to indicate
- no file should be read.
- - djm at cvs.openbsd.org 2012/04/11 13:26:40
- [sshd.c]
- don't spin in accept() when out of fds (ENFILE/ENFILE) - back off for a
- while; ok deraadt@ markus@
- - djm at cvs.openbsd.org 2012/04/11 13:34:17
- [ssh-keyscan.1 ssh-keyscan.c]
- now that sshd defaults to offering ECDSA keys, ssh-keyscan should also
- look for them by default; bz#1971
- - djm at cvs.openbsd.org 2012/04/12 02:42:32
- [servconf.c servconf.h sshd.c sshd_config sshd_config.5]
- VersionAddendum option to allow server operators to append some arbitrary
- text to the SSH-... banner; ok deraadt@ "don't care" markus@
- - djm at cvs.openbsd.org 2012/04/12 02:43:55
- [sshd_config sshd_config.5]
- mention AuthorizedPrincipalsFile=none default
- - djm at cvs.openbsd.org 2012/04/20 03:24:23
- [sftp.c]
- setlinebuf(3) is more readable than setvbuf(.., _IOLBF, ...)
- - jmc at cvs.openbsd.org 2012/04/20 16:26:22
- [ssh.1]
- use "brackets" instead of "braces", for consistency;
+ upstream commit
+
+ adjust for new SHA256 key fingerprints and
+ slightly-different MD5 hex fingerprint format
-20120420
- - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
- [contrib/suse/openssh.spec] Update for release 6.0
- - (djm) [README] Update URL to release notes.
- - (djm) Release openssh-6.0
+commit 6b40567ed722df98593ad8e6a2d2448fc2b4b151
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Dec 22 01:14:49 2014 +0000
+ upstream commit
+
+ poll changes to netcat (usr.bin/netcat.c r1.125) broke
+ this test; fix it by ensuring more stdio fds are sent to devnull
+
+commit a5375ccb970f49dddf7d0ef63c9b713ede9e7260
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Sun Dec 21 23:35:14 2014 +0000
+
+ upstream commit
+
+ tweak previous;
+
+commit b79efde5c3badf5ce4312fe608d8307eade533c5
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Dec 21 23:12:42 2014 +0000
+
+ upstream commit
+
+ document FingerprintHash here too
+
+commit d16bdd8027dd116afa01324bb071a4016cdc1a75
+Author: Damien Miller <djm at mindrot.org>
+Date: Mon Dec 22 10:18:09 2014 +1100
+
+ missing include for base64 encoding
+
+commit 56d1c83cdd1ac76f1c6bd41e01e80dad834f3994
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Sun Dec 21 22:27:55 2014 +0000
+
+ upstream commit
+
+ Add FingerprintHash option to control algorithm used for
+ key fingerprints. Default changes from MD5 to SHA256 and format from hex to
+ base64.
+
+ Feedback and ok naddy@ markus@
+
+commit 058f839fe15c51be8b3a844a76ab9a8db550be4f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 18 23:58:04 2014 +0000
+
+ upstream commit
+
+ don't count partial authentication success as a failure
+ against MaxAuthTries; ok deraadt@
+
+commit c7219f4f54d64d6dde66dbcf7a2699daa782d2a1
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Dec 12 00:02:17 2014 +0000
+
+ upstream commit
+
+ revert chunk I didn't mean to commit yet; via jmc@
+
+commit 7de5991aa3997e2981440f39c1ea01273a0a2c7b
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Dec 18 11:44:06 2014 +1100
+
+ upstream libc change
+
+ revision 1.2
+ date: 2014/12/08 03:45:00; author: bcook; state: Exp; lines: +2 -2; commitid: 7zWEBgJJOCZ2hvTV;
+ avoid left shift overflow in reallocarray.
+
+ Some 64-bit platforms (e.g. Windows 64) have a 32-bit long. So, shifting
+ 1UL 32-bits to the left causes an overflow. This replaces the constant 1UL with
+ (size_t)1 so that we get the correct constant size for the platform.
+
+ discussed with tedu@ & deraadt@
+
+commit 2048f85a5e6da8bc6e0532efe02ecfd4e63c978c
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Dec 18 10:15:49 2014 +1100
+
+ include CFLAGS in gnome askpass targets
+
+ from Fedora
+
+commit 48b68ce19ca42fa488960028048dec023f7899bb
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 11 08:20:09 2014 +0000
+
+ upstream commit
+
+ explicitly include sys/param.h in files that use the
+ howmany() macro; from portable
+
+commit d663bea30a294d440fef4398e5cd816317bd4518
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 11 05:25:06 2014 +0000
+
+ upstream commit
+
+ mention AuthorizedKeysCommandUser must be set for
+ AuthorizedKeysCommand to be run; bz#2287
+
+commit 17bf3d81e00f2abb414a4fd271118cf4913f049f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 11 05:13:28 2014 +0000
+
+ upstream commit
+
+ show in debug output which hostkeys are being tried when
+ attempting hostbased auth; patch from Iain Morgan
+
+commit da0277e3717eadf5b15e03379fc29db133487e94
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 11 04:16:14 2014 +0000
+
+ upstream commit
+
+ Make manual reflect reality: sftp-server's -d option
+ accepts a "%d" option, not a "%h" one.
+
+ bz#2316; reported by Kirk Wolf
+
+commit 4cf87f4b81fa9380bce5fcff7b0f8382ae3ad996
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Dec 10 01:24:09 2014 +0000
+
+ upstream commit
+
+ better error value for invalid signature length
+
+commit 4bfad14ca56f8ae04f418997816b4ba84e2cfc3c
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Dec 10 02:12:51 2014 +1100
+
+ Resync more with OpenBSD's rijndael.c, in particular "#if 0"-ing out some
+ unused code. Should fix compile error reported by plautrba at redhat.
+
+commit 642652d280499691c8212ec6b79724b50008ce09
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Wed Dec 10 01:32:23 2014 +1100
+
+ Add reallocarray to compat library
+
+commit 3dfd8d93dfcc69261f5af99df56f3ff598581979
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 4 22:31:50 2014 +0000
+
+ upstream commit
+
+ add tests for new client RevokedHostKeys option; refactor
+ to make it a bit more readable
+
+commit a31046cad1aed16a0b55171192faa6d02665ccec
+Author: krw at openbsd.org <krw at openbsd.org>
+Date: Wed Nov 19 13:35:37 2014 +0000
+
+ upstream commit
+
+ Nuke yet more obvious #include duplications.
+
+ ok deraadt@
+
+commit a7c762e5b2c1093542c0bc1df25ccec0b4cf479f
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 4 20:47:36 2014 +0000
+
+ upstream commit
+
+ key_in_file() wrapper is no longer used
+
+commit 5e39a49930d885aac9c76af3129332b6e772cd75
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 4 02:24:32 2014 +0000
+
+ upstream commit
+
+ add RevokedHostKeys option for the client
+
+ Allow textfile or KRL-based revocation of hostkeys.
+
+commit 74de254bb92c684cf53461da97f52d5ba34ded80
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Thu Dec 4 01:49:59 2014 +0000
+
+ upstream commit
+
+ convert KRL code to new buffer API
+
+ ok markus@
+
+commit db995f2eed5fc432598626fa3e30654503bf7151
+Author: millert at openbsd.org <millert at openbsd.org>
+Date: Wed Nov 26 18:34:51 2014 +0000
+
+ upstream commit
+
+ Prefer setvbuf() to setlinebuf() for portability; ok
+ deraadt@
+
+commit 72bba3d179ced8b425272efe6956a309202a91f3
+Author: jsg at openbsd.org <jsg at openbsd.org>
+Date: Mon Nov 24 03:39:22 2014 +0000
+
+ upstream commit
+
+ Fix crashes in the handling of the sshd config file found
+ with the afl fuzzer.
+
+ ok deraadt@ djm@
+
+commit 867f49c666adcfe92bf539d9c37c1accdea08bf6
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Nov 26 13:22:41 2014 +1100
+
+ Avoid Cygwin ssh-host-config reading /etc/group
+
+ Patch from Corinna Vinschen
+
+commit 8b66f36291a721b1ba7c44f24a07fdf39235593e
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Nov 26 13:20:35 2014 +1100
+
+ allow custom service name for sshd on Cygwin
+
+ Permits the use of multiple sshd running with different service names.
+
+ Patch by Florian Friesdorf via Corinna Vinschen
+
+commit 08c0eebf55d70a9ae1964399e609288ae3186a0c
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Sat Nov 22 19:21:03 2014 +0000
+
+ upstream commit
+
+ restore word zapped in previous, and remove some useless
+ "No" macros;
+
+commit a1418a0033fba43f061513e992e1cbcc3343e563
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Sat Nov 22 18:15:41 2014 +0000
+
+ upstream commit
+
+ /dev/random has created the same effect as /dev/arandom
+ (and /dev/urandom) for quite some time. Mop up the last few, by using
+ /dev/random where we actually want it, or not even mentioning arandom where
+ it is irrelevant.
+
+commit b6de5ac9ed421362f479d1ad4fa433d2e25dad5b
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Fri Nov 21 01:00:38 2014 +0000
+
+ upstream commit
+
+ fix NULL pointer dereference crash on invalid timestamp
+
+ found using Michal Zalewski's afl fuzzer
+
+commit a1f8110cd5ed818d59b3a2964fab7de76e92c18e
+Author: mikeb at openbsd.org <mikeb at openbsd.org>
+Date: Tue Nov 18 22:38:48 2014 +0000
+
+ upstream commit
+
+ Sync AES code to the one shipped in OpenSSL/LibreSSL.
+
+ This includes a commit made by Andy Polyakov <appro at openssl ! org>
+ to the OpenSSL source tree on Wed, 28 Jun 2006 with the following
+ message: "Mitigate cache-collision timing attack on last round."
+
+ OK naddy, miod, djm
+
+commit 335c83d5f35d8620e16b8aa26592d4f836e09ad2
+Author: krw at openbsd.org <krw at openbsd.org>
+Date: Tue Nov 18 20:54:28 2014 +0000
+
+ upstream commit
+
+ Nuke more obvious #include duplications.
+
+ ok deraadt@ millert@ tedu@
+
+commit 51b64e44121194ae4bf153dee391228dada2abcb
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Nov 17 00:21:40 2014 +0000
+
+ upstream commit
+
+ fix KRL generation when multiple CAs are in use
+
+ We would generate an invalid KRL when revoking certs by serial
+ number for multiple CA keys due to a section being written out
+ twice.
+
+ Also extend the regress test to catch this case by having it
+ produce a multi-CA KRL.
+
+ Reported by peter AT pean.org
+
+commit d2d51003a623e21fb2b25567c4878d915e90aa2a
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Nov 18 01:02:25 2014 +0000
+
+ upstream commit
+
+ fix NULL pointer dereference crash in key loading
+
+ found by Michal Zalewski's AFL fuzzer
+
+commit 9f9fad0191028edc43d100d0ded39419b6895fdf
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Nov 17 00:21:40 2014 +0000
+
+ upstream commit
+
+ fix KRL generation when multiple CAs are in use
+
+ We would generate an invalid KRL when revoking certs by serial
+ number for multiple CA keys due to a section being written out
+ twice.
+
+ Also extend the regress test to catch this case by having it
+ produce a multi-CA KRL.
+
+ Reported by peter AT pean.org
+
+commit da8af83d3f7ec00099963e455010e0ed1d7d0140
+Author: bentley at openbsd.org <bentley at openbsd.org>
+Date: Sat Nov 15 14:41:03 2014 +0000
+
+ upstream commit
+
+ Reduce instances of `` '' in manuals.
+
+ troff displays these as typographic quotes, but nroff implementations
+ almost always print them literally, which rarely has the intended effect
+ with modern fonts, even in stock xterm.
+
+ These uses of `` '' can be replaced either with more semantic alternatives
+ or with Dq, which prints typographic quotes in a UTF-8 locale (but will
+ automatically fall back to `` '' in an ASCII locale).
+
+ improvements and ok schwarze@
+
+commit fc302561369483bb755b17f671f70fb894aec01d
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Nov 10 22:25:49 2014 +0000
+
+ upstream commit
+
+ mux-related manual tweaks
+
+ mention ControlPersist=0 is the same as ControlPersist=yes
+
+ recommend that ControlPath sockets be placed in a og-w directory
+
+commit 0e4cff5f35ed11102fe3783779960ef07e0cd381
+Author: Damien Miller <djm at google.com>
+Date: Wed Nov 5 11:01:31 2014 +1100
+
+ Prepare scripts for next Cygwin release
+
+ Makes the Cygwin-specific ssh-user-config script independent of the
+ existence of /etc/passwd. The next Cygwin release will allow to
+ generate passwd and group entries from the Windows account DBs, so the
+ scripts have to adapt.
+
+ from Corinna Vinschen
+
+commit 7d0ba5336651731949762eb8877ce9e3b52df436
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Oct 30 10:45:41 2014 +1100
+
+ include version number in OpenSSL-too-old error
+
+commit 3bcb92e04d9207e9f78d82f7918c6d3422054ce9
+Author: lteo at openbsd.org <lteo at openbsd.org>
+Date: Fri Oct 24 02:01:20 2014 +0000
+
+ upstream commit
+
+ Remove unnecessary include: netinet/in_systm.h is not needed
+ by these programs.
+
+ NB. skipped for portable
+
+ ok deraadt@ millert@
+
+commit 6fdcaeb99532e28a69f1a1599fbd540bb15b70a0
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Oct 20 03:43:01 2014 +0000
+
+ upstream commit
+
+ whitespace
+
+commit 165bc8786299e261706ed60342985f9de93a7461
+Author: daniel at openbsd.org <daniel at openbsd.org>
+Date: Tue Oct 14 03:09:59 2014 +0000
+
+ upstream commit
+
+ plug a memory leak; from Maxime Villard.
+
+ ok djm@
+
+commit b1ba15f3885947c245c2dbfaad0a04ba050abea0
+Author: jmc at openbsd.org <jmc at openbsd.org>
+Date: Thu Oct 9 06:21:31 2014 +0000
+
+ upstream commit
+
+ tweak previous;
+
+commit 259a02ebdf74ad90b41d116ecf70aa823fa4c6e7
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Oct 13 00:38:35 2014 +0000
+
+ upstream commit
+
+ whitespace
+
+commit 957fbceb0f3166e41b76fdb54075ab3b9cc84cba
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Oct 8 22:20:25 2014 +0000
+
+ upstream commit
+
+ Tweak config reparsing with host canonicalisation
+
+ Make the second pass through the config files always run when
+ hostname canonicalisation is enabled.
+
+ Add a "Match canonical" criteria that allows ssh_config Match
+ blocks to trigger only in the second config pass.
+
+ Add a -G option to ssh that causes it to parse its configuration
+ and dump the result to stdout, similar to "sshd -T"
+
+ Allow ssh_config Port options set in the second config parse
+ phase to be applied (they were being ignored).
+
+ bz#2267 bz#2286; ok markus
+
+commit 5c0dafd38bf66feeeb45fa0741a5baf5ad8039ba
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Oct 8 22:15:27 2014 +0000
+
+ upstream commit
+
+ another -Wpointer-sign from clang
+
+commit bb005dc815ebda9af3ae4b39ca101c4da918f835
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Oct 8 22:15:06 2014 +0000
+
+ upstream commit
+
+ fix a few -Wpointer-sign warnings from clang
+
+commit 3cc1fbb4fb0e804bfb873fd363cea91b27fc8188
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Oct 8 21:45:48 2014 +0000
+
+ upstream commit
+
+ parse cert sections using nested buffers to reduce
+ copies; ok markus
+
+commit 4a45922aebf99164e2fc83d34fe55b11ae1866ef
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Mon Oct 6 00:47:15 2014 +0000
+
+ upstream commit
+
+ correct options in usage(); from mancha1 AT zoho.com
+
+commit 48dffd5bebae6fed0556dc5c36cece0370690618
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Sep 9 09:45:36 2014 +0000
+
+ upstream commit
+
+ mention permissions on tun(4) devices in PermitTunnel
+ documentation; bz#2273
+
+commit a5883d4eccb94b16c355987f58f86a7dee17a0c2
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Wed Sep 3 18:55:07 2014 +0000
+
+ upstream commit
+
+ tighten permissions on pty when the "tty" group does
+ not exist; pointed out by Corinna Vinschen; ok markus
+
+commit 180bcb406b58bf30723c01a6b010e48ee626dda8
+Author: sobrado at openbsd.org <sobrado at openbsd.org>
+Date: Sat Aug 30 16:32:25 2014 +0000
+
+ upstream commit
+
+ typo.
+
+commit f70b22bcdd52f6bf127047b3584371e6e5d45627
+Author: sobrado at openbsd.org <sobrado at openbsd.org>
+Date: Sat Aug 30 15:33:50 2014 +0000
+
+ upstream commit
+
+ improve capitalization for the Ed25519 public-key
+ signature system.
+
+ ok djm@
+
+commit 7df8818409c752cf3f0c3f8044fe9aebed8647bd
+Author: doug at openbsd.org <doug at openbsd.org>
+Date: Thu Aug 21 01:08:52 2014 +0000
+
+ upstream commit
+
+ Free resources on error in mkstemp and fdopen
+
+ ok djm@
+
+commit 40ba4c9733aaed08304714faeb61529f18da144b
+Author: deraadt at openbsd.org <deraadt at openbsd.org>
+Date: Wed Aug 20 01:28:55 2014 +0000
+
+ upstream commit
+
+ djm how did you make a typo like that...
+
+commit 57d378ec9278ba417a726f615daad67d157de666
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Aug 19 23:58:28 2014 +0000
+
+ upstream commit
+
+ When dumping the server configuration (sshd -T), print
+ correct KEX, MAC and cipher defaults. Spotted by Iain Morgan
+
+commit 7ff880ede5195d0b17e7f1e3b6cfbc4cb6f85240
+Author: djm at openbsd.org <djm at openbsd.org>
+Date: Tue Aug 19 23:57:18 2014 +0000
+
+ upstream commit
+
+ ~-expand lcd paths
+
+commit 4460a7ad0c78d4cd67c467f6e9f4254d0404ed59
+Author: Damien Miller <djm at mindrot.org>
+Date: Sun Oct 12 12:35:48 2014 +1100
+
+ remove duplicated KEX_DH1 entry
+
+commit c9b8426a616138d0d762176c94f51aff3faad5ff
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Oct 9 10:34:06 2014 +1100
+
+ remove ChangeLog file
+
+ Commit logs will be generated from git at release time.
+
+commit 81d18ff7c93a04affbf3903e0963859763219aed
+Author: Damien Miller <djm at google.com>
+Date: Tue Oct 7 21:24:25 2014 +1100
+
+ delete contrib/caldera directory
+
+commit 0ec9e87d3638206456968202f05bb5123670607a
+Author: Damien Miller <djm at google.com>
+Date: Tue Oct 7 19:57:27 2014 +1100
+
+ test commit
+
+commit 8fb65a44568701b779f3d77326bceae63412d28d
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Oct 7 09:21:49 2014 +1100
+
+ - (djm) Release OpenSSH-6.7
+
+commit e8c9f2602c46f6781df5e52e6cd8413dab4602a3
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Oct 3 09:24:56 2014 +1000
+
+ - (djm) [sshd_config.5] typo; from Iain Morgan
+
+commit 703b98a26706f5083801d11059486d77491342ae
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Oct 1 09:43:07 2014 +1000
+
+ - (djm) [openbsd-compat/Makefile.in openbsd-compat/kludge-fd_set.c]
+ [openbsd-compat/openbsd-compat.h] Kludge around bad glibc
+ _FORTIFY_SOURCE check that doesn't grok heap-allocated fd_sets;
+ ok dtucker@
+
+commit 0fa0ed061bbfedb0daa705e220748154a84c3413
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Sep 10 08:15:34 2014 +1000
+
+ - (djm) [sandbox-seccomp-filter.c] Allow mremap and exit for DietLibc;
+ patch from Felix von Leitner; ok dtucker
+
+commit ad7d23d461c3b7e1dcb15db13aee5f4b94dc1a95
+Author: Darren Tucker <dtucker at zip.com.au>
+Date: Tue Sep 9 12:23:10 2014 +1000
+
+ 20140908
+ - (dtucker) [INSTALL] Update info about egd. ok djm@
+
+commit 2a8699f37cc2515e3bc60e0c677ba060f4d48191
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Sep 4 03:46:05 2014 +1000
+
+ - (djm) [openbsd-compat/arc4random.c] Zero seed after keying PRNG
+
+commit 44988defb1f5e3afe576d86000365e1f07a1b494
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Sep 3 05:35:32 2014 +1000
+
+ - (djm) [contrib/cygwin/ssh-host-config] Fix old code leading to
+ permissions/ACLs; from Corinna Vinschen
+
+commit 23f269562b7537b2f6f5014e50a25e5dcc55a837
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Sep 3 05:33:25 2014 +1000
+
+ - (djm) [defines.h sshbuf.c] Move __predict_true|false to defines.h and
+ conditionalise to avoid duplicate definition.
+
+commit 41c8de2c0031cf59e7cf0c06b5bcfbf4852c1fda
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Aug 30 16:23:06 2014 +1000
+
+ - (djm) [Makefile.in] Make TEST_SHELL a variable; "good idea" tim@
+
+commit d7c81e216a7bd9eed6e239c970d9261bb1651947
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Aug 30 04:18:28 2014 +1000
+
+ - (djm) [openbsd-compat/openssl-compat.h] add include guard
+
+commit 4687802dda57365b984b897fc3c8e2867ea09b22
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Aug 30 03:29:19 2014 +1000
+
+ - (djm) [misc.c] Missing newline between functions
+
+commit 51c77e29220dee87c53be2dc47092934acab26fe
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Aug 30 02:30:30 2014 +1000
+
+ - (djm) [openbsd-compat/openssl-compat.h] add
+ OPENSSL_[RD]SA_MAX_MODULUS_BITS defines for OpenSSL that lacks them
+
+commit 3d673d103bad35afaec6e7ef73e5277216ce33a3
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Aug 27 06:32:01 2014 +1000
+
+ - (djm) [openbsd-compat/explicit_bzero.c] implement explicit_bzero()
+ using memset_s() where possible; improve fallback to indirect bzero
+ via a volatile pointer to give it more of a chance to avoid being
+ optimised away.
+
+commit 146218ac11a1eb0dcade6f793d7acdef163b5ddc
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Aug 27 04:11:55 2014 +1000
+
+ - (djm) [monitor.c sshd.c] SIGXFSZ needs to be ignored in postauth
+ monitor, not preauth; bz#2263
+
+commit 1b215c098b3b37e38aa4e4c91bb908eee41183b1
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Aug 27 04:04:40 2014 +1000
+
+ - (djm) [regress/unittests/sshbuf/test_sshbuf_getput_crypto.c]
+ [regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c]
+ [regress/unittests/sshkey/common.c]
+ [regress/unittests/sshkey/test_file.c]
+ [regress/unittests/sshkey/test_fuzz.c]
+ [regress/unittests/sshkey/test_sshkey.c] Don't include openssl/ec.h
+ on !ECC OpenSSL systems
+
+commit ad013944af0a19e3f612089d0099bb397cf6502d
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 26 09:27:28 2014 +1000
+
+ - (djm) [INSTALL] Recommend libcrypto be built -fPIC, mention LibreSSL,
+ update OpenSSL version requirement.
+
+commit ed126de8ee04c66640a0ea2697c4aaf36801f100
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 26 08:37:47 2014 +1000
+
+ - (djm) [bufec.c] Skip this file on !ECC OpenSSL
+
+commit 9c1dede005746864a4fdb36a7cdf6c51296ca909
+Author: Damien Miller <djm at mindrot.org>
+Date: Sun Aug 24 03:01:06 2014 +1000
+
+ - (djm) [sftp-server.c] Some systems (e.g. Irix) have prctl() but not
+ PR_SET_DUMPABLE, so adjust ifdef; reported by Tom Christensen
+
+commit d244a5816fd1312a33404b436e4dd83594f1119e
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Aug 23 17:06:49 2014 +1000
+
+ - (djm) [configure.ac] We now require a working vsnprintf everywhere (not
+ just for systems that lack asprintf); check for it always and extend
+ test to catch more brokenness. Fixes builds on Solaris <= 9
+
+commit 4cec036362a358e398e6a2e6d19d8e5780558634
+Author: Damien Miller <djm at mindrot.org>
+Date: Sat Aug 23 03:11:09 2014 +1000
+
+ - (djm) [sshd.c] Ignore SIGXFSZ in preauth monitor child; can explode on
+ lastlog writing on platforms with high UIDs; bz#2263
+
+commit 394a60f2598d28b670d934b93942a3370b779b39
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 22 18:06:20 2014 +1000
+
+ - (djm) [configure.ac] double braces to appease autoconf
+
+commit 4d69aeabd6e60afcdc7cca177ca751708ab79a9d
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 22 17:48:27 2014 +1000
+
+ - (djm) [openbsd-compat/bsd-snprintf.c] Fix compilation failure (prototype/
+ definition mismatch) and warning for broken/missing snprintf case.
+
+commit 0c11f1ac369d2c0aeb0ab0458a7cd04c72fe5e9e
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 22 17:36:56 2014 +1000
+
+ - (djm) [sshbuf-getput-crypto.c] Fix compilation when OpenSSL lacks ECC
+
+commit 6d62784b8973340b251fea6b04890f471adf28db
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 22 17:36:19 2014 +1000
+
+ - (djm) [configure.ac] include leading zero characters in OpenSSL version
+ number; fixes test for unsupported versions
+
+commit 4f1ff1ed782117f5d5204d4e91156ed5da07cbb7
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Aug 21 15:54:50 2014 +1000
+
+ - (djm) [regress/unittests/test_helper/test_helper.c] Fix for systems that
+ don't set __progname. Diagnosed by Tom Christensen.
+
+commit 005a64da0f457410045ef0bfa93c863c2450447d
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Aug 21 10:48:41 2014 +1000
+
+ - (djm) [key.h] Fix ifdefs for no-ECC OpenSSL
+
+commit aa6598ebb3343c7380e918388e10e8ca5852b613
+Author: Damien Miller <djm at mindrot.org>
+Date: Thu Aug 21 10:47:54 2014 +1000
+
+ - (djm) [Makefile.in] fix reference to libtest_helper.a in sshkey test too.
+
+commit 54703e3cf63f0c80d4157e5ad7dbc2b363ee2c56
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Aug 20 11:10:51 2014 +1000
+
+ - (djm) [contrib/cygwin/README] Correct build instructions; from Corinna
+
+commit f0935698f0461f24d8d1f1107b476ee5fd4db1cb
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Aug 20 11:06:50 2014 +1000
+
+ - (djm) [sshkey.h] Fix compilation when OpenSSL lacks ECC
+
+commit c5089ecaec3b2c02f014f4e67518390702a4ba14
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Aug 20 11:06:20 2014 +1000
+
+ - (djm) [Makefile.in] refer to libtest_helper.a by explicit path rather than
+ -L/-l; fixes linking problems on some platforms
+
+commit 2195847e503a382f83ee969b0a8bd3dfe0e55c18
+Author: Damien Miller <djm at mindrot.org>
+Date: Wed Aug 20 11:05:03 2014 +1000
+
+ - (djm) [configure.ac] Check OpenSSL version is supported at configure time;
+ suggested by Kevin Brott
+
+commit a75aca1bbc989aa9f8b1b08489d37855f3d24d1a
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 19 11:36:07 2014 +1000
+
+ - (djm) [INSTALL contrib/caldera/openssh.spec contrib/cygwin/README]
+ [contrib/redhat/openssh.spec contrib/suse/openssh.spec] Remove mentions
+ of TCP wrappers.
+
+commit 3f022b5a9477abceeb1bbeab04b055f3cc7ca8f6
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 19 11:32:34 2014 +1000
+
+ - (djm) [ssh-dss.c] Include openssl/dsa.h for DSA_SIG
+
+commit 88137902632aceb923990e98cf5dc923bb3ef2f5
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 19 11:28:11 2014 +1000
+
+ - (djm) [sshbuf.h] Fix compilation on systems without OPENSSL_HAS_ECC.
+
+commit 2f3d1e7fb2eabd3cfbfd8d0f7bdd2f9a1888690b
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 19 11:14:36 2014 +1000
+
+ - (djm) [myproposal.h] Make curve25519 KEX dependent on
+ HAVE_EVP_SHA256 instead of OPENSSL_HAS_ECC.
+
+commit d4e7d59d01a6c7f59e8c1f94a83c086e9a33d8aa
+Author: Damien Miller <djm at mindrot.org>
+Date: Tue Aug 19 11:14:17 2014 +1000
+
+ - (djm) [serverloop.c] Fix syntax error on Cygwin; from Corinna Vinschen
+
+commit 9eaeea2cf2b6af5f166cfa9ad3c7a90711a147a9
+Author: Damien Miller <djm at mindrot.org>
+Date: Sun Aug 10 11:35:05 2014 +1000
+
+ - (djm) [README contrib/caldera/openssh.spec]
+ [contrib/redhat/openssh.spec contrib/suse/openssh.spec] Update versions
+
+commit f8988fbef0c9801d19fa2f8f4f041690412bec37
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 1 13:31:52 2014 +1000
+
+ - (djm) [regress/multiplex.sh] Use -d (detach stdin) flag to disassociate
+ nc from stdin, it's more portable
+
+commit 5b3879fd4b7a4e3d43bab8f40addda39bc1169d0
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 1 12:28:31 2014 +1000
+
+ - (djm) [regress/multiplex.sh] Instruct nc not to quit as soon as stdin
+ is closed; avoid regress failures when stdin is /dev/null
+
+commit a9c46746d266f8a1b092a72b2150682d1af8ebfc
+Author: Damien Miller <djm at mindrot.org>
+Date: Fri Aug 1 12:26:49 2014 +1000
+
+ - (djm) [regress/multiplex.sh] Skip test for non-OpenBSD netcat. We need
+ a better solution, but this will have to do for now.
Modified: trunk/crypto/openssh/INSTALL
===================================================================
--- trunk/crypto/openssh/INSTALL 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/INSTALL 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,22 +1,27 @@
1. Prerequisites
----------------
-You will need working installations of Zlib and OpenSSL.
+You will need working installations of Zlib and libcrypto (LibreSSL /
+OpenSSL)
Zlib 1.1.4 or 1.2.1.2 or greater (ealier 1.2.x versions have problems):
http://www.gzip.org/zlib/
-OpenSSL 0.9.6 or greater:
-http://www.openssl.org/
+libcrypto (LibreSSL or OpenSSL >= 0.9.8f < 1.1.0)
+LibreSSL http://www.libressl.org/ ; or
+OpenSSL http://www.openssl.org/
-(OpenSSL 0.9.5a is partially supported, but some ciphers (SSH protocol 1
-Blowfish) do not work correctly.)
+LibreSSL/OpenSSL should be compiled as a position-independent library
+(i.e. with -fPIC) otherwise OpenSSH will not be able to link with it.
+If you must use a non-position-independent libcrypto, then you may need
+to configure OpenSSH --without-pie. Note that because of API changes,
+OpenSSL 1.1.x is not currently supported.
The remaining items are optional.
NB. If you operating system supports /dev/random, you should configure
-OpenSSL to use it. OpenSSH relies on OpenSSL's direct support of
-/dev/random, or failing that, either prngd or egd
+libcrypto (LibreSSL/OpenSSL) to use it. OpenSSH relies on libcrypto's
+direct support of /dev/random, or failing that, either prngd or egd
PRNGD:
@@ -27,10 +32,10 @@
EGD:
-The Entropy Gathering Daemon (EGD) is supported if you have a system which
-lacks /dev/random and don't want to use OpenSSH's internal entropy collection.
+If the kernel lacks /dev/random the Entropy Gathering Daemon (EGD) is
+supported only if libcrypto supports it.
-http://www.lothar.com/tech/crypto/
+http://egd.sourceforge.net/
PAM:
@@ -55,15 +60,6 @@
http://www.jmknoble.net/software/x11-ssh-askpass/
-TCP Wrappers:
-
-If you wish to use the TCP wrappers functionality you will need at least
-tcpd.h and libwrap.a, either in the standard include and library paths,
-or in the directory specified by --with-tcp-wrappers. Version 7.6 is
-known to work.
-
-http://ftp.porcupine.org/pub/security/index.html
-
S/Key Libraries:
If you wish to use --with-skey then you will need the library below
@@ -180,9 +176,6 @@
--with-skey=PATH will enable S/Key one time password support. You will
need the S/Key libraries and header files installed for this to work.
---with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny)
-support.
-
--with-md5-passwords will enable the use of MD5 passwords. Enable this
if your operating system uses MD5 passwords and the system crypt() does
not support them directly (see the crypt(3/3c) man page). If enabled, the
@@ -204,10 +197,11 @@
--with-xauth=PATH specifies the location of the xauth binary
---with-ssl-dir=DIR allows you to specify where your OpenSSL libraries
+--with-ssl-dir=DIR allows you to specify where your Libre/OpenSSL
+libraries
are installed.
---with-ssl-engine enables OpenSSL's (hardware) ENGINE support
+--with-ssl-engine enables Libre/OpenSSL's (hardware) ENGINE support
--with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to
real (AF_INET) IPv4 addresses. Works around some quirks on Linux.
@@ -266,4 +260,4 @@
http://www.openssh.com/
-$Id: INSTALL,v 1.88 2013/03/07 01:33:35 dtucker Exp $
+$Id: INSTALL,v 1.91 2014/09/09 02:23:11 dtucker Exp $
Modified: trunk/crypto/openssh/Makefile.in
===================================================================
--- trunk/crypto/openssh/Makefile.in 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/Makefile.in 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.356 2014/02/04 00:12:56 djm Exp $
+# $Id: Makefile.in,v 1.365 2014/08/30 06:23:07 djm Exp $
# uncomment if you run a non bourne compatable shell. Ie. csh
#SHELL = @SH@
@@ -29,6 +29,7 @@
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
STRIP_OPT=@STRIP_OPT@
+TEST_SHELL=@TEST_SHELL@
PATHS= -DSSHDIR=\"$(sysconfdir)\" \
-D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \
@@ -63,24 +64,38 @@
TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
-LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- canohost.o channels.o cipher.o cipher-aes.o \
+LIBOPENSSH_OBJS=\
+ ssh_api.o \
+ ssherr.o \
+ sshbuf.o \
+ sshkey.o \
+ sshbuf-getput-basic.o \
+ sshbuf-misc.o \
+ sshbuf-getput-crypto.o \
+ krl.o \
+ bitmap.o
+
+LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ authfd.o authfile.o bufaux.o bufbn.o bufec.o buffer.o \
+ canohost.o channels.o cipher.o cipher-aes.o cipher-aesctr.o \
cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
- compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
- log.o match.o md-sha256.o moduli.o nchan.o packet.o \
+ compat.o crc32.o deattack.o fatal.o hostfile.o \
+ log.o match.o md-sha256.o moduli.o nchan.o packet.o opacket.o \
readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
- atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
+ atomicio.o key.o dispatch.o mac.o uidswap.o uuencode.o misc.o utf8.o \
monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
- kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
- ssh-pkcs11.o krl.o smult_curve25519_ref.o \
- kexc25519.o kexc25519c.o poly1305.o chacha.o cipher-chachapoly.o \
- ssh-ed25519.o digest-openssl.o hmac.o \
- sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o
+ ssh-pkcs11.o smult_curve25519_ref.o \
+ poly1305.o chacha.o cipher-chachapoly.o \
+ ssh-ed25519.o digest-openssl.o digest-libc.o hmac.o \
+ sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o \
+ kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
+ kexdhc.o kexgexc.o kexecdhc.o kexc25519c.o \
+ kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o \
+ platform-pledge.o platform-tracing.o
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
- sshconnect.o sshconnect1.o sshconnect2.o mux.o \
- roaming_common.o roaming_client.o
+ sshconnect.o sshconnect1.o sshconnect2.o mux.o
SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
audit.o audit-bsm.o audit-linux.o platform.o \
@@ -89,14 +104,13 @@
auth-chall.o auth2-chall.o groupaccess.o \
auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
auth2-none.o auth2-passwd.o auth2-pubkey.o \
- monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
- kexc25519s.o auth-krb5.o \
+ monitor_mm.o monitor.o monitor_wrap.o auth-krb5.o \
auth2-gss.o gss-serv.o gss-serv-krb5.o \
loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
sftp-server.o sftp-common.o \
- roaming_common.o roaming_serv.o \
sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
- sandbox-seccomp-filter.o sandbox-capsicum.o
+ sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \
+ sandbox-solaris.o
MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
@@ -135,7 +149,7 @@
$(SSHDOBJS): Makefile.in config.h
.c.o:
- $(CC) $(CFLAGS) $(CPPFLAGS) -c $<
+ $(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
LIBCOMPAT=openbsd-compat/libopenbsd-compat.a
$(LIBCOMPAT): always
@@ -164,14 +178,14 @@
ssh-keygen$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keygen.o
$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o roaming_dummy.o readconf.o
- $(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o readconf.o
+ $(LD) -o $@ ssh-keysign.o readconf.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
- $(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
+ $(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@@ -209,11 +223,25 @@
$(CC) $(CFLAGS) $(CPPFLAGS) -o umac128.o -c $(srcdir)/umac.c \
-DUMAC_OUTPUT_LEN=16 -Dumac_new=umac128_new \
-Dumac_update=umac128_update -Dumac_final=umac128_final \
- -Dumac_delete=umac128_delete
+ -Dumac_delete=umac128_delete -Dumac_ctx=umac128_ctx
clean: regressclean
rm -f *.o *.a $(TARGETS) logintest config.cache config.log
rm -f *.out core survey
+ rm -f regress/unittests/test_helper/*.a
+ rm -f regress/unittests/test_helper/*.o
+ rm -f regress/unittests/sshbuf/*.o
+ rm -f regress/unittests/sshbuf/test_sshbuf
+ rm -f regress/unittests/sshkey/*.o
+ rm -f regress/unittests/sshkey/test_sshkey
+ rm -f regress/unittests/bitmap/*.o
+ rm -f regress/unittests/bitmap/test_bitmap
+ rm -f regress/unittests/hostkeys/*.o
+ rm -f regress/unittests/hostkeys/test_hostkeys
+ rm -f regress/unittests/kex/*.o
+ rm -f regress/unittests/kex/test_kex
+ rm -f regress/misc/kexfuzz/*.o
+ rm -f regress/misc/kexfuzz/kexfuzz
(cd openbsd-compat && $(MAKE) clean)
distclean: regressclean
@@ -222,6 +250,19 @@
rm -f Makefile buildpkg.sh config.h config.status
rm -f survey.sh openbsd-compat/regress/Makefile *~
rm -rf autom4te.cache
+ rm -f regress/unittests/test_helper/*.a
+ rm -f regress/unittests/test_helper/*.o
+ rm -f regress/unittests/sshbuf/*.o
+ rm -f regress/unittests/sshbuf/test_sshbuf
+ rm -f regress/unittests/sshkey/*.o
+ rm -f regress/unittests/sshkey/test_sshkey
+ rm -f regress/unittests/bitmap/*.o
+ rm -f regress/unittests/bitmap/test_bitmap
+ rm -f regress/unittests/hostkeys/*.o
+ rm -f regress/unittests/hostkeys/test_hostkeys
+ rm -f regress/unittests/kex/*.o
+ rm -f regress/unittests/kex/test_kex
+ rm -f regress/unittests/misc/kexfuzz
(cd openbsd-compat && $(MAKE) distclean)
if test -d pkg ; then \
rm -fr pkg ; \
@@ -289,10 +330,6 @@
$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
- -rm -f $(DESTDIR)$(bindir)/slogin
- ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
- ln -s ./ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
install-sysconf:
if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \
@@ -321,41 +358,19 @@
host-key: ssh-keygen$(EXEEXT)
@if [ -z "$(DESTDIR)" ] ; then \
- if [ -f "$(sysconfdir)/ssh_host_key" ] ; then \
- echo "$(sysconfdir)/ssh_host_key already exists, skipping." ; \
- else \
- ./ssh-keygen -t rsa1 -f $(sysconfdir)/ssh_host_key -N "" ; \
- fi ; \
- if [ -f $(sysconfdir)/ssh_host_dsa_key ] ; then \
- echo "$(sysconfdir)/ssh_host_dsa_key already exists, skipping." ; \
- else \
- ./ssh-keygen -t dsa -f $(sysconfdir)/ssh_host_dsa_key -N "" ; \
- fi ; \
- if [ -f $(sysconfdir)/ssh_host_rsa_key ] ; then \
- echo "$(sysconfdir)/ssh_host_rsa_key already exists, skipping." ; \
- else \
- ./ssh-keygen -t rsa -f $(sysconfdir)/ssh_host_rsa_key -N "" ; \
- fi ; \
- if [ -f $(sysconfdir)/ssh_host_ed25519_key ] ; then \
- echo "$(sysconfdir)/ssh_host_ed25519_key already exists, skipping." ; \
- else \
- ./ssh-keygen -t ed25519 -f $(sysconfdir)/ssh_host_ed25519_key -N "" ; \
- fi ; \
- if [ -z "@COMMENT_OUT_ECC@" ] ; then \
- if [ -f $(sysconfdir)/ssh_host_ecdsa_key ] ; then \
- echo "$(sysconfdir)/ssh_host_ecdsa_key already exists, skipping." ; \
- else \
- ./ssh-keygen -t ecdsa -f $(sysconfdir)/ssh_host_ecdsa_key -N "" ; \
- fi ; \
- fi ; \
- fi ;
+ ./ssh-keygen -A; \
+ fi
-host-key-force: ssh-keygen$(EXEEXT)
- ./ssh-keygen -t rsa1 -f $(DESTDIR)$(sysconfdir)/ssh_host_key -N ""
+host-key-force: ssh-keygen$(EXEEXT) ssh$(EXEEXT)
+ if ./ssh -Q protocol-version | grep '^1$$' >/dev/null; then \
+ ./ssh-keygen -t rsa1 -f $(DESTDIR)$(sysconfdir)/ssh_host_key -N ""; \
+ fi
./ssh-keygen -t dsa -f $(DESTDIR)$(sysconfdir)/ssh_host_dsa_key -N ""
./ssh-keygen -t rsa -f $(DESTDIR)$(sysconfdir)/ssh_host_rsa_key -N ""
./ssh-keygen -t ed25519 -f $(DESTDIR)$(sysconfdir)/ssh_host_ed25519_key -N ""
- test -z "@COMMENT_OUT_ECC@" && ./ssh-keygen -t ecdsa -f $(DESTDIR)$(sysconfdir)/ssh_host_ecdsa_key -N ""
+ if ./ssh -Q key | grep ecdsa >/dev/null ; then \
+ ./ssh-keygen -t ecdsa -f $(DESTDIR)$(sysconfdir)/ssh_host_ecdsa_key -N ""; \
+ fi
uninstallall: uninstall
-rm -f $(DESTDIR)$(sysconfdir)/ssh_config
@@ -369,7 +384,6 @@
-rmdir $(DESTDIR)$(libexecdir)
uninstall:
- -rm -f $(DESTDIR)$(bindir)/slogin
-rm -f $(DESTDIR)$(bindir)/ssh$(EXEEXT)
-rm -f $(DESTDIR)$(bindir)/scp$(EXEEXT)
-rm -f $(DESTDIR)$(bindir)/ssh-add$(EXEEXT)
@@ -392,25 +406,132 @@
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c
- [ -d `pwd`/regress ] || mkdir -p `pwd`/regress
- [ -f `pwd`/regress/Makefile ] || \
+regress-prep:
+ [ -d `pwd`/regress ] || mkdir -p `pwd`/regress
+ [ -d `pwd`/regress/unittests ] || mkdir -p `pwd`/regress/unittests
+ [ -d `pwd`/regress/unittests/test_helper ] || \
+ mkdir -p `pwd`/regress/unittests/test_helper
+ [ -d `pwd`/regress/unittests/sshbuf ] || \
+ mkdir -p `pwd`/regress/unittests/sshbuf
+ [ -d `pwd`/regress/unittests/sshkey ] || \
+ mkdir -p `pwd`/regress/unittests/sshkey
+ [ -d `pwd`/regress/unittests/bitmap ] || \
+ mkdir -p `pwd`/regress/unittests/bitmap
+ [ -d `pwd`/regress/unittests/hostkeys ] || \
+ mkdir -p `pwd`/regress/unittests/hostkeys
+ [ -d `pwd`/regress/unittests/kex ] || \
+ mkdir -p `pwd`/regress/unittests/kex
+ [ -d `pwd`/regress/misc/kexfuzz ] || \
+ mkdir -p `pwd`/regress/misc/kexfuzz
+ [ -f `pwd`/regress/Makefile ] || \
ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
- $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \
+
+REGRESSLIBS=libssh.a $(LIBCOMPAT)
+
+regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c $(REGRESSLIBS)
+ $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/modpipe.c \
$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-regress/setuid-allowed$(EXEEXT): $(srcdir)/regress/setuid-allowed.c
- [ -d `pwd`/regress ] || mkdir -p `pwd`/regress
- [ -f `pwd`/regress/Makefile ] || \
- ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
- $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \
+regress/setuid-allowed$(EXEEXT): $(srcdir)/regress/setuid-allowed.c $(REGRESSLIBS)
+ $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/setuid-allowed.c \
$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-tests interop-tests: $(TARGETS) regress/modpipe$(EXEEXT) regress/setuid-allowed$(EXEEXT)
+regress/netcat$(EXEEXT): $(srcdir)/regress/netcat.c $(REGRESSLIBS)
+ $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/netcat.c \
+ $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+regress/check-perm$(EXEEXT): $(srcdir)/regress/check-perm.c $(REGRESSLIBS)
+ $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/check-perm.c \
+ $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+UNITTESTS_TEST_HELPER_OBJS=\
+ regress/unittests/test_helper/test_helper.o \
+ regress/unittests/test_helper/fuzz.o
+
+regress/unittests/test_helper/libtest_helper.a: ${UNITTESTS_TEST_HELPER_OBJS}
+ $(AR) rv $@ $(UNITTESTS_TEST_HELPER_OBJS)
+ $(RANLIB) $@
+
+UNITTESTS_TEST_SSHBUF_OBJS=\
+ regress/unittests/sshbuf/tests.o \
+ regress/unittests/sshbuf/test_sshbuf.o \
+ regress/unittests/sshbuf/test_sshbuf_getput_basic.o \
+ regress/unittests/sshbuf/test_sshbuf_getput_crypto.o \
+ regress/unittests/sshbuf/test_sshbuf_misc.o \
+ regress/unittests/sshbuf/test_sshbuf_fuzz.o \
+ regress/unittests/sshbuf/test_sshbuf_getput_fuzz.o \
+ regress/unittests/sshbuf/test_sshbuf_fixed.o
+
+regress/unittests/sshbuf/test_sshbuf$(EXEEXT): ${UNITTESTS_TEST_SSHBUF_OBJS} \
+ regress/unittests/test_helper/libtest_helper.a libssh.a
+ $(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_SSHBUF_OBJS) \
+ regress/unittests/test_helper/libtest_helper.a \
+ -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+UNITTESTS_TEST_SSHKEY_OBJS=\
+ regress/unittests/sshkey/test_fuzz.o \
+ regress/unittests/sshkey/tests.o \
+ regress/unittests/sshkey/common.o \
+ regress/unittests/sshkey/test_file.o \
+ regress/unittests/sshkey/test_sshkey.o
+
+regress/unittests/sshkey/test_sshkey$(EXEEXT): ${UNITTESTS_TEST_SSHKEY_OBJS} \
+ regress/unittests/test_helper/libtest_helper.a libssh.a
+ $(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_SSHKEY_OBJS) \
+ regress/unittests/test_helper/libtest_helper.a \
+ -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+UNITTESTS_TEST_BITMAP_OBJS=\
+ regress/unittests/bitmap/tests.o
+
+regress/unittests/bitmap/test_bitmap$(EXEEXT): ${UNITTESTS_TEST_BITMAP_OBJS} \
+ regress/unittests/test_helper/libtest_helper.a libssh.a
+ $(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_BITMAP_OBJS) \
+ regress/unittests/test_helper/libtest_helper.a \
+ -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+UNITTESTS_TEST_KEX_OBJS=\
+ regress/unittests/kex/tests.o \
+ regress/unittests/kex/test_kex.o
+
+regress/unittests/kex/test_kex$(EXEEXT): ${UNITTESTS_TEST_KEX_OBJS} \
+ regress/unittests/test_helper/libtest_helper.a libssh.a
+ $(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_KEX_OBJS) \
+ regress/unittests/test_helper/libtest_helper.a \
+ -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+UNITTESTS_TEST_HOSTKEYS_OBJS=\
+ regress/unittests/hostkeys/tests.o \
+ regress/unittests/hostkeys/test_iterate.o
+
+regress/unittests/hostkeys/test_hostkeys$(EXEEXT): \
+ ${UNITTESTS_TEST_HOSTKEYS_OBJS} \
+ regress/unittests/test_helper/libtest_helper.a libssh.a
+ $(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_HOSTKEYS_OBJS) \
+ regress/unittests/test_helper/libtest_helper.a \
+ -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+MISC_KEX_FUZZ_OBJS=\
+ regress/misc/kexfuzz/kexfuzz.o
+
+regress/misc/kexfuzz/kexfuzz$(EXEEXT): ${MISC_KEX_FUZZ_OBJS} libssh.a
+ $(LD) -o $@ $(LDFLAGS) $(MISC_KEX_FUZZ_OBJS) \
+ -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+regress-binaries: regress/modpipe$(EXEEXT) \
+ regress/setuid-allowed$(EXEEXT) \
+ regress/netcat$(EXEEXT) \
+ regress/check-perm$(EXEEXT) \
+ regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \
+ regress/unittests/sshkey/test_sshkey$(EXEEXT) \
+ regress/unittests/bitmap/test_bitmap$(EXEEXT) \
+ regress/unittests/hostkeys/test_hostkeys$(EXEEXT) \
+ regress/unittests/kex/test_kex$(EXEEXT) \
+ regress/misc/kexfuzz/kexfuzz$(EXEEXT)
+
+tests interop-tests t-exec: regress-prep regress-binaries $(TARGETS)
BUILDDIR=`pwd`; \
- TEST_SHELL="@TEST_SHELL@"; \
TEST_SSH_SCP="$${BUILDDIR}/scp"; \
TEST_SSH_SSH="$${BUILDDIR}/ssh"; \
TEST_SSH_SSHD="$${BUILDDIR}/sshd"; \
@@ -434,7 +555,7 @@
OBJ="$${BUILDDIR}/regress/" \
PATH="$${BUILDDIR}:$${PATH}" \
TEST_ENV=MALLOC_OPTIONS="@TEST_MALLOC_OPTIONS@" \
- TEST_SHELL="$${TEST_SHELL}" \
+ TEST_MALLOC_OPTIONS="@TEST_MALLOC_OPTIONS@" \
TEST_SSH_SCP="$${TEST_SSH_SCP}" \
TEST_SSH_SSH="$${TEST_SSH_SSH}" \
TEST_SSH_SSHD="$${TEST_SSH_SSHD}" \
@@ -450,6 +571,7 @@
TEST_SSH_CONCH="$${TEST_SSH_CONCH}" \
TEST_SSH_IPV6="$${TEST_SSH_IPV6}" \
TEST_SSH_ECC="$${TEST_SSH_ECC}" \
+ TEST_SHELL="${TEST_SHELL}" \
EXEEXT="$(EXEEXT)" \
$@ && echo all tests passed
Modified: trunk/crypto/openssh/OVERVIEW
===================================================================
--- trunk/crypto/openssh/OVERVIEW 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/OVERVIEW 2016-11-05 20:36:34 UTC (rev 9223)
@@ -65,8 +65,8 @@
packets. CRC code comes from crc32.c.
- The code in packet.c calls the buffer manipulation routines
- (buffer.c, bufaux.c), compression routines (compress.c, zlib),
- and the encryption routines.
+ (buffer.c, bufaux.c), compression routines (zlib), and the
+ encryption routines.
X11, TCP/IP, and Agent forwarding
@@ -165,4 +165,4 @@
uidswap.c uid-swapping
xmalloc.c "safe" malloc routines
-$OpenBSD: OVERVIEW,v 1.11 2006/08/03 03:34:41 deraadt Exp $
+$OpenBSD: OVERVIEW,v 1.12 2015/07/08 19:01:15 markus Exp $
Modified: trunk/crypto/openssh/PROTOCOL
===================================================================
--- trunk/crypto/openssh/PROTOCOL 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/PROTOCOL 2016-11-05 20:36:34 UTC (rev 9223)
@@ -40,8 +40,8 @@
"ecdsa-sha2-nistp521-cert-v01 at openssh.com"
OpenSSH introduces new public key algorithms to support certificate
-authentication for users and hostkeys. These methods are documented in
-the file PROTOCOL.certkeys
+authentication for users and host keys. These methods are documented
+in the file PROTOCOL.certkeys
1.4. transport: Elliptic Curve cryptography
@@ -175,7 +175,7 @@
OpenSSH supports layer 2 and layer 3 tunnelling via the "tun at openssh.com"
channel type. This channel type supports forwarding of network packets
-with datagram boundaries intact between endpoints equipped with
+with datagram boundaries intact between endpoints equipped with
interfaces like the BSD tun(4) device. Tunnel forwarding channels are
requested by the client with the following packet:
@@ -232,6 +232,104 @@
The "frame" field contains an IEEE 802.3 Ethernet frame, including
header.
+2.4. connection: Unix domain socket forwarding
+
+OpenSSH supports local and remote Unix domain socket forwarding
+using the "streamlocal" extension. Forwarding is initiated as per
+TCP sockets but with a single path instead of a host and port.
+
+Similar to direct-tcpip, direct-streamlocal is sent by the client
+to request that the server make a connection to a Unix domain socket.
+
+ byte SSH_MSG_CHANNEL_OPEN
+ string "direct-streamlocal at openssh.com"
+ uint32 sender channel
+ uint32 initial window size
+ uint32 maximum packet size
+ string socket path
+ string reserved
+ uint32 reserved
+
+Similar to forwarded-tcpip, forwarded-streamlocal is sent by the
+server when the client has previously send the server a streamlocal-forward
+GLOBAL_REQUEST.
+
+ byte SSH_MSG_CHANNEL_OPEN
+ string "forwarded-streamlocal at openssh.com"
+ uint32 sender channel
+ uint32 initial window size
+ uint32 maximum packet size
+ string socket path
+ string reserved for future use
+
+The reserved field is not currently defined and is ignored on the
+remote end. It is intended to be used in the future to pass
+information about the socket file, such as ownership and mode.
+The client currently sends the empty string for this field.
+
+Similar to tcpip-forward, streamlocal-forward is sent by the client
+to request remote forwarding of a Unix domain socket.
+
+ byte SSH2_MSG_GLOBAL_REQUEST
+ string "streamlocal-forward at openssh.com"
+ boolean TRUE
+ string socket path
+
+Similar to cancel-tcpip-forward, cancel-streamlocal-forward is sent
+by the client cancel the forwarding of a Unix domain socket.
+
+ byte SSH2_MSG_GLOBAL_REQUEST
+ string "cancel-streamlocal-forward at openssh.com"
+ boolean FALSE
+ string socket path
+
+2.5. connection: hostkey update and rotation "hostkeys-00 at openssh.com"
+and "hostkeys-prove-00 at openssh.com"
+
+OpenSSH supports a protocol extension allowing a server to inform
+a client of all its protocol v.2 host keys after user-authentication
+has completed.
+
+ byte SSH_MSG_GLOBAL_REQUEST
+ string "hostkeys-00 at openssh.com"
+ string[] hostkeys
+
+Upon receiving this message, a client should check which of the
+supplied host keys are present in known_hosts. For keys that are
+not present, it should send a "hostkeys-prove at openssh.com" message
+to request the server prove ownership of the private half of the
+key.
+
+ byte SSH_MSG_GLOBAL_REQUEST
+ string "hostkeys-prove-00 at openssh.com"
+ char 1 /* want-reply */
+ string[] hostkeys
+
+When a server receives this message, it should generate a signature
+using each requested key over the following:
+
+ string "hostkeys-prove-00 at openssh.com"
+ string session identifier
+ string hostkey
+
+These signatures should be included in the reply, in the order matching
+the hostkeys in the request:
+
+ byte SSH_MSG_REQUEST_SUCCESS
+ string[] signatures
+
+When the client receives this reply (and not a failure), it should
+validate the signatures and may update its known_hosts file, adding keys
+that it has not seen before and deleting keys for the server host that
+are no longer offered.
+
+These extensions let a client learn key types that it had not previously
+encountered, thereby allowing it to potentially upgrade from weaker
+key algorithms to better ones. It also supports graceful key rotation:
+a server may offer multiple keys of the same type for a period (to
+give clients an opportunity to learn them using this extension) before
+removing the deprecated key from those offered.
+
3. SFTP protocol changes
3.1. sftp: Reversal of arguments to SSH_FXP_SYMLINK
@@ -356,4 +454,4 @@
This extension is advertised in the SSH_FXP_VERSION hello with version
"1".
-$OpenBSD: PROTOCOL,v 1.23 2013/12/01 23:19:05 djm Exp $
+$OpenBSD: PROTOCOL,v 1.30 2016/04/08 06:35:54 djm Exp $
Modified: trunk/crypto/openssh/PROTOCOL.agent
===================================================================
--- trunk/crypto/openssh/PROTOCOL.agent 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/PROTOCOL.agent 2016-11-05 20:36:34 UTC (rev 9223)
@@ -206,6 +206,28 @@
string key_comment
constraint[] key_constraints
+ED25519 keys may be added using the following request
+ byte SSH2_AGENTC_ADD_IDENTITY or
+ SSH2_AGENTC_ADD_ID_CONSTRAINED
+ string "ssh-ed25519"
+ string ed25519_public_key
+ string ed25519_private_key || ed25519_public_key
+ string key_comment
+ constraint[] key_constraints
+
+ED25519 certificates may be added with:
+ byte SSH2_AGENTC_ADD_IDENTITY or
+ SSH2_AGENTC_ADD_ID_CONSTRAINED
+ string "ssh-ed25519-cert-v01 at openssh.com"
+ string certificate
+ string ed25519_public_key
+ string ed25519_private_key || ed25519_public_key
+ string key_comment
+ constraint[] key_constraints
+
+For both ssh-ed25519 and ssh-ed25519-cert-v01 at openssh.com keys, the private
+key has the public key appended (for historical reasons).
+
RSA keys may be added with this request:
byte SSH2_AGENTC_ADD_IDENTITY or
@@ -413,7 +435,7 @@
"rsa_e" and "rsa_n" are used to identify which private key to use.
"encrypted_challenge" is a challenge blob that has (presumably)
-been encrypted with the public key and must be in the range
+been encrypted with the public key and must be in the range
1 <= encrypted_challenge < 2^256. "session_id" is the SSH protocol 1
session ID (computed from the server host key, the server semi-ephemeral
key and the session cookie).
@@ -557,4 +579,4 @@
SSH_AGENT_CONSTRAIN_LIFETIME 1
SSH_AGENT_CONSTRAIN_CONFIRM 2
-$OpenBSD: PROTOCOL.agent,v 1.7 2013/01/02 00:33:49 djm Exp $
+$OpenBSD: PROTOCOL.agent,v 1.11 2016/05/19 07:45:32 djm Exp $
Modified: trunk/crypto/openssh/PROTOCOL.certkeys
===================================================================
--- trunk/crypto/openssh/PROTOCOL.certkeys 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/PROTOCOL.certkeys 2016-11-05 20:36:34 UTC (rev 9223)
@@ -100,9 +100,9 @@
ECDSA certificate
- string "ecdsa-sha2-nistp256 at openssh.com" |
- "ecdsa-sha2-nistp384 at openssh.com" |
- "ecdsa-sha2-nistp521 at openssh.com"
+ string "ecdsa-sha2-nistp256-v01 at openssh.com" |
+ "ecdsa-sha2-nistp384-v01 at openssh.com" |
+ "ecdsa-sha2-nistp521-v01 at openssh.com"
string nonce
string curve
string public_key
@@ -118,6 +118,23 @@
string signature key
string signature
+ED25519 certificate
+
+ string "ssh-ed25519-cert-v01 at openssh.com"
+ string nonce
+ string pk
+ uint64 serial
+ uint32 type
+ string key id
+ string valid principals
+ uint64 valid after
+ uint64 valid before
+ string critical options
+ string extensions
+ string reserved
+ string signature key
+ string signature
+
The nonce field is a CA-provided random bitstring of arbitrary length
(but typically 16 or 32 bytes) included to make attacks that depend on
inducing collisions in the signature hash infeasible.
@@ -129,6 +146,9 @@
curve and public key are respectively the ECDSA "[identifier]" and "Q"
defined in section 3.1 of RFC5656.
+pk is the encoded Ed25519 public key as defined by
+draft-josefsson-eddsa-ed25519-03.
+
serial is an optional certificate serial number set by the CA to
provide an abbreviated way to refer to certificates from that CA.
If a CA does not wish to number its certificates it must set this
@@ -146,7 +166,7 @@
certificate is valid; hostnames for SSH_CERT_TYPE_HOST certificates and
usernames for SSH_CERT_TYPE_USER certificates. As a special case, a
zero-length "valid principals" field means the certificate is valid for
-any principal of the specified type. XXX DNS wildcards?
+any principal of the specified type.
"valid after" and "valid before" specify a validity period for the
certificate. Each represents a time in seconds since 1970-01-01
@@ -183,7 +203,7 @@
up to, and including the signature key. Signatures are computed and
encoded according to the rules defined for the CA's public key algorithm
(RFC4253 section 6.6 for ssh-rsa and ssh-dss, RFC5656 for the ECDSA
-types).
+types), and draft-josefsson-eddsa-ed25519-03 for Ed25519.
Critical options
----------------
@@ -203,8 +223,9 @@
"critical", if an implementation does not recognise a option
then the validating party should refuse to accept the certificate.
-The supported options and the contents and structure of their
-data fields are:
+No critical options are defined for host certificates at present. The
+supported user certificate options and the contents and structure of
+their data fields are:
Name Format Description
-----------------------------------------------------------------------------
@@ -233,8 +254,9 @@
If an implementation does not recognise an extension, then it should
ignore it.
-The supported extensions and the contents and structure of their data
-fields are:
+No extensions are defined for host certificates at present. The
+supported user certificate extensions and the contents and structure of
+their data fields are:
Name Format Description
-----------------------------------------------------------------------------
@@ -262,4 +284,4 @@
of this script will not be permitted if
this option is not present.
-$OpenBSD: PROTOCOL.certkeys,v 1.9 2012/03/28 07:23:22 djm Exp $
+$OpenBSD: PROTOCOL.certkeys,v 1.10 2016/05/03 10:27:59 djm Exp $
Modified: trunk/crypto/openssh/PROTOCOL.chacha20poly1305
===================================================================
--- trunk/crypto/openssh/PROTOCOL.chacha20poly1305 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/PROTOCOL.chacha20poly1305 2016-11-05 20:36:34 UTC (rev 9223)
@@ -34,6 +34,8 @@
The chacha20-poly1305 at openssh.com cipher requires 512 bits of key
material as output from the SSH key exchange. This forms two 256 bit
keys (K_1 and K_2), used by two separate instances of chacha20.
+The first 256 bits consitute K_2 and the second 256 bits become
+K_1.
The instance keyed by K_1 is a stream cipher that is used only
to encrypt the 4 byte packet length field. The second instance,
@@ -101,5 +103,5 @@
[3] "ChaCha20 and Poly1305 based Cipher Suites for TLS", Adam Langley
http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-03
-$OpenBSD: PROTOCOL.chacha20poly1305,v 1.2 2013/12/02 02:50:27 djm Exp $
+$OpenBSD: PROTOCOL.chacha20poly1305,v 1.3 2016/05/03 13:10:24 djm Exp $
Modified: trunk/crypto/openssh/PROTOCOL.krl
===================================================================
--- trunk/crypto/openssh/PROTOCOL.krl 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/PROTOCOL.krl 2016-11-05 20:36:34 UTC (rev 9223)
@@ -37,7 +37,7 @@
#define KRL_SECTION_FINGERPRINT_SHA1 3
#define KRL_SECTION_SIGNATURE 4
-3. Certificate serial section
+2. Certificate section
These sections use type KRL_SECTION_CERTIFICATES to revoke certificates by
serial number or key ID. The consist of the CA key that issued the
@@ -47,6 +47,11 @@
string ca_key
string reserved
+Where "ca_key" is the standard SSH wire serialisation of the CA's
+public key. Alternately, "ca_key" may be an empty string to indicate
+the certificate section applies to all CAs (this is most useful when
+revoking key IDs).
+
Followed by one or more sections:
byte cert_section_type
@@ -161,4 +166,4 @@
signatures. Signature sections are optional for KRLs distributed by
trusted means.
-$OpenBSD: PROTOCOL.krl,v 1.2 2013/01/18 00:24:58 djm Exp $
+$OpenBSD: PROTOCOL.krl,v 1.3 2015/01/30 01:10:33 djm Exp $
Modified: trunk/crypto/openssh/PROTOCOL.mux
===================================================================
--- trunk/crypto/openssh/PROTOCOL.mux 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/PROTOCOL.mux 2016-11-05 20:36:34 UTC (rev 9223)
@@ -116,6 +116,12 @@
forwarding type may be MUX_FWD_LOCAL, MUX_FWD_REMOTE, MUX_FWD_DYNAMIC.
+If listen port is (unsigned int) -2, then the listen host is treated as
+a unix socket path name.
+
+If connect port is (unsigned int) -2, then the connect host is treated
+as a unix socket path name.
+
A server may reply with a MUX_S_OK, a MUX_S_REMOTE_PORT, a
MUX_S_PERMISSION_DENIED or a MUX_S_FAILURE.
@@ -219,4 +225,4 @@
XXX server->client error/warning notifications
XXX send signals via mux
-$OpenBSD: PROTOCOL.mux,v 1.9 2012/06/01 00:49:35 djm Exp $
+$OpenBSD: PROTOCOL.mux,v 1.10 2015/07/17 03:04:27 djm Exp $
Modified: trunk/crypto/openssh/README
===================================================================
--- trunk/crypto/openssh/README 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/README 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,5 +1,9 @@
-See http://www.openssh.com/txt/release-6.6 for the release notes.
+See http://www.openssh.com/txt/release-7.3p1 for the release notes.
+Please read http://www.openssh.com/report.html for bug reporting
+instructions and note that we do not use Github for bug reporting or
+patch/pull-request management.
+
- A Japanese translation of this document and of the OpenSSH FAQ is
- available at http://www.unixuser.org/~haruyama/security/openssh/index.html
- Thanks to HARUYAMA Seigo <haruyama at unixuser.org>
@@ -62,4 +66,4 @@
[6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
[7] http://www.openssh.com/faq.html
-$Id: README,v 1.86 2014/02/27 23:03:53 djm Exp $
+$Id: README,v 1.87 2014/08/10 01:35:06 djm Exp $
Modified: trunk/crypto/openssh/README.platform
===================================================================
--- trunk/crypto/openssh/README.platform 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/README.platform 2016-11-05 20:36:34 UTC (rev 9223)
@@ -36,7 +36,10 @@
"rlogin" attribute set. This check is not done for the root account,
instead the PermitRootLogin setting in sshd_config is used.
+If you are using the IBM compiler you probably want to use CC=xlc rather
+than the default of cc.
+
Cygwin
------
To build on Cygwin, OpenSSH requires the following packages:
Modified: trunk/crypto/openssh/addrmatch.c
===================================================================
--- trunk/crypto/openssh/addrmatch.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/addrmatch.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: addrmatch.c,v 1.9 2014/01/19 11:21:51 dtucker Exp $ */
+/* $OpenBSD: addrmatch.c,v 1.10 2015/07/08 19:04:21 markus Exp $ */
/*
* Copyright (c) 2004-2008 Damien Miller <djm at mindrot.org>
@@ -31,7 +31,6 @@
#include "match.h"
#include "log.h"
-#include "xmalloc.h"
struct xaddr {
sa_family_t af;
Modified: trunk/crypto/openssh/atomicio.c
===================================================================
--- trunk/crypto/openssh/atomicio.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/atomicio.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: atomicio.c,v 1.26 2010/09/22 22:58:51 djm Exp $ */
+/* $OpenBSD: atomicio.c,v 1.27 2015/01/16 06:40:12 deraadt Exp $ */
/*
* Copyright (c) 2006 Damien Miller. All rights reserved.
* Copyright (c) 2005 Anil Madhavapeddy. All rights reserved.
@@ -41,6 +41,7 @@
#endif
#include <string.h>
#include <unistd.h>
+#include <limits.h>
#include "atomicio.h"
Modified: trunk/crypto/openssh/audit-linux.c
===================================================================
--- trunk/crypto/openssh/audit-linux.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/audit-linux.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -36,17 +36,17 @@
#include "log.h"
#include "audit.h"
#include "canohost.h"
+#include "packet.h"
-const char* audit_username(void);
+const char *audit_username(void);
int
-linux_audit_record_event(int uid, const char *username,
- const char *hostname, const char *ip, const char *ttyn, int success)
+linux_audit_record_event(int uid, const char *username, const char *hostname,
+ const char *ip, const char *ttyn, int success)
{
int audit_fd, rc, saved_errno;
- audit_fd = audit_open();
- if (audit_fd < 0) {
+ if ((audit_fd = audit_open()) < 0) {
if (errno == EINVAL || errno == EPROTONOSUPPORT ||
errno == EAFNOSUPPORT)
return 1; /* No audit support in kernel */
@@ -58,6 +58,7 @@
username == NULL ? uid : -1, hostname, ip, ttyn, success);
saved_errno = errno;
close(audit_fd);
+
/*
* Do not report error if the error is EPERM and sshd is run as non
* root user.
@@ -65,7 +66,8 @@
if ((rc == -EPERM) && (geteuid() != 0))
rc = 0;
errno = saved_errno;
- return (rc >= 0);
+
+ return rc >= 0;
}
/* Below is the sshd audit API code */
@@ -73,8 +75,8 @@
void
audit_connection_from(const char *host, int port)
{
+ /* not implemented */
}
- /* not implemented */
void
audit_run_command(const char *command)
@@ -85,8 +87,8 @@
void
audit_session_open(struct logininfo *li)
{
- if (linux_audit_record_event(li->uid, NULL, li->hostname,
- NULL, li->line, 1) == 0)
+ if (linux_audit_record_event(li->uid, NULL, li->hostname, NULL,
+ li->line, 1) == 0)
fatal("linux_audit_write_entry failed: %s", strerror(errno));
}
@@ -99,6 +101,8 @@
void
audit_event(ssh_audit_event_t event)
{
+ struct ssh *ssh = active_state; /* XXX */
+
switch(event) {
case SSH_AUTH_SUCCESS:
case SSH_CONNECTION_CLOSE:
@@ -106,7 +110,6 @@
case SSH_LOGIN_EXCEED_MAXTRIES:
case SSH_LOGIN_ROOT_DENIED:
break;
-
case SSH_AUTH_FAIL_NONE:
case SSH_AUTH_FAIL_PASSWD:
case SSH_AUTH_FAIL_KBDINT:
@@ -115,12 +118,11 @@
case SSH_AUTH_FAIL_GSSAPI:
case SSH_INVALID_USER:
linux_audit_record_event(-1, audit_username(), NULL,
- get_remote_ipaddr(), "sshd", 0);
+ ssh_remote_ipaddr(ssh), "sshd", 0);
break;
-
default:
debug("%s: unhandled event %d", __func__, event);
+ break;
}
}
-
#endif /* USE_LINUX_AUDIT */
Modified: trunk/crypto/openssh/auth-bsdauth.c
===================================================================
--- trunk/crypto/openssh/auth-bsdauth.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-bsdauth.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-bsdauth.c,v 1.11 2007/09/21 08:15:29 djm Exp $ */
+/* $OpenBSD: auth-bsdauth.c,v 1.14 2015/10/20 23:24:25 mmcc Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -26,6 +26,8 @@
#include "includes.h"
#include <sys/types.h>
+#include <stdarg.h>
+#include <stdio.h>
#include <stdarg.h>
@@ -54,6 +56,11 @@
Authctxt *authctxt = ctx;
char *challenge = NULL;
+ *infotxt = NULL;
+ *numprompts = 0;
+ *prompts = NULL;
+ *echo_on = NULL;
+
if (authctxt->as != NULL) {
debug2("bsdauth_query: try reuse session");
challenge = auth_getitem(authctxt->as, AUTHV_CHALLENGE);
@@ -96,7 +103,7 @@
if (!authctxt->valid)
return -1;
- if (authctxt->as == 0)
+ if (authctxt->as == NULL)
error("bsdauth_respond: no bsd auth session");
if (numresponses != 1)
Modified: trunk/crypto/openssh/auth-chall.c
===================================================================
--- trunk/crypto/openssh/auth-chall.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-chall.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-chall.c,v 1.13 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: auth-chall.c,v 1.14 2014/06/24 01:13:21 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -26,8 +26,9 @@
#include "includes.h"
#include <sys/types.h>
-
#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
#include "xmalloc.h"
#include "key.h"
@@ -34,6 +35,7 @@
#include "hostfile.h"
#include "auth.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
/* limited protocol v1 interface to kbd-interactive authentication */
Modified: trunk/crypto/openssh/auth-krb5.c
===================================================================
--- trunk/crypto/openssh/auth-krb5.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-krb5.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,8 +1,8 @@
-/* $OpenBSD: auth-krb5.c,v 1.20 2013/07/20 01:55:13 djm Exp $ */
+/* $OpenBSD: auth-krb5.c,v 1.22 2016/05/04 14:22:33 markus Exp $ */
/*
* Kerberos v5 authentication and ticket-passing routines.
*
- * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
+ * From: FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar
*/
/*
* Copyright (c) 2002 Daniel Kouril. All rights reserved.
@@ -36,10 +36,10 @@
#include "xmalloc.h"
#include "ssh.h"
-#include "ssh1.h"
#include "packet.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
#include "uidswap.h"
#include "key.h"
Modified: trunk/crypto/openssh/auth-options.c
===================================================================
--- trunk/crypto/openssh/auth-options.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-options.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.62 2013/12/19 00:27:57 djm Exp $ */
+/* $OpenBSD: auth-options.c,v 1.71 2016/03/07 19:02:43 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -21,15 +21,20 @@
#include <stdarg.h>
#include "openbsd-compat/sys-queue.h"
+
+#include "key.h" /* XXX for typedef */
+#include "buffer.h" /* XXX for typedef */
#include "xmalloc.h"
#include "match.h"
+#include "ssherr.h"
#include "log.h"
#include "canohost.h"
-#include "buffer.h"
+#include "packet.h"
+#include "sshbuf.h"
+#include "misc.h"
#include "channels.h"
#include "servconf.h"
-#include "misc.h"
-#include "key.h"
+#include "sshkey.h"
#include "auth-options.h"
#include "hostfile.h"
#include "auth.h"
@@ -71,19 +76,45 @@
free(ce->s);
free(ce);
}
- if (forced_command) {
- free(forced_command);
- forced_command = NULL;
- }
- if (authorized_principals) {
- free(authorized_principals);
- authorized_principals = NULL;
- }
+ free(forced_command);
+ forced_command = NULL;
+ free(authorized_principals);
+ authorized_principals = NULL;
forced_tun_device = -1;
channel_clear_permitted_opens();
}
/*
+ * Match flag 'opt' in *optsp, and if allow_negate is set then also match
+ * 'no-opt'. Returns -1 if option not matched, 1 if option matches or 0
+ * if negated option matches.
+ * If the option or negated option matches, then *optsp is updated to
+ * point to the first character after the option and, if 'msg' is not NULL
+ * then a message based on it added via auth_debug_add().
+ */
+static int
+match_flag(const char *opt, int allow_negate, char **optsp, const char *msg)
+{
+ size_t opt_len = strlen(opt);
+ char *opts = *optsp;
+ int negate = 0;
+
+ if (allow_negate && strncasecmp(opts, "no-", 3) == 0) {
+ opts += 3;
+ negate = 1;
+ }
+ if (strncasecmp(opts, opt, opt_len) == 0) {
+ *optsp = opts + opt_len;
+ if (msg != NULL) {
+ auth_debug_add("%s %s.", msg,
+ negate ? "disabled" : "enabled");
+ }
+ return negate ? 0 : 1;
+ }
+ return -1;
+}
+
+/*
* return 1 if access is granted, 0 if not.
* side effect: sets key option flags
*/
@@ -90,8 +121,9 @@
int
auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
{
+ struct ssh *ssh = active_state; /* XXX */
const char *cp;
- int i;
+ int i, r;
/* reset options */
auth_clear_options();
@@ -100,52 +132,48 @@
return 1;
while (*opts && *opts != ' ' && *opts != '\t') {
- cp = "cert-authority";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- key_is_cert_authority = 1;
- opts += strlen(cp);
+ if ((r = match_flag("cert-authority", 0, &opts, NULL)) != -1) {
+ key_is_cert_authority = r;
goto next_option;
}
- cp = "no-port-forwarding";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("Port forwarding disabled.");
+ if ((r = match_flag("restrict", 0, &opts, NULL)) != -1) {
+ auth_debug_add("Key is restricted.");
no_port_forwarding_flag = 1;
- opts += strlen(cp);
+ no_agent_forwarding_flag = 1;
+ no_x11_forwarding_flag = 1;
+ no_pty_flag = 1;
+ no_user_rc = 1;
goto next_option;
}
- cp = "no-agent-forwarding";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("Agent forwarding disabled.");
- no_agent_forwarding_flag = 1;
- opts += strlen(cp);
+ if ((r = match_flag("port-forwarding", 1, &opts,
+ "Port forwarding")) != -1) {
+ no_port_forwarding_flag = r != 1;
goto next_option;
}
- cp = "no-X11-forwarding";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("X11 forwarding disabled.");
- no_x11_forwarding_flag = 1;
- opts += strlen(cp);
+ if ((r = match_flag("agent-forwarding", 1, &opts,
+ "Agent forwarding")) != -1) {
+ no_agent_forwarding_flag = r != 1;
goto next_option;
}
- cp = "no-pty";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("Pty allocation disabled.");
- no_pty_flag = 1;
- opts += strlen(cp);
+ if ((r = match_flag("x11-forwarding", 1, &opts,
+ "X11 forwarding")) != -1) {
+ no_x11_forwarding_flag = r != 1;
goto next_option;
}
- cp = "no-user-rc";
- if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- auth_debug_add("User rc file execution disabled.");
- no_user_rc = 1;
- opts += strlen(cp);
+ if ((r = match_flag("pty", 1, &opts,
+ "PTY allocation")) != -1) {
+ no_pty_flag = r != 1;
goto next_option;
}
+ if ((r = match_flag("user-rc", 1, &opts,
+ "User rc execution")) != -1) {
+ no_user_rc = r != 1;
+ goto next_option;
+ }
cp = "command=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
opts += strlen(cp);
- if (forced_command != NULL)
- free(forced_command);
+ free(forced_command);
forced_command = xmalloc(strlen(opts) + 1);
i = 0;
while (*opts) {
@@ -175,8 +203,7 @@
cp = "principals=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
opts += strlen(cp);
- if (authorized_principals != NULL)
- free(authorized_principals);
+ free(authorized_principals);
authorized_principals = xmalloc(strlen(opts) + 1);
i = 0;
while (*opts) {
@@ -205,8 +232,7 @@
goto next_option;
}
cp = "environment=\"";
- if (options.permit_user_env &&
- strncasecmp(opts, cp, strlen(cp)) == 0) {
+ if (strncasecmp(opts, cp, strlen(cp)) == 0) {
char *s;
struct envstring *new_envstring;
@@ -232,20 +258,26 @@
goto bad_option;
}
s[i] = '\0';
- auth_debug_add("Adding to environment: %.900s", s);
- debug("Adding to environment: %.900s", s);
opts++;
- new_envstring = xcalloc(1, sizeof(struct envstring));
- new_envstring->s = s;
- new_envstring->next = custom_environment;
- custom_environment = new_envstring;
+ if (options.permit_user_env) {
+ auth_debug_add("Adding to environment: "
+ "%.900s", s);
+ debug("Adding to environment: %.900s", s);
+ new_envstring = xcalloc(1,
+ sizeof(*new_envstring));
+ new_envstring->s = s;
+ new_envstring->next = custom_environment;
+ custom_environment = new_envstring;
+ s = NULL;
+ }
+ free(s);
goto next_option;
}
cp = "from=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
- const char *remote_ip = get_remote_ipaddr();
- const char *remote_host = get_canonical_hostname(
- options.use_dns);
+ const char *remote_ip = ssh_remote_ipaddr(ssh);
+ const char *remote_host = auth_get_canonical_hostname(
+ ssh, options.use_dns);
char *patterns = xmalloc(strlen(opts) + 1);
opts += strlen(cp);
@@ -325,6 +357,7 @@
patterns[i] = '\0';
opts++;
p = patterns;
+ /* XXX - add streamlocal support */
host = hpdelim(&p);
if (host == NULL || strlen(host) >= NI_MAXHOST) {
debug("%.100s, line %lu: Bad permitopen "
@@ -416,7 +449,7 @@
#define OPTIONS_CRITICAL 1
#define OPTIONS_EXTENSIONS 2
static int
-parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
+parse_option_list(struct sshbuf *oblob, struct passwd *pw,
u_int which, int crit,
int *cert_no_port_forwarding_flag,
int *cert_no_agent_forwarding_flag,
@@ -426,29 +459,29 @@
char **cert_forced_command,
int *cert_source_address_done)
{
+ struct ssh *ssh = active_state; /* XXX */
char *command, *allowed;
const char *remote_ip;
char *name = NULL;
- u_char *data_blob = NULL;
- u_int nlen, dlen, clen;
- Buffer c, data;
- int ret = -1, result, found;
+ struct sshbuf *c = NULL, *data = NULL;
+ int r, ret = -1, result, found;
- buffer_init(&data);
+ if ((c = sshbuf_fromb(oblob)) == NULL) {
+ error("%s: sshbuf_fromb failed", __func__);
+ goto out;
+ }
- /* Make copy to avoid altering original */
- buffer_init(&c);
- buffer_append(&c, optblob, optblob_len);
-
- while (buffer_len(&c) > 0) {
- if ((name = buffer_get_cstring_ret(&c, &nlen)) == NULL ||
- (data_blob = buffer_get_string_ret(&c, &dlen)) == NULL) {
- error("Certificate options corrupt");
+ while (sshbuf_len(c) > 0) {
+ sshbuf_free(data);
+ data = NULL;
+ if ((r = sshbuf_get_cstring(c, &name, NULL)) != 0 ||
+ (r = sshbuf_froms(c, &data)) != 0) {
+ error("Unable to parse certificate options: %s",
+ ssh_err(r));
goto out;
}
- buffer_append(&data, data_blob, dlen);
- debug3("found certificate option \"%.100s\" len %u",
- name, dlen);
+ debug3("found certificate option \"%.100s\" len %zu",
+ name, sshbuf_len(data));
found = 0;
if ((which & OPTIONS_EXTENSIONS) != 0) {
if (strcmp(name, "permit-X11-forwarding") == 0) {
@@ -472,10 +505,10 @@
}
if (!found && (which & OPTIONS_CRITICAL) != 0) {
if (strcmp(name, "force-command") == 0) {
- if ((command = buffer_get_cstring_ret(&data,
- &clen)) == NULL) {
- error("Certificate constraint \"%s\" "
- "corrupt", name);
+ if ((r = sshbuf_get_cstring(data, &command,
+ NULL)) != 0) {
+ error("Unable to parse \"%s\" "
+ "section: %s", name, ssh_err(r));
goto out;
}
if (*cert_forced_command != NULL) {
@@ -488,10 +521,10 @@
found = 1;
}
if (strcmp(name, "source-address") == 0) {
- if ((allowed = buffer_get_cstring_ret(&data,
- &clen)) == NULL) {
- error("Certificate constraint "
- "\"%s\" corrupt", name);
+ if ((r = sshbuf_get_cstring(data, &allowed,
+ NULL)) != 0) {
+ error("Unable to parse \"%s\" "
+ "section: %s", name, ssh_err(r));
goto out;
}
if ((*cert_source_address_done)++) {
@@ -500,7 +533,7 @@
free(allowed);
goto out;
}
- remote_ip = get_remote_ipaddr();
+ remote_ip = ssh_remote_ipaddr(ssh);
result = addr_match_cidr_list(remote_ip,
allowed);
free(allowed);
@@ -539,16 +572,13 @@
logit("Certificate extension \"%s\" "
"is not supported", name);
}
- } else if (buffer_len(&data) != 0) {
+ } else if (sshbuf_len(data) != 0) {
error("Certificate option \"%s\" corrupt "
"(extra data)", name);
goto out;
}
- buffer_clear(&data);
free(name);
- free(data_blob);
name = NULL;
- data_blob = NULL;
}
/* successfully parsed all options */
ret = 0;
@@ -560,12 +590,9 @@
free(*cert_forced_command);
*cert_forced_command = NULL;
}
- if (name != NULL)
- free(name);
- if (data_blob != NULL)
- free(data_blob);
- buffer_free(&data);
- buffer_free(&c);
+ free(name);
+ sshbuf_free(data);
+ sshbuf_free(c);
return ret;
}
@@ -574,7 +601,7 @@
* options so this must be called after auth_parse_options().
*/
int
-auth_cert_options(Key *k, struct passwd *pw)
+auth_cert_options(struct sshkey *k, struct passwd *pw)
{
int cert_no_port_forwarding_flag = 1;
int cert_no_agent_forwarding_flag = 1;
@@ -584,38 +611,21 @@
char *cert_forced_command = NULL;
int cert_source_address_done = 0;
- if (key_cert_is_legacy(k)) {
- /* All options are in the one field for v00 certs */
- if (parse_option_list(buffer_ptr(&k->cert->critical),
- buffer_len(&k->cert->critical), pw,
- OPTIONS_CRITICAL|OPTIONS_EXTENSIONS, 1,
- &cert_no_port_forwarding_flag,
- &cert_no_agent_forwarding_flag,
- &cert_no_x11_forwarding_flag,
- &cert_no_pty_flag,
- &cert_no_user_rc,
- &cert_forced_command,
- &cert_source_address_done) == -1)
- return -1;
- } else {
- /* Separate options and extensions for v01 certs */
- if (parse_option_list(buffer_ptr(&k->cert->critical),
- buffer_len(&k->cert->critical), pw,
- OPTIONS_CRITICAL, 1, NULL, NULL, NULL, NULL, NULL,
- &cert_forced_command,
- &cert_source_address_done) == -1)
- return -1;
- if (parse_option_list(buffer_ptr(&k->cert->extensions),
- buffer_len(&k->cert->extensions), pw,
- OPTIONS_EXTENSIONS, 1,
- &cert_no_port_forwarding_flag,
- &cert_no_agent_forwarding_flag,
- &cert_no_x11_forwarding_flag,
- &cert_no_pty_flag,
- &cert_no_user_rc,
- NULL, NULL) == -1)
- return -1;
- }
+ /* Separate options and extensions for v01 certs */
+ if (parse_option_list(k->cert->critical, pw,
+ OPTIONS_CRITICAL, 1, NULL, NULL, NULL, NULL, NULL,
+ &cert_forced_command,
+ &cert_source_address_done) == -1)
+ return -1;
+ if (parse_option_list(k->cert->extensions, pw,
+ OPTIONS_EXTENSIONS, 0,
+ &cert_no_port_forwarding_flag,
+ &cert_no_agent_forwarding_flag,
+ &cert_no_x11_forwarding_flag,
+ &cert_no_pty_flag,
+ &cert_no_user_rc,
+ NULL, NULL) == -1)
+ return -1;
no_port_forwarding_flag |= cert_no_port_forwarding_flag;
no_agent_forwarding_flag |= cert_no_agent_forwarding_flag;
@@ -624,8 +634,7 @@
no_user_rc |= cert_no_user_rc;
/* CA-specified forced command supersedes key option */
if (cert_forced_command != NULL) {
- if (forced_command != NULL)
- free(forced_command);
+ free(forced_command);
forced_command = cert_forced_command;
}
return 0;
Modified: trunk/crypto/openssh/auth-options.h
===================================================================
--- trunk/crypto/openssh/auth-options.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-options.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.h,v 1.20 2010/05/07 11:30:29 djm Exp $ */
+/* $OpenBSD: auth-options.h,v 1.21 2015/01/14 10:30:34 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -35,6 +35,6 @@
int auth_parse_options(struct passwd *, char *, char *, u_long);
void auth_clear_options(void);
-int auth_cert_options(Key *, struct passwd *);
+int auth_cert_options(struct sshkey *, struct passwd *);
#endif
Modified: trunk/crypto/openssh/auth-pam.c
===================================================================
--- trunk/crypto/openssh/auth-pam.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-pam.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -45,7 +45,8 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
+/* Based on FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des */
+
#include "includes.h"
#include <sys/types.h>
@@ -67,9 +68,9 @@
/* OpenGroup RFC86.0 and XSSO specify no "const" on arguments */
#ifdef PAM_SUN_CODEBASE
-# define sshpam_const /* Solaris, HP-UX, AIX */
+# define sshpam_const /* Solaris, HP-UX, SunOS */
#else
-# define sshpam_const const /* LinuxPAM, OpenPAM */
+# define sshpam_const const /* LinuxPAM, OpenPAM, AIX */
#endif
/* Ambiguity in spec: is it an array of pointers or a pointer to an array? */
@@ -153,9 +154,12 @@
<= 0) {
/* PAM thread has not exitted, privsep slave must have */
kill(cleanup_ctxt->pam_thread, SIGTERM);
- if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
- <= 0)
- return; /* could not wait */
+ while (waitpid(cleanup_ctxt->pam_thread,
+ &sshpam_thread_status, 0) == -1) {
+ if (errno == EINTR)
+ continue;
+ return;
+ }
}
if (WIFSIGNALED(sshpam_thread_status) &&
WTERMSIG(sshpam_thread_status) == SIGTERM)
@@ -216,7 +220,11 @@
if (sshpam_thread_status != -1)
return (sshpam_thread_status);
signal(SIGCHLD, sshpam_oldsig);
- waitpid(thread, &status, 0);
+ while (waitpid(thread, &status, 0) == -1) {
+ if (errno == EINTR)
+ continue;
+ fatal("%s: waitpid: %s", __func__, strerror(errno));
+ }
return (status);
}
#endif
@@ -228,10 +236,10 @@
static int sshpam_session_open = 0;
static int sshpam_cred_established = 0;
static int sshpam_account_status = -1;
+static int sshpam_maxtries_reached = 0;
static char **sshpam_env = NULL;
static Authctxt *sshpam_authctxt = NULL;
static const char *sshpam_password = NULL;
-static char badpw[] = "\b\n\r\177INCORRECT";
/* Some PAM implementations don't implement this */
#ifndef HAVE_PAM_GETENVLIST
@@ -364,17 +372,6 @@
for (i = 0; i < n; ++i) {
switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
case PAM_PROMPT_ECHO_OFF:
- buffer_put_cstring(&buffer,
- PAM_MSG_MEMBER(msg, i, msg));
- if (ssh_msg_send(ctxt->pam_csock,
- PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
- goto fail;
- if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
- goto fail;
- if (buffer_get_char(&buffer) != PAM_AUTHTOK)
- goto fail;
- reply[i].resp = buffer_get_string(&buffer, NULL);
- break;
case PAM_PROMPT_ECHO_ON:
buffer_put_cstring(&buffer,
PAM_MSG_MEMBER(msg, i, msg));
@@ -388,12 +385,6 @@
reply[i].resp = buffer_get_string(&buffer, NULL);
break;
case PAM_ERROR_MSG:
- buffer_put_cstring(&buffer,
- PAM_MSG_MEMBER(msg, i, msg));
- if (ssh_msg_send(ctxt->pam_csock,
- PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
- goto fail;
- break;
case PAM_TEXT_INFO:
buffer_put_cstring(&buffer,
PAM_MSG_MEMBER(msg, i, msg));
@@ -467,6 +458,8 @@
if (sshpam_err != PAM_SUCCESS)
goto auth_fail;
sshpam_err = pam_authenticate(sshpam_handle, flags);
+ if (sshpam_err == PAM_MAXTRIES)
+ sshpam_set_maxtries_reached(1);
if (sshpam_err != PAM_SUCCESS)
goto auth_fail;
@@ -518,6 +511,8 @@
/* XXX - can't do much about an error here */
if (sshpam_err == PAM_ACCT_EXPIRED)
ssh_msg_send(ctxt->pam_csock, PAM_ACCT_EXPIRED, &buffer);
+ else if (sshpam_maxtries_reached)
+ ssh_msg_send(ctxt->pam_csock, PAM_MAXTRIES, &buffer);
else
ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
buffer_free(&buffer);
@@ -623,6 +618,7 @@
extern char *__progname;
const char *pam_rhost, *pam_user, *user = authctxt->user;
const char **ptr_pam_user = &pam_user;
+ struct ssh *ssh = active_state; /* XXX */
if (sshpam_handle != NULL) {
/* We already have a PAM context; check if the user matches */
@@ -643,7 +639,7 @@
sshpam_handle = NULL;
return (-1);
}
- pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
+ pam_rhost = auth_get_canonical_hostname(ssh, options.use_dns);
debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
if (sshpam_err != PAM_SUCCESS) {
@@ -714,6 +710,7 @@
sshpam_query(void *ctx, char **name, char **info,
u_int *num, char ***prompts, u_int **echo_on)
{
+ struct ssh *ssh = active_state; /* XXX */
Buffer buffer;
struct pam_ctxt *ctxt = ctx;
size_t plen;
@@ -738,7 +735,7 @@
case PAM_PROMPT_ECHO_OFF:
*num = 1;
len = plen + mlen + 1;
- **prompts = xrealloc(**prompts, 1, len);
+ **prompts = xreallocarray(**prompts, 1, len);
strlcpy(**prompts + plen, msg, len - plen);
plen += mlen;
**echo_on = (type == PAM_PROMPT_ECHO_ON);
@@ -748,7 +745,7 @@
case PAM_TEXT_INFO:
/* accumulate messages */
len = plen + mlen + 2;
- **prompts = xrealloc(**prompts, 1, len);
+ **prompts = xreallocarray(**prompts, 1, len);
strlcpy(**prompts + plen, msg, len - plen);
plen += mlen;
strlcat(**prompts + plen, "\n", len - plen);
@@ -756,7 +753,11 @@
free(msg);
break;
case PAM_ACCT_EXPIRED:
- sshpam_account_status = 0;
+ case PAM_MAXTRIES:
+ if (type == PAM_ACCT_EXPIRED)
+ sshpam_account_status = 0;
+ if (type == PAM_MAXTRIES)
+ sshpam_set_maxtries_reached(1);
/* FALLTHROUGH */
case PAM_AUTH_ERR:
debug3("PAM: %s", pam_strerror(sshpam_handle, type));
@@ -796,7 +797,7 @@
error("PAM: %s for %s%.100s from %.100s", msg,
sshpam_authctxt->valid ? "" : "illegal user ",
sshpam_authctxt->user,
- get_remote_name_or_ip(utmp_len, options.use_dns));
+ auth_get_canonical_hostname(ssh, options.use_dns));
/* FALLTHROUGH */
default:
*num = 0;
@@ -809,6 +810,28 @@
return (-1);
}
+/*
+ * Returns a junk password of identical length to that the user supplied.
+ * Used to mitigate timing attacks against crypt(3)/PAM stacks that
+ * vary processing time in proportion to password length.
+ */
+static char *
+fake_password(const char *wire_password)
+{
+ const char junk[] = "\b\n\r\177INCORRECT";
+ char *ret = NULL;
+ size_t i, l = wire_password != NULL ? strlen(wire_password) : 0;
+
+ if (l >= INT_MAX)
+ fatal("%s: password length too long: %zu", __func__, l);
+
+ ret = malloc(l + 1);
+ for (i = 0; i < l; i++)
+ ret[i] = junk[i % (sizeof(junk) - 1)];
+ ret[i] = '\0';
+ return ret;
+}
+
/* XXX - see also comment in auth-chall.c:verify_response */
static int
sshpam_respond(void *ctx, u_int num, char **resp)
@@ -815,6 +838,7 @@
{
Buffer buffer;
struct pam_ctxt *ctxt = ctx;
+ char *fake;
debug2("PAM: %s entering, %u responses", __func__, num);
switch (ctxt->pam_done) {
@@ -835,8 +859,11 @@
(sshpam_authctxt->pw->pw_uid != 0 ||
options.permit_root_login == PERMIT_YES))
buffer_put_cstring(&buffer, *resp);
- else
- buffer_put_cstring(&buffer, badpw);
+ else {
+ fake = fake_password(*resp);
+ buffer_put_cstring(&buffer, fake);
+ free(fake);
+ }
if (ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer) == -1) {
buffer_free(&buffer);
return (-1);
@@ -1180,6 +1207,7 @@
{
int flags = (options.permit_empty_passwd == 0 ?
PAM_DISALLOW_NULL_AUTHTOK : 0);
+ char *fake = NULL;
if (!options.use_pam || sshpam_handle == NULL)
fatal("PAM: %s called when PAM disabled or failed to "
@@ -1195,7 +1223,7 @@
*/
if (!authctxt->valid || (authctxt->pw->pw_uid == 0 &&
options.permit_root_login != PERMIT_YES))
- sshpam_password = badpw;
+ sshpam_password = fake = fake_password(password);
sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
(const void *)&passwd_conv);
@@ -1205,6 +1233,9 @@
sshpam_err = pam_authenticate(sshpam_handle, flags);
sshpam_password = NULL;
+ free(fake);
+ if (sshpam_err == PAM_MAXTRIES)
+ sshpam_set_maxtries_reached(1);
if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
debug("PAM: password authentication accepted for %.100s",
authctxt->user);
@@ -1216,4 +1247,21 @@
return 0;
}
}
+
+int
+sshpam_get_maxtries_reached(void)
+{
+ return sshpam_maxtries_reached;
+}
+
+void
+sshpam_set_maxtries_reached(int reached)
+{
+ if (reached == 0 || sshpam_maxtries_reached)
+ return;
+ sshpam_maxtries_reached = 1;
+ options.password_authentication = 0;
+ options.kbd_interactive_authentication = 0;
+ options.challenge_response_authentication = 0;
+}
#endif /* USE_PAM */
Modified: trunk/crypto/openssh/auth-pam.h
===================================================================
--- trunk/crypto/openssh/auth-pam.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-pam.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -45,6 +45,8 @@
void sshpam_thread_cleanup(void);
void sshpam_cleanup(void);
int sshpam_auth_passwd(Authctxt *, const char *);
+int sshpam_get_maxtries_reached(void);
+void sshpam_set_maxtries_reached(int);
int is_pam_session_open(void);
#endif /* USE_PAM */
Modified: trunk/crypto/openssh/auth-passwd.c
===================================================================
--- trunk/crypto/openssh/auth-passwd.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-passwd.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-passwd.c,v 1.43 2007/09/21 08:15:29 djm Exp $ */
+/* $OpenBSD: auth-passwd.c,v 1.45 2016/07/21 01:39:35 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -48,6 +48,7 @@
#include "packet.h"
#include "buffer.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "key.h"
#include "hostfile.h"
@@ -65,6 +66,8 @@
#define DAY (24L * 60 * 60) /* 1 day in seconds */
#define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */
+#define MAX_PASSWORD_LEN 1024
+
void
disable_forwarding(void)
{
@@ -86,6 +89,9 @@
static int expire_checked = 0;
#endif
+ if (strlen(password) > MAX_PASSWORD_LEN)
+ return 0;
+
#ifndef HAVE_CYGWIN
if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
ok = 0;
@@ -192,7 +198,7 @@
sys_auth_passwd(Authctxt *authctxt, const char *password)
{
struct passwd *pw = authctxt->pw;
- char *encrypted_password;
+ char *encrypted_password, *salt = NULL;
/* Just use the supplied fake password if authctxt is invalid */
char *pw_password = authctxt->valid ? shadow_pw(pw) : pw->pw_passwd;
@@ -201,9 +207,13 @@
if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0)
return (1);
- /* Encrypt the candidate password using the proper salt. */
- encrypted_password = xcrypt(password,
- (pw_password[0] && pw_password[1]) ? pw_password : "xx");
+ /*
+ * Encrypt the candidate password using the proper salt, or pass a
+ * NULL and let xcrypt pick one.
+ */
+ if (authctxt->valid && pw_password[0] && pw_password[1])
+ salt = pw_password;
+ encrypted_password = xcrypt(password, salt);
/*
* Authentication is accepted if the encrypted passwords
Modified: trunk/crypto/openssh/auth-rh-rsa.c
===================================================================
--- trunk/crypto/openssh/auth-rh-rsa.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-rh-rsa.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-rh-rsa.c,v 1.43 2010/03/04 10:36:03 djm Exp $ */
+/* $OpenBSD: auth-rh-rsa.c,v 1.45 2016/03/07 19:02:43 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -15,6 +15,8 @@
#include "includes.h"
+#ifdef WITH_SSH1
+
#include <sys/types.h>
#include <pwd.h>
@@ -24,6 +26,7 @@
#include "uidswap.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
#include "key.h"
#include "hostfile.h"
@@ -39,8 +42,8 @@
extern ServerOptions options;
int
-auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost,
- Key *client_host_key)
+auth_rhosts_rsa_key_allowed(struct passwd *pw, const char *cuser,
+ const char *chost, Key *client_host_key)
{
HostStatus host_status;
@@ -65,7 +68,8 @@
int
auth_rhosts_rsa(Authctxt *authctxt, char *cuser, Key *client_host_key)
{
- char *chost;
+ struct ssh *ssh = active_state; /* XXX */
+ const char *chost;
struct passwd *pw = authctxt->pw;
debug("Trying rhosts with RSA host authentication for client user %.100s",
@@ -75,7 +79,7 @@
client_host_key->rsa == NULL)
return 0;
- chost = (char *)get_canonical_hostname(options.use_dns);
+ chost = auth_get_canonical_hostname(ssh, options.use_dns);
debug("Rhosts RSA authentication: canonical host %.900s", chost);
if (!PRIVSEP(auth_rhosts_rsa_key_allowed(pw, cuser, chost, client_host_key))) {
@@ -101,3 +105,5 @@
packet_send_debug("Rhosts with RSA host authentication accepted.");
return 1;
}
+
+#endif /* WITH_SSH1 */
Modified: trunk/crypto/openssh/auth-rhosts.c
===================================================================
--- trunk/crypto/openssh/auth-rhosts.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-rhosts.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-rhosts.c,v 1.44 2010/03/07 11:57:13 dtucker Exp $ */
+/* $OpenBSD: auth-rhosts.c,v 1.47 2016/03/07 19:02:43 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -30,16 +30,17 @@
#include <unistd.h>
#include "packet.h"
-#include "buffer.h"
#include "uidswap.h"
#include "pathnames.h"
#include "log.h"
+#include "misc.h"
+#include "buffer.h" /* XXX */
+#include "key.h" /* XXX */
#include "servconf.h"
#include "canohost.h"
-#include "key.h"
+#include "sshkey.h"
#include "hostfile.h"
#include "auth.h"
-#include "misc.h"
/* import */
extern ServerOptions options;
@@ -57,7 +58,8 @@
const char *server_user)
{
FILE *f;
- char buf[1024]; /* Must not be larger than host, user, dummy below. */
+#define RBUFLN 1024
+ char buf[RBUFLN];/* Must not be larger than host, user, dummy below. */
int fd;
struct stat st;
@@ -80,8 +82,9 @@
return 0;
}
while (fgets(buf, sizeof(buf), f)) {
- /* All three must be at least as big as buf to avoid overflows. */
- char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp;
+ /* All three must have length >= buf to avoid overflows. */
+ char hostbuf[RBUFLN], userbuf[RBUFLN], dummy[RBUFLN];
+ char *host, *user, *cp;
int negated;
for (cp = buf; *cp == ' ' || *cp == '\t'; cp++)
@@ -140,8 +143,8 @@
/* Check for empty host/user names (particularly '+'). */
if (!host[0] || !user[0]) {
/* We come here if either was '+' or '-'. */
- auth_debug_add("Ignoring wild host/user names in %.100s.",
- filename);
+ auth_debug_add("Ignoring wild host/user names "
+ "in %.100s.", filename);
continue;
}
/* Verify that host name matches. */
@@ -149,7 +152,8 @@
if (!innetgr(host + 1, hostname, NULL, NULL) &&
!innetgr(host + 1, ipaddr, NULL, NULL))
continue;
- } else if (strcasecmp(host, hostname) && strcmp(host, ipaddr) != 0)
+ } else if (strcasecmp(host, hostname) &&
+ strcmp(host, ipaddr) != 0)
continue; /* Different hostname. */
/* Verify that user name matches. */
@@ -186,10 +190,11 @@
int
auth_rhosts(struct passwd *pw, const char *client_user)
{
+ struct ssh *ssh = active_state; /* XXX */
const char *hostname, *ipaddr;
- hostname = get_canonical_hostname(options.use_dns);
- ipaddr = get_remote_ipaddr();
+ hostname = auth_get_canonical_hostname(ssh, options.use_dns);
+ ipaddr = ssh_remote_ipaddr(ssh);
return auth_rhosts2(pw, client_user, hostname, ipaddr);
}
@@ -208,7 +213,8 @@
/* Switch to the user's uid. */
temporarily_use_uid(pw);
/*
- * Quick check: if the user has no .shosts or .rhosts files, return
+ * Quick check: if the user has no .shosts or .rhosts files and
+ * no system hosts.equiv/shosts.equiv files exist then return
* failure immediately without doing costly lookups from name
* servers.
*/
@@ -223,27 +229,38 @@
/* Switch back to privileged uid. */
restore_uid();
- /* Deny if The user has no .shosts or .rhosts file and there are no system-wide files. */
+ /*
+ * Deny if The user has no .shosts or .rhosts file and there
+ * are no system-wide files.
+ */
if (!rhosts_files[rhosts_file_index] &&
stat(_PATH_RHOSTS_EQUIV, &st) < 0 &&
- stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0)
+ stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0) {
+ debug3("%s: no hosts access files exist", __func__);
return 0;
+ }
- /* If not logging in as superuser, try /etc/hosts.equiv and shosts.equiv. */
- if (pw->pw_uid != 0) {
+ /*
+ * If not logging in as superuser, try /etc/hosts.equiv and
+ * shosts.equiv.
+ */
+ if (pw->pw_uid == 0)
+ debug3("%s: root user, ignoring system hosts files", __func__);
+ else {
if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr,
client_user, pw->pw_name)) {
- auth_debug_add("Accepted for %.100s [%.100s] by /etc/hosts.equiv.",
- hostname, ipaddr);
+ auth_debug_add("Accepted for %.100s [%.100s] by "
+ "/etc/hosts.equiv.", hostname, ipaddr);
return 1;
}
if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr,
client_user, pw->pw_name)) {
- auth_debug_add("Accepted for %.100s [%.100s] by %.100s.",
- hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV);
+ auth_debug_add("Accepted for %.100s [%.100s] by "
+ "%.100s.", hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV);
return 1;
}
}
+
/*
* Check that the home directory is owned by root or the user, and is
* not group or world writable.
@@ -290,20 +307,25 @@
auth_debug_add("Bad file modes for %.200s", buf);
continue;
}
- /* Check if we have been configured to ignore .rhosts and .shosts files. */
+ /*
+ * Check if we have been configured to ignore .rhosts
+ * and .shosts files.
+ */
if (options.ignore_rhosts) {
- auth_debug_add("Server has been configured to ignore %.100s.",
- rhosts_files[rhosts_file_index]);
+ auth_debug_add("Server has been configured to "
+ "ignore %.100s.", rhosts_files[rhosts_file_index]);
continue;
}
/* Check if authentication is permitted by the file. */
- if (check_rhosts_file(buf, hostname, ipaddr, client_user, pw->pw_name)) {
+ if (check_rhosts_file(buf, hostname, ipaddr,
+ client_user, pw->pw_name)) {
auth_debug_add("Accepted by %.100s.",
rhosts_files[rhosts_file_index]);
/* Restore the privileged uid. */
restore_uid();
- auth_debug_add("Accepted host %s ip %s client_user %s server_user %s",
- hostname, ipaddr, client_user, pw->pw_name);
+ auth_debug_add("Accepted host %s ip %s client_user "
+ "%s server_user %s", hostname, ipaddr,
+ client_user, pw->pw_name);
return 1;
}
}
Modified: trunk/crypto/openssh/auth-rsa.c
===================================================================
--- trunk/crypto/openssh/auth-rsa.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth-rsa.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-rsa.c,v 1.86 2014/01/27 19:18:54 markus Exp $ */
+/* $OpenBSD: auth-rsa.c,v 1.90 2015/01/28 22:36:00 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -16,6 +16,8 @@
#include "includes.h"
+#ifdef WITH_SSH1
+
#include <sys/types.h>
#include <sys/stat.h>
@@ -35,6 +37,7 @@
#include "buffer.h"
#include "pathnames.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "key.h"
#include "auth-options.h"
@@ -45,7 +48,6 @@
#endif
#include "monitor_wrap.h"
#include "ssh.h"
-#include "misc.h"
#include "digest.h"
@@ -144,7 +146,8 @@
challenge = PRIVSEP(auth_rsa_generate_challenge(key));
/* Encrypt the challenge with the public key. */
- rsa_public_encrypt(encrypted_challenge, challenge, key->rsa);
+ if (rsa_public_encrypt(encrypted_challenge, challenge, key->rsa) != 0)
+ fatal("%s: rsa_public_encrypt failed", __func__);
/* Send the encrypted challenge to the client. */
packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE);
@@ -235,7 +238,9 @@
"actual %d vs. announced %d.",
file, linenum, BN_num_bits(key->rsa->n), bits);
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL)
+ continue;
debug("matching key found: file %s, line %lu %s %s",
file, linenum, key_type(key), fp);
free(fp);
@@ -340,3 +345,5 @@
packet_send_debug("RSA authentication accepted.");
return (1);
}
+
+#endif /* WITH_SSH1 */
Modified: trunk/crypto/openssh/auth.c
===================================================================
--- trunk/crypto/openssh/auth.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.103 2013/05/19 02:42:42 djm Exp $ */
+/* $OpenBSD: auth.c,v 1.115 2016/06/15 00:40:40 dtucker Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -27,7 +27,7 @@
#include <sys/types.h>
#include <sys/stat.h>
-#include <sys/param.h>
+#include <sys/socket.h>
#include <netinet/in.h>
@@ -50,6 +50,8 @@
#include <stdio.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
+#include <netdb.h>
#include "xmalloc.h"
#include "match.h"
@@ -56,6 +58,7 @@
#include "groupaccess.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
#include "key.h"
#include "hostfile.h"
@@ -63,7 +66,6 @@
#include "auth-options.h"
#include "canohost.h"
#include "uidswap.h"
-#include "misc.h"
#include "packet.h"
#include "loginrec.h"
#ifdef GSSAPI
@@ -71,7 +73,8 @@
#endif
#include "authfile.h"
#include "monitor_wrap.h"
-#include "krl.h"
+#include "authfile.h"
+#include "ssherr.h"
#include "compat.h"
/* import */
@@ -96,6 +99,7 @@
int
allowed_user(struct passwd * pw)
{
+ struct ssh *ssh = active_state; /* XXX */
struct stat st;
const char *hostname = NULL, *ipaddr = NULL, *passwd = NULL;
u_int i;
@@ -181,8 +185,8 @@
if (options.num_deny_users > 0 || options.num_allow_users > 0 ||
options.num_deny_groups > 0 || options.num_allow_groups > 0) {
- hostname = get_canonical_hostname(options.use_dns);
- ipaddr = get_remote_ipaddr();
+ hostname = auth_get_canonical_hostname(ssh, options.use_dns);
+ ipaddr = ssh_remote_ipaddr(ssh);
}
/* Return false if user is listed in DenyUsers */
@@ -273,6 +277,7 @@
auth_log(Authctxt *authctxt, int authenticated, int partial,
const char *method, const char *submethod)
{
+ struct ssh *ssh = active_state; /* XXX */
void (*authlog) (const char *fmt,...) = verbose;
char *authmsg;
@@ -299,8 +304,8 @@
submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod,
authctxt->valid ? "" : "invalid user ",
authctxt->user,
- get_remote_ipaddr(),
- get_remote_port(),
+ ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh),
compat20 ? "ssh2" : "ssh1",
authctxt->info != NULL ? ": " : "",
authctxt->info != NULL ? authctxt->info : "");
@@ -313,11 +318,12 @@
strncmp(method, "keyboard-interactive", 20) == 0 ||
strcmp(method, "challenge-response") == 0))
record_failed_login(authctxt->user,
- get_canonical_hostname(options.use_dns), "ssh");
+ auth_get_canonical_hostname(ssh, options.use_dns), "ssh");
# ifdef WITH_AIXAUTHENTICATE
if (authenticated)
sys_auth_record_login(authctxt->user,
- get_canonical_hostname(options.use_dns), "ssh", &loginmsg);
+ auth_get_canonical_hostname(ssh, options.use_dns), "ssh",
+ &loginmsg);
# endif
#endif
#ifdef SSH_AUDIT_EVENTS
@@ -326,6 +332,23 @@
#endif
}
+
+void
+auth_maxtries_exceeded(Authctxt *authctxt)
+{
+ struct ssh *ssh = active_state; /* XXX */
+
+ error("maximum authentication attempts exceeded for "
+ "%s%.100s from %.200s port %d %s",
+ authctxt->valid ? "" : "invalid user ",
+ authctxt->user,
+ ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh),
+ compat20 ? "ssh2" : "ssh1");
+ packet_disconnect("Too many authentication failures");
+ /* NOTREACHED */
+}
+
/*
* Check whether root logins are disallowed.
*/
@@ -332,11 +355,15 @@
int
auth_root_allowed(const char *method)
{
+ struct ssh *ssh = active_state; /* XXX */
+
switch (options.permit_root_login) {
case PERMIT_YES:
return 1;
case PERMIT_NO_PASSWD:
- if (strcmp(method, "password") != 0)
+ if (strcmp(method, "publickey") == 0 ||
+ strcmp(method, "hostbased") == 0 ||
+ strcmp(method, "gssapi-with-mic") == 0)
return 1;
break;
case PERMIT_FORCED_ONLY:
@@ -346,7 +373,8 @@
}
break;
}
- logit("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr());
+ logit("ROOT LOGIN REFUSED FROM %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
return 0;
}
@@ -361,7 +389,7 @@
char *
expand_authorized_keys(const char *filename, struct passwd *pw)
{
- char *file, ret[MAXPATHLEN];
+ char *file, ret[PATH_MAX];
int i;
file = percent_expand(filename, "h", pw->pw_dir,
@@ -384,8 +412,7 @@
char *
authorized_principals_file(struct passwd *pw)
{
- if (options.authorized_principals_file == NULL ||
- strcasecmp(options.authorized_principals_file, "none") == 0)
+ if (options.authorized_principals_file == NULL)
return NULL;
return expand_authorized_keys(options.authorized_principals_file, pw);
}
@@ -453,7 +480,7 @@
auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
uid_t uid, char *err, size_t errlen)
{
- char buf[MAXPATHLEN], homedir[MAXPATHLEN];
+ char buf[PATH_MAX], homedir[PATH_MAX];
char *cp;
int comparehome = 0;
struct stat st;
@@ -587,6 +614,7 @@
struct passwd *
getpwnamallow(const char *user)
{
+ struct ssh *ssh = active_state; /* XXX */
#ifdef HAVE_LOGIN_CAP
extern login_cap_t *lc;
#ifdef BSD_AUTH
@@ -622,11 +650,11 @@
}
#endif
if (pw == NULL) {
- logit("Invalid user %.100s from %.100s",
- user, get_remote_ipaddr());
+ logit("Invalid user %.100s from %.100s port %d",
+ user, ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
#ifdef CUSTOM_FAILED_LOGIN
record_failed_login(user,
- get_canonical_hostname(options.use_dns), "ssh");
+ auth_get_canonical_hostname(ssh, options.use_dns), "ssh");
#endif
#ifdef SSH_AUDIT_EVENTS
audit_event(SSH_INVALID_USER);
@@ -659,39 +687,39 @@
int
auth_key_is_revoked(Key *key)
{
- char *key_fp;
+ char *fp = NULL;
+ int r;
if (options.revoked_keys_file == NULL)
return 0;
- switch (ssh_krl_file_contains_key(options.revoked_keys_file, key)) {
+ if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ error("%s: fingerprint key: %s", __func__, ssh_err(r));
+ goto out;
+ }
+
+ r = sshkey_check_revoked(key, options.revoked_keys_file);
+ switch (r) {
case 0:
- return 0; /* Not revoked */
- case -2:
- break; /* Not a KRL */
+ break; /* not revoked */
+ case SSH_ERR_KEY_REVOKED:
+ error("Authentication key %s %s revoked by file %s",
+ sshkey_type(key), fp, options.revoked_keys_file);
+ goto out;
default:
- goto revoked;
+ error("Error checking authentication key %s %s in "
+ "revoked keys file %s: %s", sshkey_type(key), fp,
+ options.revoked_keys_file, ssh_err(r));
+ goto out;
}
- debug3("%s: treating %s as a key list", __func__,
- options.revoked_keys_file);
- switch (key_in_file(key, options.revoked_keys_file, 0)) {
- case 0:
- /* key not revoked */
- return 0;
- case -1:
- /* Error opening revoked_keys_file: refuse all keys */
- error("Revoked keys file is unreadable: refusing public key "
- "authentication");
- return 1;
- case 1:
- revoked:
- /* Key revoked */
- key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
- error("WARNING: authentication attempt with a revoked "
- "%s key %s ", key_type(key), key_fp);
- free(key_fp);
- return 1;
- }
- fatal("key_in_file returned junk");
+
+ /* Success */
+ r = 0;
+
+ out:
+ free(fp);
+ return r == 0 ? 0 : 1;
}
void
@@ -756,3 +784,117 @@
return (&fake);
}
+
+/*
+ * Returns the remote DNS hostname as a string. The returned string must not
+ * be freed. NB. this will usually trigger a DNS query the first time it is
+ * called.
+ * This function does additional checks on the hostname to mitigate some
+ * attacks on legacy rhosts-style authentication.
+ * XXX is RhostsRSAAuthentication vulnerable to these?
+ * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?)
+ */
+
+static char *
+remote_hostname(struct ssh *ssh)
+{
+ struct sockaddr_storage from;
+ socklen_t fromlen;
+ struct addrinfo hints, *ai, *aitop;
+ char name[NI_MAXHOST], ntop2[NI_MAXHOST];
+ const char *ntop = ssh_remote_ipaddr(ssh);
+
+ /* Get IP address of client. */
+ fromlen = sizeof(from);
+ memset(&from, 0, sizeof(from));
+ if (getpeername(ssh_packet_get_connection_in(ssh),
+ (struct sockaddr *)&from, &fromlen) < 0) {
+ debug("getpeername failed: %.100s", strerror(errno));
+ return strdup(ntop);
+ }
+
+ ipv64_normalise_mapped(&from, &fromlen);
+ if (from.ss_family == AF_INET6)
+ fromlen = sizeof(struct sockaddr_in6);
+
+ debug3("Trying to reverse map address %.100s.", ntop);
+ /* Map the IP address to a host name. */
+ if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
+ NULL, 0, NI_NAMEREQD) != 0) {
+ /* Host name not found. Use ip address. */
+ return strdup(ntop);
+ }
+
+ /*
+ * if reverse lookup result looks like a numeric hostname,
+ * someone is trying to trick us by PTR record like following:
+ * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
+ */
+ memset(&hints, 0, sizeof(hints));
+ hints.ai_socktype = SOCK_DGRAM; /*dummy*/
+ hints.ai_flags = AI_NUMERICHOST;
+ if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
+ logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
+ name, ntop);
+ freeaddrinfo(ai);
+ return strdup(ntop);
+ }
+
+ /* Names are stored in lowercase. */
+ lowercase(name);
+
+ /*
+ * Map it back to an IP address and check that the given
+ * address actually is an address of this host. This is
+ * necessary because anyone with access to a name server can
+ * define arbitrary names for an IP address. Mapping from
+ * name to IP address can be trusted better (but can still be
+ * fooled if the intruder has access to the name server of
+ * the domain).
+ */
+ memset(&hints, 0, sizeof(hints));
+ hints.ai_family = from.ss_family;
+ hints.ai_socktype = SOCK_STREAM;
+ if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
+ logit("reverse mapping checking getaddrinfo for %.700s "
+ "[%s] failed.", name, ntop);
+ return strdup(ntop);
+ }
+ /* Look for the address from the list of addresses. */
+ for (ai = aitop; ai; ai = ai->ai_next) {
+ if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
+ sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
+ (strcmp(ntop, ntop2) == 0))
+ break;
+ }
+ freeaddrinfo(aitop);
+ /* If we reached the end of the list, the address was not there. */
+ if (ai == NULL) {
+ /* Address not found for the host name. */
+ logit("Address %.100s maps to %.600s, but this does not "
+ "map back to the address.", ntop, name);
+ return strdup(ntop);
+ }
+ return strdup(name);
+}
+
+/*
+ * Return the canonical name of the host in the other side of the current
+ * connection. The host name is cached, so it is efficient to call this
+ * several times.
+ */
+
+const char *
+auth_get_canonical_hostname(struct ssh *ssh, int use_dns)
+{
+ static char *dnsname;
+
+ if (!use_dns)
+ return ssh_remote_ipaddr(ssh);
+ else if (dnsname != NULL)
+ return dnsname;
+ else {
+ dnsname = remote_hostname(ssh);
+ return dnsname;
+ }
+}
Modified: trunk/crypto/openssh/auth.h
===================================================================
--- trunk/crypto/openssh/auth.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.h,v 1.77 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: auth.h,v 1.88 2016/05/04 14:04:40 markus Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -42,6 +42,9 @@
#include <krb5.h>
#endif
+struct ssh;
+struct sshkey;
+
typedef struct Authctxt Authctxt;
typedef struct Authmethod Authmethod;
typedef struct KbdintDevice KbdintDevice;
@@ -53,7 +56,7 @@
int valid; /* user exists and is allowed to login */
int attempt;
int failures;
- int server_caused_failure;
+ int server_caused_failure;
int force_pwchange;
char *user; /* username sent by the client */
char *service;
@@ -75,6 +78,9 @@
#endif
Buffer *loginmsg;
void *methoddata;
+
+ struct sshkey **prev_userkeys;
+ u_int nprev_userkeys;
};
/*
* Every authentication method has to handle authentication requests for
@@ -118,11 +124,14 @@
int auth_rsa_verify_response(Key *, BIGNUM *, u_char[]);
int auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
-int auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
+int auth_rhosts_rsa_key_allowed(struct passwd *, const char *,
+ const char *, Key *);
int hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
-int user_key_allowed(struct passwd *, Key *);
+int user_key_allowed(struct passwd *, Key *, int);
void pubkey_auth_info(Authctxt *, const Key *, const char *, ...)
__attribute__((__format__ (printf, 3, 4)));
+void auth2_record_userkey(Authctxt *, struct sshkey *);
+int auth2_userkey_already_used(Authctxt *, struct sshkey *);
struct stat;
int auth_secure_path(const char *, struct stat *, const char *, uid_t,
@@ -154,6 +163,7 @@
__attribute__((__format__ (printf, 2, 3)))
__attribute__((__nonnull__ (2)));
void auth_log(Authctxt *, int, int, const char *, const char *);
+void auth_maxtries_exceeded(Authctxt *) __attribute__((noreturn));
void userauth_finish(Authctxt *, int, const char *, const char *);
int auth_root_allowed(const char *);
@@ -188,6 +198,8 @@
FILE *auth_openprincipals(const char *, struct passwd *, int);
int auth_key_is_revoked(Key *);
+const char *auth_get_canonical_hostname(struct ssh *, int);
+
HostStatus
check_key_in_hostfiles(struct passwd *, Key *, const char *,
const char *, const char *);
@@ -194,12 +206,13 @@
/* hostkey handling */
Key *get_hostkey_by_index(int);
-Key *get_hostkey_public_by_index(int);
-Key *get_hostkey_public_by_type(int);
-Key *get_hostkey_private_by_type(int);
-int get_hostkey_index(Key *);
+Key *get_hostkey_public_by_index(int, struct ssh *);
+Key *get_hostkey_public_by_type(int, int, struct ssh *);
+Key *get_hostkey_private_by_type(int, int, struct ssh *);
+int get_hostkey_index(Key *, int, struct ssh *);
int ssh1_session_key(BIGNUM *);
-void sshd_hostkey_sign(Key *, Key *, u_char **, u_int *, u_char *, u_int);
+int sshd_hostkey_sign(Key *, Key *, u_char **, size_t *,
+ const u_char *, size_t, const char *, u_int);
/* debug messages during authentication */
void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
@@ -210,8 +223,6 @@
int sys_auth_passwd(Authctxt *, const char *);
-#define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
-
#define SKEY_PROMPT "\nS/Key Password: "
#if defined(KRB5) && !defined(HEIMDAL)
Modified: trunk/crypto/openssh/auth1.c
===================================================================
--- trunk/crypto/openssh/auth1.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth1.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth1.c,v 1.80 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: auth1.c,v 1.82 2014/07/15 15:54:14 millert Exp $ */
/*
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
* All rights reserved
@@ -12,6 +12,8 @@
#include "includes.h"
+#ifdef WITH_SSH1
+
#include <sys/types.h>
#include <stdarg.h>
@@ -27,6 +29,7 @@
#include "packet.h"
#include "buffer.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "compat.h"
#include "key.h"
@@ -363,7 +366,7 @@
#ifdef SSH_AUDIT_EVENTS
PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES));
#endif
- packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
+ auth_maxtries_exceeded(authctxt);
}
packet_start(SSH_SMSG_FAILURE);
@@ -437,3 +440,5 @@
packet_send();
packet_write_wait();
}
+
+#endif /* WITH_SSH1 */
Modified: trunk/crypto/openssh/auth2-chall.c
===================================================================
--- trunk/crypto/openssh/auth2-chall.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth2-chall.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-chall.c,v 1.41 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: auth2-chall.c,v 1.44 2016/05/02 08:49:03 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2001 Per Allansson. All rights reserved.
@@ -41,6 +41,7 @@
#include "packet.h"
#include "dispatch.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
/* import */
@@ -48,7 +49,7 @@
static int auth2_challenge_start(Authctxt *);
static int send_userauth_info_request(Authctxt *);
-static void input_userauth_info_response(int, u_int32_t, void *);
+static int input_userauth_info_response(int, u_int32_t, void *);
#ifdef BSD_AUTH
extern KbdintDevice bsdauth_device;
@@ -121,8 +122,8 @@
buffer_append(&b, devices[i]->name,
strlen(devices[i]->name));
}
- buffer_append(&b, "\0", 1);
- kbdintctxt->devices = xstrdup(buffer_ptr(&b));
+ if ((kbdintctxt->devices = sshbuf_dup_string(&b)) == NULL)
+ fatal("%s: sshbuf_dup_string failed", __func__);
buffer_free(&b);
} else {
kbdintctxt->devices = xstrdup(devs);
@@ -283,7 +284,7 @@
return 1;
}
-static void
+static int
input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -348,6 +349,7 @@
}
userauth_finish(authctxt, authenticated, "keyboard-interactive",
devicename);
+ return 0;
}
void
Modified: trunk/crypto/openssh/auth2-gss.c
===================================================================
--- trunk/crypto/openssh/auth2-gss.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth2-gss.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-gss.c,v 1.21 2014/02/26 20:28:44 djm Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.22 2015/01/19 20:07:45 markus Exp $ */
/*
* Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -40,6 +40,7 @@
#include "log.h"
#include "dispatch.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
#include "packet.h"
#include "ssh-gss.h"
@@ -47,10 +48,10 @@
extern ServerOptions options;
-static void input_gssapi_token(int type, u_int32_t plen, void *ctxt);
-static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
-static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
-static void input_gssapi_errtok(int, u_int32_t, void *);
+static int input_gssapi_token(int type, u_int32_t plen, void *ctxt);
+static int input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
+static int input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
+static int input_gssapi_errtok(int, u_int32_t, void *);
/*
* We only support those mechanisms that we know about (ie ones that we know
@@ -125,7 +126,7 @@
return (0);
}
-static void
+static int
input_gssapi_token(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -177,9 +178,10 @@
}
gss_release_buffer(&min_status, &send_tok);
+ return 0;
}
-static void
+static int
input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -211,6 +213,7 @@
/* The client will have already moved on to the next auth */
gss_release_buffer(&maj_status, &send_tok);
+ return 0;
}
/*
@@ -219,7 +222,7 @@
* which only enables it once the GSSAPI exchange is complete.
*/
-static void
+static int
input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -243,9 +246,10 @@
dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
+ return 0;
}
-static void
+static int
input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -283,6 +287,7 @@
dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
+ return 0;
}
Authmethod method_gssapi = {
Modified: trunk/crypto/openssh/auth2-hostbased.c
===================================================================
--- trunk/crypto/openssh/auth2-hostbased.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth2-hostbased.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-hostbased.c,v 1.17 2013/12/30 23:52:27 djm Exp $ */
+/* $OpenBSD: auth2-hostbased.c,v 1.26 2016/03/07 19:02:43 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -36,6 +36,7 @@
#include "packet.h"
#include "buffer.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "compat.h"
#include "key.h"
@@ -47,6 +48,7 @@
#endif
#include "monitor_wrap.h"
#include "pathnames.h"
+#include "match.h"
/* import */
extern ServerOptions options;
@@ -106,6 +108,13 @@
"signature format");
goto done;
}
+ if (match_pattern_list(sshkey_ssh_name(key),
+ options.hostbased_key_types, 0) != 1) {
+ logit("%s: key type %s not in HostbasedAcceptedKeyTypes",
+ __func__, sshkey_type(key));
+ goto done;
+ }
+
service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
authctxt->service;
buffer_init(&b);
@@ -151,6 +160,7 @@
hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
Key *key)
{
+ struct ssh *ssh = active_state; /* XXX */
const char *resolvedname, *ipaddr, *lookup, *reason;
HostStatus host_status;
int len;
@@ -159,10 +169,10 @@
if (auth_key_is_revoked(key))
return 0;
- resolvedname = get_canonical_hostname(options.use_dns);
- ipaddr = get_remote_ipaddr();
+ resolvedname = auth_get_canonical_hostname(ssh, options.use_dns);
+ ipaddr = ssh_remote_ipaddr(ssh);
- debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
+ debug2("%s: chost %s resolvedname %s ipaddr %s", __func__,
chost, resolvedname, ipaddr);
if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
@@ -171,8 +181,12 @@
}
if (options.hostbased_uses_name_from_packet_only) {
- if (auth_rhosts2(pw, cuser, chost, chost) == 0)
+ if (auth_rhosts2(pw, cuser, chost, chost) == 0) {
+ debug2("%s: auth_rhosts2 refused "
+ "user \"%.100s\" host \"%.100s\" (from packet)",
+ __func__, cuser, chost);
return 0;
+ }
lookup = chost;
} else {
if (strcasecmp(resolvedname, chost) != 0)
@@ -179,11 +193,15 @@
logit("userauth_hostbased mismatch: "
"client sends %s, but we resolve %s to %s",
chost, ipaddr, resolvedname);
- if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
+ if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0) {
+ debug2("%s: auth_rhosts2 refused "
+ "user \"%.100s\" host \"%.100s\" addr \"%.100s\"",
+ __func__, cuser, resolvedname, ipaddr);
return 0;
+ }
lookup = resolvedname;
}
- debug2("userauth_hostbased: access allowed by auth_rhosts2");
+ debug2("%s: access allowed by auth_rhosts2", __func__);
if (key_is_cert(key) &&
key_cert_check_authority(key, 1, 0, lookup, &reason)) {
@@ -206,14 +224,17 @@
if (host_status == HOST_OK) {
if (key_is_cert(key)) {
- fp = key_fingerprint(key->cert->signature_key,
- SSH_FP_MD5, SSH_FP_HEX);
+ if ((fp = sshkey_fingerprint(key->cert->signature_key,
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+ fatal("%s: sshkey_fingerprint fail", __func__);
verbose("Accepted certificate ID \"%s\" signed by "
"%s CA %s from %s@%s", key->cert->key_id,
key_type(key->cert->signature_key), fp,
cuser, lookup);
} else {
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ if ((fp = sshkey_fingerprint(key,
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+ fatal("%s: sshkey_fingerprint fail", __func__);
verbose("Accepted %s public key %s from %s@%s",
key_type(key), fp, cuser, lookup);
}
Modified: trunk/crypto/openssh/auth2-kbdint.c
===================================================================
--- trunk/crypto/openssh/auth2-kbdint.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth2-kbdint.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-kbdint.c,v 1.6 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: auth2-kbdint.c,v 1.7 2014/07/15 15:54:14 millert Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -36,6 +36,7 @@
#include "auth.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
/* import */
Modified: trunk/crypto/openssh/auth2-none.c
===================================================================
--- trunk/crypto/openssh/auth2-none.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth2-none.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-none.c,v 1.16 2010/06/25 08:46:17 djm Exp $ */
+/* $OpenBSD: auth2-none.c,v 1.18 2014/07/15 15:54:14 millert Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -30,9 +30,10 @@
#include <sys/uio.h>
#include <fcntl.h>
-#include <stdarg.h>
#include <string.h>
#include <unistd.h>
+#include <stdarg.h>
+#include <stdio.h>
#include "atomicio.h"
#include "xmalloc.h"
@@ -42,6 +43,7 @@
#include "packet.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
#include "compat.h"
#include "ssh2.h"
Modified: trunk/crypto/openssh/auth2-passwd.c
===================================================================
--- trunk/crypto/openssh/auth2-passwd.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth2-passwd.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-passwd.c,v 1.11 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: auth2-passwd.c,v 1.12 2014/07/15 15:54:14 millert Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -41,6 +41,7 @@
#include "ssh-gss.h"
#endif
#include "monitor_wrap.h"
+#include "misc.h"
#include "servconf.h"
/* import */
Modified: trunk/crypto/openssh/auth2-pubkey.c
===================================================================
--- trunk/crypto/openssh/auth2-pubkey.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth2-pubkey.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.39 2013/12/30 23:52:27 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.55 2016/01/27 00:53:12 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -41,6 +41,7 @@
#include <string.h>
#include <time.h>
#include <unistd.h>
+#include <limits.h>
#include "xmalloc.h"
#include "ssh.h"
@@ -48,6 +49,7 @@
#include "packet.h"
#include "buffer.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "compat.h"
#include "key.h"
@@ -61,9 +63,11 @@
#include "ssh-gss.h"
#endif
#include "monitor_wrap.h"
-#include "misc.h"
#include "authfile.h"
#include "match.h"
+#include "ssherr.h"
+#include "channels.h" /* XXX for session.h */
+#include "session.h" /* XXX for child_set_env(); refactor? */
/* import */
extern ServerOptions options;
@@ -75,7 +79,7 @@
{
Buffer b;
Key *key = NULL;
- char *pkalg, *userstyle;
+ char *pkalg, *userstyle, *fp = NULL;
u_char *pkblob, *sig;
u_int alen, blen, slen;
int have_sig, pktype;
@@ -82,12 +86,12 @@
int authenticated = 0;
if (!authctxt->valid) {
- debug2("userauth_pubkey: disabled because of invalid user");
+ debug2("%s: disabled because of invalid user", __func__);
return 0;
}
have_sig = packet_get_char();
if (datafellows & SSH_BUG_PKAUTH) {
- debug2("userauth_pubkey: SSH_BUG_PKAUTH");
+ debug2("%s: SSH_BUG_PKAUTH", __func__);
/* no explicit pkalg given */
pkblob = packet_get_string(&blen);
buffer_init(&b);
@@ -102,18 +106,18 @@
pktype = key_type_from_name(pkalg);
if (pktype == KEY_UNSPEC) {
/* this is perfectly legal */
- logit("userauth_pubkey: unsupported public key algorithm: %s",
- pkalg);
+ logit("%s: unsupported public key algorithm: %s",
+ __func__, pkalg);
goto done;
}
key = key_from_blob(pkblob, blen);
if (key == NULL) {
- error("userauth_pubkey: cannot decode key: %s", pkalg);
+ error("%s: cannot decode key: %s", __func__, pkalg);
goto done;
}
if (key->type != pktype) {
- error("userauth_pubkey: type mismatch for decoded key "
- "(received %d, expected %d)", key->type, pktype);
+ error("%s: type mismatch for decoded key "
+ "(received %d, expected %d)", __func__, key->type, pktype);
goto done;
}
if (key_type_plain(key->type) == KEY_RSA &&
@@ -122,7 +126,21 @@
"signature scheme");
goto done;
}
+ fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_DEFAULT);
+ if (auth2_userkey_already_used(authctxt, key)) {
+ logit("refusing previously-used %s key", key_type(key));
+ goto done;
+ }
+ if (match_pattern_list(sshkey_ssh_name(key),
+ options.pubkey_key_types, 0) != 1) {
+ logit("%s: key type %s not in PubkeyAcceptedKeyTypes",
+ __func__, sshkey_ssh_name(key));
+ goto done;
+ }
+
if (have_sig) {
+ debug3("%s: have signature for %s %s",
+ __func__, sshkey_type(key), fp);
sig = packet_get_string(&slen);
packet_check_eom();
buffer_init(&b);
@@ -157,14 +175,19 @@
/* test for correct signature */
authenticated = 0;
- if (PRIVSEP(user_key_allowed(authctxt->pw, key)) &&
+ if (PRIVSEP(user_key_allowed(authctxt->pw, key, 1)) &&
PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
- buffer_len(&b))) == 1)
+ buffer_len(&b))) == 1) {
authenticated = 1;
+ /* Record the successful key to prevent reuse */
+ auth2_record_userkey(authctxt, key);
+ key = NULL; /* Don't free below */
+ }
buffer_free(&b);
free(sig);
} else {
- debug("test whether pkalg/pkblob are acceptable");
+ debug("%s: test whether pkalg/pkblob are acceptable for %s %s",
+ __func__, sshkey_type(key), fp);
packet_check_eom();
/* XXX fake reply and always send PK_OK ? */
@@ -175,7 +198,7 @@
* if a user is not allowed to login. is this an
* issue? -markus
*/
- if (PRIVSEP(user_key_allowed(authctxt->pw, key))) {
+ if (PRIVSEP(user_key_allowed(authctxt->pw, key, 0))) {
packet_start(SSH2_MSG_USERAUTH_PK_OK);
packet_put_string(pkalg, alen);
packet_put_string(pkblob, blen);
@@ -187,11 +210,12 @@
if (authenticated != 1)
auth_clear_options();
done:
- debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg);
+ debug2("%s: authenticated %d pkalg %s", __func__, authenticated, pkalg);
if (key != NULL)
key_free(key);
free(pkalg);
free(pkblob);
+ free(fp);
return authenticated;
}
@@ -212,17 +236,20 @@
}
if (key_is_cert(key)) {
- fp = key_fingerprint(key->cert->signature_key,
- SSH_FP_MD5, SSH_FP_HEX);
+ fp = sshkey_fingerprint(key->cert->signature_key,
+ options.fingerprint_hash, SSH_FP_DEFAULT);
auth_info(authctxt, "%s ID %s (serial %llu) CA %s %s%s%s",
key_type(key), key->cert->key_id,
(unsigned long long)key->cert->serial,
- key_type(key->cert->signature_key), fp,
+ key_type(key->cert->signature_key),
+ fp == NULL ? "(null)" : fp,
extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
free(fp);
} else {
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
- auth_info(authctxt, "%s %s%s%s", key_type(key), fp,
+ fp = sshkey_fingerprint(key, options.fingerprint_hash,
+ SSH_FP_DEFAULT);
+ auth_info(authctxt, "%s %s%s%s", key_type(key),
+ fp == NULL ? "(null)" : fp,
extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
free(fp);
}
@@ -229,9 +256,291 @@
free(extra);
}
+/*
+ * Splits 's' into an argument vector. Handles quoted string and basic
+ * escape characters (\\, \", \'). Caller must free the argument vector
+ * and its members.
+ */
static int
-match_principals_option(const char *principal_list, struct KeyCert *cert)
+split_argv(const char *s, int *argcp, char ***argvp)
{
+ int r = SSH_ERR_INTERNAL_ERROR;
+ int argc = 0, quote, i, j;
+ char *arg, **argv = xcalloc(1, sizeof(*argv));
+
+ *argvp = NULL;
+ *argcp = 0;
+
+ for (i = 0; s[i] != '\0'; i++) {
+ /* Skip leading whitespace */
+ if (s[i] == ' ' || s[i] == '\t')
+ continue;
+
+ /* Start of a token */
+ quote = 0;
+ if (s[i] == '\\' &&
+ (s[i + 1] == '\'' || s[i + 1] == '\"' || s[i + 1] == '\\'))
+ i++;
+ else if (s[i] == '\'' || s[i] == '"')
+ quote = s[i++];
+
+ argv = xreallocarray(argv, (argc + 2), sizeof(*argv));
+ arg = argv[argc++] = xcalloc(1, strlen(s + i) + 1);
+ argv[argc] = NULL;
+
+ /* Copy the token in, removing escapes */
+ for (j = 0; s[i] != '\0'; i++) {
+ if (s[i] == '\\') {
+ if (s[i + 1] == '\'' ||
+ s[i + 1] == '\"' ||
+ s[i + 1] == '\\') {
+ i++; /* Skip '\' */
+ arg[j++] = s[i];
+ } else {
+ /* Unrecognised escape */
+ arg[j++] = s[i];
+ }
+ } else if (quote == 0 && (s[i] == ' ' || s[i] == '\t'))
+ break; /* done */
+ else if (quote != 0 && s[i] == quote)
+ break; /* done */
+ else
+ arg[j++] = s[i];
+ }
+ if (s[i] == '\0') {
+ if (quote != 0) {
+ /* Ran out of string looking for close quote */
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ break;
+ }
+ }
+ /* Success */
+ *argcp = argc;
+ *argvp = argv;
+ argc = 0;
+ argv = NULL;
+ r = 0;
+ out:
+ if (argc != 0 && argv != NULL) {
+ for (i = 0; i < argc; i++)
+ free(argv[i]);
+ free(argv);
+ }
+ return r;
+}
+
+/*
+ * Reassemble an argument vector into a string, quoting and escaping as
+ * necessary. Caller must free returned string.
+ */
+static char *
+assemble_argv(int argc, char **argv)
+{
+ int i, j, ws, r;
+ char c, *ret;
+ struct sshbuf *buf, *arg;
+
+ if ((buf = sshbuf_new()) == NULL || (arg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+
+ for (i = 0; i < argc; i++) {
+ ws = 0;
+ sshbuf_reset(arg);
+ for (j = 0; argv[i][j] != '\0'; j++) {
+ r = 0;
+ c = argv[i][j];
+ switch (c) {
+ case ' ':
+ case '\t':
+ ws = 1;
+ r = sshbuf_put_u8(arg, c);
+ break;
+ case '\\':
+ case '\'':
+ case '"':
+ if ((r = sshbuf_put_u8(arg, '\\')) != 0)
+ break;
+ /* FALLTHROUGH */
+ default:
+ r = sshbuf_put_u8(arg, c);
+ break;
+ }
+ if (r != 0)
+ fatal("%s: sshbuf_put_u8: %s",
+ __func__, ssh_err(r));
+ }
+ if ((i != 0 && (r = sshbuf_put_u8(buf, ' ')) != 0) ||
+ (ws != 0 && (r = sshbuf_put_u8(buf, '"')) != 0) ||
+ (r = sshbuf_putb(buf, arg)) != 0 ||
+ (ws != 0 && (r = sshbuf_put_u8(buf, '"')) != 0))
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ }
+ if ((ret = malloc(sshbuf_len(buf) + 1)) == NULL)
+ fatal("%s: malloc failed", __func__);
+ memcpy(ret, sshbuf_ptr(buf), sshbuf_len(buf));
+ ret[sshbuf_len(buf)] = '\0';
+ sshbuf_free(buf);
+ sshbuf_free(arg);
+ return ret;
+}
+
+/*
+ * Runs command in a subprocess. Returns pid on success and a FILE* to the
+ * subprocess' stdout or 0 on failure.
+ * NB. "command" is only used for logging.
+ */
+static pid_t
+subprocess(const char *tag, struct passwd *pw, const char *command,
+ int ac, char **av, FILE **child)
+{
+ FILE *f;
+ struct stat st;
+ int devnull, p[2], i;
+ pid_t pid;
+ char *cp, errmsg[512];
+ u_int envsize;
+ char **child_env;
+
+ *child = NULL;
+
+ debug3("%s: %s command \"%s\" running as %s", __func__,
+ tag, command, pw->pw_name);
+
+ /* Verify the path exists and is safe-ish to execute */
+ if (*av[0] != '/') {
+ error("%s path is not absolute", tag);
+ return 0;
+ }
+ temporarily_use_uid(pw);
+ if (stat(av[0], &st) < 0) {
+ error("Could not stat %s \"%s\": %s", tag,
+ av[0], strerror(errno));
+ restore_uid();
+ return 0;
+ }
+ if (auth_secure_path(av[0], &st, NULL, 0,
+ errmsg, sizeof(errmsg)) != 0) {
+ error("Unsafe %s \"%s\": %s", tag, av[0], errmsg);
+ restore_uid();
+ return 0;
+ }
+
+ /*
+ * Run the command; stderr is left in place, stdout is the
+ * authorized_keys output.
+ */
+ if (pipe(p) != 0) {
+ error("%s: pipe: %s", tag, strerror(errno));
+ restore_uid();
+ return 0;
+ }
+
+ /*
+ * Don't want to call this in the child, where it can fatal() and
+ * run cleanup_exit() code.
+ */
+ restore_uid();
+
+ switch ((pid = fork())) {
+ case -1: /* error */
+ error("%s: fork: %s", tag, strerror(errno));
+ close(p[0]);
+ close(p[1]);
+ return 0;
+ case 0: /* child */
+ /* Prepare a minimal environment for the child. */
+ envsize = 5;
+ child_env = xcalloc(sizeof(*child_env), envsize);
+ child_set_env(&child_env, &envsize, "PATH", _PATH_STDPATH);
+ child_set_env(&child_env, &envsize, "USER", pw->pw_name);
+ child_set_env(&child_env, &envsize, "LOGNAME", pw->pw_name);
+ child_set_env(&child_env, &envsize, "HOME", pw->pw_dir);
+ if ((cp = getenv("LANG")) != NULL)
+ child_set_env(&child_env, &envsize, "LANG", cp);
+
+ for (i = 0; i < NSIG; i++)
+ signal(i, SIG_DFL);
+
+ if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
+ error("%s: open %s: %s", tag, _PATH_DEVNULL,
+ strerror(errno));
+ _exit(1);
+ }
+ /* Keep stderr around a while longer to catch errors */
+ if (dup2(devnull, STDIN_FILENO) == -1 ||
+ dup2(p[1], STDOUT_FILENO) == -1) {
+ error("%s: dup2: %s", tag, strerror(errno));
+ _exit(1);
+ }
+ closefrom(STDERR_FILENO + 1);
+
+ /* Don't use permanently_set_uid() here to avoid fatal() */
+ if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
+ error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid,
+ strerror(errno));
+ _exit(1);
+ }
+ if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) {
+ error("%s: setresuid %u: %s", tag, (u_int)pw->pw_uid,
+ strerror(errno));
+ _exit(1);
+ }
+ /* stdin is pointed to /dev/null at this point */
+ if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) {
+ error("%s: dup2: %s", tag, strerror(errno));
+ _exit(1);
+ }
+
+ execve(av[0], av, child_env);
+ error("%s exec \"%s\": %s", tag, command, strerror(errno));
+ _exit(127);
+ default: /* parent */
+ break;
+ }
+
+ close(p[1]);
+ if ((f = fdopen(p[0], "r")) == NULL) {
+ error("%s: fdopen: %s", tag, strerror(errno));
+ close(p[0]);
+ /* Don't leave zombie child */
+ kill(pid, SIGTERM);
+ while (waitpid(pid, NULL, 0) == -1 && errno == EINTR)
+ ;
+ return 0;
+ }
+ /* Success */
+ debug3("%s: %s pid %ld", __func__, tag, (long)pid);
+ *child = f;
+ return pid;
+}
+
+/* Returns 0 if pid exited cleanly, non-zero otherwise */
+static int
+exited_cleanly(pid_t pid, const char *tag, const char *cmd)
+{
+ int status;
+
+ while (waitpid(pid, &status, 0) == -1) {
+ if (errno != EINTR) {
+ error("%s: waitpid: %s", tag, strerror(errno));
+ return -1;
+ }
+ }
+ if (WIFSIGNALED(status)) {
+ error("%s %s exited on signal %d", tag, cmd, WTERMSIG(status));
+ return -1;
+ } else if (WEXITSTATUS(status) != 0) {
+ error("%s %s failed, status %d", tag, cmd, WEXITSTATUS(status));
+ return -1;
+ }
+ return 0;
+}
+
+static int
+match_principals_option(const char *principal_list, struct sshkey_cert *cert)
+{
char *result;
u_int i;
@@ -250,19 +559,13 @@
}
static int
-match_principals_file(char *file, struct passwd *pw, struct KeyCert *cert)
+process_principals(FILE *f, char *file, struct passwd *pw,
+ struct sshkey_cert *cert)
{
- FILE *f;
char line[SSH_MAX_PUBKEY_BYTES], *cp, *ep, *line_opts;
u_long linenum = 0;
u_int i;
- temporarily_use_uid(pw);
- debug("trying authorized principals file %s", file);
- if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) {
- restore_uid();
- return 0;
- }
while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
/* Skip leading whitespace. */
for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
@@ -290,24 +593,128 @@
}
for (i = 0; i < cert->nprincipals; i++) {
if (strcmp(cp, cert->principals[i]) == 0) {
- debug3("matched principal \"%.100s\" "
- "from file \"%s\" on line %lu",
- cert->principals[i], file, linenum);
+ debug3("%s:%lu: matched principal \"%.100s\"",
+ file == NULL ? "(command)" : file,
+ linenum, cert->principals[i]);
if (auth_parse_options(pw, line_opts,
file, linenum) != 1)
continue;
- fclose(f);
- restore_uid();
return 1;
}
}
}
+ return 0;
+}
+
+static int
+match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert)
+{
+ FILE *f;
+ int success;
+
+ temporarily_use_uid(pw);
+ debug("trying authorized principals file %s", file);
+ if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) {
+ restore_uid();
+ return 0;
+ }
+ success = process_principals(f, file, pw, cert);
fclose(f);
restore_uid();
- return 0;
+ return success;
}
/*
+ * Checks whether principal is allowed in output of command.
+ * returns 1 if the principal is allowed or 0 otherwise.
+ */
+static int
+match_principals_command(struct passwd *user_pw, struct sshkey_cert *cert)
+{
+ FILE *f = NULL;
+ int ok, found_principal = 0;
+ struct passwd *pw;
+ int i, ac = 0, uid_swapped = 0;
+ pid_t pid;
+ char *tmp, *username = NULL, *command = NULL, **av = NULL;
+ void (*osigchld)(int);
+
+ if (options.authorized_principals_command == NULL)
+ return 0;
+ if (options.authorized_principals_command_user == NULL) {
+ error("No user for AuthorizedPrincipalsCommand specified, "
+ "skipping");
+ return 0;
+ }
+
+ /*
+ * NB. all returns later this function should go via "out" to
+ * ensure the original SIGCHLD handler is restored properly.
+ */
+ osigchld = signal(SIGCHLD, SIG_DFL);
+
+ /* Prepare and verify the user for the command */
+ username = percent_expand(options.authorized_principals_command_user,
+ "u", user_pw->pw_name, (char *)NULL);
+ pw = getpwnam(username);
+ if (pw == NULL) {
+ error("AuthorizedPrincipalsCommandUser \"%s\" not found: %s",
+ username, strerror(errno));
+ goto out;
+ }
+
+ /* Turn the command into an argument vector */
+ if (split_argv(options.authorized_principals_command, &ac, &av) != 0) {
+ error("AuthorizedPrincipalsCommand \"%s\" contains "
+ "invalid quotes", command);
+ goto out;
+ }
+ if (ac == 0) {
+ error("AuthorizedPrincipalsCommand \"%s\" yielded no arguments",
+ command);
+ goto out;
+ }
+ for (i = 1; i < ac; i++) {
+ tmp = percent_expand(av[i],
+ "u", user_pw->pw_name,
+ "h", user_pw->pw_dir,
+ (char *)NULL);
+ if (tmp == NULL)
+ fatal("%s: percent_expand failed", __func__);
+ free(av[i]);
+ av[i] = tmp;
+ }
+ /* Prepare a printable command for logs, etc. */
+ command = assemble_argv(ac, av);
+
+ if ((pid = subprocess("AuthorizedPrincipalsCommand", pw, command,
+ ac, av, &f)) == 0)
+ goto out;
+
+ uid_swapped = 1;
+ temporarily_use_uid(pw);
+
+ ok = process_principals(f, NULL, pw, cert);
+
+ if (exited_cleanly(pid, "AuthorizedPrincipalsCommand", command) != 0)
+ goto out;
+
+ /* Read completed successfully */
+ found_principal = ok;
+ out:
+ if (f != NULL)
+ fclose(f);
+ signal(SIGCHLD, osigchld);
+ for (i = 0; i < ac; i++)
+ free(av[i]);
+ free(av);
+ if (uid_swapped)
+ restore_uid();
+ free(command);
+ free(username);
+ return found_principal;
+}
+/*
* Checks whether key is allowed in authorized_keys-format file,
* returns 1 if the key is allowed or 0 otherwise.
*/
@@ -365,8 +772,9 @@
continue;
if (!key_is_cert_authority)
continue;
- fp = key_fingerprint(found, SSH_FP_MD5,
- SSH_FP_HEX);
+ if ((fp = sshkey_fingerprint(found,
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+ continue;
debug("matching CA found: file %s, line %lu, %s %s",
file, linenum, key_type(found), fp);
/*
@@ -393,8 +801,9 @@
free(fp);
continue;
}
- verbose("Accepted certificate ID \"%s\" "
+ verbose("Accepted certificate ID \"%s\" (serial %llu) "
"signed by %s CA %s via %s", key->cert->key_id,
+ (unsigned long long)key->cert->serial,
key_type(found), fp, file);
free(fp);
found_key = 1;
@@ -405,11 +814,13 @@
continue;
if (key_is_cert_authority)
continue;
- found_key = 1;
- fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
+ if ((fp = sshkey_fingerprint(found,
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+ continue;
debug("matching key found: file %s, line %lu %s %s",
file, linenum, key_type(found), fp);
free(fp);
+ found_key = 1;
break;
}
}
@@ -426,16 +837,17 @@
{
char *ca_fp, *principals_file = NULL;
const char *reason;
- int ret = 0;
+ int ret = 0, found_principal = 0, use_authorized_principals;
if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
return 0;
- ca_fp = key_fingerprint(key->cert->signature_key,
- SSH_FP_MD5, SSH_FP_HEX);
+ if ((ca_fp = sshkey_fingerprint(key->cert->signature_key,
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+ return 0;
- if (key_in_file(key->cert->signature_key,
- options.trusted_user_ca_keys, 1) != 1) {
+ if (sshkey_in_file(key->cert->signature_key,
+ options.trusted_user_ca_keys, 1, 0) != 0) {
debug2("%s: CA %s %s is not listed in %s", __func__,
key_type(key->cert->signature_key), ca_fp,
options.trusted_user_ca_keys);
@@ -447,23 +859,32 @@
* against the username.
*/
if ((principals_file = authorized_principals_file(pw)) != NULL) {
- if (!match_principals_file(principals_file, pw, key->cert)) {
- reason = "Certificate does not contain an "
- "authorized principal";
+ if (match_principals_file(principals_file, pw, key->cert))
+ found_principal = 1;
+ }
+ /* Try querying command if specified */
+ if (!found_principal && match_principals_command(pw, key->cert))
+ found_principal = 1;
+ /* If principals file or command is specified, then require a match */
+ use_authorized_principals = principals_file != NULL ||
+ options.authorized_principals_command != NULL;
+ if (!found_principal && use_authorized_principals) {
+ reason = "Certificate does not contain an authorized principal";
fail_reason:
- error("%s", reason);
- auth_debug_add("%s", reason);
- goto out;
- }
+ error("%s", reason);
+ auth_debug_add("%s", reason);
+ goto out;
}
if (key_cert_check_authority(key, 0, 1,
- principals_file == NULL ? pw->pw_name : NULL, &reason) != 0)
+ use_authorized_principals ? NULL : pw->pw_name, &reason) != 0)
goto fail_reason;
if (auth_cert_options(key, pw) != 0)
goto out;
- verbose("Accepted certificate ID \"%s\" signed by %s CA %s via %s",
- key->cert->key_id, key_type(key->cert->signature_key), ca_fp,
+ verbose("Accepted certificate ID \"%s\" (serial %llu) signed by "
+ "%s CA %s via %s", key->cert->key_id,
+ (unsigned long long)key->cert->serial,
+ key_type(key->cert->signature_key), ca_fp,
options.trusted_user_ca_keys);
ret = 1;
@@ -503,23 +924,29 @@
static int
user_key_command_allowed2(struct passwd *user_pw, Key *key)
{
- FILE *f;
- int ok, found_key = 0;
+ FILE *f = NULL;
+ int r, ok, found_key = 0;
struct passwd *pw;
- struct stat st;
- int status, devnull, p[2], i;
+ int i, uid_swapped = 0, ac = 0;
pid_t pid;
- char *username, errmsg[512];
+ char *username = NULL, *key_fp = NULL, *keytext = NULL;
+ char *tmp, *command = NULL, **av = NULL;
+ void (*osigchld)(int);
- if (options.authorized_keys_command == NULL ||
- options.authorized_keys_command[0] != '/')
+ if (options.authorized_keys_command == NULL)
return 0;
-
if (options.authorized_keys_command_user == NULL) {
error("No user for AuthorizedKeysCommand specified, skipping");
return 0;
}
+ /*
+ * NB. all returns later this function should go via "out" to
+ * ensure the original SIGCHLD handler is restored properly.
+ */
+ osigchld = signal(SIGCHLD, SIG_DFL);
+
+ /* Prepare and verify the user for the command */
username = percent_expand(options.authorized_keys_command_user,
"u", user_pw->pw_name, (char *)NULL);
pw = getpwnam(username);
@@ -526,121 +953,88 @@
if (pw == NULL) {
error("AuthorizedKeysCommandUser \"%s\" not found: %s",
username, strerror(errno));
- free(username);
- return 0;
+ goto out;
}
- free(username);
- temporarily_use_uid(pw);
-
- if (stat(options.authorized_keys_command, &st) < 0) {
- error("Could not stat AuthorizedKeysCommand \"%s\": %s",
- options.authorized_keys_command, strerror(errno));
+ /* Prepare AuthorizedKeysCommand */
+ if ((key_fp = sshkey_fingerprint(key, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL) {
+ error("%s: sshkey_fingerprint failed", __func__);
goto out;
}
- if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0,
- errmsg, sizeof(errmsg)) != 0) {
- error("Unsafe AuthorizedKeysCommand: %s", errmsg);
+ if ((r = sshkey_to_base64(key, &keytext)) != 0) {
+ error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r));
goto out;
}
- if (pipe(p) != 0) {
- error("%s: pipe: %s", __func__, strerror(errno));
+ /* Turn the command into an argument vector */
+ if (split_argv(options.authorized_keys_command, &ac, &av) != 0) {
+ error("AuthorizedKeysCommand \"%s\" contains invalid quotes",
+ command);
goto out;
}
+ if (ac == 0) {
+ error("AuthorizedKeysCommand \"%s\" yielded no arguments",
+ command);
+ goto out;
+ }
+ for (i = 1; i < ac; i++) {
+ tmp = percent_expand(av[i],
+ "u", user_pw->pw_name,
+ "h", user_pw->pw_dir,
+ "t", sshkey_ssh_name(key),
+ "f", key_fp,
+ "k", keytext,
+ (char *)NULL);
+ if (tmp == NULL)
+ fatal("%s: percent_expand failed", __func__);
+ free(av[i]);
+ av[i] = tmp;
+ }
+ /* Prepare a printable command for logs, etc. */
+ command = assemble_argv(ac, av);
- debug3("Running AuthorizedKeysCommand: \"%s %s\" as \"%s\"",
- options.authorized_keys_command, user_pw->pw_name, pw->pw_name);
-
/*
- * Don't want to call this in the child, where it can fatal() and
- * run cleanup_exit() code.
+ * If AuthorizedKeysCommand was run without arguments
+ * then fall back to the old behaviour of passing the
+ * target username as a single argument.
*/
- restore_uid();
+ if (ac == 1) {
+ av = xreallocarray(av, ac + 2, sizeof(*av));
+ av[1] = xstrdup(user_pw->pw_name);
+ av[2] = NULL;
+ /* Fix up command too, since it is used in log messages */
+ free(command);
+ xasprintf(&command, "%s %s", av[0], av[1]);
+ }
- switch ((pid = fork())) {
- case -1: /* error */
- error("%s: fork: %s", __func__, strerror(errno));
- close(p[0]);
- close(p[1]);
- return 0;
- case 0: /* child */
- for (i = 0; i < NSIG; i++)
- signal(i, SIG_DFL);
+ if ((pid = subprocess("AuthorizedKeysCommand", pw, command,
+ ac, av, &f)) == 0)
+ goto out;
- if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
- error("%s: open %s: %s", __func__, _PATH_DEVNULL,
- strerror(errno));
- _exit(1);
- }
- /* Keep stderr around a while longer to catch errors */
- if (dup2(devnull, STDIN_FILENO) == -1 ||
- dup2(p[1], STDOUT_FILENO) == -1) {
- error("%s: dup2: %s", __func__, strerror(errno));
- _exit(1);
- }
- closefrom(STDERR_FILENO + 1);
-
- /* Don't use permanently_set_uid() here to avoid fatal() */
- if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
- error("setresgid %u: %s", (u_int)pw->pw_gid,
- strerror(errno));
- _exit(1);
- }
- if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) {
- error("setresuid %u: %s", (u_int)pw->pw_uid,
- strerror(errno));
- _exit(1);
- }
- /* stdin is pointed to /dev/null at this point */
- if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) {
- error("%s: dup2: %s", __func__, strerror(errno));
- _exit(1);
- }
-
- execl(options.authorized_keys_command,
- options.authorized_keys_command, user_pw->pw_name, NULL);
-
- error("AuthorizedKeysCommand %s exec failed: %s",
- options.authorized_keys_command, strerror(errno));
- _exit(127);
- default: /* parent */
- break;
- }
-
+ uid_swapped = 1;
temporarily_use_uid(pw);
- close(p[1]);
- if ((f = fdopen(p[0], "r")) == NULL) {
- error("%s: fdopen: %s", __func__, strerror(errno));
- close(p[0]);
- /* Don't leave zombie child */
- kill(pid, SIGTERM);
- while (waitpid(pid, NULL, 0) == -1 && errno == EINTR)
- ;
- goto out;
- }
ok = check_authkeys_file(f, options.authorized_keys_command, key, pw);
- fclose(f);
- while (waitpid(pid, &status, 0) == -1) {
- if (errno != EINTR) {
- error("%s: waitpid: %s", __func__, strerror(errno));
- goto out;
- }
- }
- if (WIFSIGNALED(status)) {
- error("AuthorizedKeysCommand %s exited on signal %d",
- options.authorized_keys_command, WTERMSIG(status));
+ if (exited_cleanly(pid, "AuthorizedKeysCommand", command) != 0)
goto out;
- } else if (WEXITSTATUS(status) != 0) {
- error("AuthorizedKeysCommand %s returned status %d",
- options.authorized_keys_command, WEXITSTATUS(status));
- goto out;
- }
+
+ /* Read completed successfully */
found_key = ok;
out:
- restore_uid();
+ if (f != NULL)
+ fclose(f);
+ signal(SIGCHLD, osigchld);
+ for (i = 0; i < ac; i++)
+ free(av[i]);
+ free(av);
+ if (uid_swapped)
+ restore_uid();
+ free(command);
+ free(username);
+ free(key_fp);
+ free(keytext);
return found_key;
}
@@ -648,7 +1042,7 @@
* Check whether key authenticates and authorises the user.
*/
int
-user_key_allowed(struct passwd *pw, Key *key)
+user_key_allowed(struct passwd *pw, Key *key, int auth_attempt)
{
u_int success, i;
char *file;
@@ -680,6 +1074,35 @@
return success;
}
+/* Records a public key in the list of previously-successful keys */
+void
+auth2_record_userkey(Authctxt *authctxt, struct sshkey *key)
+{
+ struct sshkey **tmp;
+
+ if (authctxt->nprev_userkeys >= INT_MAX ||
+ (tmp = reallocarray(authctxt->prev_userkeys,
+ authctxt->nprev_userkeys + 1, sizeof(*tmp))) == NULL)
+ fatal("%s: reallocarray failed", __func__);
+ authctxt->prev_userkeys = tmp;
+ authctxt->prev_userkeys[authctxt->nprev_userkeys] = key;
+ authctxt->nprev_userkeys++;
+}
+
+/* Checks whether a key has already been used successfully for authentication */
+int
+auth2_userkey_already_used(Authctxt *authctxt, struct sshkey *key)
+{
+ u_int i;
+
+ for (i = 0; i < authctxt->nprev_userkeys; i++) {
+ if (sshkey_equal_public(key, authctxt->prev_userkeys[i])) {
+ return 1;
+ }
+ }
+ return 0;
+}
+
Authmethod method_pubkey = {
"publickey",
userauth_pubkey,
Modified: trunk/crypto/openssh/auth2.c
===================================================================
--- trunk/crypto/openssh/auth2.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/auth2.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2.c,v 1.130 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: auth2.c,v 1.136 2016/05/02 08:49:03 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -41,6 +41,7 @@
#include "packet.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
#include "compat.h"
#include "key.h"
@@ -86,8 +87,8 @@
/* protocol */
-static void input_service_request(int, u_int32_t, void *);
-static void input_userauth_request(int, u_int32_t, void *);
+static int input_service_request(int, u_int32_t, void *);
+static int input_userauth_request(int, u_int32_t, void *);
/* helper */
static Authmethod *authmethod_lookup(Authctxt *, const char *);
@@ -150,9 +151,7 @@
{
char *banner = NULL;
- if (options.banner == NULL ||
- strcasecmp(options.banner, "none") == 0 ||
- (datafellows & SSH_BUG_BANNER) != 0)
+ if (options.banner == NULL || (datafellows & SSH_BUG_BANNER) != 0)
return;
if ((banner = PRIVSEP(auth2_read_banner())) == NULL)
@@ -175,7 +174,7 @@
}
/*ARGSUSED*/
-static void
+static int
input_service_request(int type, u_int32_t seq, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -206,10 +205,11 @@
packet_disconnect("bad service request %s", service);
}
free(service);
+ return 0;
}
/*ARGSUSED*/
-static void
+static int
input_userauth_request(int type, u_int32_t seq, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -285,6 +285,7 @@
free(service);
free(user);
free(method);
+ return 0;
}
void
@@ -355,7 +356,7 @@
} else {
/* Allow initial try of "none" auth without failure penalty */
- if (!authctxt->server_caused_failure &&
+ if (!partial && !authctxt->server_caused_failure &&
(authctxt->attempt > 1 || strcmp(method, "none") != 0))
authctxt->failures++;
if (authctxt->failures >= options.max_authtries) {
@@ -362,7 +363,7 @@
#ifdef SSH_AUDIT_EVENTS
PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES));
#endif
- packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
+ auth_maxtries_exceeded(authctxt);
}
methods = authmethods_get(authctxt);
debug3("%s: failure partial=%d next methods=\"%s\"", __func__,
@@ -423,8 +424,8 @@
buffer_append(&b, authmethods[i]->name,
strlen(authmethods[i]->name));
}
- buffer_append(&b, "\0", 1);
- list = xstrdup(buffer_ptr(&b));
+ if ((list = sshbuf_dup_string(&b)) == NULL)
+ fatal("%s: sshbuf_dup_string failed", __func__);
buffer_free(&b);
return list;
}
Modified: trunk/crypto/openssh/authfd.c
===================================================================
--- trunk/crypto/openssh/authfd.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/authfd.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfd.c,v 1.92 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: authfd.c,v 1.100 2015/12/04 16:41:28 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -41,9 +41,6 @@
#include <sys/un.h>
#include <sys/socket.h>
-#include <openssl/evp.h>
-#include <openssl/crypto.h>
-
#include <fcntl.h>
#include <stdlib.h>
#include <signal.h>
@@ -50,124 +47,121 @@
#include <stdarg.h>
#include <string.h>
#include <unistd.h>
+#include <errno.h>
#include "xmalloc.h"
#include "ssh.h"
#include "rsa.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshbuf.h"
+#include "sshkey.h"
#include "authfd.h"
#include "cipher.h"
-#include "kex.h"
#include "compat.h"
#include "log.h"
#include "atomicio.h"
#include "misc.h"
+#include "ssherr.h"
-static int agent_present = 0;
+#define MAX_AGENT_IDENTITIES 2048 /* Max keys in agent reply */
+#define MAX_AGENT_REPLY_LEN (256 * 1024) /* Max bytes in agent reply */
-/* helper */
-int decode_reply(int type);
-
/* macro to check for "agent failure" message */
#define agent_failed(x) \
- ((x == SSH_AGENT_FAILURE) || (x == SSH_COM_AGENT2_FAILURE) || \
+ ((x == SSH_AGENT_FAILURE) || \
+ (x == SSH_COM_AGENT2_FAILURE) || \
(x == SSH2_AGENT_FAILURE))
-int
-ssh_agent_present(void)
+/* Convert success/failure response from agent to a err.h status */
+static int
+decode_reply(u_char type)
{
- int authfd;
-
- if (agent_present)
- return 1;
- if ((authfd = ssh_get_authentication_socket()) == -1)
+ if (agent_failed(type))
+ return SSH_ERR_AGENT_FAILURE;
+ else if (type == SSH_AGENT_SUCCESS)
return 0;
- else {
- ssh_close_authentication_socket(authfd);
- return 1;
- }
+ else
+ return SSH_ERR_INVALID_FORMAT;
}
/* Returns the number of the authentication fd, or -1 if there is none. */
-
int
-ssh_get_authentication_socket(void)
+ssh_get_authentication_socket(int *fdp)
{
const char *authsocket;
- int sock;
+ int sock, oerrno;
struct sockaddr_un sunaddr;
+ if (fdp != NULL)
+ *fdp = -1;
+
authsocket = getenv(SSH_AUTHSOCKET_ENV_NAME);
if (!authsocket)
- return -1;
+ return SSH_ERR_AGENT_NOT_PRESENT;
memset(&sunaddr, 0, sizeof(sunaddr));
sunaddr.sun_family = AF_UNIX;
strlcpy(sunaddr.sun_path, authsocket, sizeof(sunaddr.sun_path));
- sock = socket(AF_UNIX, SOCK_STREAM, 0);
- if (sock < 0)
- return -1;
+ if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
+ return SSH_ERR_SYSTEM_ERROR;
/* close on exec */
- if (fcntl(sock, F_SETFD, FD_CLOEXEC) == -1) {
+ if (fcntl(sock, F_SETFD, FD_CLOEXEC) == -1 ||
+ connect(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) {
+ oerrno = errno;
close(sock);
- return -1;
+ errno = oerrno;
+ return SSH_ERR_SYSTEM_ERROR;
}
- if (connect(sock, (struct sockaddr *)&sunaddr, sizeof sunaddr) < 0) {
+ if (fdp != NULL)
+ *fdp = sock;
+ else
close(sock);
- return -1;
- }
- agent_present = 1;
- return sock;
+ return 0;
}
+/* Communicate with agent: send request and read reply */
static int
-ssh_request_reply(AuthenticationConnection *auth, Buffer *request, Buffer *reply)
+ssh_request_reply(int sock, struct sshbuf *request, struct sshbuf *reply)
{
- u_int l, len;
+ int r;
+ size_t l, len;
char buf[1024];
/* Get the length of the message, and format it in the buffer. */
- len = buffer_len(request);
+ len = sshbuf_len(request);
put_u32(buf, len);
/* Send the length and then the packet to the agent. */
- if (atomicio(vwrite, auth->fd, buf, 4) != 4 ||
- atomicio(vwrite, auth->fd, buffer_ptr(request),
- buffer_len(request)) != buffer_len(request)) {
- error("Error writing to authentication socket.");
- return 0;
- }
+ if (atomicio(vwrite, sock, buf, 4) != 4 ||
+ atomicio(vwrite, sock, (u_char *)sshbuf_ptr(request),
+ sshbuf_len(request)) != sshbuf_len(request))
+ return SSH_ERR_AGENT_COMMUNICATION;
/*
* Wait for response from the agent. First read the length of the
* response packet.
*/
- if (atomicio(read, auth->fd, buf, 4) != 4) {
- error("Error reading response length from authentication socket.");
- return 0;
- }
+ if (atomicio(read, sock, buf, 4) != 4)
+ return SSH_ERR_AGENT_COMMUNICATION;
/* Extract the length, and check it for sanity. */
len = get_u32(buf);
- if (len > 256 * 1024)
- fatal("Authentication response too long: %u", len);
+ if (len > MAX_AGENT_REPLY_LEN)
+ return SSH_ERR_INVALID_FORMAT;
/* Read the rest of the response in to the buffer. */
- buffer_clear(reply);
+ sshbuf_reset(reply);
while (len > 0) {
l = len;
if (l > sizeof(buf))
l = sizeof(buf);
- if (atomicio(read, auth->fd, buf, l) != l) {
- error("Error reading response from authentication socket.");
- return 0;
- }
- buffer_append(reply, buf, l);
+ if (atomicio(read, sock, buf, l) != l)
+ return SSH_ERR_AGENT_COMMUNICATION;
+ if ((r = sshbuf_put(reply, buf, l)) != 0)
+ return r;
len -= l;
}
- return 1;
+ return 0;
}
/*
@@ -175,7 +169,6 @@
* obtained). The argument must have been returned by
* ssh_get_authentication_socket().
*/
-
void
ssh_close_authentication_socket(int sock)
{
@@ -183,80 +176,103 @@
close(sock);
}
-/*
- * Opens and connects a private socket for communication with the
- * authentication agent. Returns the file descriptor (which must be
- * shut down and closed by the caller when no longer needed).
- * Returns NULL if an error occurred and the connection could not be
- * opened.
- */
-
-AuthenticationConnection *
-ssh_get_authentication_connection(void)
+/* Lock/unlock agent */
+int
+ssh_lock_agent(int sock, int lock, const char *password)
{
- AuthenticationConnection *auth;
- int sock;
+ int r;
+ u_char type = lock ? SSH_AGENTC_LOCK : SSH_AGENTC_UNLOCK;
+ struct sshbuf *msg;
- sock = ssh_get_authentication_socket();
-
- /*
- * Fail if we couldn't obtain a connection. This happens if we
- * exited due to a timeout.
- */
- if (sock < 0)
- return NULL;
-
- auth = xcalloc(1, sizeof(*auth));
- auth->fd = sock;
- buffer_init(&auth->identities);
- auth->howmany = 0;
-
- return auth;
+ if ((msg = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_u8(msg, type)) != 0 ||
+ (r = sshbuf_put_cstring(msg, password)) != 0)
+ goto out;
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
+ goto out;
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ goto out;
+ r = decode_reply(type);
+ out:
+ sshbuf_free(msg);
+ return r;
}
-/*
- * Closes the connection to the authentication agent and frees any associated
- * memory.
- */
+#ifdef WITH_SSH1
+static int
+deserialise_identity1(struct sshbuf *ids, struct sshkey **keyp, char **commentp)
+{
+ struct sshkey *key;
+ int r, keybits;
+ u_int32_t bits;
+ char *comment = NULL;
-void
-ssh_close_authentication_connection(AuthenticationConnection *auth)
-{
- buffer_free(&auth->identities);
- close(auth->fd);
- free(auth);
+ if ((key = sshkey_new(KEY_RSA1)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_get_u32(ids, &bits)) != 0 ||
+ (r = sshbuf_get_bignum1(ids, key->rsa->e)) != 0 ||
+ (r = sshbuf_get_bignum1(ids, key->rsa->n)) != 0 ||
+ (r = sshbuf_get_cstring(ids, &comment, NULL)) != 0)
+ goto out;
+ keybits = BN_num_bits(key->rsa->n);
+ /* XXX previously we just warned here. I think we should be strict */
+ if (keybits < 0 || bits != (u_int)keybits) {
+ r = SSH_ERR_KEY_BITS_MISMATCH;
+ goto out;
+ }
+ if (keyp != NULL) {
+ *keyp = key;
+ key = NULL;
+ }
+ if (commentp != NULL) {
+ *commentp = comment;
+ comment = NULL;
+ }
+ r = 0;
+ out:
+ sshkey_free(key);
+ free(comment);
+ return r;
}
+#endif
-/* Lock/unlock agent */
-int
-ssh_lock_agent(AuthenticationConnection *auth, int lock, const char *password)
+static int
+deserialise_identity2(struct sshbuf *ids, struct sshkey **keyp, char **commentp)
{
- int type;
- Buffer msg;
+ int r;
+ char *comment = NULL;
+ const u_char *blob;
+ size_t blen;
- buffer_init(&msg);
- buffer_put_char(&msg, lock ? SSH_AGENTC_LOCK : SSH_AGENTC_UNLOCK);
- buffer_put_cstring(&msg, password);
-
- if (ssh_request_reply(auth, &msg, &msg) == 0) {
- buffer_free(&msg);
- return 0;
+ if ((r = sshbuf_get_string_direct(ids, &blob, &blen)) != 0 ||
+ (r = sshbuf_get_cstring(ids, &comment, NULL)) != 0)
+ goto out;
+ if ((r = sshkey_from_blob(blob, blen, keyp)) != 0)
+ goto out;
+ if (commentp != NULL) {
+ *commentp = comment;
+ comment = NULL;
}
- type = buffer_get_char(&msg);
- buffer_free(&msg);
- return decode_reply(type);
+ r = 0;
+ out:
+ free(comment);
+ return r;
}
/*
- * Returns the first authentication identity held by the agent.
+ * Fetch list of identities held by the agent.
*/
-
int
-ssh_get_num_identities(AuthenticationConnection *auth, int version)
+ssh_fetch_identitylist(int sock, int version, struct ssh_identitylist **idlp)
{
- int type, code1 = 0, code2 = 0;
- Buffer request;
+ u_char type, code1 = 0, code2 = 0;
+ u_int32_t num, i;
+ struct sshbuf *msg;
+ struct ssh_identitylist *idl = NULL;
+ int r;
+ /* Determine request and expected response types */
switch (version) {
case 1:
code1 = SSH_AGENTC_REQUEST_RSA_IDENTITIES;
@@ -267,7 +283,7 @@
code2 = SSH2_AGENT_IDENTITIES_ANSWER;
break;
default:
- return 0;
+ return SSH_ERR_INVALID_ARGUMENT;
}
/*
@@ -274,313 +290,382 @@
* Send a message to the agent requesting for a list of the
* identities it can represent.
*/
- buffer_init(&request);
- buffer_put_char(&request, code1);
+ if ((msg = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_u8(msg, code1)) != 0)
+ goto out;
- buffer_clear(&auth->identities);
- if (ssh_request_reply(auth, &request, &auth->identities) == 0) {
- buffer_free(&request);
- return 0;
- }
- buffer_free(&request);
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
+ goto out;
/* Get message type, and verify that we got a proper answer. */
- type = buffer_get_char(&auth->identities);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ goto out;
if (agent_failed(type)) {
- return 0;
+ r = SSH_ERR_AGENT_FAILURE;
+ goto out;
} else if (type != code2) {
- fatal("Bad authentication reply message type: %d", type);
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
/* Get the number of entries in the response and check it for sanity. */
- auth->howmany = buffer_get_int(&auth->identities);
- if ((u_int)auth->howmany > 1024)
- fatal("Too many identities in authentication reply: %d",
- auth->howmany);
+ if ((r = sshbuf_get_u32(msg, &num)) != 0)
+ goto out;
+ if (num > MAX_AGENT_IDENTITIES) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if (num == 0) {
+ r = SSH_ERR_AGENT_NO_IDENTITIES;
+ goto out;
+ }
- return auth->howmany;
+ /* Deserialise the response into a list of keys/comments */
+ if ((idl = calloc(1, sizeof(*idl))) == NULL ||
+ (idl->keys = calloc(num, sizeof(*idl->keys))) == NULL ||
+ (idl->comments = calloc(num, sizeof(*idl->comments))) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ for (i = 0; i < num;) {
+ switch (version) {
+ case 1:
+#ifdef WITH_SSH1
+ if ((r = deserialise_identity1(msg,
+ &(idl->keys[i]), &(idl->comments[i]))) != 0)
+ goto out;
+#endif
+ break;
+ case 2:
+ if ((r = deserialise_identity2(msg,
+ &(idl->keys[i]), &(idl->comments[i]))) != 0) {
+ if (r == SSH_ERR_KEY_TYPE_UNKNOWN) {
+ /* Gracefully skip unknown key types */
+ num--;
+ continue;
+ } else
+ goto out;
+ }
+ break;
+ }
+ i++;
+ }
+ idl->nkeys = num;
+ *idlp = idl;
+ idl = NULL;
+ r = 0;
+ out:
+ sshbuf_free(msg);
+ if (idl != NULL)
+ ssh_free_identitylist(idl);
+ return r;
}
-Key *
-ssh_get_first_identity(AuthenticationConnection *auth, char **comment, int version)
+void
+ssh_free_identitylist(struct ssh_identitylist *idl)
{
- /* get number of identities and return the first entry (if any). */
- if (ssh_get_num_identities(auth, version) > 0)
- return ssh_get_next_identity(auth, comment, version);
- return NULL;
-}
+ size_t i;
-Key *
-ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int version)
-{
- int keybits;
- u_int bits;
- u_char *blob;
- u_int blen;
- Key *key = NULL;
-
- /* Return failure if no more entries. */
- if (auth->howmany <= 0)
- return NULL;
-
- /*
- * Get the next entry from the packet. These will abort with a fatal
- * error if the packet is too short or contains corrupt data.
- */
- switch (version) {
- case 1:
- key = key_new(KEY_RSA1);
- bits = buffer_get_int(&auth->identities);
- buffer_get_bignum(&auth->identities, key->rsa->e);
- buffer_get_bignum(&auth->identities, key->rsa->n);
- *comment = buffer_get_string(&auth->identities, NULL);
- keybits = BN_num_bits(key->rsa->n);
- if (keybits < 0 || bits != (u_int)keybits)
- logit("Warning: identity keysize mismatch: actual %d, announced %u",
- BN_num_bits(key->rsa->n), bits);
- break;
- case 2:
- blob = buffer_get_string(&auth->identities, &blen);
- *comment = buffer_get_string(&auth->identities, NULL);
- key = key_from_blob(blob, blen);
- free(blob);
- break;
- default:
- return NULL;
+ if (idl == NULL)
+ return;
+ for (i = 0; i < idl->nkeys; i++) {
+ if (idl->keys != NULL)
+ sshkey_free(idl->keys[i]);
+ if (idl->comments != NULL)
+ free(idl->comments[i]);
}
- /* Decrement the number of remaining entries. */
- auth->howmany--;
- return key;
+ free(idl);
}
/*
- * Generates a random challenge, sends it to the agent, and waits for
- * response from the agent. Returns true (non-zero) if the agent gave the
- * correct answer, zero otherwise. Response type selects the style of
- * response desired, with 0 corresponding to protocol version 1.0 (no longer
- * supported) and 1 corresponding to protocol version 1.1.
+ * Sends a challenge (typically from a server via ssh(1)) to the agent,
+ * and waits for a response from the agent.
+ * Returns true (non-zero) if the agent gave the correct answer, zero
+ * otherwise.
*/
+#ifdef WITH_SSH1
int
-ssh_decrypt_challenge(AuthenticationConnection *auth,
- Key* key, BIGNUM *challenge,
- u_char session_id[16],
- u_int response_type,
- u_char response[16])
+ssh_decrypt_challenge(int sock, struct sshkey* key, BIGNUM *challenge,
+ u_char session_id[16], u_char response[16])
{
- Buffer buffer;
- int success = 0;
- int i;
- int type;
+ struct sshbuf *msg;
+ int r;
+ u_char type;
if (key->type != KEY_RSA1)
- return 0;
- if (response_type == 0) {
- logit("Compatibility with ssh protocol version 1.0 no longer supported.");
- return 0;
- }
- buffer_init(&buffer);
- buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE);
- buffer_put_int(&buffer, BN_num_bits(key->rsa->n));
- buffer_put_bignum(&buffer, key->rsa->e);
- buffer_put_bignum(&buffer, key->rsa->n);
- buffer_put_bignum(&buffer, challenge);
- buffer_append(&buffer, session_id, 16);
- buffer_put_int(&buffer, response_type);
-
- if (ssh_request_reply(auth, &buffer, &buffer) == 0) {
- buffer_free(&buffer);
- return 0;
- }
- type = buffer_get_char(&buffer);
-
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((msg = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_u8(msg, SSH_AGENTC_RSA_CHALLENGE)) != 0 ||
+ (r = sshbuf_put_u32(msg, BN_num_bits(key->rsa->n))) != 0 ||
+ (r = sshbuf_put_bignum1(msg, key->rsa->e)) != 0 ||
+ (r = sshbuf_put_bignum1(msg, key->rsa->n)) != 0 ||
+ (r = sshbuf_put_bignum1(msg, challenge)) != 0 ||
+ (r = sshbuf_put(msg, session_id, 16)) != 0 ||
+ (r = sshbuf_put_u32(msg, 1)) != 0) /* Response type for proto 1.1 */
+ goto out;
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
+ goto out;
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ goto out;
if (agent_failed(type)) {
- logit("Agent admitted failure to authenticate using the key.");
+ r = SSH_ERR_AGENT_FAILURE;
+ goto out;
} else if (type != SSH_AGENT_RSA_RESPONSE) {
- fatal("Bad authentication response: %d", type);
- } else {
- success = 1;
- /*
- * Get the response from the packet. This will abort with a
- * fatal error if the packet is corrupt.
- */
- for (i = 0; i < 16; i++)
- response[i] = (u_char)buffer_get_char(&buffer);
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
- buffer_free(&buffer);
- return success;
+ if ((r = sshbuf_get(msg, response, 16)) != 0)
+ goto out;
+ r = 0;
+ out:
+ sshbuf_free(msg);
+ return r;
}
+#endif
-/* ask agent to sign data, returns -1 on error, 0 on success */
+/* encode signature algoritm in flag bits, so we can keep the msg format */
+static u_int
+agent_encode_alg(struct sshkey *key, const char *alg)
+{
+ if (alg != NULL && key->type == KEY_RSA) {
+ if (strcmp(alg, "rsa-sha2-256") == 0)
+ return SSH_AGENT_RSA_SHA2_256;
+ else if (strcmp(alg, "rsa-sha2-512") == 0)
+ return SSH_AGENT_RSA_SHA2_512;
+ }
+ return 0;
+}
+
+/* ask agent to sign data, returns err.h code on error, 0 on success */
int
-ssh_agent_sign(AuthenticationConnection *auth,
- Key *key,
- u_char **sigp, u_int *lenp,
- u_char *data, u_int datalen)
+ssh_agent_sign(int sock, struct sshkey *key,
+ u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, const char *alg, u_int compat)
{
- extern int datafellows;
- Buffer msg;
- u_char *blob;
- u_int blen;
- int type, flags = 0;
- int ret = -1;
+ struct sshbuf *msg;
+ u_char *blob = NULL, type;
+ size_t blen = 0, len = 0;
+ u_int flags = 0;
+ int r = SSH_ERR_INTERNAL_ERROR;
- if (key_to_blob(key, &blob, &blen) == 0)
- return -1;
+ *sigp = NULL;
+ *lenp = 0;
- if (datafellows & SSH_BUG_SIGBLOB)
- flags = SSH_AGENT_OLD_SIGNATURE;
-
- buffer_init(&msg);
- buffer_put_char(&msg, SSH2_AGENTC_SIGN_REQUEST);
- buffer_put_string(&msg, blob, blen);
- buffer_put_string(&msg, data, datalen);
- buffer_put_int(&msg, flags);
- free(blob);
-
- if (ssh_request_reply(auth, &msg, &msg) == 0) {
- buffer_free(&msg);
- return -1;
- }
- type = buffer_get_char(&msg);
+ if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (compat & SSH_BUG_SIGBLOB)
+ flags |= SSH_AGENT_OLD_SIGNATURE;
+ if ((msg = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshkey_to_blob(key, &blob, &blen)) != 0)
+ goto out;
+ flags |= agent_encode_alg(key, alg);
+ if ((r = sshbuf_put_u8(msg, SSH2_AGENTC_SIGN_REQUEST)) != 0 ||
+ (r = sshbuf_put_string(msg, blob, blen)) != 0 ||
+ (r = sshbuf_put_string(msg, data, datalen)) != 0 ||
+ (r = sshbuf_put_u32(msg, flags)) != 0)
+ goto out;
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
+ goto out;
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ goto out;
if (agent_failed(type)) {
- logit("Agent admitted failure to sign using the key.");
+ r = SSH_ERR_AGENT_FAILURE;
+ goto out;
} else if (type != SSH2_AGENT_SIGN_RESPONSE) {
- fatal("Bad authentication response: %d", type);
- } else {
- ret = 0;
- *sigp = buffer_get_string(&msg, lenp);
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
- buffer_free(&msg);
- return ret;
+ if ((r = sshbuf_get_string(msg, sigp, &len)) != 0)
+ goto out;
+ *lenp = len;
+ r = 0;
+ out:
+ if (blob != NULL) {
+ explicit_bzero(blob, blen);
+ free(blob);
+ }
+ sshbuf_free(msg);
+ return r;
}
/* Encode key for a message to the agent. */
-static void
-ssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment)
+#ifdef WITH_SSH1
+static int
+ssh_encode_identity_rsa1(struct sshbuf *b, RSA *key, const char *comment)
{
- buffer_put_int(b, BN_num_bits(key->n));
- buffer_put_bignum(b, key->n);
- buffer_put_bignum(b, key->e);
- buffer_put_bignum(b, key->d);
+ int r;
+
/* To keep within the protocol: p < q for ssh. in SSL p > q */
- buffer_put_bignum(b, key->iqmp); /* ssh key->u */
- buffer_put_bignum(b, key->q); /* ssh key->p, SSL key->q */
- buffer_put_bignum(b, key->p); /* ssh key->q, SSL key->p */
- buffer_put_cstring(b, comment);
+ if ((r = sshbuf_put_u32(b, BN_num_bits(key->n))) != 0 ||
+ (r = sshbuf_put_bignum1(b, key->n)) != 0 ||
+ (r = sshbuf_put_bignum1(b, key->e)) != 0 ||
+ (r = sshbuf_put_bignum1(b, key->d)) != 0 ||
+ (r = sshbuf_put_bignum1(b, key->iqmp)) != 0 ||
+ (r = sshbuf_put_bignum1(b, key->q)) != 0 ||
+ (r = sshbuf_put_bignum1(b, key->p)) != 0 ||
+ (r = sshbuf_put_cstring(b, comment)) != 0)
+ return r;
+ return 0;
}
+#endif
-static void
-ssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment)
+static int
+ssh_encode_identity_ssh2(struct sshbuf *b, struct sshkey *key,
+ const char *comment)
{
- key_private_serialize(key, b);
- buffer_put_cstring(b, comment);
+ int r;
+
+ if ((r = sshkey_private_serialize(key, b)) != 0 ||
+ (r = sshbuf_put_cstring(b, comment)) != 0)
+ return r;
+ return 0;
}
+static int
+encode_constraints(struct sshbuf *m, u_int life, u_int confirm)
+{
+ int r;
+
+ if (life != 0) {
+ if ((r = sshbuf_put_u8(m, SSH_AGENT_CONSTRAIN_LIFETIME)) != 0 ||
+ (r = sshbuf_put_u32(m, life)) != 0)
+ goto out;
+ }
+ if (confirm != 0) {
+ if ((r = sshbuf_put_u8(m, SSH_AGENT_CONSTRAIN_CONFIRM)) != 0)
+ goto out;
+ }
+ r = 0;
+ out:
+ return r;
+}
+
/*
- * Adds an identity to the authentication server. This call is not meant to
- * be used by normal applications.
+ * Adds an identity to the authentication server.
+ * This call is intended only for use by ssh-add(1) and like applications.
*/
-
int
-ssh_add_identity_constrained(AuthenticationConnection *auth, Key *key,
- const char *comment, u_int life, u_int confirm)
+ssh_add_identity_constrained(int sock, struct sshkey *key, const char *comment,
+ u_int life, u_int confirm)
{
- Buffer msg;
- int type, constrained = (life || confirm);
+ struct sshbuf *msg;
+ int r, constrained = (life || confirm);
+ u_char type;
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
switch (key->type) {
+#ifdef WITH_SSH1
case KEY_RSA1:
type = constrained ?
SSH_AGENTC_ADD_RSA_ID_CONSTRAINED :
SSH_AGENTC_ADD_RSA_IDENTITY;
- buffer_put_char(&msg, type);
- ssh_encode_identity_rsa1(&msg, key->rsa, comment);
+ if ((r = sshbuf_put_u8(msg, type)) != 0 ||
+ (r = ssh_encode_identity_rsa1(msg, key->rsa, comment)) != 0)
+ goto out;
break;
+#endif
+#ifdef WITH_OPENSSL
case KEY_RSA:
case KEY_RSA_CERT:
- case KEY_RSA_CERT_V00:
case KEY_DSA:
case KEY_DSA_CERT:
- case KEY_DSA_CERT_V00:
case KEY_ECDSA:
case KEY_ECDSA_CERT:
+#endif
case KEY_ED25519:
case KEY_ED25519_CERT:
type = constrained ?
SSH2_AGENTC_ADD_ID_CONSTRAINED :
SSH2_AGENTC_ADD_IDENTITY;
- buffer_put_char(&msg, type);
- ssh_encode_identity_ssh2(&msg, key, comment);
+ if ((r = sshbuf_put_u8(msg, type)) != 0 ||
+ (r = ssh_encode_identity_ssh2(msg, key, comment)) != 0)
+ goto out;
break;
default:
- buffer_free(&msg);
- return 0;
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
}
- if (constrained) {
- if (life != 0) {
- buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_LIFETIME);
- buffer_put_int(&msg, life);
- }
- if (confirm != 0)
- buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_CONFIRM);
- }
- if (ssh_request_reply(auth, &msg, &msg) == 0) {
- buffer_free(&msg);
- return 0;
- }
- type = buffer_get_char(&msg);
- buffer_free(&msg);
- return decode_reply(type);
+ if (constrained &&
+ (r = encode_constraints(msg, life, confirm)) != 0)
+ goto out;
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
+ goto out;
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ goto out;
+ r = decode_reply(type);
+ out:
+ sshbuf_free(msg);
+ return r;
}
/*
- * Removes an identity from the authentication server. This call is not
- * meant to be used by normal applications.
+ * Removes an identity from the authentication server.
+ * This call is intended only for use by ssh-add(1) and like applications.
*/
-
int
-ssh_remove_identity(AuthenticationConnection *auth, Key *key)
+ssh_remove_identity(int sock, struct sshkey *key)
{
- Buffer msg;
- int type;
- u_char *blob;
- u_int blen;
+ struct sshbuf *msg;
+ int r;
+ u_char type, *blob = NULL;
+ size_t blen;
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+#ifdef WITH_SSH1
if (key->type == KEY_RSA1) {
- buffer_put_char(&msg, SSH_AGENTC_REMOVE_RSA_IDENTITY);
- buffer_put_int(&msg, BN_num_bits(key->rsa->n));
- buffer_put_bignum(&msg, key->rsa->e);
- buffer_put_bignum(&msg, key->rsa->n);
- } else if (key->type != KEY_UNSPEC) {
- key_to_blob(key, &blob, &blen);
- buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY);
- buffer_put_string(&msg, blob, blen);
- free(blob);
+ if ((r = sshbuf_put_u8(msg,
+ SSH_AGENTC_REMOVE_RSA_IDENTITY)) != 0 ||
+ (r = sshbuf_put_u32(msg, BN_num_bits(key->rsa->n))) != 0 ||
+ (r = sshbuf_put_bignum1(msg, key->rsa->e)) != 0 ||
+ (r = sshbuf_put_bignum1(msg, key->rsa->n)) != 0)
+ goto out;
+ } else
+#endif
+ if (key->type != KEY_UNSPEC) {
+ if ((r = sshkey_to_blob(key, &blob, &blen)) != 0)
+ goto out;
+ if ((r = sshbuf_put_u8(msg,
+ SSH2_AGENTC_REMOVE_IDENTITY)) != 0 ||
+ (r = sshbuf_put_string(msg, blob, blen)) != 0)
+ goto out;
} else {
- buffer_free(&msg);
- return 0;
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
}
- if (ssh_request_reply(auth, &msg, &msg) == 0) {
- buffer_free(&msg);
- return 0;
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
+ goto out;
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ goto out;
+ r = decode_reply(type);
+ out:
+ if (blob != NULL) {
+ explicit_bzero(blob, blen);
+ free(blob);
}
- type = buffer_get_char(&msg);
- buffer_free(&msg);
- return decode_reply(type);
+ sshbuf_free(msg);
+ return r;
}
+/*
+ * Add/remove an token-based identity from the authentication server.
+ * This call is intended only for use by ssh-add(1) and like applications.
+ */
int
-ssh_update_card(AuthenticationConnection *auth, int add,
- const char *reader_id, const char *pin, u_int life, u_int confirm)
+ssh_update_card(int sock, int add, const char *reader_id, const char *pin,
+ u_int life, u_int confirm)
{
- Buffer msg;
- int type, constrained = (life || confirm);
+ struct sshbuf *msg;
+ int r, constrained = (life || confirm);
+ u_char type;
if (add) {
type = constrained ?
@@ -589,69 +674,48 @@
} else
type = SSH_AGENTC_REMOVE_SMARTCARD_KEY;
- buffer_init(&msg);
- buffer_put_char(&msg, type);
- buffer_put_cstring(&msg, reader_id);
- buffer_put_cstring(&msg, pin);
-
- if (constrained) {
- if (life != 0) {
- buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_LIFETIME);
- buffer_put_int(&msg, life);
- }
- if (confirm != 0)
- buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_CONFIRM);
- }
-
- if (ssh_request_reply(auth, &msg, &msg) == 0) {
- buffer_free(&msg);
- return 0;
- }
- type = buffer_get_char(&msg);
- buffer_free(&msg);
- return decode_reply(type);
+ if ((msg = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_u8(msg, type)) != 0 ||
+ (r = sshbuf_put_cstring(msg, reader_id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, pin)) != 0)
+ goto out;
+ if (constrained &&
+ (r = encode_constraints(msg, life, confirm)) != 0)
+ goto out;
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
+ goto out;
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ goto out;
+ r = decode_reply(type);
+ out:
+ sshbuf_free(msg);
+ return r;
}
/*
- * Removes all identities from the agent. This call is not meant to be used
- * by normal applications.
+ * Removes all identities from the agent.
+ * This call is intended only for use by ssh-add(1) and like applications.
*/
-
int
-ssh_remove_all_identities(AuthenticationConnection *auth, int version)
+ssh_remove_all_identities(int sock, int version)
{
- Buffer msg;
- int type;
- int code = (version==1) ?
- SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES :
- SSH2_AGENTC_REMOVE_ALL_IDENTITIES;
+ struct sshbuf *msg;
+ u_char type = (version == 1) ?
+ SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES :
+ SSH2_AGENTC_REMOVE_ALL_IDENTITIES;
+ int r;
- buffer_init(&msg);
- buffer_put_char(&msg, code);
-
- if (ssh_request_reply(auth, &msg, &msg) == 0) {
- buffer_free(&msg);
- return 0;
- }
- type = buffer_get_char(&msg);
- buffer_free(&msg);
- return decode_reply(type);
+ if ((msg = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_u8(msg, type)) != 0)
+ goto out;
+ if ((r = ssh_request_reply(sock, msg, msg)) != 0)
+ goto out;
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ goto out;
+ r = decode_reply(type);
+ out:
+ sshbuf_free(msg);
+ return r;
}
-
-int
-decode_reply(int type)
-{
- switch (type) {
- case SSH_AGENT_FAILURE:
- case SSH_COM_AGENT2_FAILURE:
- case SSH2_AGENT_FAILURE:
- logit("SSH_AGENT_FAILURE");
- return 0;
- case SSH_AGENT_SUCCESS:
- return 1;
- default:
- fatal("Bad response from authentication agent: %d", type);
- }
- /* NOTREACHED */
- return 0;
-}
Modified: trunk/crypto/openssh/authfd.h
===================================================================
--- trunk/crypto/openssh/authfd.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/authfd.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfd.h,v 1.37 2009/08/27 17:44:52 djm Exp $ */
+/* $OpenBSD: authfd.h,v 1.39 2015/12/04 16:41:28 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -16,6 +16,33 @@
#ifndef AUTHFD_H
#define AUTHFD_H
+/* List of identities returned by ssh_fetch_identitylist() */
+struct ssh_identitylist {
+ size_t nkeys;
+ struct sshkey **keys;
+ char **comments;
+};
+
+int ssh_get_authentication_socket(int *fdp);
+void ssh_close_authentication_socket(int sock);
+
+int ssh_lock_agent(int sock, int lock, const char *password);
+int ssh_fetch_identitylist(int sock, int version,
+ struct ssh_identitylist **idlp);
+void ssh_free_identitylist(struct ssh_identitylist *idl);
+int ssh_add_identity_constrained(int sock, struct sshkey *key,
+ const char *comment, u_int life, u_int confirm);
+int ssh_remove_identity(int sock, struct sshkey *key);
+int ssh_update_card(int sock, int add, const char *reader_id,
+ const char *pin, u_int life, u_int confirm);
+int ssh_remove_all_identities(int sock, int version);
+
+int ssh_decrypt_challenge(int sock, struct sshkey* key, BIGNUM *challenge,
+ u_char session_id[16], u_char response[16]);
+int ssh_agent_sign(int sock, struct sshkey *key,
+ u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, const char *alg, u_int compat);
+
/* Messages for the authentication agent connection. */
#define SSH_AGENTC_REQUEST_RSA_IDENTITIES 1
#define SSH_AGENT_RSA_IDENTITIES_ANSWER 2
@@ -59,36 +86,7 @@
#define SSH_COM_AGENT2_FAILURE 102
#define SSH_AGENT_OLD_SIGNATURE 0x01
+#define SSH_AGENT_RSA_SHA2_256 0x02
+#define SSH_AGENT_RSA_SHA2_512 0x04
-typedef struct {
- int fd;
- Buffer identities;
- int howmany;
-} AuthenticationConnection;
-
-int ssh_agent_present(void);
-int ssh_get_authentication_socket(void);
-void ssh_close_authentication_socket(int);
-
-AuthenticationConnection *ssh_get_authentication_connection(void);
-void ssh_close_authentication_connection(AuthenticationConnection *);
-int ssh_get_num_identities(AuthenticationConnection *, int);
-Key *ssh_get_first_identity(AuthenticationConnection *, char **, int);
-Key *ssh_get_next_identity(AuthenticationConnection *, char **, int);
-int ssh_add_identity_constrained(AuthenticationConnection *, Key *,
- const char *, u_int, u_int);
-int ssh_remove_identity(AuthenticationConnection *, Key *);
-int ssh_remove_all_identities(AuthenticationConnection *, int);
-int ssh_lock_agent(AuthenticationConnection *, int, const char *);
-int ssh_update_card(AuthenticationConnection *, int, const char *,
- const char *, u_int, u_int);
-
-int
-ssh_decrypt_challenge(AuthenticationConnection *, Key *, BIGNUM *, u_char[16],
- u_int, u_char[16]);
-
-int
-ssh_agent_sign(AuthenticationConnection *, Key *, u_char **, u_int *, u_char *,
- u_int);
-
#endif /* AUTHFD_H */
Modified: trunk/crypto/openssh/authfile.c
===================================================================
--- trunk/crypto/openssh/authfile.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/authfile.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,18 +1,5 @@
-/* $OpenBSD: authfile.c,v 1.103 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: authfile.c,v 1.121 2016/04/09 12:39:30 djm Exp $ */
/*
- * Author: Tatu Ylonen <ylo at cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
- * All rights reserved
- * This file contains functions for reading and writing identity files, and
- * for reading the passphrase from the user.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose. Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
* Copyright (c) 2000, 2013 Markus Friedl. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -40,34 +27,18 @@
#include <sys/types.h>
#include <sys/stat.h>
-#include <sys/param.h>
#include <sys/uio.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/pem.h>
-
-/* compatibility with old or broken OpenSSL versions */
-#include "openbsd-compat/openssl-compat.h"
-
-#include "crypto_api.h"
-
#include <errno.h>
#include <fcntl.h>
+#include <stdio.h>
#include <stdarg.h>
-#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
-#ifdef HAVE_UTIL_H
-#include <util.h>
-#endif
-
-#include "xmalloc.h"
#include "cipher.h"
-#include "buffer.h"
-#include "key.h"
#include "ssh.h"
#include "log.h"
#include "authfile.h"
@@ -74,903 +45,134 @@
#include "rsa.h"
#include "misc.h"
#include "atomicio.h"
-#include "uuencode.h"
+#include "sshkey.h"
+#include "sshbuf.h"
+#include "ssherr.h"
+#include "krl.h"
-/* openssh private key file format */
-#define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n"
-#define MARK_END "-----END OPENSSH PRIVATE KEY-----\n"
-#define KDFNAME "bcrypt"
-#define AUTH_MAGIC "openssh-key-v1"
-#define SALT_LEN 16
-#define DEFAULT_CIPHERNAME "aes256-cbc"
-#define DEFAULT_ROUNDS 16
-
#define MAX_KEY_FILE_SIZE (1024 * 1024)
-/* Version identification string for SSH v1 identity files. */
-static const char authfile_id_string[] =
- "SSH PRIVATE KEY FILE FORMAT 1.1\n";
-
-static int
-key_private_to_blob2(Key *prv, Buffer *blob, const char *passphrase,
- const char *comment, const char *ciphername, int rounds)
-{
- u_char *key, *cp, salt[SALT_LEN];
- size_t keylen, ivlen, blocksize, authlen;
- u_int len, check;
- int i, n;
- const Cipher *c;
- Buffer encoded, b, kdf;
- CipherContext ctx;
- const char *kdfname = KDFNAME;
-
- if (rounds <= 0)
- rounds = DEFAULT_ROUNDS;
- if (passphrase == NULL || !strlen(passphrase)) {
- ciphername = "none";
- kdfname = "none";
- } else if (ciphername == NULL)
- ciphername = DEFAULT_CIPHERNAME;
- else if (cipher_number(ciphername) != SSH_CIPHER_SSH2)
- fatal("invalid cipher");
-
- if ((c = cipher_by_name(ciphername)) == NULL)
- fatal("unknown cipher name");
- buffer_init(&kdf);
- blocksize = cipher_blocksize(c);
- keylen = cipher_keylen(c);
- ivlen = cipher_ivlen(c);
- authlen = cipher_authlen(c);
- key = xcalloc(1, keylen + ivlen);
- if (strcmp(kdfname, "none") != 0) {
- arc4random_buf(salt, SALT_LEN);
- if (bcrypt_pbkdf(passphrase, strlen(passphrase),
- salt, SALT_LEN, key, keylen + ivlen, rounds) < 0)
- fatal("bcrypt_pbkdf failed");
- buffer_put_string(&kdf, salt, SALT_LEN);
- buffer_put_int(&kdf, rounds);
- }
- cipher_init(&ctx, c, key, keylen, key + keylen , ivlen, 1);
- explicit_bzero(key, keylen + ivlen);
- free(key);
-
- buffer_init(&encoded);
- buffer_append(&encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC));
- buffer_put_cstring(&encoded, ciphername);
- buffer_put_cstring(&encoded, kdfname);
- buffer_put_string(&encoded, buffer_ptr(&kdf), buffer_len(&kdf));
- buffer_put_int(&encoded, 1); /* number of keys */
- key_to_blob(prv, &cp, &len); /* public key */
- buffer_put_string(&encoded, cp, len);
-
- explicit_bzero(cp, len);
- free(cp);
-
- buffer_free(&kdf);
-
- /* set up the buffer that will be encrypted */
- buffer_init(&b);
-
- /* Random check bytes */
- check = arc4random();
- buffer_put_int(&b, check);
- buffer_put_int(&b, check);
-
- /* append private key and comment*/
- key_private_serialize(prv, &b);
- buffer_put_cstring(&b, comment);
-
- /* padding */
- i = 0;
- while (buffer_len(&b) % blocksize)
- buffer_put_char(&b, ++i & 0xff);
-
- /* length */
- buffer_put_int(&encoded, buffer_len(&b));
-
- /* encrypt */
- cp = buffer_append_space(&encoded, buffer_len(&b) + authlen);
- if (cipher_crypt(&ctx, 0, cp, buffer_ptr(&b), buffer_len(&b), 0,
- authlen) != 0)
- fatal("%s: cipher_crypt failed", __func__);
- buffer_free(&b);
- cipher_cleanup(&ctx);
-
- /* uuencode */
- len = 2 * buffer_len(&encoded);
- cp = xmalloc(len);
- n = uuencode(buffer_ptr(&encoded), buffer_len(&encoded),
- (char *)cp, len);
- if (n < 0)
- fatal("%s: uuencode", __func__);
-
- buffer_clear(blob);
- buffer_append(blob, MARK_BEGIN, sizeof(MARK_BEGIN) - 1);
- for (i = 0; i < n; i++) {
- buffer_put_char(blob, cp[i]);
- if (i % 70 == 69)
- buffer_put_char(blob, '\n');
- }
- if (i % 70 != 69)
- buffer_put_char(blob, '\n');
- buffer_append(blob, MARK_END, sizeof(MARK_END) - 1);
- free(cp);
-
- return buffer_len(blob);
-}
-
-static Key *
-key_parse_private2(Buffer *blob, int type, const char *passphrase,
- char **commentp)
-{
- u_char *key = NULL, *cp, *salt = NULL, pad, last;
- char *comment = NULL, *ciphername = NULL, *kdfname = NULL, *kdfp;
- u_int keylen = 0, ivlen, blocksize, slen, klen, len, rounds, nkeys;
- u_int check1, check2, m1len, m2len;
- size_t authlen;
- const Cipher *c;
- Buffer b, encoded, copy, kdf;
- CipherContext ctx;
- Key *k = NULL;
- int dlen, ret, i;
-
- buffer_init(&b);
- buffer_init(&kdf);
- buffer_init(&encoded);
- buffer_init(©);
-
- /* uudecode */
- m1len = sizeof(MARK_BEGIN) - 1;
- m2len = sizeof(MARK_END) - 1;
- cp = buffer_ptr(blob);
- len = buffer_len(blob);
- if (len < m1len || memcmp(cp, MARK_BEGIN, m1len)) {
- debug("%s: missing begin marker", __func__);
- goto out;
- }
- cp += m1len;
- len -= m1len;
- while (len) {
- if (*cp != '\n' && *cp != '\r')
- buffer_put_char(&encoded, *cp);
- last = *cp;
- len--;
- cp++;
- if (last == '\n') {
- if (len >= m2len && !memcmp(cp, MARK_END, m2len)) {
- buffer_put_char(&encoded, '\0');
- break;
- }
- }
- }
- if (!len) {
- debug("%s: no end marker", __func__);
- goto out;
- }
- len = buffer_len(&encoded);
- if ((cp = buffer_append_space(©, len)) == NULL) {
- error("%s: buffer_append_space", __func__);
- goto out;
- }
- if ((dlen = uudecode(buffer_ptr(&encoded), cp, len)) < 0) {
- error("%s: uudecode failed", __func__);
- goto out;
- }
- if ((u_int)dlen > len) {
- error("%s: crazy uudecode length %d > %u", __func__, dlen, len);
- goto out;
- }
- buffer_consume_end(©, len - dlen);
- if (buffer_len(©) < sizeof(AUTH_MAGIC) ||
- memcmp(buffer_ptr(©), AUTH_MAGIC, sizeof(AUTH_MAGIC))) {
- error("%s: bad magic", __func__);
- goto out;
- }
- buffer_consume(©, sizeof(AUTH_MAGIC));
-
- ciphername = buffer_get_cstring_ret(©, NULL);
- if (ciphername == NULL ||
- (c = cipher_by_name(ciphername)) == NULL) {
- error("%s: unknown cipher name", __func__);
- goto out;
- }
- if ((passphrase == NULL || !strlen(passphrase)) &&
- strcmp(ciphername, "none") != 0) {
- /* passphrase required */
- goto out;
- }
- kdfname = buffer_get_cstring_ret(©, NULL);
- if (kdfname == NULL ||
- (!strcmp(kdfname, "none") && !strcmp(kdfname, "bcrypt"))) {
- error("%s: unknown kdf name", __func__);
- goto out;
- }
- if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) {
- error("%s: cipher %s requires kdf", __func__, ciphername);
- goto out;
- }
- /* kdf options */
- kdfp = buffer_get_string_ptr_ret(©, &klen);
- if (kdfp == NULL) {
- error("%s: kdf options not set", __func__);
- goto out;
- }
- if (klen > 0) {
- if ((cp = buffer_append_space(&kdf, klen)) == NULL) {
- error("%s: kdf alloc failed", __func__);
- goto out;
- }
- memcpy(cp, kdfp, klen);
- }
- /* number of keys */
- if (buffer_get_int_ret(&nkeys, ©) < 0) {
- error("%s: key counter missing", __func__);
- goto out;
- }
- if (nkeys != 1) {
- error("%s: only one key supported", __func__);
- goto out;
- }
- /* pubkey */
- if ((cp = buffer_get_string_ret(©, &len)) == NULL) {
- error("%s: pubkey not found", __func__);
- goto out;
- }
- free(cp); /* XXX check pubkey against decrypted private key */
-
- /* size of encrypted key blob */
- len = buffer_get_int(©);
- blocksize = cipher_blocksize(c);
- authlen = cipher_authlen(c);
- if (len < blocksize) {
- error("%s: encrypted data too small", __func__);
- goto out;
- }
- if (len % blocksize) {
- error("%s: length not multiple of blocksize", __func__);
- goto out;
- }
-
- /* setup key */
- keylen = cipher_keylen(c);
- ivlen = cipher_ivlen(c);
- key = xcalloc(1, keylen + ivlen);
- if (!strcmp(kdfname, "bcrypt")) {
- if ((salt = buffer_get_string_ret(&kdf, &slen)) == NULL) {
- error("%s: salt not set", __func__);
- goto out;
- }
- if (buffer_get_int_ret(&rounds, &kdf) < 0) {
- error("%s: rounds not set", __func__);
- goto out;
- }
- if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen,
- key, keylen + ivlen, rounds) < 0) {
- error("%s: bcrypt_pbkdf failed", __func__);
- goto out;
- }
- }
-
- cp = buffer_append_space(&b, len);
- cipher_init(&ctx, c, key, keylen, key + keylen, ivlen, 0);
- ret = cipher_crypt(&ctx, 0, cp, buffer_ptr(©), len, 0, authlen);
- cipher_cleanup(&ctx);
- buffer_consume(©, len);
-
- /* fail silently on decryption errors */
- if (ret != 0) {
- debug("%s: decrypt failed", __func__);
- goto out;
- }
-
- if (buffer_len(©) != 0) {
- error("%s: key blob has trailing data (len = %u)", __func__,
- buffer_len(©));
- goto out;
- }
-
- /* check bytes */
- if (buffer_get_int_ret(&check1, &b) < 0 ||
- buffer_get_int_ret(&check2, &b) < 0) {
- error("check bytes missing");
- goto out;
- }
- if (check1 != check2) {
- debug("%s: decrypt failed: 0x%08x != 0x%08x", __func__,
- check1, check2);
- goto out;
- }
-
- k = key_private_deserialize(&b);
-
- /* comment */
- comment = buffer_get_cstring_ret(&b, NULL);
-
- i = 0;
- while (buffer_len(&b)) {
- if (buffer_get_char_ret(&pad, &b) == -1 ||
- pad != (++i & 0xff)) {
- error("%s: bad padding", __func__);
- key_free(k);
- k = NULL;
- goto out;
- }
- }
-
- if (k && commentp) {
- *commentp = comment;
- comment = NULL;
- }
-
- /* XXX decode pubkey and check against private */
- out:
- free(ciphername);
- free(kdfname);
- free(salt);
- free(comment);
- if (key)
- explicit_bzero(key, keylen + ivlen);
- free(key);
- buffer_free(&encoded);
- buffer_free(©);
- buffer_free(&kdf);
- buffer_free(&b);
- return k;
-}
-
-/*
- * Serialises the authentication (private) key to a blob, encrypting it with
- * passphrase. The identification of the blob (lowest 64 bits of n) will
- * precede the key to provide identification of the key without needing a
- * passphrase.
- */
-static int
-key_private_rsa1_to_blob(Key *key, Buffer *blob, const char *passphrase,
- const char *comment)
-{
- Buffer buffer, encrypted;
- u_char buf[100], *cp;
- int i, cipher_num;
- CipherContext ciphercontext;
- const Cipher *cipher;
- u_int32_t rnd;
-
- /*
- * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting
- * to another cipher; otherwise use SSH_AUTHFILE_CIPHER.
- */
- cipher_num = (strcmp(passphrase, "") == 0) ?
- SSH_CIPHER_NONE : SSH_AUTHFILE_CIPHER;
- if ((cipher = cipher_by_number(cipher_num)) == NULL)
- fatal("save_private_key_rsa: bad cipher");
-
- /* This buffer is used to built the secret part of the private key. */
- buffer_init(&buffer);
-
- /* Put checkbytes for checking passphrase validity. */
- rnd = arc4random();
- buf[0] = rnd & 0xff;
- buf[1] = (rnd >> 8) & 0xff;
- buf[2] = buf[0];
- buf[3] = buf[1];
- buffer_append(&buffer, buf, 4);
-
- /*
- * Store the private key (n and e will not be stored because they
- * will be stored in plain text, and storing them also in encrypted
- * format would just give known plaintext).
- */
- buffer_put_bignum(&buffer, key->rsa->d);
- buffer_put_bignum(&buffer, key->rsa->iqmp);
- buffer_put_bignum(&buffer, key->rsa->q); /* reverse from SSL p */
- buffer_put_bignum(&buffer, key->rsa->p); /* reverse from SSL q */
-
- /* Pad the part to be encrypted until its size is a multiple of 8. */
- while (buffer_len(&buffer) % 8 != 0)
- buffer_put_char(&buffer, 0);
-
- /* This buffer will be used to contain the data in the file. */
- buffer_init(&encrypted);
-
- /* First store keyfile id string. */
- for (i = 0; authfile_id_string[i]; i++)
- buffer_put_char(&encrypted, authfile_id_string[i]);
- buffer_put_char(&encrypted, 0);
-
- /* Store cipher type. */
- buffer_put_char(&encrypted, cipher_num);
- buffer_put_int(&encrypted, 0); /* For future extension */
-
- /* Store public key. This will be in plain text. */
- buffer_put_int(&encrypted, BN_num_bits(key->rsa->n));
- buffer_put_bignum(&encrypted, key->rsa->n);
- buffer_put_bignum(&encrypted, key->rsa->e);
- buffer_put_cstring(&encrypted, comment);
-
- /* Allocate space for the private part of the key in the buffer. */
- cp = buffer_append_space(&encrypted, buffer_len(&buffer));
-
- cipher_set_key_string(&ciphercontext, cipher, passphrase,
- CIPHER_ENCRYPT);
- if (cipher_crypt(&ciphercontext, 0, cp,
- buffer_ptr(&buffer), buffer_len(&buffer), 0, 0) != 0)
- fatal("%s: cipher_crypt failed", __func__);
- cipher_cleanup(&ciphercontext);
- explicit_bzero(&ciphercontext, sizeof(ciphercontext));
-
- /* Destroy temporary data. */
- explicit_bzero(buf, sizeof(buf));
- buffer_free(&buffer);
-
- buffer_append(blob, buffer_ptr(&encrypted), buffer_len(&encrypted));
- buffer_free(&encrypted);
-
- return 1;
-}
-
-/* convert SSH v2 key in OpenSSL PEM format */
-static int
-key_private_pem_to_blob(Key *key, Buffer *blob, const char *_passphrase,
- const char *comment)
-{
- int success = 0;
- int blen, len = strlen(_passphrase);
- u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL;
-#if (OPENSSL_VERSION_NUMBER < 0x00907000L)
- const EVP_CIPHER *cipher = (len > 0) ? EVP_des_ede3_cbc() : NULL;
-#else
- const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL;
-#endif
- const u_char *bptr;
- BIO *bio;
-
- if (len > 0 && len <= 4) {
- error("passphrase too short: have %d bytes, need > 4", len);
- return 0;
- }
- if ((bio = BIO_new(BIO_s_mem())) == NULL) {
- error("%s: BIO_new failed", __func__);
- return 0;
- }
- switch (key->type) {
- case KEY_DSA:
- success = PEM_write_bio_DSAPrivateKey(bio, key->dsa,
- cipher, passphrase, len, NULL, NULL);
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa,
- cipher, passphrase, len, NULL, NULL);
- break;
-#endif
- case KEY_RSA:
- success = PEM_write_bio_RSAPrivateKey(bio, key->rsa,
- cipher, passphrase, len, NULL, NULL);
- break;
- }
- if (success) {
- if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0)
- success = 0;
- else
- buffer_append(blob, bptr, blen);
- }
- BIO_free(bio);
- return success;
-}
-
/* Save a key blob to a file */
static int
-key_save_private_blob(Buffer *keybuf, const char *filename)
+sshkey_save_private_blob(struct sshbuf *keybuf, const char *filename)
{
- int fd;
+ int fd, oerrno;
- if ((fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600)) < 0) {
- error("open %s failed: %s.", filename, strerror(errno));
- return 0;
- }
- if (atomicio(vwrite, fd, buffer_ptr(keybuf),
- buffer_len(keybuf)) != buffer_len(keybuf)) {
- error("write to key file %s failed: %s", filename,
- strerror(errno));
+ if ((fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600)) < 0)
+ return SSH_ERR_SYSTEM_ERROR;
+ if (atomicio(vwrite, fd, (u_char *)sshbuf_ptr(keybuf),
+ sshbuf_len(keybuf)) != sshbuf_len(keybuf)) {
+ oerrno = errno;
close(fd);
unlink(filename);
- return 0;
+ errno = oerrno;
+ return SSH_ERR_SYSTEM_ERROR;
}
close(fd);
- return 1;
+ return 0;
}
-/* Serialise "key" to buffer "blob" */
-static int
-key_private_to_blob(Key *key, Buffer *blob, const char *passphrase,
- const char *comment, int force_new_format, const char *new_format_cipher,
- int new_format_rounds)
-{
- switch (key->type) {
- case KEY_RSA1:
- return key_private_rsa1_to_blob(key, blob, passphrase, comment);
- case KEY_DSA:
- case KEY_ECDSA:
- case KEY_RSA:
- if (force_new_format) {
- return key_private_to_blob2(key, blob, passphrase,
- comment, new_format_cipher, new_format_rounds);
- }
- return key_private_pem_to_blob(key, blob, passphrase, comment);
- case KEY_ED25519:
- return key_private_to_blob2(key, blob, passphrase,
- comment, new_format_cipher, new_format_rounds);
- default:
- error("%s: cannot save key type %d", __func__, key->type);
- return 0;
- }
-}
-
int
-key_save_private(Key *key, const char *filename, const char *passphrase,
- const char *comment, int force_new_format, const char *new_format_cipher,
- int new_format_rounds)
+sshkey_save_private(struct sshkey *key, const char *filename,
+ const char *passphrase, const char *comment,
+ int force_new_format, const char *new_format_cipher, int new_format_rounds)
{
- Buffer keyblob;
- int success = 0;
+ struct sshbuf *keyblob = NULL;
+ int r;
- buffer_init(&keyblob);
- if (!key_private_to_blob(key, &keyblob, passphrase, comment,
- force_new_format, new_format_cipher, new_format_rounds))
+ if ((keyblob = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshkey_private_to_fileblob(key, keyblob, passphrase, comment,
+ force_new_format, new_format_cipher, new_format_rounds)) != 0)
goto out;
- if (!key_save_private_blob(&keyblob, filename))
+ if ((r = sshkey_save_private_blob(keyblob, filename)) != 0)
goto out;
- success = 1;
+ r = 0;
out:
- buffer_free(&keyblob);
- return success;
+ sshbuf_free(keyblob);
+ return r;
}
-/*
- * Parse the public, unencrypted portion of a RSA1 key.
- */
-static Key *
-key_parse_public_rsa1(Buffer *blob, char **commentp)
-{
- Key *pub;
- Buffer copy;
-
- /* Check that it is at least big enough to contain the ID string. */
- if (buffer_len(blob) < sizeof(authfile_id_string)) {
- debug3("Truncated RSA1 identifier");
- return NULL;
- }
-
- /*
- * Make sure it begins with the id string. Consume the id string
- * from the buffer.
- */
- if (memcmp(buffer_ptr(blob), authfile_id_string,
- sizeof(authfile_id_string)) != 0) {
- debug3("Incorrect RSA1 identifier");
- return NULL;
- }
- buffer_init(©);
- buffer_append(©, buffer_ptr(blob), buffer_len(blob));
- buffer_consume(©, sizeof(authfile_id_string));
-
- /* Skip cipher type and reserved data. */
- (void) buffer_get_char(©); /* cipher type */
- (void) buffer_get_int(©); /* reserved */
-
- /* Read the public key from the buffer. */
- (void) buffer_get_int(©);
- pub = key_new(KEY_RSA1);
- buffer_get_bignum(©, pub->rsa->n);
- buffer_get_bignum(©, pub->rsa->e);
- if (commentp)
- *commentp = buffer_get_string(©, NULL);
- /* The encrypted private part is not parsed by this function. */
- buffer_free(©);
-
- return pub;
-}
-
/* Load a key from a fd into a buffer */
int
-key_load_file(int fd, const char *filename, Buffer *blob)
+sshkey_load_file(int fd, struct sshbuf *blob)
{
u_char buf[1024];
size_t len;
struct stat st;
+ int r;
- if (fstat(fd, &st) < 0) {
- error("%s: fstat of key file %.200s%sfailed: %.100s", __func__,
- filename == NULL ? "" : filename,
- filename == NULL ? "" : " ",
- strerror(errno));
- return 0;
- }
+ if (fstat(fd, &st) < 0)
+ return SSH_ERR_SYSTEM_ERROR;
if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
- st.st_size > MAX_KEY_FILE_SIZE) {
- toobig:
- error("%s: key file %.200s%stoo large", __func__,
- filename == NULL ? "" : filename,
- filename == NULL ? "" : " ");
- return 0;
- }
- buffer_clear(blob);
+ st.st_size > MAX_KEY_FILE_SIZE)
+ return SSH_ERR_INVALID_FORMAT;
for (;;) {
if ((len = atomicio(read, fd, buf, sizeof(buf))) == 0) {
if (errno == EPIPE)
break;
- debug("%s: read from key file %.200s%sfailed: %.100s",
- __func__, filename == NULL ? "" : filename,
- filename == NULL ? "" : " ", strerror(errno));
- buffer_clear(blob);
- explicit_bzero(buf, sizeof(buf));
- return 0;
+ r = SSH_ERR_SYSTEM_ERROR;
+ goto out;
}
- buffer_append(blob, buf, len);
- if (buffer_len(blob) > MAX_KEY_FILE_SIZE) {
- buffer_clear(blob);
- explicit_bzero(buf, sizeof(buf));
- goto toobig;
+ if ((r = sshbuf_put(blob, buf, len)) != 0)
+ goto out;
+ if (sshbuf_len(blob) > MAX_KEY_FILE_SIZE) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
}
- explicit_bzero(buf, sizeof(buf));
if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
- st.st_size != buffer_len(blob)) {
- debug("%s: key file %.200s%schanged size while reading",
- __func__, filename == NULL ? "" : filename,
- filename == NULL ? "" : " ");
- buffer_clear(blob);
- return 0;
+ st.st_size != (off_t)sshbuf_len(blob)) {
+ r = SSH_ERR_FILE_CHANGED;
+ goto out;
}
+ r = 0;
- return 1;
+ out:
+ explicit_bzero(buf, sizeof(buf));
+ if (r != 0)
+ sshbuf_reset(blob);
+ return r;
}
+#ifdef WITH_SSH1
/*
* Loads the public part of the ssh v1 key file. Returns NULL if an error was
* encountered (the file does not exist or is not readable), and the key
* otherwise.
*/
-static Key *
-key_load_public_rsa1(int fd, const char *filename, char **commentp)
+static int
+sshkey_load_public_rsa1(int fd, struct sshkey **keyp, char **commentp)
{
- Buffer buffer;
- Key *pub;
+ struct sshbuf *b = NULL;
+ int r;
- buffer_init(&buffer);
- if (!key_load_file(fd, filename, &buffer)) {
- buffer_free(&buffer);
- return NULL;
- }
-
- pub = key_parse_public_rsa1(&buffer, commentp);
- if (pub == NULL)
- debug3("Could not load \"%s\" as a RSA1 public key", filename);
- buffer_free(&buffer);
- return pub;
-}
-
-/* load public key from private-key file, works only for SSH v1 */
-Key *
-key_load_public_type(int type, const char *filename, char **commentp)
-{
- Key *pub;
- int fd;
-
- if (type == KEY_RSA1) {
- fd = open(filename, O_RDONLY);
- if (fd < 0)
- return NULL;
- pub = key_load_public_rsa1(fd, filename, commentp);
- close(fd);
- return pub;
- }
- return NULL;
-}
-
-static Key *
-key_parse_private_rsa1(Buffer *blob, const char *passphrase, char **commentp)
-{
- int check1, check2, cipher_type;
- Buffer decrypted;
- u_char *cp;
- CipherContext ciphercontext;
- const Cipher *cipher;
- Key *prv = NULL;
- Buffer copy;
-
- /* Check that it is at least big enough to contain the ID string. */
- if (buffer_len(blob) < sizeof(authfile_id_string)) {
- debug3("Truncated RSA1 identifier");
- return NULL;
- }
-
- /*
- * Make sure it begins with the id string. Consume the id string
- * from the buffer.
- */
- if (memcmp(buffer_ptr(blob), authfile_id_string,
- sizeof(authfile_id_string)) != 0) {
- debug3("Incorrect RSA1 identifier");
- return NULL;
- }
- buffer_init(©);
- buffer_append(©, buffer_ptr(blob), buffer_len(blob));
- buffer_consume(©, sizeof(authfile_id_string));
-
- /* Read cipher type. */
- cipher_type = buffer_get_char(©);
- (void) buffer_get_int(©); /* Reserved data. */
-
- /* Read the public key from the buffer. */
- (void) buffer_get_int(©);
- prv = key_new_private(KEY_RSA1);
-
- buffer_get_bignum(©, prv->rsa->n);
- buffer_get_bignum(©, prv->rsa->e);
- if (commentp)
- *commentp = buffer_get_string(©, NULL);
- else
- (void)buffer_get_string_ptr(©, NULL);
-
- /* Check that it is a supported cipher. */
- cipher = cipher_by_number(cipher_type);
- if (cipher == NULL) {
- debug("Unsupported RSA1 cipher %d", cipher_type);
- buffer_free(©);
- goto fail;
- }
- /* Initialize space for decrypted data. */
- buffer_init(&decrypted);
- cp = buffer_append_space(&decrypted, buffer_len(©));
-
- /* Rest of the buffer is encrypted. Decrypt it using the passphrase. */
- cipher_set_key_string(&ciphercontext, cipher, passphrase,
- CIPHER_DECRYPT);
- if (cipher_crypt(&ciphercontext, 0, cp,
- buffer_ptr(©), buffer_len(©), 0, 0) != 0)
- fatal("%s: cipher_crypt failed", __func__);
- cipher_cleanup(&ciphercontext);
- explicit_bzero(&ciphercontext, sizeof(ciphercontext));
- buffer_free(©);
-
- check1 = buffer_get_char(&decrypted);
- check2 = buffer_get_char(&decrypted);
- if (check1 != buffer_get_char(&decrypted) ||
- check2 != buffer_get_char(&decrypted)) {
- if (strcmp(passphrase, "") != 0)
- debug("Bad passphrase supplied for RSA1 key");
- /* Bad passphrase. */
- buffer_free(&decrypted);
- goto fail;
- }
- /* Read the rest of the private key. */
- buffer_get_bignum(&decrypted, prv->rsa->d);
- buffer_get_bignum(&decrypted, prv->rsa->iqmp); /* u */
- /* in SSL and SSH v1 p and q are exchanged */
- buffer_get_bignum(&decrypted, prv->rsa->q); /* p */
- buffer_get_bignum(&decrypted, prv->rsa->p); /* q */
-
- /* calculate p-1 and q-1 */
- rsa_generate_additional_parameters(prv->rsa);
-
- buffer_free(&decrypted);
-
- /* enable blinding */
- if (RSA_blinding_on(prv->rsa, NULL) != 1) {
- error("%s: RSA_blinding_on failed", __func__);
- goto fail;
- }
- return prv;
-
-fail:
+ if (keyp != NULL)
+ *keyp = NULL;
if (commentp != NULL)
- free(*commentp);
- key_free(prv);
- return NULL;
-}
+ *commentp = NULL;
-static Key *
-key_parse_private_pem(Buffer *blob, int type, const char *passphrase,
- char **commentp)
-{
- EVP_PKEY *pk = NULL;
- Key *prv = NULL;
- char *name = "<no key>";
- BIO *bio;
-
- if ((bio = BIO_new_mem_buf(buffer_ptr(blob),
- buffer_len(blob))) == NULL) {
- error("%s: BIO_new_mem_buf failed", __func__);
- return NULL;
- }
-
- pk = PEM_read_bio_PrivateKey(bio, NULL, NULL, (char *)passphrase);
- BIO_free(bio);
- if (pk == NULL) {
- debug("%s: PEM_read_PrivateKey failed", __func__);
- (void)ERR_get_error();
- } else if (pk->type == EVP_PKEY_RSA &&
- (type == KEY_UNSPEC||type==KEY_RSA)) {
- prv = key_new(KEY_UNSPEC);
- prv->rsa = EVP_PKEY_get1_RSA(pk);
- prv->type = KEY_RSA;
- name = "rsa w/o comment";
-#ifdef DEBUG_PK
- RSA_print_fp(stderr, prv->rsa, 8);
-#endif
- if (RSA_blinding_on(prv->rsa, NULL) != 1) {
- error("%s: RSA_blinding_on failed", __func__);
- key_free(prv);
- prv = NULL;
- }
- } else if (pk->type == EVP_PKEY_DSA &&
- (type == KEY_UNSPEC||type==KEY_DSA)) {
- prv = key_new(KEY_UNSPEC);
- prv->dsa = EVP_PKEY_get1_DSA(pk);
- prv->type = KEY_DSA;
- name = "dsa w/o comment";
-#ifdef DEBUG_PK
- DSA_print_fp(stderr, prv->dsa, 8);
-#endif
-#ifdef OPENSSL_HAS_ECC
- } else if (pk->type == EVP_PKEY_EC &&
- (type == KEY_UNSPEC||type==KEY_ECDSA)) {
- prv = key_new(KEY_UNSPEC);
- prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk);
- prv->type = KEY_ECDSA;
- if ((prv->ecdsa_nid = key_ecdsa_key_to_nid(prv->ecdsa)) == -1 ||
- key_curve_nid_to_name(prv->ecdsa_nid) == NULL ||
- key_ec_validate_public(EC_KEY_get0_group(prv->ecdsa),
- EC_KEY_get0_public_key(prv->ecdsa)) != 0 ||
- key_ec_validate_private(prv->ecdsa) != 0) {
- error("%s: bad ECDSA key", __func__);
- key_free(prv);
- prv = NULL;
- }
- name = "ecdsa w/o comment";
-#ifdef DEBUG_PK
- if (prv != NULL && prv->ecdsa != NULL)
- key_dump_ec_key(prv->ecdsa);
-#endif
-#endif /* OPENSSL_HAS_ECC */
- } else {
- error("%s: PEM_read_PrivateKey: mismatch or "
- "unknown EVP_PKEY save_type %d", __func__, pk->save_type);
- }
- if (pk != NULL)
- EVP_PKEY_free(pk);
- if (prv != NULL && commentp)
- *commentp = xstrdup(name);
- debug("read PEM private key done: type %s",
- prv ? key_type(prv) : "<unknown>");
- return prv;
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshkey_load_file(fd, b)) != 0)
+ goto out;
+ if ((r = sshkey_parse_public_rsa1_fileblob(b, keyp, commentp)) != 0)
+ goto out;
+ r = 0;
+ out:
+ sshbuf_free(b);
+ return r;
}
+#endif /* WITH_SSH1 */
-Key *
-key_load_private_pem(int fd, int type, const char *passphrase,
- char **commentp)
-{
- Buffer buffer;
- Key *prv;
-
- buffer_init(&buffer);
- if (!key_load_file(fd, NULL, &buffer)) {
- buffer_free(&buffer);
- return NULL;
- }
- prv = key_parse_private_pem(&buffer, type, passphrase, commentp);
- buffer_free(&buffer);
- return prv;
-}
-
+/* XXX remove error() calls from here? */
int
-key_perm_ok(int fd, const char *filename)
+sshkey_perm_ok(int fd, const char *filename)
{
struct stat st;
if (fstat(fd, &st) < 0)
- return 0;
+ return SSH_ERR_SYSTEM_ERROR;
/*
* if a key owned by the user is accessed, then we check the
* permissions of the file. if the key owned by a different user,
@@ -987,296 +189,328 @@
(u_int)st.st_mode & 0777, filename);
error("It is required that your private key files are NOT accessible by others.");
error("This private key will be ignored.");
- return 0;
+ return SSH_ERR_KEY_BAD_PERMISSIONS;
}
- return 1;
+ return 0;
}
-static Key *
-key_parse_private_type(Buffer *blob, int type, const char *passphrase,
- char **commentp)
+/* XXX kill perm_ok now that we have SSH_ERR_KEY_BAD_PERMISSIONS? */
+int
+sshkey_load_private_type(int type, const char *filename, const char *passphrase,
+ struct sshkey **keyp, char **commentp, int *perm_ok)
{
- Key *k;
+ int fd, r;
- switch (type) {
- case KEY_RSA1:
- return key_parse_private_rsa1(blob, passphrase, commentp);
- case KEY_DSA:
- case KEY_ECDSA:
- case KEY_RSA:
- return key_parse_private_pem(blob, type, passphrase, commentp);
- case KEY_ED25519:
- return key_parse_private2(blob, type, passphrase, commentp);
- case KEY_UNSPEC:
- if ((k = key_parse_private2(blob, type, passphrase, commentp)))
- return k;
- return key_parse_private_pem(blob, type, passphrase, commentp);
- default:
- error("%s: cannot parse key type %d", __func__, type);
- break;
- }
- return NULL;
-}
+ if (keyp != NULL)
+ *keyp = NULL;
+ if (commentp != NULL)
+ *commentp = NULL;
-Key *
-key_load_private_type(int type, const char *filename, const char *passphrase,
- char **commentp, int *perm_ok)
-{
- int fd;
- Key *ret;
- Buffer buffer;
-
- fd = open(filename, O_RDONLY);
- if (fd < 0) {
- debug("could not open key file '%s': %s", filename,
- strerror(errno));
+ if ((fd = open(filename, O_RDONLY)) < 0) {
if (perm_ok != NULL)
*perm_ok = 0;
- return NULL;
+ return SSH_ERR_SYSTEM_ERROR;
}
- if (!key_perm_ok(fd, filename)) {
+ if (sshkey_perm_ok(fd, filename) != 0) {
if (perm_ok != NULL)
*perm_ok = 0;
- error("bad permissions: ignore key: %s", filename);
- close(fd);
- return NULL;
+ r = SSH_ERR_KEY_BAD_PERMISSIONS;
+ goto out;
}
if (perm_ok != NULL)
*perm_ok = 1;
- buffer_init(&buffer);
- if (!key_load_file(fd, filename, &buffer)) {
- buffer_free(&buffer);
- close(fd);
- return NULL;
- }
+ r = sshkey_load_private_type_fd(fd, type, passphrase, keyp, commentp);
+ out:
close(fd);
- ret = key_parse_private_type(&buffer, type, passphrase, commentp);
- buffer_free(&buffer);
- return ret;
+ return r;
}
-Key *
-key_parse_private(Buffer *buffer, const char *filename,
- const char *passphrase, char **commentp)
+int
+sshkey_load_private_type_fd(int fd, int type, const char *passphrase,
+ struct sshkey **keyp, char **commentp)
{
- Key *pub, *prv;
+ struct sshbuf *buffer = NULL;
+ int r;
- /* it's a SSH v1 key if the public key part is readable */
- pub = key_parse_public_rsa1(buffer, commentp);
- if (pub == NULL) {
- prv = key_parse_private_type(buffer, KEY_UNSPEC,
- passphrase, NULL);
- /* use the filename as a comment for PEM */
- if (commentp && prv)
- *commentp = xstrdup(filename);
- } else {
- key_free(pub);
- /* key_parse_public_rsa1() has already loaded the comment */
- prv = key_parse_private_type(buffer, KEY_RSA1, passphrase,
- NULL);
+ if (keyp != NULL)
+ *keyp = NULL;
+ if ((buffer = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
}
- return prv;
+ if ((r = sshkey_load_file(fd, buffer)) != 0 ||
+ (r = sshkey_parse_private_fileblob_type(buffer, type,
+ passphrase, keyp, commentp)) != 0)
+ goto out;
+
+ /* success */
+ r = 0;
+ out:
+ sshbuf_free(buffer);
+ return r;
}
-Key *
-key_load_private(const char *filename, const char *passphrase,
- char **commentp)
+/* XXX this is almost identical to sshkey_load_private_type() */
+int
+sshkey_load_private(const char *filename, const char *passphrase,
+ struct sshkey **keyp, char **commentp)
{
- Key *prv;
- Buffer buffer;
- int fd;
+ struct sshbuf *buffer = NULL;
+ int r, fd;
- fd = open(filename, O_RDONLY);
- if (fd < 0) {
- debug("could not open key file '%s': %s", filename,
- strerror(errno));
- return NULL;
+ if (keyp != NULL)
+ *keyp = NULL;
+ if (commentp != NULL)
+ *commentp = NULL;
+
+ if ((fd = open(filename, O_RDONLY)) < 0)
+ return SSH_ERR_SYSTEM_ERROR;
+ if (sshkey_perm_ok(fd, filename) != 0) {
+ r = SSH_ERR_KEY_BAD_PERMISSIONS;
+ goto out;
}
- if (!key_perm_ok(fd, filename)) {
- error("bad permissions: ignore key: %s", filename);
- close(fd);
- return NULL;
- }
- buffer_init(&buffer);
- if (!key_load_file(fd, filename, &buffer)) {
- buffer_free(&buffer);
- close(fd);
- return NULL;
+ if ((buffer = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
}
+ if ((r = sshkey_load_file(fd, buffer)) != 0 ||
+ (r = sshkey_parse_private_fileblob(buffer, passphrase, keyp,
+ commentp)) != 0)
+ goto out;
+ r = 0;
+ out:
close(fd);
-
- prv = key_parse_private(&buffer, filename, passphrase, commentp);
- buffer_free(&buffer);
- return prv;
+ sshbuf_free(buffer);
+ return r;
}
static int
-key_try_load_public(Key *k, const char *filename, char **commentp)
+sshkey_try_load_public(struct sshkey *k, const char *filename, char **commentp)
{
FILE *f;
char line[SSH_MAX_PUBKEY_BYTES];
char *cp;
u_long linenum = 0;
+ int r;
- f = fopen(filename, "r");
- if (f != NULL) {
- while (read_keyfile_line(f, filename, line, sizeof(line),
- &linenum) != -1) {
- cp = line;
- switch (*cp) {
- case '#':
- case '\n':
- case '\0':
- continue;
- }
- /* Abort loading if this looks like a private key */
- if (strncmp(cp, "-----BEGIN", 10) == 0)
- break;
- /* Skip leading whitespace. */
- for (; *cp && (*cp == ' ' || *cp == '\t'); cp++)
- ;
- if (*cp) {
- if (key_read(k, &cp) == 1) {
- cp[strcspn(cp, "\r\n")] = '\0';
- if (commentp) {
- *commentp = xstrdup(*cp ?
- cp : filename);
- }
- fclose(f);
- return 1;
+ if (commentp != NULL)
+ *commentp = NULL;
+ if ((f = fopen(filename, "r")) == NULL)
+ return SSH_ERR_SYSTEM_ERROR;
+ while (read_keyfile_line(f, filename, line, sizeof(line),
+ &linenum) != -1) {
+ cp = line;
+ switch (*cp) {
+ case '#':
+ case '\n':
+ case '\0':
+ continue;
+ }
+ /* Abort loading if this looks like a private key */
+ if (strncmp(cp, "-----BEGIN", 10) == 0 ||
+ strcmp(cp, "SSH PRIVATE KEY FILE") == 0)
+ break;
+ /* Skip leading whitespace. */
+ for (; *cp && (*cp == ' ' || *cp == '\t'); cp++)
+ ;
+ if (*cp) {
+ if ((r = sshkey_read(k, &cp)) == 0) {
+ cp[strcspn(cp, "\r\n")] = '\0';
+ if (commentp) {
+ *commentp = strdup(*cp ?
+ cp : filename);
+ if (*commentp == NULL)
+ r = SSH_ERR_ALLOC_FAIL;
}
+ fclose(f);
+ return r;
}
}
- fclose(f);
}
- return 0;
+ fclose(f);
+ return SSH_ERR_INVALID_FORMAT;
}
/* load public key from ssh v1 private or any pubkey file */
-Key *
-key_load_public(const char *filename, char **commentp)
+int
+sshkey_load_public(const char *filename, struct sshkey **keyp, char **commentp)
{
- Key *pub;
- char file[MAXPATHLEN];
+ struct sshkey *pub = NULL;
+ char file[PATH_MAX];
+ int r, fd;
+ if (keyp != NULL)
+ *keyp = NULL;
+ if (commentp != NULL)
+ *commentp = NULL;
+
+ /* XXX should load file once and attempt to parse each format */
+
+ if ((fd = open(filename, O_RDONLY)) < 0)
+ goto skip;
+#ifdef WITH_SSH1
/* try rsa1 private key */
- pub = key_load_public_type(KEY_RSA1, filename, commentp);
- if (pub != NULL)
- return pub;
+ r = sshkey_load_public_rsa1(fd, keyp, commentp);
+ close(fd);
+ switch (r) {
+ case SSH_ERR_INTERNAL_ERROR:
+ case SSH_ERR_ALLOC_FAIL:
+ case SSH_ERR_INVALID_ARGUMENT:
+ case SSH_ERR_SYSTEM_ERROR:
+ case 0:
+ return r;
+ }
+#else /* WITH_SSH1 */
+ close(fd);
+#endif /* WITH_SSH1 */
+ /* try ssh2 public key */
+ if ((pub = sshkey_new(KEY_UNSPEC)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshkey_try_load_public(pub, filename, commentp)) == 0) {
+ if (keyp != NULL)
+ *keyp = pub;
+ return 0;
+ }
+ sshkey_free(pub);
+
+#ifdef WITH_SSH1
/* try rsa1 public key */
- pub = key_new(KEY_RSA1);
- if (key_try_load_public(pub, filename, commentp) == 1)
- return pub;
- key_free(pub);
+ if ((pub = sshkey_new(KEY_RSA1)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshkey_try_load_public(pub, filename, commentp)) == 0) {
+ if (keyp != NULL)
+ *keyp = pub;
+ return 0;
+ }
+ sshkey_free(pub);
+#endif /* WITH_SSH1 */
- /* try ssh2 public key */
- pub = key_new(KEY_UNSPEC);
- if (key_try_load_public(pub, filename, commentp) == 1)
- return pub;
+ skip:
+ /* try .pub suffix */
+ if ((pub = sshkey_new(KEY_UNSPEC)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ r = SSH_ERR_ALLOC_FAIL; /* in case strlcpy or strlcat fail */
if ((strlcpy(file, filename, sizeof file) < sizeof(file)) &&
(strlcat(file, ".pub", sizeof file) < sizeof(file)) &&
- (key_try_load_public(pub, file, commentp) == 1))
- return pub;
- key_free(pub);
- return NULL;
+ (r = sshkey_try_load_public(pub, file, commentp)) == 0) {
+ if (keyp != NULL)
+ *keyp = pub;
+ return 0;
+ }
+ sshkey_free(pub);
+
+ return r;
}
/* Load the certificate associated with the named private key */
-Key *
-key_load_cert(const char *filename)
+int
+sshkey_load_cert(const char *filename, struct sshkey **keyp)
{
- Key *pub;
- char *file;
+ struct sshkey *pub = NULL;
+ char *file = NULL;
+ int r = SSH_ERR_INTERNAL_ERROR;
- pub = key_new(KEY_UNSPEC);
- xasprintf(&file, "%s-cert.pub", filename);
- if (key_try_load_public(pub, file, NULL) == 1) {
- free(file);
- return pub;
+ if (keyp != NULL)
+ *keyp = NULL;
+
+ if (asprintf(&file, "%s-cert.pub", filename) == -1)
+ return SSH_ERR_ALLOC_FAIL;
+
+ if ((pub = sshkey_new(KEY_UNSPEC)) == NULL) {
+ goto out;
}
+ if ((r = sshkey_try_load_public(pub, file, NULL)) != 0)
+ goto out;
+ /* success */
+ if (keyp != NULL) {
+ *keyp = pub;
+ pub = NULL;
+ }
+ r = 0;
+ out:
free(file);
- key_free(pub);
- return NULL;
+ sshkey_free(pub);
+ return r;
}
/* Load private key and certificate */
-Key *
-key_load_private_cert(int type, const char *filename, const char *passphrase,
- int *perm_ok)
+int
+sshkey_load_private_cert(int type, const char *filename, const char *passphrase,
+ struct sshkey **keyp, int *perm_ok)
{
- Key *key, *pub;
+ struct sshkey *key = NULL, *cert = NULL;
+ int r;
+ if (keyp != NULL)
+ *keyp = NULL;
+
switch (type) {
+#ifdef WITH_OPENSSL
case KEY_RSA:
case KEY_DSA:
case KEY_ECDSA:
+#endif /* WITH_OPENSSL */
case KEY_ED25519:
+ case KEY_UNSPEC:
break;
default:
- error("%s: unsupported key type", __func__);
- return NULL;
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
}
- if ((key = key_load_private_type(type, filename,
- passphrase, NULL, perm_ok)) == NULL)
- return NULL;
+ if ((r = sshkey_load_private_type(type, filename,
+ passphrase, &key, NULL, perm_ok)) != 0 ||
+ (r = sshkey_load_cert(filename, &cert)) != 0)
+ goto out;
- if ((pub = key_load_cert(filename)) == NULL) {
- key_free(key);
- return NULL;
+ /* Make sure the private key matches the certificate */
+ if (sshkey_equal_public(key, cert) == 0) {
+ r = SSH_ERR_KEY_CERT_MISMATCH;
+ goto out;
}
- /* Make sure the private key matches the certificate */
- if (key_equal_public(key, pub) == 0) {
- error("%s: certificate does not match private key %s",
- __func__, filename);
- } else if (key_to_certified(key, key_cert_is_legacy(pub)) != 0) {
- error("%s: key_to_certified failed", __func__);
- } else {
- key_cert_copy(pub, key);
- key_free(pub);
- return key;
+ if ((r = sshkey_to_certified(key)) != 0 ||
+ (r = sshkey_cert_copy(cert, key)) != 0)
+ goto out;
+ r = 0;
+ if (keyp != NULL) {
+ *keyp = key;
+ key = NULL;
}
-
- key_free(key);
- key_free(pub);
- return NULL;
+ out:
+ sshkey_free(key);
+ sshkey_free(cert);
+ return r;
}
/*
- * Returns 1 if the specified "key" is listed in the file "filename",
- * 0 if the key is not listed or -1 on error.
- * If strict_type is set then the key type must match exactly,
+ * Returns success if the specified "key" is listed in the file "filename",
+ * SSH_ERR_KEY_NOT_FOUND: if the key is not listed or another error.
+ * If "strict_type" is set then the key type must match exactly,
* otherwise a comparison that ignores certficiate data is performed.
+ * If "check_ca" is set and "key" is a certificate, then its CA key is
+ * also checked and sshkey_in_file() will return success if either is found.
*/
int
-key_in_file(Key *key, const char *filename, int strict_type)
+sshkey_in_file(struct sshkey *key, const char *filename, int strict_type,
+ int check_ca)
{
FILE *f;
char line[SSH_MAX_PUBKEY_BYTES];
char *cp;
u_long linenum = 0;
- int ret = 0;
- Key *pub;
- int (*key_compare)(const Key *, const Key *) = strict_type ?
- key_equal : key_equal_public;
+ int r = 0;
+ struct sshkey *pub = NULL;
+ int (*sshkey_compare)(const struct sshkey *, const struct sshkey *) =
+ strict_type ? sshkey_equal : sshkey_equal_public;
- if ((f = fopen(filename, "r")) == NULL) {
- if (errno == ENOENT) {
- debug("%s: keyfile \"%s\" missing", __func__, filename);
- return 0;
- } else {
- error("%s: could not open keyfile \"%s\": %s", __func__,
- filename, strerror(errno));
- return -1;
- }
- }
+ if ((f = fopen(filename, "r")) == NULL)
+ return SSH_ERR_SYSTEM_ERROR;
while (read_keyfile_line(f, filename, line, sizeof(line),
- &linenum) != -1) {
+ &linenum) != -1) {
cp = line;
/* Skip leading whitespace. */
@@ -1291,18 +525,59 @@
continue;
}
- pub = key_new(KEY_UNSPEC);
- if (key_read(pub, &cp) != 1) {
- key_free(pub);
- continue;
+ if ((pub = sshkey_new(KEY_UNSPEC)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
}
- if (key_compare(key, pub)) {
- ret = 1;
- key_free(pub);
- break;
+ if ((r = sshkey_read(pub, &cp)) != 0)
+ goto out;
+ if (sshkey_compare(key, pub) ||
+ (check_ca && sshkey_is_cert(key) &&
+ sshkey_compare(key->cert->signature_key, pub))) {
+ r = 0;
+ goto out;
}
- key_free(pub);
+ sshkey_free(pub);
+ pub = NULL;
}
+ r = SSH_ERR_KEY_NOT_FOUND;
+ out:
+ sshkey_free(pub);
fclose(f);
- return ret;
+ return r;
}
+
+/*
+ * Checks whether the specified key is revoked, returning 0 if not,
+ * SSH_ERR_KEY_REVOKED if it is or another error code if something
+ * unexpected happened.
+ * This will check both the key and, if it is a certificate, its CA key too.
+ * "revoked_keys_file" may be a KRL or a one-per-line list of public keys.
+ */
+int
+sshkey_check_revoked(struct sshkey *key, const char *revoked_keys_file)
+{
+ int r;
+
+ r = ssh_krl_file_contains_key(revoked_keys_file, key);
+ /* If this was not a KRL to begin with then continue below */
+ if (r != SSH_ERR_KRL_BAD_MAGIC)
+ return r;
+
+ /*
+ * If the file is not a KRL or we can't handle KRLs then attempt to
+ * parse the file as a flat list of keys.
+ */
+ switch ((r = sshkey_in_file(key, revoked_keys_file, 0, 1))) {
+ case 0:
+ /* Key found => revoked */
+ return SSH_ERR_KEY_REVOKED;
+ case SSH_ERR_KEY_NOT_FOUND:
+ /* Key not found => not revoked */
+ return 0;
+ default:
+ /* Some other error occurred */
+ return r;
+ }
+}
+
Modified: trunk/crypto/openssh/authfile.h
===================================================================
--- trunk/crypto/openssh/authfile.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/authfile.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,32 +1,52 @@
-/* $OpenBSD: authfile.h,v 1.17 2013/12/06 13:34:54 markus Exp $ */
+/* $OpenBSD: authfile.h,v 1.21 2015/01/08 10:14:08 djm Exp $ */
/*
- * Author: Tatu Ylonen <ylo at cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
- * All rights reserved
+ * Copyright (c) 2000, 2013 Markus Friedl. All rights reserved.
*
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose. Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef AUTHFILE_H
#define AUTHFILE_H
-int key_save_private(Key *, const char *, const char *, const char *,
- int, const char *, int);
-int key_load_file(int, const char *, Buffer *);
-Key *key_load_cert(const char *);
-Key *key_load_public(const char *, char **);
-Key *key_load_public_type(int, const char *, char **);
-Key *key_parse_private(Buffer *, const char *, const char *, char **);
-Key *key_load_private(const char *, const char *, char **);
-Key *key_load_private_cert(int, const char *, const char *, int *);
-Key *key_load_private_type(int, const char *, const char *, char **, int *);
-Key *key_load_private_pem(int, int, const char *, char **);
-int key_perm_ok(int, const char *);
-int key_in_file(Key *, const char *, int);
+struct sshbuf;
+struct sshkey;
+/* XXX document these */
+/* XXX some of these could probably be merged/retired */
+
+int sshkey_save_private(struct sshkey *, const char *,
+ const char *, const char *, int, const char *, int);
+int sshkey_load_file(int, struct sshbuf *);
+int sshkey_load_cert(const char *, struct sshkey **);
+int sshkey_load_public(const char *, struct sshkey **, char **);
+int sshkey_load_private(const char *, const char *, struct sshkey **, char **);
+int sshkey_load_private_cert(int, const char *, const char *,
+ struct sshkey **, int *);
+int sshkey_load_private_type(int, const char *, const char *,
+ struct sshkey **, char **, int *);
+int sshkey_load_private_type_fd(int fd, int type, const char *passphrase,
+ struct sshkey **keyp, char **commentp);
+int sshkey_perm_ok(int, const char *);
+int sshkey_in_file(struct sshkey *, const char *, int, int);
+int sshkey_check_revoked(struct sshkey *key, const char *revoked_keys_file);
+
#endif
Copied: trunk/crypto/openssh/bitmap.c (from rev 9222, vendor-crypto/openssh/dist/bitmap.c)
===================================================================
--- trunk/crypto/openssh/bitmap.c (rev 0)
+++ trunk/crypto/openssh/bitmap.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,212 @@
+/*
+ * Copyright (c) 2015 Damien Miller <djm at mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "bitmap.h"
+
+#define BITMAP_WTYPE u_int
+#define BITMAP_MAX (1<<24)
+#define BITMAP_BYTES (sizeof(BITMAP_WTYPE))
+#define BITMAP_BITS (sizeof(BITMAP_WTYPE) * 8)
+#define BITMAP_WMASK ((BITMAP_WTYPE)BITMAP_BITS - 1)
+struct bitmap {
+ BITMAP_WTYPE *d;
+ size_t len; /* number of words allocated */
+ size_t top; /* index of top word allocated */
+};
+
+struct bitmap *
+bitmap_new(void)
+{
+ struct bitmap *ret;
+
+ if ((ret = calloc(1, sizeof(*ret))) == NULL)
+ return NULL;
+ if ((ret->d = calloc(1, BITMAP_BYTES)) == NULL) {
+ free(ret);
+ return NULL;
+ }
+ ret->len = 1;
+ ret->top = 0;
+ return ret;
+}
+
+void
+bitmap_free(struct bitmap *b)
+{
+ if (b != NULL && b->d != NULL) {
+ explicit_bzero(b->d, b->len);
+ free(b->d);
+ }
+ free(b);
+}
+
+void
+bitmap_zero(struct bitmap *b)
+{
+ memset(b->d, 0, b->len * BITMAP_BYTES);
+ b->top = 0;
+}
+
+int
+bitmap_test_bit(struct bitmap *b, u_int n)
+{
+ if (b->top >= b->len)
+ return 0; /* invalid */
+ if (b->len == 0 || (n / BITMAP_BITS) > b->top)
+ return 0;
+ return (b->d[n / BITMAP_BITS] >> (n & BITMAP_WMASK)) & 1;
+}
+
+static int
+reserve(struct bitmap *b, u_int n)
+{
+ BITMAP_WTYPE *tmp;
+ size_t nlen;
+
+ if (b->top >= b->len || n > BITMAP_MAX)
+ return -1; /* invalid */
+ nlen = (n / BITMAP_BITS) + 1;
+ if (b->len < nlen) {
+ if ((tmp = reallocarray(b->d, nlen, BITMAP_BYTES)) == NULL)
+ return -1;
+ b->d = tmp;
+ memset(b->d + b->len, 0, (nlen - b->len) * BITMAP_BYTES);
+ b->len = nlen;
+ }
+ return 0;
+}
+
+int
+bitmap_set_bit(struct bitmap *b, u_int n)
+{
+ int r;
+ size_t offset;
+
+ if ((r = reserve(b, n)) != 0)
+ return r;
+ offset = n / BITMAP_BITS;
+ if (offset > b->top)
+ b->top = offset;
+ b->d[offset] |= (BITMAP_WTYPE)1 << (n & BITMAP_WMASK);
+ return 0;
+}
+
+/* Resets b->top to point to the most significant bit set in b->d */
+static void
+retop(struct bitmap *b)
+{
+ if (b->top >= b->len)
+ return;
+ while (b->top > 0 && b->d[b->top] == 0)
+ b->top--;
+}
+
+void
+bitmap_clear_bit(struct bitmap *b, u_int n)
+{
+ size_t offset;
+
+ if (b->top >= b->len || n > BITMAP_MAX)
+ return; /* invalid */
+ offset = n / BITMAP_BITS;
+ if (offset > b->top)
+ return;
+ b->d[offset] &= ~((BITMAP_WTYPE)1 << (n & BITMAP_WMASK));
+ /* The top may have changed as a result of the clear */
+ retop(b);
+}
+
+size_t
+bitmap_nbits(struct bitmap *b)
+{
+ size_t bits;
+ BITMAP_WTYPE w;
+
+ retop(b);
+ if (b->top >= b->len)
+ return 0; /* invalid */
+ if (b->len == 0 || (b->top == 0 && b->d[0] == 0))
+ return 0;
+ /* Find MSB set */
+ w = b->d[b->top];
+ bits = (b->top + 1) * BITMAP_BITS;
+ while (!(w & ((BITMAP_WTYPE)1 << (BITMAP_BITS - 1)))) {
+ w <<= 1;
+ bits--;
+ }
+ return bits;
+}
+
+size_t
+bitmap_nbytes(struct bitmap *b)
+{
+ return (bitmap_nbits(b) + 7) / 8;
+}
+
+int
+bitmap_to_string(struct bitmap *b, void *p, size_t l)
+{
+ u_char *s = (u_char *)p;
+ size_t i, j, k, need = bitmap_nbytes(b);
+
+ if (l < need || b->top >= b->len)
+ return -1;
+ if (l > need)
+ l = need;
+ /* Put the bytes from LSB backwards */
+ for (i = k = 0; i < b->top + 1; i++) {
+ for (j = 0; j < BITMAP_BYTES; j++) {
+ if (k >= l)
+ break;
+ s[need - 1 - k++] = (b->d[i] >> (j * 8)) & 0xff;
+ }
+ }
+ return 0;
+}
+
+int
+bitmap_from_string(struct bitmap *b, const void *p, size_t l)
+{
+ int r;
+ size_t i, offset, shift;
+ u_char *s = (u_char *)p;
+
+ if (l > BITMAP_MAX / 8)
+ return -1;
+ if ((r = reserve(b, l * 8)) != 0)
+ return r;
+ bitmap_zero(b);
+ if (l == 0)
+ return 0;
+ b->top = offset = ((l + (BITMAP_BYTES - 1)) / BITMAP_BYTES) - 1;
+ shift = ((l + (BITMAP_BYTES - 1)) % BITMAP_BYTES) * 8;
+ for (i = 0; i < l; i++) {
+ b->d[offset] |= (BITMAP_WTYPE)s[i] << shift;
+ if (shift == 0) {
+ offset--;
+ shift = BITMAP_BITS - 8;
+ } else
+ shift -= 8;
+ }
+ retop(b);
+ return 0;
+}
Copied: trunk/crypto/openssh/bitmap.h (from rev 9222, vendor-crypto/openssh/dist/bitmap.h)
===================================================================
--- trunk/crypto/openssh/bitmap.h (rev 0)
+++ trunk/crypto/openssh/bitmap.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2015 Damien Miller <djm at mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BITMAP_H
+#define _BITMAP_H
+
+#include <sys/types.h>
+
+/* Simple bit vector routines */
+
+struct bitmap;
+
+/* Allocate a new bitmap. Returns NULL on allocation failure. */
+struct bitmap *bitmap_new(void);
+
+/* Free a bitmap */
+void bitmap_free(struct bitmap *b);
+
+/* Zero an existing bitmap */
+void bitmap_zero(struct bitmap *b);
+
+/* Test whether a bit is set in a bitmap. */
+int bitmap_test_bit(struct bitmap *b, u_int n);
+
+/* Set a bit in a bitmap. Returns 0 on success or -1 on error */
+int bitmap_set_bit(struct bitmap *b, u_int n);
+
+/* Clear a bit in a bitmap */
+void bitmap_clear_bit(struct bitmap *b, u_int n);
+
+/* Return the number of bits in a bitmap (i.e. the position of the MSB) */
+size_t bitmap_nbits(struct bitmap *b);
+
+/* Return the number of bytes needed to represent a bitmap */
+size_t bitmap_nbytes(struct bitmap *b);
+
+/* Convert a bitmap to a big endian byte string */
+int bitmap_to_string(struct bitmap *b, void *p, size_t l);
+
+/* Convert a big endian byte string to a bitmap */
+int bitmap_from_string(struct bitmap *b, const void *p, size_t l);
+
+#endif /* _BITMAP_H */
Modified: trunk/crypto/openssh/bufaux.c
===================================================================
--- trunk/crypto/openssh/bufaux.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/bufaux.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,70 +1,40 @@
-/* $OpenBSD: bufaux.c,v 1.56 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: bufaux.c,v 1.60 2014/04/30 05:29:56 djm Exp $ */
/*
- * Author: Tatu Ylonen <ylo at cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
- * All rights reserved
- * Auxiliary functions for storing and retrieving various data types to/from
- * Buffers.
+ * Copyright (c) 2012 Damien Miller <djm at mindrot.org>
*
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose. Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
*
- *
- * SSH2 packet format added by Markus Friedl
- * Copyright (c) 2000 Markus Friedl. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
+/* Emulation wrappers for legacy OpenSSH buffer API atop sshbuf */
+
#include "includes.h"
#include <sys/types.h>
-#include <openssl/bn.h>
-
-#include <string.h>
-#include <stdarg.h>
-#include <stdlib.h>
-
-#include "xmalloc.h"
#include "buffer.h"
#include "log.h"
-#include "misc.h"
+#include "ssherr.h"
-/*
- * Returns integers from the buffer (msb first).
- */
-
int
-buffer_get_short_ret(u_short *ret, Buffer *buffer)
+buffer_get_short_ret(u_short *v, Buffer *buffer)
{
- u_char buf[2];
+ int ret;
- if (buffer_get_ret(buffer, (char *) buf, 2) == -1)
- return (-1);
- *ret = get_u16(buf);
- return (0);
+ if ((ret = sshbuf_get_u16(buffer, v)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
+ }
+ return 0;
}
u_short
@@ -73,21 +43,21 @@
u_short ret;
if (buffer_get_short_ret(&ret, buffer) == -1)
- fatal("buffer_get_short: buffer error");
+ fatal("%s: buffer error", __func__);
return (ret);
}
int
-buffer_get_int_ret(u_int *ret, Buffer *buffer)
+buffer_get_int_ret(u_int *v, Buffer *buffer)
{
- u_char buf[4];
+ int ret;
- if (buffer_get_ret(buffer, (char *) buf, 4) == -1)
- return (-1);
- if (ret != NULL)
- *ret = get_u32(buf);
- return (0);
+ if ((ret = sshbuf_get_u32(buffer, v)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
+ }
+ return 0;
}
u_int
@@ -96,21 +66,21 @@
u_int ret;
if (buffer_get_int_ret(&ret, buffer) == -1)
- fatal("buffer_get_int: buffer error");
+ fatal("%s: buffer error", __func__);
return (ret);
}
int
-buffer_get_int64_ret(u_int64_t *ret, Buffer *buffer)
+buffer_get_int64_ret(u_int64_t *v, Buffer *buffer)
{
- u_char buf[8];
+ int ret;
- if (buffer_get_ret(buffer, (char *) buf, 8) == -1)
- return (-1);
- if (ret != NULL)
- *ret = get_u64(buf);
- return (0);
+ if ((ret = sshbuf_get_u64(buffer, v)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
+ }
+ return 0;
}
u_int64_t
@@ -119,78 +89,52 @@
u_int64_t ret;
if (buffer_get_int64_ret(&ret, buffer) == -1)
- fatal("buffer_get_int: buffer error");
+ fatal("%s: buffer error", __func__);
return (ret);
}
-/*
- * Stores integers in the buffer, msb first.
- */
void
buffer_put_short(Buffer *buffer, u_short value)
{
- char buf[2];
+ int ret;
- put_u16(buf, value);
- buffer_append(buffer, buf, 2);
+ if ((ret = sshbuf_put_u16(buffer, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
}
void
buffer_put_int(Buffer *buffer, u_int value)
{
- char buf[4];
+ int ret;
- put_u32(buf, value);
- buffer_append(buffer, buf, 4);
+ if ((ret = sshbuf_put_u32(buffer, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
}
void
buffer_put_int64(Buffer *buffer, u_int64_t value)
{
- char buf[8];
+ int ret;
- put_u64(buf, value);
- buffer_append(buffer, buf, 8);
+ if ((ret = sshbuf_put_u64(buffer, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
}
-/*
- * Returns an arbitrary binary string from the buffer. The string cannot
- * be longer than 256k. The returned value points to memory allocated
- * with xmalloc; it is the responsibility of the calling function to free
- * the data. If length_ptr is non-NULL, the length of the returned data
- * will be stored there. A null character will be automatically appended
- * to the returned string, and is not counted in length.
- */
void *
buffer_get_string_ret(Buffer *buffer, u_int *length_ptr)
{
+ size_t len;
+ int ret;
u_char *value;
- u_int len;
- /* Get the length. */
- if (buffer_get_int_ret(&len, buffer) != 0) {
- error("buffer_get_string_ret: cannot extract length");
- return (NULL);
+ if ((ret = sshbuf_get_string(buffer, &value, &len)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return NULL;
}
- if (len > 256 * 1024) {
- error("buffer_get_string_ret: bad string length %u", len);
- return (NULL);
- }
- /* Allocate space for the string. Add one byte for a null character. */
- value = xmalloc(len + 1);
- /* Get the string. */
- if (buffer_get_ret(buffer, value, len) == -1) {
- error("buffer_get_string_ret: buffer_get failed");
- free(value);
- return (NULL);
- }
- /* Append a null character to make processing easier. */
- value[len] = '\0';
- /* Optionally return the length of the string. */
- if (length_ptr)
- *length_ptr = len;
- return (value);
+ if (length_ptr != NULL)
+ *length_ptr = len; /* Safe: sshbuf never stores len > 2^31 */
+ return value;
}
void *
@@ -199,7 +143,7 @@
void *ret;
if ((ret = buffer_get_string_ret(buffer, length_ptr)) == NULL)
- fatal("buffer_get_string: buffer error");
+ fatal("%s: buffer error", __func__);
return (ret);
}
@@ -206,24 +150,17 @@
char *
buffer_get_cstring_ret(Buffer *buffer, u_int *length_ptr)
{
- u_int length;
- char *cp, *ret = buffer_get_string_ret(buffer, &length);
+ size_t len;
+ int ret;
+ char *value;
- if (ret == NULL)
+ if ((ret = sshbuf_get_cstring(buffer, &value, &len)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
return NULL;
- if ((cp = memchr(ret, '\0', length)) != NULL) {
- /* XXX allow \0 at end-of-string for a while, remove later */
- if (cp == ret + length - 1)
- error("buffer_get_cstring_ret: string contains \\0");
- else {
- explicit_bzero(ret, length);
- free(ret);
- return NULL;
- }
}
if (length_ptr != NULL)
- *length_ptr = length;
- return ret;
+ *length_ptr = len; /* Safe: sshbuf never stores len > 2^31 */
+ return value;
}
char *
@@ -232,159 +169,91 @@
char *ret;
if ((ret = buffer_get_cstring_ret(buffer, length_ptr)) == NULL)
- fatal("buffer_get_cstring: buffer error");
+ fatal("%s: buffer error", __func__);
return ret;
}
-void *
+const void *
buffer_get_string_ptr_ret(Buffer *buffer, u_int *length_ptr)
{
- void *ptr;
- u_int len;
+ size_t len;
+ int ret;
+ const u_char *value;
- if (buffer_get_int_ret(&len, buffer) != 0)
+ if ((ret = sshbuf_get_string_direct(buffer, &value, &len)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
return NULL;
- if (len > 256 * 1024) {
- error("buffer_get_string_ptr: bad string length %u", len);
- return NULL;
}
- ptr = buffer_ptr(buffer);
- buffer_consume(buffer, len);
- if (length_ptr)
- *length_ptr = len;
- return (ptr);
+ if (length_ptr != NULL)
+ *length_ptr = len; /* Safe: sshbuf never stores len > 2^31 */
+ return value;
}
-void *
+const void *
buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr)
{
- void *ret;
+ const void *ret;
if ((ret = buffer_get_string_ptr_ret(buffer, length_ptr)) == NULL)
- fatal("buffer_get_string_ptr: buffer error");
+ fatal("%s: buffer error", __func__);
return (ret);
}
-/*
- * Stores and arbitrary binary string in the buffer.
- */
void
buffer_put_string(Buffer *buffer, const void *buf, u_int len)
{
- buffer_put_int(buffer, len);
- buffer_append(buffer, buf, len);
+ int ret;
+
+ if ((ret = sshbuf_put_string(buffer, buf, len)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
}
+
void
buffer_put_cstring(Buffer *buffer, const char *s)
{
- if (s == NULL)
- fatal("buffer_put_cstring: s == NULL");
- buffer_put_string(buffer, s, strlen(s));
+ int ret;
+
+ if ((ret = sshbuf_put_cstring(buffer, s)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
}
-/*
- * Returns a character from the buffer (0 - 255).
- */
int
-buffer_get_char_ret(u_char *ret, Buffer *buffer)
+buffer_get_char_ret(char *v, Buffer *buffer)
{
- if (buffer_get_ret(buffer, ret, 1) == -1) {
- error("buffer_get_char_ret: buffer_get_ret failed");
- return (-1);
+ int ret;
+
+ if ((ret = sshbuf_get_u8(buffer, (u_char *)v)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
}
- return (0);
+ return 0;
}
int
buffer_get_char(Buffer *buffer)
{
- u_char ch;
+ char ch;
if (buffer_get_char_ret(&ch, buffer) == -1)
- fatal("buffer_get_char: buffer error");
- return ch;
+ fatal("%s: buffer error", __func__);
+ return (u_char) ch;
}
-/*
- * Stores a character in the buffer.
- */
void
buffer_put_char(Buffer *buffer, int value)
{
- char ch = value;
+ int ret;
- buffer_append(buffer, &ch, 1);
+ if ((ret = sshbuf_put_u8(buffer, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
}
-/* Pseudo bignum functions */
-
-void *
-buffer_get_bignum2_as_string_ret(Buffer *buffer, u_int *length_ptr)
-{
- u_int len;
- u_char *bin, *p, *ret;
-
- if ((p = bin = buffer_get_string_ret(buffer, &len)) == NULL) {
- error("%s: invalid bignum", __func__);
- return NULL;
- }
-
- if (len > 0 && (bin[0] & 0x80)) {
- error("%s: negative numbers not supported", __func__);
- free(bin);
- return NULL;
- }
- if (len > 8 * 1024) {
- error("%s: cannot handle BN of size %d", __func__, len);
- free(bin);
- return NULL;
- }
- /* Skip zero prefix on numbers with the MSB set */
- if (len > 1 && bin[0] == 0x00 && (bin[1] & 0x80) != 0) {
- p++;
- len--;
- }
- ret = xmalloc(len);
- memcpy(ret, p, len);
- explicit_bzero(p, len);
- free(bin);
- return ret;
-}
-
-void *
-buffer_get_bignum2_as_string(Buffer *buffer, u_int *l)
-{
- void *ret = buffer_get_bignum2_as_string_ret(buffer, l);
-
- if (ret == NULL)
- fatal("%s: buffer error", __func__);
- return ret;
-}
-
-/*
- * Stores a string using the bignum encoding rules (\0 pad if MSB set).
- */
void
buffer_put_bignum2_from_string(Buffer *buffer, const u_char *s, u_int l)
{
- u_char *buf, *p;
- int pad = 0;
+ int ret;
- if (l > 8 * 1024)
- fatal("%s: length %u too long", __func__, l);
- p = buf = xmalloc(l + 1);
- /*
- * If most significant bit is set then prepend a zero byte to
- * avoid interpretation as a negative number.
- */
- if (l > 0 && (s[0] & 0x80) != 0) {
- *p++ = '\0';
- pad = 1;
- }
- memcpy(p, s, l);
- buffer_put_string(buffer, buf, l + pad);
- explicit_bzero(buf, l + pad);
- free(buf);
+ if ((ret = sshbuf_put_bignum2_bytes(buffer, s, l)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
}
-
Modified: trunk/crypto/openssh/bufbn.c
===================================================================
--- trunk/crypto/openssh/bufbn.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/bufbn.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,89 +1,44 @@
-/* $OpenBSD: bufbn.c,v 1.11 2014/02/27 08:25:09 djm Exp $*/
+/* $OpenBSD: bufbn.c,v 1.12 2014/04/30 05:29:56 djm Exp $ */
+
/*
- * Author: Tatu Ylonen <ylo at cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
- * All rights reserved
- * Auxiliary functions for storing and retrieving various data types to/from
- * Buffers.
+ * Copyright (c) 2012 Damien Miller <djm at mindrot.org>
*
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose. Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
*
- *
- * SSH2 packet format added by Markus Friedl
- * Copyright (c) 2000 Markus Friedl. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
+/* Emulation wrappers for legacy OpenSSH buffer API atop sshbuf */
+
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
-#include <openssl/bn.h>
-
-#include <string.h>
-#include <stdarg.h>
-#include <stdlib.h>
-
-#include "xmalloc.h"
#include "buffer.h"
#include "log.h"
-#include "misc.h"
+#include "ssherr.h"
-/*
- * Stores an BIGNUM in the buffer with a 2-byte msb first bit count, followed
- * by (bits+7)/8 bytes of binary data, msb first.
- */
+#ifdef WITH_SSH1
int
buffer_put_bignum_ret(Buffer *buffer, const BIGNUM *value)
{
- int bits = BN_num_bits(value);
- int bin_size = (bits + 7) / 8;
- u_char *buf = xmalloc(bin_size);
- int oi;
- char msg[2];
+ int ret;
- /* Get the value of in binary */
- oi = BN_bn2bin(value, buf);
- if (oi != bin_size) {
- error("buffer_put_bignum_ret: BN_bn2bin() failed: oi %d != bin_size %d",
- oi, bin_size);
- free(buf);
- return (-1);
+ if ((ret = sshbuf_put_bignum1(buffer, value)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
}
-
- /* Store the number of bits in the buffer in two bytes, msb first. */
- put_u16(msg, bits);
- buffer_append(buffer, msg, 2);
- /* Store the binary data. */
- buffer_append(buffer, buf, oi);
-
- explicit_bzero(buf, bin_size);
- free(buf);
-
- return (0);
+ return 0;
}
void
@@ -90,49 +45,19 @@
buffer_put_bignum(Buffer *buffer, const BIGNUM *value)
{
if (buffer_put_bignum_ret(buffer, value) == -1)
- fatal("buffer_put_bignum: buffer error");
+ fatal("%s: buffer error", __func__);
}
-/*
- * Retrieves a BIGNUM from the buffer.
- */
int
buffer_get_bignum_ret(Buffer *buffer, BIGNUM *value)
{
- u_int bits, bytes;
- u_char buf[2], *bin;
+ int ret;
- /* Get the number of bits. */
- if (buffer_get_ret(buffer, (char *) buf, 2) == -1) {
- error("buffer_get_bignum_ret: invalid length");
- return (-1);
+ if ((ret = sshbuf_get_bignum1(buffer, value)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
}
- bits = get_u16(buf);
- if (bits > 65535-7) {
- error("buffer_get_bignum_ret: cannot handle BN of size %d",
- bits);
- return (-1);
- }
- /* Compute the number of binary bytes that follow. */
- bytes = (bits + 7) / 8;
- if (bytes > 8 * 1024) {
- error("buffer_get_bignum_ret: cannot handle BN of size %d", bytes);
- return (-1);
- }
- if (buffer_len(buffer) < bytes) {
- error("buffer_get_bignum_ret: input buffer too small");
- return (-1);
- }
- bin = buffer_ptr(buffer);
- if (BN_bin2bn(bin, bytes, value) == NULL) {
- error("buffer_get_bignum_ret: BN_bin2bn failed");
- return (-1);
- }
- if (buffer_consume_ret(buffer, bytes) == -1) {
- error("buffer_get_bignum_ret: buffer_consume failed");
- return (-1);
- }
- return (0);
+ return 0;
}
void
@@ -139,48 +64,20 @@
buffer_get_bignum(Buffer *buffer, BIGNUM *value)
{
if (buffer_get_bignum_ret(buffer, value) == -1)
- fatal("buffer_get_bignum: buffer error");
+ fatal("%s: buffer error", __func__);
}
+#endif /* WITH_SSH1 */
-/*
- * Stores a BIGNUM in the buffer in SSH2 format.
- */
int
buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
{
- u_int bytes;
- u_char *buf;
- int oi;
- u_int hasnohigh = 0;
+ int ret;
- if (BN_is_zero(value)) {
- buffer_put_int(buffer, 0);
- return 0;
+ if ((ret = sshbuf_put_bignum2(buffer, value)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
}
- if (value->neg) {
- error("buffer_put_bignum2_ret: negative numbers not supported");
- return (-1);
- }
- bytes = BN_num_bytes(value) + 1; /* extra padding byte */
- if (bytes < 2) {
- error("buffer_put_bignum2_ret: BN too small");
- return (-1);
- }
- buf = xmalloc(bytes);
- buf[0] = 0x00;
- /* Get the value of in binary */
- oi = BN_bn2bin(value, buf+1);
- if (oi < 0 || (u_int)oi != bytes - 1) {
- error("buffer_put_bignum2_ret: BN_bn2bin() failed: "
- "oi %d != bin_size %d", oi, bytes);
- free(buf);
- return (-1);
- }
- hasnohigh = (buf[1] & 0x80) ? 0 : 1;
- buffer_put_string(buffer, buf+hasnohigh, bytes-hasnohigh);
- explicit_bzero(buf, bytes);
- free(buf);
- return (0);
+ return 0;
}
void
@@ -187,38 +84,19 @@
buffer_put_bignum2(Buffer *buffer, const BIGNUM *value)
{
if (buffer_put_bignum2_ret(buffer, value) == -1)
- fatal("buffer_put_bignum2: buffer error");
+ fatal("%s: buffer error", __func__);
}
int
buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
{
- u_int len;
- u_char *bin;
+ int ret;
- if ((bin = buffer_get_string_ret(buffer, &len)) == NULL) {
- error("buffer_get_bignum2_ret: invalid bignum");
- return (-1);
+ if ((ret = sshbuf_get_bignum2(buffer, value)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
}
-
- if (len > 0 && (bin[0] & 0x80)) {
- error("buffer_get_bignum2_ret: negative numbers not supported");
- free(bin);
- return (-1);
- }
- if (len > 8 * 1024) {
- error("buffer_get_bignum2_ret: cannot handle BN of size %d",
- len);
- free(bin);
- return (-1);
- }
- if (BN_bin2bn(bin, len, value) == NULL) {
- error("buffer_get_bignum2_ret: BN_bin2bn failed");
- free(bin);
- return (-1);
- }
- free(bin);
- return (0);
+ return 0;
}
void
@@ -225,5 +103,7 @@
buffer_get_bignum2(Buffer *buffer, BIGNUM *value)
{
if (buffer_get_bignum2_ret(buffer, value) == -1)
- fatal("buffer_get_bignum2: buffer error");
+ fatal("%s: buffer error", __func__);
}
+
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/bufec.c
===================================================================
--- trunk/crypto/openssh/bufec.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/bufec.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,6 +1,7 @@
-/* $OpenBSD: bufec.c,v 1.3 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: bufec.c,v 1.4 2014/04/30 05:29:56 djm Exp $ */
+
/*
- * Copyright (c) 2010 Damien Miller <djm at mindrot.org>
+ * Copyright (c) 2012 Damien Miller <djm at mindrot.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -15,73 +16,29 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
+/* Emulation wrappers for legacy OpenSSH buffer API atop sshbuf */
+
#include "includes.h"
-#ifdef OPENSSL_HAS_ECC
-
#include <sys/types.h>
-#include <openssl/bn.h>
-#include <openssl/ec.h>
-
-#include <string.h>
-#include <stdarg.h>
-
-#include "xmalloc.h"
#include "buffer.h"
#include "log.h"
-#include "misc.h"
+#include "ssherr.h"
-/*
- * Maximum supported EC GFp field length is 528 bits. SEC1 uncompressed
- * encoding represents this as two bitstring points that should each
- * be no longer than the field length, SEC1 specifies a 1 byte
- * point type header.
- * Being paranoid here may insulate us to parsing problems in
- * EC_POINT_oct2point.
- */
-#define BUFFER_MAX_ECPOINT_LEN ((528*2 / 8) + 1)
+#ifdef OPENSSL_HAS_ECC
-/*
- * Append an EC_POINT to the buffer as a string containing a SEC1 encoded
- * uncompressed point. Fortunately OpenSSL handles the gory details for us.
- */
int
buffer_put_ecpoint_ret(Buffer *buffer, const EC_GROUP *curve,
const EC_POINT *point)
{
- u_char *buf = NULL;
- size_t len;
- BN_CTX *bnctx;
- int ret = -1;
+ int ret;
- /* Determine length */
- if ((bnctx = BN_CTX_new()) == NULL)
- fatal("%s: BN_CTX_new failed", __func__);
- len = EC_POINT_point2oct(curve, point, POINT_CONVERSION_UNCOMPRESSED,
- NULL, 0, bnctx);
- if (len > BUFFER_MAX_ECPOINT_LEN) {
- error("%s: giant EC point: len = %lu (max %u)",
- __func__, (u_long)len, BUFFER_MAX_ECPOINT_LEN);
- goto out;
+ if ((ret = sshbuf_put_ec(buffer, point, curve)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
}
- /* Convert */
- buf = xmalloc(len);
- if (EC_POINT_point2oct(curve, point, POINT_CONVERSION_UNCOMPRESSED,
- buf, len, bnctx) != len) {
- error("%s: EC_POINT_point2oct length mismatch", __func__);
- goto out;
- }
- /* Append */
- buffer_put_string(buffer, buf, len);
- ret = 0;
- out:
- if (buf != NULL) {
- explicit_bzero(buf, len);
- free(buf);
- }
- BN_CTX_free(bnctx);
- return ret;
+ return 0;
}
void
@@ -96,43 +53,13 @@
buffer_get_ecpoint_ret(Buffer *buffer, const EC_GROUP *curve,
EC_POINT *point)
{
- u_char *buf;
- u_int len;
- BN_CTX *bnctx;
- int ret = -1;
+ int ret;
- if ((buf = buffer_get_string_ret(buffer, &len)) == NULL) {
- error("%s: invalid point", __func__);
+ if ((ret = sshbuf_get_ec(buffer, point, curve)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
return -1;
}
- if ((bnctx = BN_CTX_new()) == NULL)
- fatal("%s: BN_CTX_new failed", __func__);
- if (len > BUFFER_MAX_ECPOINT_LEN) {
- error("%s: EC_POINT too long: %u > max %u", __func__,
- len, BUFFER_MAX_ECPOINT_LEN);
- goto out;
- }
- if (len == 0) {
- error("%s: EC_POINT buffer is empty", __func__);
- goto out;
- }
- if (buf[0] != POINT_CONVERSION_UNCOMPRESSED) {
- error("%s: EC_POINT is in an incorrect form: "
- "0x%02x (want 0x%02x)", __func__, buf[0],
- POINT_CONVERSION_UNCOMPRESSED);
- goto out;
- }
- if (EC_POINT_oct2point(curve, point, buf, len, bnctx) != 1) {
- error("buffer_get_bignum2_ret: BN_bin2bn failed");
- goto out;
- }
- /* EC_POINT_oct2point verifies that the point is on the curve for us */
- ret = 0;
- out:
- BN_CTX_free(bnctx);
- explicit_bzero(buf, len);
- free(buf);
- return ret;
+ return 0;
}
void
@@ -144,3 +71,4 @@
}
#endif /* OPENSSL_HAS_ECC */
+
Modified: trunk/crypto/openssh/buffer.c
===================================================================
--- trunk/crypto/openssh/buffer.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/buffer.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,184 +1,73 @@
-/* $OpenBSD: buffer.c,v 1.35 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: buffer.c,v 1.36 2014/04/30 05:29:56 djm Exp $ */
+
/*
- * Author: Tatu Ylonen <ylo at cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
- * All rights reserved
- * Functions for manipulating fifo buffers (that can grow if needed).
+ * Copyright (c) 2012 Damien Miller <djm at mindrot.org>
*
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose. Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
+/* Emulation wrappers for legacy OpenSSH buffer API atop sshbuf */
+
#include "includes.h"
-#include <sys/param.h>
+#include <sys/types.h>
-#include <stdio.h>
-#include <string.h>
-#include <stdarg.h>
-#include <stdlib.h>
-
-#include "xmalloc.h"
#include "buffer.h"
#include "log.h"
+#include "ssherr.h"
-#define BUFFER_MAX_CHUNK 0x100000
-#define BUFFER_MAX_LEN 0xa00000
-#define BUFFER_ALLOCSZ 0x008000
-
-/* Initializes the buffer structure. */
-
void
-buffer_init(Buffer *buffer)
-{
- const u_int len = 4096;
-
- buffer->alloc = 0;
- buffer->buf = xmalloc(len);
- buffer->alloc = len;
- buffer->offset = 0;
- buffer->end = 0;
-}
-
-/* Frees any memory used for the buffer. */
-
-void
-buffer_free(Buffer *buffer)
-{
- if (buffer->alloc > 0) {
- explicit_bzero(buffer->buf, buffer->alloc);
- buffer->alloc = 0;
- free(buffer->buf);
- }
-}
-
-/*
- * Clears any data from the buffer, making it empty. This does not actually
- * zero the memory.
- */
-
-void
-buffer_clear(Buffer *buffer)
-{
- buffer->offset = 0;
- buffer->end = 0;
-}
-
-/* Appends data to the buffer, expanding it if necessary. */
-
-void
buffer_append(Buffer *buffer, const void *data, u_int len)
{
- void *p;
- p = buffer_append_space(buffer, len);
- memcpy(p, data, len);
-}
+ int ret;
-static int
-buffer_compact(Buffer *buffer)
-{
- /*
- * If the buffer is quite empty, but all data is at the end, move the
- * data to the beginning.
- */
- if (buffer->offset > MIN(buffer->alloc, BUFFER_MAX_CHUNK)) {
- memmove(buffer->buf, buffer->buf + buffer->offset,
- buffer->end - buffer->offset);
- buffer->end -= buffer->offset;
- buffer->offset = 0;
- return (1);
- }
- return (0);
+ if ((ret = sshbuf_put(buffer, data, len)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
}
-/*
- * Appends space to the buffer, expanding the buffer if necessary. This does
- * not actually copy the data into the buffer, but instead returns a pointer
- * to the allocated region.
- */
-
void *
buffer_append_space(Buffer *buffer, u_int len)
{
- u_int newlen;
- void *p;
+ int ret;
+ u_char *p;
- if (len > BUFFER_MAX_CHUNK)
- fatal("buffer_append_space: len %u not supported", len);
-
- /* If the buffer is empty, start using it from the beginning. */
- if (buffer->offset == buffer->end) {
- buffer->offset = 0;
- buffer->end = 0;
- }
-restart:
- /* If there is enough space to store all data, store it now. */
- if (buffer->end + len < buffer->alloc) {
- p = buffer->buf + buffer->end;
- buffer->end += len;
- return p;
- }
-
- /* Compact data back to the start of the buffer if necessary */
- if (buffer_compact(buffer))
- goto restart;
-
- /* Increase the size of the buffer and retry. */
- newlen = roundup(buffer->alloc + len, BUFFER_ALLOCSZ);
- if (newlen > BUFFER_MAX_LEN)
- fatal("buffer_append_space: alloc %u not supported",
- newlen);
- buffer->buf = xrealloc(buffer->buf, 1, newlen);
- buffer->alloc = newlen;
- goto restart;
- /* NOTREACHED */
+ if ((ret = sshbuf_reserve(buffer, len, &p)) != 0)
+ fatal("%s: %s", __func__, ssh_err(ret));
+ return p;
}
-/*
- * Check whether an allocation of 'len' will fit in the buffer
- * This must follow the same math as buffer_append_space
- */
int
buffer_check_alloc(Buffer *buffer, u_int len)
{
- if (buffer->offset == buffer->end) {
- buffer->offset = 0;
- buffer->end = 0;
- }
- restart:
- if (buffer->end + len < buffer->alloc)
- return (1);
- if (buffer_compact(buffer))
- goto restart;
- if (roundup(buffer->alloc + len, BUFFER_ALLOCSZ) <= BUFFER_MAX_LEN)
- return (1);
- return (0);
-}
+ int ret = sshbuf_check_reserve(buffer, len);
-/* Returns the number of bytes of data in the buffer. */
-
-u_int
-buffer_len(const Buffer *buffer)
-{
- return buffer->end - buffer->offset;
+ if (ret == 0)
+ return 1;
+ if (ret == SSH_ERR_NO_BUFFER_SPACE)
+ return 0;
+ fatal("%s: %s", __func__, ssh_err(ret));
}
-/* Gets data from the beginning of the buffer. */
-
int
buffer_get_ret(Buffer *buffer, void *buf, u_int len)
{
- if (len > buffer->end - buffer->offset) {
- error("buffer_get_ret: trying to get more bytes %d than in buffer %d",
- len, buffer->end - buffer->offset);
- return (-1);
+ int ret;
+
+ if ((ret = sshbuf_get(buffer, buf, len)) != 0) {
+ error("%s: %s", __func__, ssh_err(ret));
+ return -1;
}
- memcpy(buf, buffer->buf + buffer->offset, len);
- buffer->offset += len;
- return (0);
+ return 0;
}
void
@@ -185,20 +74,19 @@
buffer_get(Buffer *buffer, void *buf, u_int len)
{
if (buffer_get_ret(buffer, buf, len) == -1)
- fatal("buffer_get: buffer error");
+ fatal("%s: buffer error", __func__);
}
-/* Consumes the given number of bytes from the beginning of the buffer. */
-
int
buffer_consume_ret(Buffer *buffer, u_int bytes)
{
- if (bytes > buffer->end - buffer->offset) {
- error("buffer_consume_ret: trying to get more bytes than in buffer");
- return (-1);
- }
- buffer->offset += bytes;
- return (0);
+ int ret = sshbuf_consume(buffer, bytes);
+
+ if (ret == 0)
+ return 0;
+ if (ret == SSH_ERR_MESSAGE_INCOMPLETE)
+ return -1;
+ fatal("%s: %s", __func__, ssh_err(ret));
}
void
@@ -205,18 +93,19 @@
buffer_consume(Buffer *buffer, u_int bytes)
{
if (buffer_consume_ret(buffer, bytes) == -1)
- fatal("buffer_consume: buffer error");
+ fatal("%s: buffer error", __func__);
}
-/* Consumes the given number of bytes from the end of the buffer. */
-
int
buffer_consume_end_ret(Buffer *buffer, u_int bytes)
{
- if (bytes > buffer->end - buffer->offset)
- return (-1);
- buffer->end -= bytes;
- return (0);
+ int ret = sshbuf_consume_end(buffer, bytes);
+
+ if (ret == 0)
+ return 0;
+ if (ret == SSH_ERR_MESSAGE_INCOMPLETE)
+ return -1;
+ fatal("%s: %s", __func__, ssh_err(ret));
}
void
@@ -223,31 +112,7 @@
buffer_consume_end(Buffer *buffer, u_int bytes)
{
if (buffer_consume_end_ret(buffer, bytes) == -1)
- fatal("buffer_consume_end: trying to get more bytes than in buffer");
+ fatal("%s: buffer error", __func__);
}
-/* Returns a pointer to the first used byte in the buffer. */
-void *
-buffer_ptr(const Buffer *buffer)
-{
- return buffer->buf + buffer->offset;
-}
-
-/* Dumps the contents of the buffer to stderr. */
-
-void
-buffer_dump(const Buffer *buffer)
-{
- u_int i;
- u_char *ucp = buffer->buf;
-
- for (i = buffer->offset; i < buffer->end; i++) {
- fprintf(stderr, "%02x", ucp[i]);
- if ((i-buffer->offset)%16==15)
- fprintf(stderr, "\r\n");
- else if ((i-buffer->offset)%2==1)
- fprintf(stderr, " ");
- }
- fprintf(stderr, "\r\n");
-}
Modified: trunk/crypto/openssh/buffer.h
===================================================================
--- trunk/crypto/openssh/buffer.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/buffer.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,57 +1,59 @@
-/* $OpenBSD: buffer.h,v 1.23 2014/01/12 08:13:13 djm Exp $ */
+/* $OpenBSD: buffer.h,v 1.25 2014/04/30 05:29:56 djm Exp $ */
/*
- * Author: Tatu Ylonen <ylo at cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
- * All rights reserved
- * Code for manipulating FIFO buffers.
+ * Copyright (c) 2012 Damien Miller <djm at mindrot.org>
*
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose. Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
+/* Emulation wrappers for legacy OpenSSH buffer API atop sshbuf */
+
#ifndef BUFFER_H
#define BUFFER_H
-typedef struct {
- u_char *buf; /* Buffer for data. */
- u_int alloc; /* Number of bytes allocated for data. */
- u_int offset; /* Offset of first byte containing data. */
- u_int end; /* Offset of last byte containing data. */
-} Buffer;
+#include "sshbuf.h"
-void buffer_init(Buffer *);
-void buffer_clear(Buffer *);
-void buffer_free(Buffer *);
+typedef struct sshbuf Buffer;
-u_int buffer_len(const Buffer *);
-void *buffer_ptr(const Buffer *);
+#define buffer_init(b) sshbuf_init(b)
+#define buffer_clear(b) sshbuf_reset(b)
+#define buffer_free(b) sshbuf_free(b)
+#define buffer_dump(b) sshbuf_dump(b, stderr)
+/* XXX cast is safe: sshbuf never stores more than len 2^31 */
+#define buffer_len(b) ((u_int) sshbuf_len(b))
+#define buffer_ptr(b) sshbuf_mutable_ptr(b)
+
void buffer_append(Buffer *, const void *, u_int);
void *buffer_append_space(Buffer *, u_int);
-
int buffer_check_alloc(Buffer *, u_int);
-
void buffer_get(Buffer *, void *, u_int);
void buffer_consume(Buffer *, u_int);
void buffer_consume_end(Buffer *, u_int);
-void buffer_dump(const Buffer *);
int buffer_get_ret(Buffer *, void *, u_int);
int buffer_consume_ret(Buffer *, u_int);
int buffer_consume_end_ret(Buffer *, u_int);
+#include <openssl/objects.h>
#include <openssl/bn.h>
-
void buffer_put_bignum(Buffer *, const BIGNUM *);
void buffer_put_bignum2(Buffer *, const BIGNUM *);
void buffer_get_bignum(Buffer *, BIGNUM *);
void buffer_get_bignum2(Buffer *, BIGNUM *);
+void buffer_put_bignum2_from_string(Buffer *, const u_char *, u_int);
u_short buffer_get_short(Buffer *);
void buffer_put_short(Buffer *, u_short);
@@ -66,13 +68,12 @@
void buffer_put_char(Buffer *, int);
void *buffer_get_string(Buffer *, u_int *);
-void *buffer_get_string_ptr(Buffer *, u_int *);
+const void *buffer_get_string_ptr(Buffer *, u_int *);
void buffer_put_string(Buffer *, const void *, u_int);
char *buffer_get_cstring(Buffer *, u_int *);
void buffer_put_cstring(Buffer *, const char *);
-#define buffer_skip_string(b) \
- do { u_int l = buffer_get_int(b); buffer_consume(b, l); } while (0)
+#define buffer_skip_string(b) (void)buffer_get_string_ptr(b, NULL);
int buffer_put_bignum_ret(Buffer *, const BIGNUM *);
int buffer_get_bignum_ret(Buffer *, BIGNUM *);
@@ -83,16 +84,11 @@
int buffer_get_int64_ret(u_int64_t *, Buffer *);
void *buffer_get_string_ret(Buffer *, u_int *);
char *buffer_get_cstring_ret(Buffer *, u_int *);
-void *buffer_get_string_ptr_ret(Buffer *, u_int *);
-int buffer_get_char_ret(u_char *, Buffer *);
+const void *buffer_get_string_ptr_ret(Buffer *, u_int *);
+int buffer_get_char_ret(char *, Buffer *);
-void *buffer_get_bignum2_as_string_ret(Buffer *, u_int *);
-void *buffer_get_bignum2_as_string(Buffer *, u_int *);
-void buffer_put_bignum2_from_string(Buffer *, const u_char *, u_int);
-
#ifdef OPENSSL_HAS_ECC
#include <openssl/ec.h>
-
int buffer_put_ecpoint_ret(Buffer *, const EC_GROUP *, const EC_POINT *);
void buffer_put_ecpoint(Buffer *, const EC_GROUP *, const EC_POINT *);
int buffer_get_ecpoint_ret(Buffer *, const EC_GROUP *, EC_POINT *);
@@ -99,4 +95,5 @@
void buffer_get_ecpoint(Buffer *, const EC_GROUP *, EC_POINT *);
#endif
-#endif /* BUFFER_H */
+#endif /* BUFFER_H */
+
Modified: trunk/crypto/openssh/canohost.c
===================================================================
--- trunk/crypto/openssh/canohost.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/canohost.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: canohost.c,v 1.70 2014/01/19 04:17:29 dtucker Exp $ */
+/* $OpenBSD: canohost.c,v 1.73 2016/03/07 19:02:43 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -16,6 +16,7 @@
#include <sys/types.h>
#include <sys/socket.h>
+#include <sys/un.h>
#include <netinet/in.h>
#include <arpa/inet.h>
@@ -34,147 +35,6 @@
#include "canohost.h"
#include "misc.h"
-static void check_ip_options(int, char *);
-static char *canonical_host_ip = NULL;
-static int cached_port = -1;
-
-/*
- * Return the canonical name of the host at the other end of the socket. The
- * caller should free the returned string.
- */
-
-static char *
-get_remote_hostname(int sock, int use_dns)
-{
- struct sockaddr_storage from;
- socklen_t fromlen;
- struct addrinfo hints, *ai, *aitop;
- char name[NI_MAXHOST], ntop[NI_MAXHOST], ntop2[NI_MAXHOST];
-
- /* Get IP address of client. */
- fromlen = sizeof(from);
- memset(&from, 0, sizeof(from));
- if (getpeername(sock, (struct sockaddr *)&from, &fromlen) < 0) {
- debug("getpeername failed: %.100s", strerror(errno));
- cleanup_exit(255);
- }
-
- if (from.ss_family == AF_INET)
- check_ip_options(sock, ntop);
-
- ipv64_normalise_mapped(&from, &fromlen);
-
- if (from.ss_family == AF_INET6)
- fromlen = sizeof(struct sockaddr_in6);
-
- if (getnameinfo((struct sockaddr *)&from, fromlen, ntop, sizeof(ntop),
- NULL, 0, NI_NUMERICHOST) != 0)
- fatal("get_remote_hostname: getnameinfo NI_NUMERICHOST failed");
-
- if (!use_dns)
- return xstrdup(ntop);
-
- debug3("Trying to reverse map address %.100s.", ntop);
- /* Map the IP address to a host name. */
- if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
- NULL, 0, NI_NAMEREQD) != 0) {
- /* Host name not found. Use ip address. */
- return xstrdup(ntop);
- }
-
- /*
- * if reverse lookup result looks like a numeric hostname,
- * someone is trying to trick us by PTR record like following:
- * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
- */
- memset(&hints, 0, sizeof(hints));
- hints.ai_socktype = SOCK_DGRAM; /*dummy*/
- hints.ai_flags = AI_NUMERICHOST;
- if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
- logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
- name, ntop);
- freeaddrinfo(ai);
- return xstrdup(ntop);
- }
-
- /* Names are stores in lowercase. */
- lowercase(name);
-
- /*
- * Map it back to an IP address and check that the given
- * address actually is an address of this host. This is
- * necessary because anyone with access to a name server can
- * define arbitrary names for an IP address. Mapping from
- * name to IP address can be trusted better (but can still be
- * fooled if the intruder has access to the name server of
- * the domain).
- */
- memset(&hints, 0, sizeof(hints));
- hints.ai_family = from.ss_family;
- hints.ai_socktype = SOCK_STREAM;
- if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
- logit("reverse mapping checking getaddrinfo for %.700s "
- "[%s] failed - POSSIBLE BREAK-IN ATTEMPT!", name, ntop);
- return xstrdup(ntop);
- }
- /* Look for the address from the list of addresses. */
- for (ai = aitop; ai; ai = ai->ai_next) {
- if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
- sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
- (strcmp(ntop, ntop2) == 0))
- break;
- }
- freeaddrinfo(aitop);
- /* If we reached the end of the list, the address was not there. */
- if (!ai) {
- /* Address not found for the host name. */
- logit("Address %.100s maps to %.600s, but this does not "
- "map back to the address - POSSIBLE BREAK-IN ATTEMPT!",
- ntop, name);
- return xstrdup(ntop);
- }
- return xstrdup(name);
-}
-
-/*
- * If IP options are supported, make sure there are none (log and
- * disconnect them if any are found). Basically we are worried about
- * source routing; it can be used to pretend you are somebody
- * (ip-address) you are not. That itself may be "almost acceptable"
- * under certain circumstances, but rhosts autentication is useless
- * if source routing is accepted. Notice also that if we just dropped
- * source routing here, the other side could use IP spoofing to do
- * rest of the interaction and could still bypass security. So we
- * exit here if we detect any IP options.
- */
-/* IPv4 only */
-static void
-check_ip_options(int sock, char *ipaddr)
-{
-#ifdef IP_OPTIONS
- u_char options[200];
- char text[sizeof(options) * 3 + 1];
- socklen_t option_size, i;
- int ipproto;
- struct protoent *ip;
-
- if ((ip = getprotobyname("ip")) != NULL)
- ipproto = ip->p_proto;
- else
- ipproto = IPPROTO_IP;
- option_size = sizeof(options);
- if (getsockopt(sock, ipproto, IP_OPTIONS, options,
- &option_size) >= 0 && option_size != 0) {
- text[0] = '\0';
- for (i = 0; i < option_size; i++)
- snprintf(text + i*3, sizeof(text) - i*3,
- " %2.2x", options[i]);
- fatal("Connection from %.100s with IP options:%.800s",
- ipaddr, text);
- }
-#endif /* IP_OPTIONS */
-}
-
void
ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)
{
@@ -201,38 +61,6 @@
}
/*
- * Return the canonical name of the host in the other side of the current
- * connection. The host name is cached, so it is efficient to call this
- * several times.
- */
-
-const char *
-get_canonical_hostname(int use_dns)
-{
- char *host;
- static char *canonical_host_name = NULL;
- static char *remote_ip = NULL;
-
- /* Check if we have previously retrieved name with same option. */
- if (use_dns && canonical_host_name != NULL)
- return canonical_host_name;
- if (!use_dns && remote_ip != NULL)
- return remote_ip;
-
- /* Get the real hostname if socket; otherwise return UNKNOWN. */
- if (packet_connection_is_on_socket())
- host = get_remote_hostname(packet_get_connection_in(), use_dns);
- else
- host = "UNKNOWN";
-
- if (use_dns)
- canonical_host_name = host;
- else
- remote_ip = host;
- return host;
-}
-
-/*
* Returns the local/remote IP-address/hostname of socket as a string.
* The returned string must be freed.
*/
@@ -249,29 +77,37 @@
memset(&addr, 0, sizeof(addr));
if (remote) {
- if (getpeername(sock, (struct sockaddr *)&addr, &addrlen)
- < 0)
+ if (getpeername(sock, (struct sockaddr *)&addr, &addrlen) != 0)
return NULL;
} else {
- if (getsockname(sock, (struct sockaddr *)&addr, &addrlen)
- < 0)
+ if (getsockname(sock, (struct sockaddr *)&addr, &addrlen) != 0)
return NULL;
}
/* Work around Linux IPv6 weirdness */
- if (addr.ss_family == AF_INET6)
+ if (addr.ss_family == AF_INET6) {
addrlen = sizeof(struct sockaddr_in6);
+ ipv64_normalise_mapped(&addr, &addrlen);
+ }
- ipv64_normalise_mapped(&addr, &addrlen);
-
- /* Get the address in ascii. */
- if ((r = getnameinfo((struct sockaddr *)&addr, addrlen, ntop,
- sizeof(ntop), NULL, 0, flags)) != 0) {
- error("get_socket_address: getnameinfo %d failed: %s", flags,
- ssh_gai_strerror(r));
+ switch (addr.ss_family) {
+ case AF_INET:
+ case AF_INET6:
+ /* Get the address in ascii. */
+ if ((r = getnameinfo((struct sockaddr *)&addr, addrlen, ntop,
+ sizeof(ntop), NULL, 0, flags)) != 0) {
+ error("%s: getnameinfo %d failed: %s", __func__,
+ flags, ssh_gai_strerror(r));
+ return NULL;
+ }
+ return xstrdup(ntop);
+ case AF_UNIX:
+ /* Get the Unix domain socket path. */
+ return xstrdup(((struct sockaddr_un *)&addr)->sun_path);
+ default:
+ /* We can't look up remote Unix domain sockets. */
return NULL;
}
- return xstrdup(ntop);
}
char *
@@ -305,7 +141,8 @@
/* Handle the case where we were passed a pipe */
if (gethostname(myname, sizeof(myname)) == -1) {
- verbose("get_local_name: gethostname: %s", strerror(errno));
+ verbose("%s: gethostname: %s", __func__, strerror(errno));
+ host = xstrdup("UNKNOWN");
} else {
host = xstrdup(myname);
}
@@ -313,51 +150,9 @@
return host;
}
-void
-clear_cached_addr(void)
-{
- free(canonical_host_ip);
- canonical_host_ip = NULL;
- cached_port = -1;
-}
-
-/*
- * Returns the IP-address of the remote host as a string. The returned
- * string must not be freed.
- */
-
-const char *
-get_remote_ipaddr(void)
-{
- /* Check whether we have cached the ipaddr. */
- if (canonical_host_ip == NULL) {
- if (packet_connection_is_on_socket()) {
- canonical_host_ip =
- get_peer_ipaddr(packet_get_connection_in());
- if (canonical_host_ip == NULL)
- cleanup_exit(255);
- } else {
- /* If not on socket, return UNKNOWN. */
- canonical_host_ip = xstrdup("UNKNOWN");
- }
- }
- return canonical_host_ip;
-}
-
-const char *
-get_remote_name_or_ip(u_int utmp_len, int use_dns)
-{
- static const char *remote = "";
- if (utmp_len > 0)
- remote = get_canonical_hostname(use_dns);
- if (utmp_len == 0 || strlen(remote) > utmp_len)
- remote = get_remote_ipaddr();
- return remote;
-}
-
/* Returns the local/remote port for the socket. */
-int
+static int
get_sock_port(int sock, int local)
{
struct sockaddr_storage from;
@@ -384,30 +179,18 @@
if (from.ss_family == AF_INET6)
fromlen = sizeof(struct sockaddr_in6);
+ /* Non-inet sockets don't have a port number. */
+ if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
+ return 0;
+
/* Return port number. */
if ((r = getnameinfo((struct sockaddr *)&from, fromlen, NULL, 0,
strport, sizeof(strport), NI_NUMERICSERV)) != 0)
- fatal("get_sock_port: getnameinfo NI_NUMERICSERV failed: %s",
+ fatal("%s: getnameinfo NI_NUMERICSERV failed: %s", __func__,
ssh_gai_strerror(r));
return atoi(strport);
}
-/* Returns remote/local port number for the current connection. */
-
-static int
-get_port(int local)
-{
- /*
- * If the connection is not a socket, return 65535. This is
- * intentionally chosen to be an unprivileged port number.
- */
- if (!packet_connection_is_on_socket())
- return 65535;
-
- /* Get socket and return the port number. */
- return get_sock_port(packet_get_connection_in(), local);
-}
-
int
get_peer_port(int sock)
{
@@ -415,17 +198,7 @@
}
int
-get_remote_port(void)
+get_local_port(int sock)
{
- /* Cache to avoid getpeername() on a dead connection */
- if (cached_port == -1)
- cached_port = get_port(0);
-
- return cached_port;
+ return get_sock_port(sock, 1);
}
-
-int
-get_local_port(void)
-{
- return get_port(1);
-}
Modified: trunk/crypto/openssh/canohost.h
===================================================================
--- trunk/crypto/openssh/canohost.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/canohost.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: canohost.h,v 1.11 2009/05/27 06:31:25 andreas Exp $ */
+/* $OpenBSD: canohost.h,v 1.12 2016/03/07 19:02:43 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -12,18 +12,15 @@
* called by a name other than "ssh" or "Secure Shell".
*/
-const char *get_canonical_hostname(int);
-const char *get_remote_ipaddr(void);
-const char *get_remote_name_or_ip(u_int, int);
+#ifndef _CANOHOST_H
+#define _CANOHOST_H
char *get_peer_ipaddr(int);
int get_peer_port(int);
char *get_local_ipaddr(int);
char *get_local_name(int);
+int get_local_port(int);
-int get_remote_port(void);
-int get_local_port(void);
-int get_sock_port(int, int);
-void clear_cached_addr(void);
+#endif /* _CANOHOST_H */
void ipv64_normalise_mapped(struct sockaddr_storage *, socklen_t *);
Modified: trunk/crypto/openssh/chacha.h
===================================================================
--- trunk/crypto/openssh/chacha.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/chacha.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: chacha.h,v 1.1 2013/11/21 00:45:44 djm Exp $ */
+/* $OpenBSD: chacha.h,v 1.3 2014/05/02 03:27:54 djm Exp $ */
/*
chacha-merged.c version 20080118
Modified: trunk/crypto/openssh/channels.c
===================================================================
--- trunk/crypto/openssh/channels.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/channels.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.331 2014/02/26 20:29:29 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.351 2016/07/19 11:38:53 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -42,6 +42,8 @@
#include "includes.h"
#include <sys/types.h>
+#include <sys/param.h> /* MIN MAX */
+#include <sys/stat.h>
#include <sys/ioctl.h>
#include <sys/un.h>
#include <sys/socket.h>
@@ -55,6 +57,9 @@
#include <errno.h>
#include <fcntl.h>
#include <netdb.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -107,10 +112,15 @@
* a corrupt remote server from accessing arbitrary TCP/IP ports on our local
* network (which might be behind a firewall).
*/
+/* XXX: streamlocal wants a path instead of host:port */
+/* Overload host_to_connect; we could just make this match Forward */
+/* XXX - can we use listen_host instead of listen_path? */
typedef struct {
char *host_to_connect; /* Connect to 'host'. */
- u_short port_to_connect; /* Connect to 'port'. */
- u_short listen_port; /* Remote side should listen port number. */
+ int port_to_connect; /* Connect to 'port'. */
+ char *listen_host; /* Remote side should listen address. */
+ char *listen_path; /* Remote side should listen path. */
+ int listen_port; /* Remote side should listen port. */
} ForwardPermission;
/* List of all permitted host/port pairs to connect by the user. */
@@ -128,6 +138,9 @@
/* special-case port number meaning allow any port */
#define FWD_PERMIT_ANY_PORT 0
+/* special-case wildcard meaning allow any host */
+#define FWD_PERMIT_ANY_HOST "*"
+
/*
* If this is true, all opens are permitted. This is the case on the server
* on which we have to trust the client anyway, and the user could do
@@ -151,6 +164,9 @@
static char *x11_saved_data = NULL;
static u_int x11_saved_data_len = 0;
+/* Deadline after which all X11 connections are refused */
+static u_int x11_refuse_time;
+
/*
* Fake X11 authentication data. This is what the server will be sending us;
* we should replace any occurrences of this by the real data.
@@ -296,7 +312,7 @@
if (channels_alloc > 10000)
fatal("channel_new: internal error: channels_alloc %d "
"too big.", channels_alloc);
- channels = xrealloc(channels, channels_alloc + 10,
+ channels = xreallocarray(channels, channels_alloc + 10,
sizeof(Channel *));
channels_alloc += 10;
debug2("channel: expanding %d", channels_alloc);
@@ -473,6 +489,8 @@
case SSH_CHANNEL_PORT_LISTENER:
case SSH_CHANNEL_RPORT_LISTENER:
case SSH_CHANNEL_X11_LISTENER:
+ case SSH_CHANNEL_UNIX_LISTENER:
+ case SSH_CHANNEL_RUNIX_LISTENER:
channel_close_fd(&c->sock);
channel_free(c);
break;
@@ -535,6 +553,8 @@
case SSH_CHANNEL_CONNECTING:
case SSH_CHANNEL_ZOMBIE:
case SSH_CHANNEL_ABANDONED:
+ case SSH_CHANNEL_UNIX_LISTENER:
+ case SSH_CHANNEL_RUNIX_LISTENER:
continue;
case SSH_CHANNEL_LARVAL:
if (!compat20)
@@ -581,6 +601,8 @@
case SSH_CHANNEL_CONNECTING:
case SSH_CHANNEL_ZOMBIE:
case SSH_CHANNEL_ABANDONED:
+ case SSH_CHANNEL_UNIX_LISTENER:
+ case SSH_CHANNEL_RUNIX_LISTENER:
continue;
case SSH_CHANNEL_LARVAL:
case SSH_CHANNEL_AUTH_SOCKET:
@@ -631,6 +653,8 @@
case SSH_CHANNEL_ABANDONED:
case SSH_CHANNEL_MUX_CLIENT:
case SSH_CHANNEL_MUX_LISTENER:
+ case SSH_CHANNEL_UNIX_LISTENER:
+ case SSH_CHANNEL_RUNIX_LISTENER:
continue;
case SSH_CHANNEL_LARVAL:
case SSH_CHANNEL_OPENING:
@@ -641,7 +665,7 @@
case SSH_CHANNEL_INPUT_DRAINING:
case SSH_CHANNEL_OUTPUT_DRAINING:
snprintf(buf, sizeof buf,
- " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d cc %d)\r\n",
+ " #%d %.300s (t%d r%d i%u/%d o%u/%d fd %d/%d cc %d)\r\n",
c->self, c->remote_name,
c->type, c->remote_id,
c->istate, buffer_len(&c->input),
@@ -655,7 +679,7 @@
}
}
buffer_append(&buffer, "\0", 1);
- cp = xstrdup(buffer_ptr(&buffer));
+ cp = xstrdup((char *)buffer_ptr(&buffer));
buffer_free(&buffer);
return cp;
}
@@ -894,6 +918,13 @@
u_char *ucp;
u_int proto_len, data_len;
+ /* Is this being called after the refusal deadline? */
+ if (x11_refuse_time != 0 && (u_int)monotime() >= x11_refuse_time) {
+ verbose("Rejected X11 connection after ForwardX11Timeout "
+ "expired");
+ return -1;
+ }
+
/* Check if the fixed size part of the packet is in buffer. */
if (buffer_len(b) < 12)
return 0;
@@ -1041,7 +1072,7 @@
len = sizeof(s4_req);
if (have < len)
return 0;
- p = buffer_ptr(&c->input);
+ p = (char *)buffer_ptr(&c->input);
need = 1;
/* SOCKS4A uses an invalid IP address 0.0.0.x */
@@ -1071,7 +1102,7 @@
buffer_get(&c->input, (char *)&s4_req.dest_port, 2);
buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
have = buffer_len(&c->input);
- p = buffer_ptr(&c->input);
+ p = (char *)buffer_ptr(&c->input);
if (memchr(p, '\0', have) == NULL)
fatal("channel %d: decode socks4: user not nul terminated",
c->self);
@@ -1091,7 +1122,7 @@
c->path = xstrdup(host);
} else { /* SOCKS4A: two strings */
have = buffer_len(&c->input);
- p = buffer_ptr(&c->input);
+ p = (char *)buffer_ptr(&c->input);
len = strlen(p);
debug2("channel %d: decode socks4a: host %s/%d",
c->self, p, len);
@@ -1386,10 +1417,9 @@
static void
port_open_helper(Channel *c, char *rtype)
{
- int direct;
char buf[1024];
char *local_ipaddr = get_local_ipaddr(c->sock);
- int local_port = c->sock == -1 ? 65536 : get_sock_port(c->sock, 1);
+ int local_port = c->sock == -1 ? 65536 : get_local_port(c->sock);
char *remote_ipaddr = get_peer_ipaddr(c->sock);
int remote_port = get_peer_port(c->sock);
@@ -1400,8 +1430,6 @@
remote_port = 65535;
}
- direct = (strcmp(rtype, "direct-tcpip") == 0);
-
snprintf(buf, sizeof buf,
"%s: listening port %d for %.100s port %d, "
"connect from %.200s port %d to %.100s port %d",
@@ -1417,18 +1445,29 @@
packet_put_int(c->self);
packet_put_int(c->local_window_max);
packet_put_int(c->local_maxpacket);
- if (direct) {
+ if (strcmp(rtype, "direct-tcpip") == 0) {
/* target host, port */
packet_put_cstring(c->path);
packet_put_int(c->host_port);
+ } else if (strcmp(rtype, "direct-streamlocal at openssh.com") == 0) {
+ /* target path */
+ packet_put_cstring(c->path);
+ } else if (strcmp(rtype, "forwarded-streamlocal at openssh.com") == 0) {
+ /* listen path */
+ packet_put_cstring(c->path);
} else {
/* listen address, port */
packet_put_cstring(c->path);
packet_put_int(local_port);
}
- /* originator host and port */
- packet_put_cstring(remote_ipaddr);
- packet_put_int((u_int)remote_port);
+ if (strcmp(rtype, "forwarded-streamlocal at openssh.com") == 0) {
+ /* reserved for future owner/mode info */
+ packet_put_cstring("");
+ } else {
+ /* originator host and port */
+ packet_put_cstring(remote_ipaddr);
+ packet_put_int((u_int)remote_port);
+ }
packet_send();
} else {
packet_start(SSH_MSG_PORT_OPEN);
@@ -1457,6 +1496,12 @@
error("setsockopt SO_REUSEADDR fd %d: %s", fd, strerror(errno));
}
+void
+channel_set_x11_refuse_time(u_int refuse_time)
+{
+ x11_refuse_time = refuse_time;
+}
+
/*
* This socket is listening for connections to a forwarded TCP/IP port.
*/
@@ -1478,14 +1523,18 @@
if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
nextstate = SSH_CHANNEL_OPENING;
rtype = "forwarded-tcpip";
+ } else if (c->type == SSH_CHANNEL_RUNIX_LISTENER) {
+ nextstate = SSH_CHANNEL_OPENING;
+ rtype = "forwarded-streamlocal at openssh.com";
+ } else if (c->host_port == PORT_STREAMLOCAL) {
+ nextstate = SSH_CHANNEL_OPENING;
+ rtype = "direct-streamlocal at openssh.com";
+ } else if (c->host_port == 0) {
+ nextstate = SSH_CHANNEL_DYNAMIC;
+ rtype = "dynamic-tcpip";
} else {
- if (c->host_port == 0) {
- nextstate = SSH_CHANNEL_DYNAMIC;
- rtype = "dynamic-tcpip";
- } else {
- nextstate = SSH_CHANNEL_OPENING;
- rtype = "direct-tcpip";
- }
+ nextstate = SSH_CHANNEL_OPENING;
+ rtype = "direct-tcpip";
}
addrlen = sizeof(addr);
@@ -1498,7 +1547,8 @@
c->notbefore = monotime() + 1;
return;
}
- set_nodelay(newsock);
+ if (c->host_port != PORT_STREAMLOCAL)
+ set_nodelay(newsock);
nc = channel_new(rtype, nextstate, newsock, newsock, -1,
c->local_window_max, c->local_maxpacket, 0, rtype, 1);
nc->listening_port = c->listening_port;
@@ -1849,13 +1899,13 @@
if (buffer_len(&c->input) < need) {
rlen = need - buffer_len(&c->input);
len = read(c->rfd, buf, MIN(rlen, CHAN_RBUF));
+ if (len < 0 && (errno == EINTR || errno == EAGAIN))
+ return buffer_len(&c->input);
if (len <= 0) {
- if (errno != EINTR && errno != EAGAIN) {
- debug2("channel %d: ctl read<=0 rfd %d len %d",
- c->self, c->rfd, len);
- chan_read_failed(c);
- return 0;
- }
+ debug2("channel %d: ctl read<=0 rfd %d len %d",
+ c->self, c->rfd, len);
+ chan_read_failed(c);
+ return 0;
} else
buffer_append(&c->input, buf, len);
}
@@ -1987,6 +2037,8 @@
channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener;
+ channel_pre[SSH_CHANNEL_UNIX_LISTENER] = &channel_pre_listener;
+ channel_pre[SSH_CHANNEL_RUNIX_LISTENER] = &channel_pre_listener;
channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
@@ -1997,6 +2049,8 @@
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open;
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener;
+ channel_post[SSH_CHANNEL_UNIX_LISTENER] = &channel_post_port_listener;
+ channel_post[SSH_CHANNEL_RUNIX_LISTENER] = &channel_post_port_listener;
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
@@ -2151,14 +2205,14 @@
nfdset = howmany(n+1, NFDBITS);
/* Explicitly test here, because xrealloc isn't always called */
- if (nfdset && SIZE_T_MAX / nfdset < sizeof(fd_mask))
+ if (nfdset && SIZE_MAX / nfdset < sizeof(fd_mask))
fatal("channel_prepare_select: max_fd (%d) is too large", n);
sz = nfdset * sizeof(fd_mask);
/* perhaps check sz < nalloc/2 and shrink? */
if (*readsetp == NULL || sz > *nallocp) {
- *readsetp = xrealloc(*readsetp, nfdset, sizeof(fd_mask));
- *writesetp = xrealloc(*writesetp, nfdset, sizeof(fd_mask));
+ *readsetp = xreallocarray(*readsetp, nfdset, sizeof(fd_mask));
+ *writesetp = xreallocarray(*writesetp, nfdset, sizeof(fd_mask));
*nallocp = sz;
}
*maxfdp = n;
@@ -2235,7 +2289,7 @@
packet_put_int(c->remote_id);
packet_put_string(data, dlen);
packet_send();
- c->remote_window -= dlen + 4;
+ c->remote_window -= dlen;
free(data);
}
continue;
@@ -2311,11 +2365,11 @@
/* -- protocol input */
/* ARGSUSED */
-void
+int
channel_input_data(int type, u_int32_t seq, void *ctxt)
{
int id;
- char *data;
+ const u_char *data;
u_int data_len, win_len;
Channel *c;
@@ -2328,7 +2382,7 @@
/* Ignore any data for non-open channels (might happen on close) */
if (c->type != SSH_CHANNEL_OPEN &&
c->type != SSH_CHANNEL_X11_OPEN)
- return;
+ return 0;
/* Get the data. */
data = packet_get_string_ptr(&data_len);
@@ -2348,7 +2402,7 @@
c->local_window -= win_len;
c->local_consumed += win_len;
}
- return;
+ return 0;
}
if (compat20) {
@@ -2359,7 +2413,7 @@
if (win_len > c->local_window) {
logit("channel %d: rcvd too much data %d, win %d",
c->self, win_len, c->local_window);
- return;
+ return 0;
}
c->local_window -= win_len;
}
@@ -2368,10 +2422,11 @@
else
buffer_append(&c->output, data, data_len);
packet_check_eom();
+ return 0;
}
/* ARGSUSED */
-void
+int
channel_input_extended_data(int type, u_int32_t seq, void *ctxt)
{
int id;
@@ -2387,7 +2442,7 @@
packet_disconnect("Received extended_data for bad channel %d.", id);
if (c->type != SSH_CHANNEL_OPEN) {
logit("channel %d: ext data for non open", id);
- return;
+ return 0;
}
if (c->flags & CHAN_EOF_RCVD) {
if (datafellows & SSH_BUG_EXTEOF)
@@ -2401,7 +2456,7 @@
c->extended_usage != CHAN_EXTENDED_WRITE ||
tcode != SSH2_EXTENDED_DATA_STDERR) {
logit("channel %d: bad ext data", c->self);
- return;
+ return 0;
}
data = packet_get_string(&data_len);
packet_check_eom();
@@ -2409,16 +2464,17 @@
logit("channel %d: rcvd too much extended_data %d, win %d",
c->self, data_len, c->local_window);
free(data);
- return;
+ return 0;
}
debug2("channel %d: rcvd ext data %d", c->self, data_len);
c->local_window -= data_len;
buffer_append(&c->extended, data, data_len);
free(data);
+ return 0;
}
/* ARGSUSED */
-void
+int
channel_input_ieof(int type, u_int32_t seq, void *ctxt)
{
int id;
@@ -2438,11 +2494,11 @@
if (buffer_len(&c->input) == 0)
chan_ibuf_empty(c);
}
-
+ return 0;
}
/* ARGSUSED */
-void
+int
channel_input_close(int type, u_int32_t seq, void *ctxt)
{
int id;
@@ -2477,11 +2533,12 @@
buffer_clear(&c->input);
c->type = SSH_CHANNEL_OUTPUT_DRAINING;
}
+ return 0;
}
/* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
/* ARGSUSED */
-void
+int
channel_input_oclose(int type, u_int32_t seq, void *ctxt)
{
int id = packet_get_int();
@@ -2491,10 +2548,11 @@
if (c == NULL)
packet_disconnect("Received oclose for nonexistent channel %d.", id);
chan_rcvd_oclose(c);
+ return 0;
}
/* ARGSUSED */
-void
+int
channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt)
{
int id = packet_get_int();
@@ -2508,10 +2566,11 @@
packet_disconnect("Received close confirmation for "
"non-closed channel %d (type %d).", id, c->type);
channel_free(c);
+ return 0;
}
/* ARGSUSED */
-void
+int
channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt)
{
int id, remote_id;
@@ -2540,6 +2599,7 @@
c->remote_window, c->remote_maxpacket);
}
packet_check_eom();
+ return 0;
}
static char *
@@ -2559,7 +2619,7 @@
}
/* ARGSUSED */
-void
+int
channel_input_open_failure(int type, u_int32_t seq, void *ctxt)
{
int id, reason;
@@ -2591,18 +2651,19 @@
packet_check_eom();
/* Schedule the channel for cleanup/deletion. */
chan_mark_dead(c);
+ return 0;
}
/* ARGSUSED */
-void
+int
channel_input_window_adjust(int type, u_int32_t seq, void *ctxt)
{
Channel *c;
int id;
- u_int adjust;
+ u_int adjust, tmp;
if (!compat20)
- return;
+ return 0;
/* Get the channel number and verify it. */
id = packet_get_int();
@@ -2610,16 +2671,20 @@
if (c == NULL) {
logit("Received window adjust for non-open channel %d.", id);
- return;
+ return 0;
}
adjust = packet_get_int();
packet_check_eom();
debug2("channel %d: rcvd adjust %u", id, adjust);
- c->remote_window += adjust;
+ if ((tmp = c->remote_window + adjust) < c->remote_window)
+ fatal("channel %d: adjust %u overflows remote window %u",
+ id, adjust, c->remote_window);
+ c->remote_window = tmp;
+ return 0;
}
/* ARGSUSED */
-void
+int
channel_input_port_open(int type, u_int32_t seq, void *ctxt)
{
Channel *c = NULL;
@@ -2637,7 +2702,7 @@
originator_string = xstrdup("unknown (remote did not supply name)");
}
packet_check_eom();
- c = channel_connect_to(host, host_port,
+ c = channel_connect_to_port(host, host_port,
"connected socket", originator_string);
free(originator_string);
free(host);
@@ -2647,10 +2712,11 @@
packet_send();
} else
c->remote_id = remote_id;
+ return 0;
}
/* ARGSUSED */
-void
+int
channel_input_status_confirm(int type, u_int32_t seq, void *ctxt)
{
Channel *c;
@@ -2667,15 +2733,15 @@
if ((c = channel_lookup(id)) == NULL) {
logit("channel_input_status_confirm: %d: unknown", id);
- return;
+ return 0;
}
- ;
if ((cc = TAILQ_FIRST(&c->status_confirms)) == NULL)
- return;
+ return 0;
cc->cb(type, c, cc->ctx);
TAILQ_REMOVE(&c->status_confirms, cc, entry);
explicit_bzero(cc, sizeof(*cc));
free(cc);
+ return 0;
}
/* -- tcp forwarding */
@@ -2700,10 +2766,11 @@
* "0.0.0.0" -> wildcard v4/v6 if SSH_OLD_FORWARD_ADDR
* "" (empty string), "*" -> wildcard v4/v6
* "localhost" -> loopback v4/v6
+ * "127.0.0.1" / "::1" -> accepted even if gateway_ports isn't set
*/
static const char *
channel_fwd_bind_addr(const char *listen_addr, int *wildcardp,
- int is_client, int gateway_ports)
+ int is_client, struct ForwardOptions *fwd_opts)
{
const char *addr = NULL;
int wildcard = 0;
@@ -2710,13 +2777,13 @@
if (listen_addr == NULL) {
/* No address specified: default to gateway_ports setting */
- if (gateway_ports)
+ if (fwd_opts->gateway_ports)
wildcard = 1;
- } else if (gateway_ports || is_client) {
+ } else if (fwd_opts->gateway_ports || is_client) {
if (((datafellows & SSH_OLD_FORWARD_ADDR) &&
strcmp(listen_addr, "0.0.0.0") == 0 && is_client == 0) ||
*listen_addr == '\0' || strcmp(listen_addr, "*") == 0 ||
- (!is_client && gateway_ports == 1)) {
+ (!is_client && fwd_opts->gateway_ports == 1)) {
wildcard = 1;
/*
* Notify client if they requested a specific listen
@@ -2729,9 +2796,20 @@
"\"%s\" overridden by server "
"GatewayPorts", listen_addr);
}
+ } else if (strcmp(listen_addr, "localhost") != 0 ||
+ strcmp(listen_addr, "127.0.0.1") == 0 ||
+ strcmp(listen_addr, "::1") == 0) {
+ /* Accept localhost address when GatewayPorts=yes */
+ addr = listen_addr;
}
- else if (strcmp(listen_addr, "localhost") != 0)
- addr = listen_addr;
+ } else if (strcmp(listen_addr, "127.0.0.1") == 0 ||
+ strcmp(listen_addr, "::1") == 0) {
+ /*
+ * If a specific IPv4/IPv6 localhost address has been
+ * requested then accept it even if gateway_ports is in
+ * effect. This allows the client to prefer IPv4 or IPv6.
+ */
+ addr = listen_addr;
}
if (wildcardp != NULL)
*wildcardp = wildcard;
@@ -2739,9 +2817,8 @@
}
static int
-channel_setup_fwd_listener(int type, const char *listen_addr,
- u_short listen_port, int *allocated_listen_port,
- const char *host_to_connect, u_short port_to_connect, int gateway_ports)
+channel_setup_fwd_listener_tcpip(int type, struct Forward *fwd,
+ int *allocated_listen_port, struct ForwardOptions *fwd_opts)
{
Channel *c;
int sock, r, success = 0, wildcard = 0, is_client;
@@ -2750,23 +2827,27 @@
char ntop[NI_MAXHOST], strport[NI_MAXSERV];
in_port_t *lport_p;
- host = (type == SSH_CHANNEL_RPORT_LISTENER) ?
- listen_addr : host_to_connect;
is_client = (type == SSH_CHANNEL_PORT_LISTENER);
- if (host == NULL) {
- error("No forward host name.");
- return 0;
+ if (is_client && fwd->connect_path != NULL) {
+ host = fwd->connect_path;
+ } else {
+ host = (type == SSH_CHANNEL_RPORT_LISTENER) ?
+ fwd->listen_host : fwd->connect_host;
+ if (host == NULL) {
+ error("No forward host name.");
+ return 0;
+ }
+ if (strlen(host) >= NI_MAXHOST) {
+ error("Forward host name too long.");
+ return 0;
+ }
}
- if (strlen(host) >= NI_MAXHOST) {
- error("Forward host name too long.");
- return 0;
- }
/* Determine the bind address, cf. channel_fwd_bind_addr() comment */
- addr = channel_fwd_bind_addr(listen_addr, &wildcard,
- is_client, gateway_ports);
- debug3("channel_setup_fwd_listener: type %d wildcard %d addr %s",
+ addr = channel_fwd_bind_addr(fwd->listen_host, &wildcard,
+ is_client, fwd_opts);
+ debug3("%s: type %d wildcard %d addr %s", __func__,
type, wildcard, (addr == NULL) ? "NULL" : addr);
/*
@@ -2777,7 +2858,7 @@
hints.ai_family = IPv4or6;
hints.ai_flags = wildcard ? AI_PASSIVE : 0;
hints.ai_socktype = SOCK_STREAM;
- snprintf(strport, sizeof strport, "%d", listen_port);
+ snprintf(strport, sizeof strport, "%d", fwd->listen_port);
if ((r = getaddrinfo(addr, strport, &hints, &aitop)) != 0) {
if (addr == NULL) {
/* This really shouldn't happen */
@@ -2784,8 +2865,7 @@
packet_disconnect("getaddrinfo: fatal error: %s",
ssh_gai_strerror(r));
} else {
- error("channel_setup_fwd_listener: "
- "getaddrinfo(%.64s): %s", addr,
+ error("%s: getaddrinfo(%.64s): %s", __func__, addr,
ssh_gai_strerror(r));
}
return 0;
@@ -2809,13 +2889,13 @@
* If allocating a port for -R forwards, then use the
* same port for all address families.
*/
- if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port == 0 &&
+ if (type == SSH_CHANNEL_RPORT_LISTENER && fwd->listen_port == 0 &&
allocated_listen_port != NULL && *allocated_listen_port > 0)
*lport_p = htons(*allocated_listen_port);
if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
- error("channel_setup_fwd_listener: getnameinfo failed");
+ error("%s: getnameinfo failed", __func__);
continue;
}
/* Create a port to listen for the host. */
@@ -2852,13 +2932,13 @@
}
/*
- * listen_port == 0 requests a dynamically allocated port -
+ * fwd->listen_port == 0 requests a dynamically allocated port -
* record what we got.
*/
- if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port == 0 &&
+ if (type == SSH_CHANNEL_RPORT_LISTENER && fwd->listen_port == 0 &&
allocated_listen_port != NULL &&
*allocated_listen_port == 0) {
- *allocated_listen_port = get_sock_port(sock, 1);
+ *allocated_listen_port = get_local_port(sock);
debug("Allocated listen port %d",
*allocated_listen_port);
}
@@ -2868,25 +2948,99 @@
CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
0, "port listener", 1);
c->path = xstrdup(host);
- c->host_port = port_to_connect;
+ c->host_port = fwd->connect_port;
c->listening_addr = addr == NULL ? NULL : xstrdup(addr);
- if (listen_port == 0 && allocated_listen_port != NULL &&
+ if (fwd->listen_port == 0 && allocated_listen_port != NULL &&
!(datafellows & SSH_BUG_DYNAMIC_RPORT))
c->listening_port = *allocated_listen_port;
else
- c->listening_port = listen_port;
+ c->listening_port = fwd->listen_port;
success = 1;
}
if (success == 0)
- error("channel_setup_fwd_listener: cannot listen to port: %d",
- listen_port);
+ error("%s: cannot listen to port: %d", __func__,
+ fwd->listen_port);
freeaddrinfo(aitop);
return success;
}
-int
-channel_cancel_rport_listener(const char *host, u_short port)
+static int
+channel_setup_fwd_listener_streamlocal(int type, struct Forward *fwd,
+ struct ForwardOptions *fwd_opts)
{
+ struct sockaddr_un sunaddr;
+ const char *path;
+ Channel *c;
+ int port, sock;
+ mode_t omask;
+
+ switch (type) {
+ case SSH_CHANNEL_UNIX_LISTENER:
+ if (fwd->connect_path != NULL) {
+ if (strlen(fwd->connect_path) > sizeof(sunaddr.sun_path)) {
+ error("Local connecting path too long: %s",
+ fwd->connect_path);
+ return 0;
+ }
+ path = fwd->connect_path;
+ port = PORT_STREAMLOCAL;
+ } else {
+ if (fwd->connect_host == NULL) {
+ error("No forward host name.");
+ return 0;
+ }
+ if (strlen(fwd->connect_host) >= NI_MAXHOST) {
+ error("Forward host name too long.");
+ return 0;
+ }
+ path = fwd->connect_host;
+ port = fwd->connect_port;
+ }
+ break;
+ case SSH_CHANNEL_RUNIX_LISTENER:
+ path = fwd->listen_path;
+ port = PORT_STREAMLOCAL;
+ break;
+ default:
+ error("%s: unexpected channel type %d", __func__, type);
+ return 0;
+ }
+
+ if (fwd->listen_path == NULL) {
+ error("No forward path name.");
+ return 0;
+ }
+ if (strlen(fwd->listen_path) > sizeof(sunaddr.sun_path)) {
+ error("Local listening path too long: %s", fwd->listen_path);
+ return 0;
+ }
+
+ debug3("%s: type %d path %s", __func__, type, fwd->listen_path);
+
+ /* Start a Unix domain listener. */
+ omask = umask(fwd_opts->streamlocal_bind_mask);
+ sock = unix_listener(fwd->listen_path, SSH_LISTEN_BACKLOG,
+ fwd_opts->streamlocal_bind_unlink);
+ umask(omask);
+ if (sock < 0)
+ return 0;
+
+ debug("Local forwarding listening on path %s.", fwd->listen_path);
+
+ /* Allocate a channel number for the socket. */
+ c = channel_new("unix listener", type, sock, sock, -1,
+ CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
+ 0, "unix listener", 1);
+ c->path = xstrdup(path);
+ c->host_port = port;
+ c->listening_port = PORT_STREAMLOCAL;
+ c->listening_addr = xstrdup(fwd->listen_path);
+ return 1;
+}
+
+static int
+channel_cancel_rport_listener_tcpip(const char *host, u_short port)
+{
u_int i;
int found = 0;
@@ -2904,13 +3058,44 @@
return (found);
}
+static int
+channel_cancel_rport_listener_streamlocal(const char *path)
+{
+ u_int i;
+ int found = 0;
+
+ for (i = 0; i < channels_alloc; i++) {
+ Channel *c = channels[i];
+ if (c == NULL || c->type != SSH_CHANNEL_RUNIX_LISTENER)
+ continue;
+ if (c->path == NULL)
+ continue;
+ if (strcmp(c->path, path) == 0) {
+ debug2("%s: close channel %d", __func__, i);
+ channel_free(c);
+ found = 1;
+ }
+ }
+
+ return (found);
+}
+
int
-channel_cancel_lport_listener(const char *lhost, u_short lport,
- int cport, int gateway_ports)
+channel_cancel_rport_listener(struct Forward *fwd)
{
+ if (fwd->listen_path != NULL)
+ return channel_cancel_rport_listener_streamlocal(fwd->listen_path);
+ else
+ return channel_cancel_rport_listener_tcpip(fwd->listen_host, fwd->listen_port);
+}
+
+static int
+channel_cancel_lport_listener_tcpip(const char *lhost, u_short lport,
+ int cport, struct ForwardOptions *fwd_opts)
+{
u_int i;
int found = 0;
- const char *addr = channel_fwd_bind_addr(lhost, NULL, 1, gateway_ports);
+ const char *addr = channel_fwd_bind_addr(lhost, NULL, 1, fwd_opts);
for (i = 0; i < channels_alloc; i++) {
Channel *c = channels[i];
@@ -2939,24 +3124,68 @@
return (found);
}
+static int
+channel_cancel_lport_listener_streamlocal(const char *path)
+{
+ u_int i;
+ int found = 0;
+
+ if (path == NULL) {
+ error("%s: no path specified.", __func__);
+ return 0;
+ }
+
+ for (i = 0; i < channels_alloc; i++) {
+ Channel *c = channels[i];
+ if (c == NULL || c->type != SSH_CHANNEL_UNIX_LISTENER)
+ continue;
+ if (c->listening_addr == NULL)
+ continue;
+ if (strcmp(c->listening_addr, path) == 0) {
+ debug2("%s: close channel %d", __func__, i);
+ channel_free(c);
+ found = 1;
+ }
+ }
+
+ return (found);
+}
+
+int
+channel_cancel_lport_listener(struct Forward *fwd, int cport, struct ForwardOptions *fwd_opts)
+{
+ if (fwd->listen_path != NULL)
+ return channel_cancel_lport_listener_streamlocal(fwd->listen_path);
+ else
+ return channel_cancel_lport_listener_tcpip(fwd->listen_host, fwd->listen_port, cport, fwd_opts);
+}
+
/* protocol local port fwd, used by ssh (and sshd in v1) */
int
-channel_setup_local_fwd_listener(const char *listen_host, u_short listen_port,
- const char *host_to_connect, u_short port_to_connect, int gateway_ports)
+channel_setup_local_fwd_listener(struct Forward *fwd, struct ForwardOptions *fwd_opts)
{
- return channel_setup_fwd_listener(SSH_CHANNEL_PORT_LISTENER,
- listen_host, listen_port, NULL, host_to_connect, port_to_connect,
- gateway_ports);
+ if (fwd->listen_path != NULL) {
+ return channel_setup_fwd_listener_streamlocal(
+ SSH_CHANNEL_UNIX_LISTENER, fwd, fwd_opts);
+ } else {
+ return channel_setup_fwd_listener_tcpip(SSH_CHANNEL_PORT_LISTENER,
+ fwd, NULL, fwd_opts);
+ }
}
/* protocol v2 remote port fwd, used by sshd */
int
-channel_setup_remote_fwd_listener(const char *listen_address,
- u_short listen_port, int *allocated_listen_port, int gateway_ports)
+channel_setup_remote_fwd_listener(struct Forward *fwd,
+ int *allocated_listen_port, struct ForwardOptions *fwd_opts)
{
- return channel_setup_fwd_listener(SSH_CHANNEL_RPORT_LISTENER,
- listen_address, listen_port, allocated_listen_port,
- NULL, 0, gateway_ports);
+ if (fwd->listen_path != NULL) {
+ return channel_setup_fwd_listener_streamlocal(
+ SSH_CHANNEL_RUNIX_LISTENER, fwd, fwd_opts);
+ } else {
+ return channel_setup_fwd_listener_tcpip(
+ SSH_CHANNEL_RPORT_LISTENER, fwd, allocated_listen_port,
+ fwd_opts);
+ }
}
/*
@@ -2987,8 +3216,7 @@
* channel_update_permitted_opens().
*/
int
-channel_request_remote_forwarding(const char *listen_host, u_short listen_port,
- const char *host_to_connect, u_short port_to_connect)
+channel_request_remote_forwarding(struct Forward *fwd)
{
int type, success = 0, idx = -1;
@@ -2995,19 +3223,25 @@
/* Send the forward request to the remote side. */
if (compat20) {
packet_start(SSH2_MSG_GLOBAL_REQUEST);
- packet_put_cstring("tcpip-forward");
- packet_put_char(1); /* boolean: want reply */
- packet_put_cstring(channel_rfwd_bind_host(listen_host));
- packet_put_int(listen_port);
+ if (fwd->listen_path != NULL) {
+ packet_put_cstring("streamlocal-forward at openssh.com");
+ packet_put_char(1); /* boolean: want reply */
+ packet_put_cstring(fwd->listen_path);
+ } else {
+ packet_put_cstring("tcpip-forward");
+ packet_put_char(1); /* boolean: want reply */
+ packet_put_cstring(channel_rfwd_bind_host(fwd->listen_host));
+ packet_put_int(fwd->listen_port);
+ }
packet_send();
packet_write_wait();
/* Assume that server accepts the request */
success = 1;
- } else {
+ } else if (fwd->listen_path == NULL) {
packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
- packet_put_int(listen_port);
- packet_put_cstring(host_to_connect);
- packet_put_int(port_to_connect);
+ packet_put_int(fwd->listen_port);
+ packet_put_cstring(fwd->connect_host);
+ packet_put_int(fwd->connect_port);
packet_send();
packet_write_wait();
@@ -3024,25 +3258,103 @@
packet_disconnect("Protocol error for port forward request:"
"received packet type %d.", type);
}
+ } else {
+ logit("Warning: Server does not support remote stream local forwarding.");
}
if (success) {
/* Record that connection to this host/port is permitted. */
- permitted_opens = xrealloc(permitted_opens,
+ permitted_opens = xreallocarray(permitted_opens,
num_permitted_opens + 1, sizeof(*permitted_opens));
idx = num_permitted_opens++;
- permitted_opens[idx].host_to_connect = xstrdup(host_to_connect);
- permitted_opens[idx].port_to_connect = port_to_connect;
- permitted_opens[idx].listen_port = listen_port;
+ if (fwd->connect_path != NULL) {
+ permitted_opens[idx].host_to_connect =
+ xstrdup(fwd->connect_path);
+ permitted_opens[idx].port_to_connect =
+ PORT_STREAMLOCAL;
+ } else {
+ permitted_opens[idx].host_to_connect =
+ xstrdup(fwd->connect_host);
+ permitted_opens[idx].port_to_connect =
+ fwd->connect_port;
+ }
+ if (fwd->listen_path != NULL) {
+ permitted_opens[idx].listen_host = NULL;
+ permitted_opens[idx].listen_path =
+ xstrdup(fwd->listen_path);
+ permitted_opens[idx].listen_port = PORT_STREAMLOCAL;
+ } else {
+ permitted_opens[idx].listen_host =
+ fwd->listen_host ? xstrdup(fwd->listen_host) : NULL;
+ permitted_opens[idx].listen_path = NULL;
+ permitted_opens[idx].listen_port = fwd->listen_port;
+ }
}
return (idx);
}
+static int
+open_match(ForwardPermission *allowed_open, const char *requestedhost,
+ int requestedport)
+{
+ if (allowed_open->host_to_connect == NULL)
+ return 0;
+ if (allowed_open->port_to_connect != FWD_PERMIT_ANY_PORT &&
+ allowed_open->port_to_connect != requestedport)
+ return 0;
+ if (strcmp(allowed_open->host_to_connect, FWD_PERMIT_ANY_HOST) != 0 &&
+ strcmp(allowed_open->host_to_connect, requestedhost) != 0)
+ return 0;
+ return 1;
+}
+
/*
+ * Note that in the listen host/port case
+ * we don't support FWD_PERMIT_ANY_PORT and
+ * need to translate between the configured-host (listen_host)
+ * and what we've sent to the remote server (channel_rfwd_bind_host)
+ */
+static int
+open_listen_match_tcpip(ForwardPermission *allowed_open,
+ const char *requestedhost, u_short requestedport, int translate)
+{
+ const char *allowed_host;
+
+ if (allowed_open->host_to_connect == NULL)
+ return 0;
+ if (allowed_open->listen_port != requestedport)
+ return 0;
+ if (!translate && allowed_open->listen_host == NULL &&
+ requestedhost == NULL)
+ return 1;
+ allowed_host = translate ?
+ channel_rfwd_bind_host(allowed_open->listen_host) :
+ allowed_open->listen_host;
+ if (allowed_host == NULL ||
+ strcmp(allowed_host, requestedhost) != 0)
+ return 0;
+ return 1;
+}
+
+static int
+open_listen_match_streamlocal(ForwardPermission *allowed_open,
+ const char *requestedpath)
+{
+ if (allowed_open->host_to_connect == NULL)
+ return 0;
+ if (allowed_open->listen_port != PORT_STREAMLOCAL)
+ return 0;
+ if (allowed_open->listen_path == NULL ||
+ strcmp(allowed_open->listen_path, requestedpath) != 0)
+ return 0;
+ return 1;
+}
+
+/*
* Request cancellation of remote forwarding of connection host:port from
* local side.
*/
-int
-channel_request_rforward_cancel(const char *host, u_short port)
+static int
+channel_request_rforward_cancel_tcpip(const char *host, u_short port)
{
int i;
@@ -3050,8 +3362,7 @@
return -1;
for (i = 0; i < num_permitted_opens; i++) {
- if (permitted_opens[i].host_to_connect != NULL &&
- permitted_opens[i].listen_port == port)
+ if (open_listen_match_tcpip(&permitted_opens[i], host, port, 0))
break;
}
if (i >= num_permitted_opens) {
@@ -3069,26 +3380,81 @@
permitted_opens[i].port_to_connect = 0;
free(permitted_opens[i].host_to_connect);
permitted_opens[i].host_to_connect = NULL;
+ free(permitted_opens[i].listen_host);
+ permitted_opens[i].listen_host = NULL;
+ permitted_opens[i].listen_path = NULL;
return 0;
}
/*
+ * Request cancellation of remote forwarding of Unix domain socket
+ * path from local side.
+ */
+static int
+channel_request_rforward_cancel_streamlocal(const char *path)
+{
+ int i;
+
+ if (!compat20)
+ return -1;
+
+ for (i = 0; i < num_permitted_opens; i++) {
+ if (open_listen_match_streamlocal(&permitted_opens[i], path))
+ break;
+ }
+ if (i >= num_permitted_opens) {
+ debug("%s: requested forward not found", __func__);
+ return -1;
+ }
+ packet_start(SSH2_MSG_GLOBAL_REQUEST);
+ packet_put_cstring("cancel-streamlocal-forward at openssh.com");
+ packet_put_char(0);
+ packet_put_cstring(path);
+ packet_send();
+
+ permitted_opens[i].listen_port = 0;
+ permitted_opens[i].port_to_connect = 0;
+ free(permitted_opens[i].host_to_connect);
+ permitted_opens[i].host_to_connect = NULL;
+ permitted_opens[i].listen_host = NULL;
+ free(permitted_opens[i].listen_path);
+ permitted_opens[i].listen_path = NULL;
+
+ return 0;
+}
+
+/*
+ * Request cancellation of remote forwarding of a connection from local side.
+ */
+int
+channel_request_rforward_cancel(struct Forward *fwd)
+{
+ if (fwd->listen_path != NULL) {
+ return (channel_request_rforward_cancel_streamlocal(
+ fwd->listen_path));
+ } else {
+ return (channel_request_rforward_cancel_tcpip(fwd->listen_host,
+ fwd->listen_port ? fwd->listen_port : fwd->allocated_port));
+ }
+}
+
+/*
* This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
* listening for the port, and sends back a success reply (or disconnect
* message if there was an error).
*/
int
-channel_input_port_forward_request(int is_root, int gateway_ports)
+channel_input_port_forward_request(int is_root, struct ForwardOptions *fwd_opts)
{
- u_short port, host_port;
int success = 0;
- char *hostname;
+ struct Forward fwd;
/* Get arguments from the packet. */
- port = packet_get_int();
- hostname = packet_get_string(NULL);
- host_port = packet_get_int();
+ memset(&fwd, 0, sizeof(fwd));
+ fwd.listen_port = packet_get_int();
+ fwd.connect_host = packet_get_string(NULL);
+ fwd.connect_port = packet_get_int();
#ifndef HAVE_CYGWIN
/*
@@ -3095,20 +3461,19 @@
* Check that an unprivileged user is not trying to forward a
* privileged port.
*/
- if (port < IPPORT_RESERVED && !is_root)
+ if (fwd.listen_port < IPPORT_RESERVED && !is_root)
packet_disconnect(
"Requested forwarding of port %d but user is not root.",
- port);
- if (host_port == 0)
+ fwd.listen_port);
+ if (fwd.connect_port == 0)
packet_disconnect("Dynamic forwarding denied.");
#endif
/* Initiate forwarding */
- success = channel_setup_local_fwd_listener(NULL, port, hostname,
- host_port, gateway_ports);
+ success = channel_setup_local_fwd_listener(&fwd, fwd_opts);
/* Free the argument string. */
- free(hostname);
+ free(fwd.connect_host);
return (success ? 0 : -1);
}
@@ -3130,10 +3495,13 @@
{
debug("allow port forwarding to host %s port %d", host, port);
- permitted_opens = xrealloc(permitted_opens,
+ permitted_opens = xreallocarray(permitted_opens,
num_permitted_opens + 1, sizeof(*permitted_opens));
permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
permitted_opens[num_permitted_opens].port_to_connect = port;
+ permitted_opens[num_permitted_opens].listen_host = NULL;
+ permitted_opens[num_permitted_opens].listen_path = NULL;
+ permitted_opens[num_permitted_opens].listen_port = 0;
num_permitted_opens++;
all_opens_permitted = 0;
@@ -3165,6 +3533,10 @@
permitted_opens[idx].port_to_connect = 0;
free(permitted_opens[idx].host_to_connect);
permitted_opens[idx].host_to_connect = NULL;
+ free(permitted_opens[idx].listen_host);
+ permitted_opens[idx].listen_host = NULL;
+ free(permitted_opens[idx].listen_path);
+ permitted_opens[idx].listen_path = NULL;
}
}
@@ -3173,11 +3545,14 @@
{
debug("config allows port forwarding to host %s port %d", host, port);
- permitted_adm_opens = xrealloc(permitted_adm_opens,
+ permitted_adm_opens = xreallocarray(permitted_adm_opens,
num_adm_permitted_opens + 1, sizeof(*permitted_adm_opens));
permitted_adm_opens[num_adm_permitted_opens].host_to_connect
= xstrdup(host);
permitted_adm_opens[num_adm_permitted_opens].port_to_connect = port;
+ permitted_adm_opens[num_adm_permitted_opens].listen_host = NULL;
+ permitted_adm_opens[num_adm_permitted_opens].listen_path = NULL;
+ permitted_adm_opens[num_adm_permitted_opens].listen_port = 0;
return ++num_adm_permitted_opens;
}
@@ -3185,7 +3560,7 @@
channel_disable_adm_local_opens(void)
{
channel_clear_adm_permitted_opens();
- permitted_adm_opens = xmalloc(sizeof(*permitted_adm_opens));
+ permitted_adm_opens = xcalloc(sizeof(*permitted_adm_opens), 1);
permitted_adm_opens[num_adm_permitted_opens].host_to_connect = NULL;
num_adm_permitted_opens = 1;
}
@@ -3195,8 +3570,11 @@
{
int i;
- for (i = 0; i < num_permitted_opens; i++)
+ for (i = 0; i < num_permitted_opens; i++) {
free(permitted_opens[i].host_to_connect);
+ free(permitted_opens[i].listen_host);
+ free(permitted_opens[i].listen_path);
+ }
free(permitted_opens);
permitted_opens = NULL;
num_permitted_opens = 0;
@@ -3207,8 +3585,11 @@
{
int i;
- for (i = 0; i < num_adm_permitted_opens; i++)
+ for (i = 0; i < num_adm_permitted_opens; i++) {
free(permitted_adm_opens[i].host_to_connect);
+ free(permitted_adm_opens[i].listen_host);
+ free(permitted_adm_opens[i].listen_path);
+ }
free(permitted_adm_opens);
permitted_adm_opens = NULL;
num_adm_permitted_opens = 0;
@@ -3246,31 +3627,33 @@
return -1;
}
-static int
-port_match(u_short allowedport, u_short requestedport)
-{
- if (allowedport == FWD_PERMIT_ANY_PORT ||
- allowedport == requestedport)
- return 1;
- return 0;
-}
-
/* Try to start non-blocking connect to next host in cctx list */
static int
connect_next(struct channel_connect *cctx)
{
int sock, saved_errno;
- char ntop[NI_MAXHOST], strport[NI_MAXSERV];
+ struct sockaddr_un *sunaddr;
+ char ntop[NI_MAXHOST], strport[MAX(NI_MAXSERV,sizeof(sunaddr->sun_path))];
for (; cctx->ai; cctx->ai = cctx->ai->ai_next) {
- if (cctx->ai->ai_family != AF_INET &&
- cctx->ai->ai_family != AF_INET6)
+ switch (cctx->ai->ai_family) {
+ case AF_UNIX:
+ /* unix:pathname instead of host:port */
+ sunaddr = (struct sockaddr_un *)cctx->ai->ai_addr;
+ strlcpy(ntop, "unix", sizeof(ntop));
+ strlcpy(strport, sunaddr->sun_path, sizeof(strport));
+ break;
+ case AF_INET:
+ case AF_INET6:
+ if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen,
+ ntop, sizeof(ntop), strport, sizeof(strport),
+ NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
+ error("connect_next: getnameinfo failed");
+ continue;
+ }
+ break;
+ default:
continue;
- if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen,
- ntop, sizeof(ntop), strport, sizeof(strport),
- NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
- error("connect_next: getnameinfo failed");
- continue;
}
if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype,
cctx->ai->ai_protocol)) == -1) {
@@ -3292,10 +3675,11 @@
errno = saved_errno;
continue; /* fail -- try next */
}
+ if (cctx->ai->ai_family != AF_UNIX)
+ set_nodelay(sock);
debug("connect_next: host %.100s ([%.100s]:%s) "
"in progress, fd=%d", cctx->host, ntop, strport, sock);
cctx->ai = cctx->ai->ai_next;
- set_nodelay(sock);
return sock;
}
return -1;
@@ -3305,14 +3689,18 @@
channel_connect_ctx_free(struct channel_connect *cctx)
{
free(cctx->host);
- if (cctx->aitop)
- freeaddrinfo(cctx->aitop);
+ if (cctx->aitop) {
+ if (cctx->aitop->ai_family == AF_UNIX)
+ free(cctx->aitop);
+ else
+ freeaddrinfo(cctx->aitop);
+ }
memset(cctx, 0, sizeof(*cctx));
}
-/* Return CONNECTING channel to remote host, port */
+/* Return CONNECTING channel to remote host:port or local socket path */
static Channel *
-connect_to(const char *host, u_short port, char *ctype, char *rname)
+connect_to(const char *name, int port, char *ctype, char *rname)
{
struct addrinfo hints;
int gaierr;
@@ -3322,23 +3710,51 @@
Channel *c;
memset(&cctx, 0, sizeof(cctx));
- memset(&hints, 0, sizeof(hints));
- hints.ai_family = IPv4or6;
- hints.ai_socktype = SOCK_STREAM;
- snprintf(strport, sizeof strport, "%d", port);
- if ((gaierr = getaddrinfo(host, strport, &hints, &cctx.aitop)) != 0) {
- error("connect_to %.100s: unknown host (%s)", host,
- ssh_gai_strerror(gaierr));
- return NULL;
+
+ if (port == PORT_STREAMLOCAL) {
+ struct sockaddr_un *sunaddr;
+ struct addrinfo *ai;
+
+ if (strlen(name) > sizeof(sunaddr->sun_path)) {
+ error("%.100s: %.100s", name, strerror(ENAMETOOLONG));
+ return (NULL);
+ }
+
+ /*
+ * Fake up a struct addrinfo for AF_UNIX connections.
+ * channel_connect_ctx_free() must check ai_family
+ * and use free() not freeaddirinfo() for AF_UNIX.
+ */
+ ai = xmalloc(sizeof(*ai) + sizeof(*sunaddr));
+ memset(ai, 0, sizeof(*ai) + sizeof(*sunaddr));
+ ai->ai_addr = (struct sockaddr *)(ai + 1);
+ ai->ai_addrlen = sizeof(*sunaddr);
+ ai->ai_family = AF_UNIX;
+ ai->ai_socktype = SOCK_STREAM;
+ ai->ai_protocol = PF_UNSPEC;
+ sunaddr = (struct sockaddr_un *)ai->ai_addr;
+ sunaddr->sun_family = AF_UNIX;
+ strlcpy(sunaddr->sun_path, name, sizeof(sunaddr->sun_path));
+ cctx.aitop = ai;
+ } else {
+ memset(&hints, 0, sizeof(hints));
+ hints.ai_family = IPv4or6;
+ hints.ai_socktype = SOCK_STREAM;
+ snprintf(strport, sizeof strport, "%d", port);
+ if ((gaierr = getaddrinfo(name, strport, &hints, &cctx.aitop)) != 0) {
+ error("connect_to %.100s: unknown host (%s)", name,
+ ssh_gai_strerror(gaierr));
+ return NULL;
+ }
}
- cctx.host = xstrdup(host);
+ cctx.host = xstrdup(name);
cctx.port = port;
cctx.ai = cctx.aitop;
if ((sock = connect_next(&cctx)) == -1) {
error("connect to %.100s port %d failed: %s",
- host, port, strerror(errno));
+ name, port, strerror(errno));
channel_connect_ctx_free(&cctx);
return NULL;
}
@@ -3349,13 +3765,14 @@
}
Channel *
-channel_connect_by_listen_address(u_short listen_port, char *ctype, char *rname)
+channel_connect_by_listen_address(const char *listen_host,
+ u_short listen_port, char *ctype, char *rname)
{
int i;
for (i = 0; i < num_permitted_opens; i++) {
- if (permitted_opens[i].host_to_connect != NULL &&
- port_match(permitted_opens[i].listen_port, listen_port)) {
+ if (open_listen_match_tcpip(&permitted_opens[i], listen_host,
+ listen_port, 1)) {
return connect_to(
permitted_opens[i].host_to_connect,
permitted_opens[i].port_to_connect, ctype, rname);
@@ -3366,9 +3783,26 @@
return NULL;
}
+Channel *
+channel_connect_by_listen_path(const char *path, char *ctype, char *rname)
+{
+ int i;
+
+ for (i = 0; i < num_permitted_opens; i++) {
+ if (open_listen_match_streamlocal(&permitted_opens[i], path)) {
+ return connect_to(
+ permitted_opens[i].host_to_connect,
+ permitted_opens[i].port_to_connect, ctype, rname);
+ }
+ }
+ error("WARNING: Server requests forwarding for unknown path %.100s",
+ path);
+ return NULL;
+}
+
/* Check if connecting to that port is permitted and connect. */
Channel *
-channel_connect_to(const char *host, u_short port, char *ctype, char *rname)
+channel_connect_to_port(const char *host, u_short port, char *ctype, char *rname)
{
int i, permit, permit_adm = 1;
@@ -3375,20 +3809,19 @@
permit = all_opens_permitted;
if (!permit) {
for (i = 0; i < num_permitted_opens; i++)
- if (permitted_opens[i].host_to_connect != NULL &&
- port_match(permitted_opens[i].port_to_connect, port) &&
- strcmp(permitted_opens[i].host_to_connect, host) == 0)
+ if (open_match(&permitted_opens[i], host, port)) {
permit = 1;
+ break;
+ }
}
if (num_adm_permitted_opens > 0) {
permit_adm = 0;
for (i = 0; i < num_adm_permitted_opens; i++)
- if (permitted_adm_opens[i].host_to_connect != NULL &&
- port_match(permitted_adm_opens[i].port_to_connect, port) &&
- strcmp(permitted_adm_opens[i].host_to_connect, host)
- == 0)
+ if (open_match(&permitted_adm_opens[i], host, port)) {
permit_adm = 1;
+ break;
+ }
}
if (!permit || !permit_adm) {
@@ -3399,6 +3832,38 @@
return connect_to(host, port, ctype, rname);
}
+/* Check if connecting to that path is permitted and connect. */
+Channel *
+channel_connect_to_path(const char *path, char *ctype, char *rname)
+{
+ int i, permit, permit_adm = 1;
+
+ permit = all_opens_permitted;
+ if (!permit) {
+ for (i = 0; i < num_permitted_opens; i++)
+ if (open_match(&permitted_opens[i], path, PORT_STREAMLOCAL)) {
+ permit = 1;
+ break;
+ }
+ }
+
+ if (num_adm_permitted_opens > 0) {
+ permit_adm = 0;
+ for (i = 0; i < num_adm_permitted_opens; i++)
+ if (open_match(&permitted_adm_opens[i], path, PORT_STREAMLOCAL)) {
+ permit_adm = 1;
+ break;
+ }
+ }
+
+ if (!permit || !permit_adm) {
+ logit("Received request to connect to path %.100s, "
+ "but the request was denied.", path);
+ return NULL;
+ }
+ return connect_to(path, PORT_STREAMLOCAL, ctype, rname);
+}
+
void
channel_send_window_changes(void)
{
@@ -3669,7 +4134,7 @@
*/
/* ARGSUSED */
-void
+int
x11_input_open(int type, u_int32_t seq, void *ctxt)
{
Channel *c = NULL;
@@ -3709,11 +4174,12 @@
packet_put_int(c->self);
}
packet_send();
+ return 0;
}
/* dummy protocol handler that denies SSH-1 requests (agent/x11) */
/* ARGSUSED */
-void
+int
deny_input_open(int type, u_int32_t seq, void *ctxt)
{
int rchan = packet_get_int();
@@ -3733,6 +4199,7 @@
packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
packet_put_int(rchan);
packet_send();
+ return 0;
}
/*
Modified: trunk/crypto/openssh/channels.h
===================================================================
--- trunk/crypto/openssh/channels.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/channels.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.h,v 1.113 2013/06/07 15:37:52 dtucker Exp $ */
+/* $OpenBSD: channels.h,v 1.118 2015/07/01 02:26:31 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -56,7 +56,9 @@
#define SSH_CHANNEL_MUX_LISTENER 15 /* Listener for mux conn. */
#define SSH_CHANNEL_MUX_CLIENT 16 /* Conn. to mux slave */
#define SSH_CHANNEL_ABANDONED 17 /* Abandoned session, eg mux */
-#define SSH_CHANNEL_MAX_TYPE 18
+#define SSH_CHANNEL_UNIX_LISTENER 18 /* Listening on a domain socket. */
+#define SSH_CHANNEL_RUNIX_LISTENER 19 /* Listening to a R-style domain socket. */
+#define SSH_CHANNEL_MAX_TYPE 20
#define CHANNEL_CANCEL_PORT_STATIC -1
@@ -111,7 +113,7 @@
time_t notbefore; /* Pause IO until deadline (time_t) */
int delayed; /* post-select handlers for newly created
* channels are delayed until the first call
- * to a matching pre-select handler.
+ * to a matching pre-select handler.
* this way post-select handlers are not
* accidentally called if a FD gets reused */
Buffer input; /* data read from socket, to be sent over
@@ -228,17 +230,17 @@
/* protocol handler */
-void channel_input_close(int, u_int32_t, void *);
-void channel_input_close_confirmation(int, u_int32_t, void *);
-void channel_input_data(int, u_int32_t, void *);
-void channel_input_extended_data(int, u_int32_t, void *);
-void channel_input_ieof(int, u_int32_t, void *);
-void channel_input_oclose(int, u_int32_t, void *);
-void channel_input_open_confirmation(int, u_int32_t, void *);
-void channel_input_open_failure(int, u_int32_t, void *);
-void channel_input_port_open(int, u_int32_t, void *);
-void channel_input_window_adjust(int, u_int32_t, void *);
-void channel_input_status_confirm(int, u_int32_t, void *);
+int channel_input_close(int, u_int32_t, void *);
+int channel_input_close_confirmation(int, u_int32_t, void *);
+int channel_input_data(int, u_int32_t, void *);
+int channel_input_extended_data(int, u_int32_t, void *);
+int channel_input_ieof(int, u_int32_t, void *);
+int channel_input_oclose(int, u_int32_t, void *);
+int channel_input_open_confirmation(int, u_int32_t, void *);
+int channel_input_open_failure(int, u_int32_t, void *);
+int channel_input_port_open(int, u_int32_t, void *);
+int channel_input_window_adjust(int, u_int32_t, void *);
+int channel_input_status_confirm(int, u_int32_t, void *);
/* file descriptor handling (read/write) */
@@ -254,6 +256,8 @@
int channel_find_open(void);
/* tcp forwarding */
+struct Forward;
+struct ForwardOptions;
void channel_set_af(int af);
void channel_permit_all_opens(void);
void channel_add_permitted_opens(char *, int);
@@ -263,28 +267,30 @@
void channel_clear_permitted_opens(void);
void channel_clear_adm_permitted_opens(void);
void channel_print_adm_permitted_opens(void);
-int channel_input_port_forward_request(int, int);
-Channel *channel_connect_to(const char *, u_short, char *, char *);
+int channel_input_port_forward_request(int, struct ForwardOptions *);
+Channel *channel_connect_to_port(const char *, u_short, char *, char *);
+Channel *channel_connect_to_path(const char *, char *, char *);
Channel *channel_connect_stdio_fwd(const char*, u_short, int, int);
-Channel *channel_connect_by_listen_address(u_short, char *, char *);
-int channel_request_remote_forwarding(const char *, u_short,
- const char *, u_short);
-int channel_setup_local_fwd_listener(const char *, u_short,
- const char *, u_short, int);
-int channel_request_rforward_cancel(const char *host, u_short port);
-int channel_setup_remote_fwd_listener(const char *, u_short, int *, int);
-int channel_cancel_rport_listener(const char *, u_short);
-int channel_cancel_lport_listener(const char *, u_short, int, int);
+Channel *channel_connect_by_listen_address(const char *, u_short,
+ char *, char *);
+Channel *channel_connect_by_listen_path(const char *, char *, char *);
+int channel_request_remote_forwarding(struct Forward *);
+int channel_setup_local_fwd_listener(struct Forward *, struct ForwardOptions *);
+int channel_request_rforward_cancel(struct Forward *);
+int channel_setup_remote_fwd_listener(struct Forward *, int *, struct ForwardOptions *);
+int channel_cancel_rport_listener(struct Forward *);
+int channel_cancel_lport_listener(struct Forward *, int, struct ForwardOptions *);
int permitopen_port(const char *);
/* x11 forwarding */
+void channel_set_x11_refuse_time(u_int);
int x11_connect_display(void);
int x11_create_display_inet(int, int, int, u_int *, int **);
-void x11_input_open(int, u_int32_t, void *);
+int x11_input_open(int, u_int32_t, void *);
void x11_request_forwarding_with_spoofing(int, const char *, const char *,
const char *, int);
-void deny_input_open(int, u_int32_t, void *);
+int deny_input_open(int, u_int32_t, void *);
/* agent forwarding */
Modified: trunk/crypto/openssh/cipher-3des1.c
===================================================================
--- trunk/crypto/openssh/cipher-3des1.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/cipher-3des1.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,15 +1,10 @@
-/* $OpenBSD: cipher-3des1.c,v 1.10 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: cipher-3des1.c,v 1.12 2015/01/14 10:24:42 markus Exp $ */
/*
* Copyright (c) 2003 Markus Friedl. All rights reserved.
*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -26,17 +21,11 @@
#include "includes.h"
#include <sys/types.h>
-
+#include <string.h>
#include <openssl/evp.h>
-#include <stdarg.h>
-#include <string.h>
+#include "ssherr.h"
-#include "xmalloc.h"
-#include "log.h"
-
-#include "openbsd-compat/openssl-compat.h"
-
/*
* This is used by SSH1:
*
@@ -57,7 +46,7 @@
};
const EVP_CIPHER * evp_ssh1_3des(void);
-void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
+int ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
static int
ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
@@ -67,11 +56,12 @@
u_char *k1, *k2, *k3;
if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
- c = xcalloc(1, sizeof(*c));
+ if ((c = calloc(1, sizeof(*c))) == NULL)
+ return 0;
EVP_CIPHER_CTX_set_app_data(ctx, c);
}
if (key == NULL)
- return (1);
+ return 1;
if (enc == -1)
enc = ctx->encrypt;
k1 = k2 = k3 = (u_char *) key;
@@ -85,11 +75,6 @@
EVP_CIPHER_CTX_init(&c->k1);
EVP_CIPHER_CTX_init(&c->k2);
EVP_CIPHER_CTX_init(&c->k3);
-#ifdef SSH_OLD_EVP
- EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc);
- EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc);
- EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc);
-#else
if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 ||
EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 ||
EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) {
@@ -96,33 +81,23 @@
explicit_bzero(c, sizeof(*c));
free(c);
EVP_CIPHER_CTX_set_app_data(ctx, NULL);
- return (0);
+ return 0;
}
-#endif
- return (1);
+ return 1;
}
static int
-ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src,
- LIBCRYPTO_EVP_INL_TYPE len)
+ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, size_t len)
{
struct ssh1_3des_ctx *c;
- if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
- error("ssh1_3des_cbc: no context");
- return (0);
- }
-#ifdef SSH_OLD_EVP
- EVP_Cipher(&c->k1, dest, (u_char *)src, len);
- EVP_Cipher(&c->k2, dest, dest, len);
- EVP_Cipher(&c->k3, dest, dest, len);
-#else
+ if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL)
+ return 0;
if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 ||
EVP_Cipher(&c->k2, dest, dest, len) == 0 ||
EVP_Cipher(&c->k3, dest, dest, len) == 0)
- return (0);
-#endif
- return (1);
+ return 0;
+ return 1;
}
static int
@@ -138,29 +113,28 @@
free(c);
EVP_CIPHER_CTX_set_app_data(ctx, NULL);
}
- return (1);
+ return 1;
}
-void
+int
ssh1_3des_iv(EVP_CIPHER_CTX *evp, int doset, u_char *iv, int len)
{
struct ssh1_3des_ctx *c;
if (len != 24)
- fatal("%s: bad 3des iv length: %d", __func__, len);
+ return SSH_ERR_INVALID_ARGUMENT;
if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL)
- fatal("%s: no 3des context", __func__);
+ return SSH_ERR_INTERNAL_ERROR;
if (doset) {
- debug3("%s: Installed 3DES IV", __func__);
memcpy(c->k1.iv, iv, 8);
memcpy(c->k2.iv, iv + 8, 8);
memcpy(c->k3.iv, iv + 16, 8);
} else {
- debug3("%s: Copying 3DES IV", __func__);
memcpy(iv, c->k1.iv, 8);
memcpy(iv + 8, c->k2.iv, 8);
memcpy(iv + 16, c->k3.iv, 8);
}
+ return 0;
}
const EVP_CIPHER *
@@ -168,7 +142,7 @@
{
static EVP_CIPHER ssh1_3des;
- memset(&ssh1_3des, 0, sizeof(EVP_CIPHER));
+ memset(&ssh1_3des, 0, sizeof(ssh1_3des));
ssh1_3des.nid = NID_undef;
ssh1_3des.block_size = 8;
ssh1_3des.iv_len = 0;
@@ -176,8 +150,6 @@
ssh1_3des.init = ssh1_3des_init;
ssh1_3des.cleanup = ssh1_3des_cleanup;
ssh1_3des.do_cipher = ssh1_3des_cbc;
-#ifndef SSH_OLD_EVP
ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH;
-#endif
- return (&ssh1_3des);
+ return &ssh1_3des;
}
Copied: trunk/crypto/openssh/cipher-aesctr.c (from rev 9222, vendor-crypto/openssh/dist/cipher-aesctr.c)
===================================================================
--- trunk/crypto/openssh/cipher-aesctr.c (rev 0)
+++ trunk/crypto/openssh/cipher-aesctr.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,83 @@
+/* $OpenBSD: cipher-aesctr.c,v 1.2 2015/01/14 10:24:42 markus Exp $ */
+/*
+ * Copyright (c) 2003 Markus Friedl. All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <string.h>
+
+#ifndef WITH_OPENSSL
+
+#include "cipher-aesctr.h"
+
+/*
+ * increment counter 'ctr',
+ * the counter is of size 'len' bytes and stored in network-byte-order.
+ * (LSB at ctr[len-1], MSB at ctr[0])
+ */
+static inline void
+aesctr_inc(u8 *ctr, u32 len)
+{
+ ssize_t i;
+
+#ifndef CONSTANT_TIME_INCREMENT
+ for (i = len - 1; i >= 0; i--)
+ if (++ctr[i]) /* continue on overflow */
+ return;
+#else
+ u8 x, add = 1;
+
+ for (i = len - 1; i >= 0; i--) {
+ ctr[i] += add;
+ /* constant time for: x = ctr[i] ? 1 : 0 */
+ x = ctr[i];
+ x = (x | (x >> 4)) & 0xf;
+ x = (x | (x >> 2)) & 0x3;
+ x = (x | (x >> 1)) & 0x1;
+ add *= (x^1);
+ }
+#endif
+}
+
+void
+aesctr_keysetup(aesctr_ctx *x,const u8 *k,u32 kbits,u32 ivbits)
+{
+ x->rounds = rijndaelKeySetupEnc(x->ek, k, kbits);
+}
+
+void
+aesctr_ivsetup(aesctr_ctx *x,const u8 *iv)
+{
+ memcpy(x->ctr, iv, AES_BLOCK_SIZE);
+}
+
+void
+aesctr_encrypt_bytes(aesctr_ctx *x,const u8 *m,u8 *c,u32 bytes)
+{
+ u32 n = 0;
+ u8 buf[AES_BLOCK_SIZE];
+
+ while ((bytes--) > 0) {
+ if (n == 0) {
+ rijndaelEncrypt(x->ek, x->rounds, x->ctr, buf);
+ aesctr_inc(x->ctr, AES_BLOCK_SIZE);
+ }
+ *(c++) = *(m++) ^ buf[n];
+ n = (n + 1) % AES_BLOCK_SIZE;
+ }
+}
+#endif /* !WITH_OPENSSL */
Copied: trunk/crypto/openssh/cipher-aesctr.h (from rev 9222, vendor-crypto/openssh/dist/cipher-aesctr.h)
===================================================================
--- trunk/crypto/openssh/cipher-aesctr.h (rev 0)
+++ trunk/crypto/openssh/cipher-aesctr.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,35 @@
+/* $OpenBSD: cipher-aesctr.h,v 1.1 2014/04/29 15:39:33 markus Exp $ */
+/*
+ * Copyright (c) 2014 Markus Friedl
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef OPENSSH_AESCTR_H
+#define OPENSSH_AESCTR_H
+
+#include "rijndael.h"
+
+#define AES_BLOCK_SIZE 16
+
+typedef struct aesctr_ctx {
+ int rounds; /* keylen-dependent #rounds */
+ u32 ek[4*(AES_MAXROUNDS + 1)]; /* encrypt key schedule */
+ u8 ctr[AES_BLOCK_SIZE]; /* counter */
+} aesctr_ctx;
+
+void aesctr_keysetup(aesctr_ctx *x,const u8 *k,u32 kbits,u32 ivbits);
+void aesctr_ivsetup(aesctr_ctx *x,const u8 *iv);
+void aesctr_encrypt_bytes(aesctr_ctx *x,const u8 *m,u8 *c,u32 bytes);
+
+#endif
Modified: trunk/crypto/openssh/cipher-bf1.c
===================================================================
--- trunk/crypto/openssh/cipher-bf1.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/cipher-bf1.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,15 +1,10 @@
-/* $OpenBSD: cipher-bf1.c,v 1.6 2010/10/01 23:05:32 djm Exp $ */
+/* $OpenBSD: cipher-bf1.c,v 1.7 2015/01/14 10:24:42 markus Exp $ */
/*
* Copyright (c) 2003 Markus Friedl. All rights reserved.
*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -25,15 +20,14 @@
#include "includes.h"
+#if defined(WITH_OPENSSL) && !defined(OPENSSL_NO_BF)
+
#include <sys/types.h>
-#include <openssl/evp.h>
-
#include <stdarg.h>
#include <string.h>
-#include "xmalloc.h"
-#include "log.h"
+#include <openssl/evp.h>
#include "openbsd-compat/openssl-compat.h"
@@ -106,3 +100,4 @@
ssh1_bf.key_len = 32;
return (&ssh1_bf);
}
+#endif /* defined(WITH_OPENSSL) && !defined(OPENSSL_NO_BF) */
Modified: trunk/crypto/openssh/cipher-chachapoly.c
===================================================================
--- trunk/crypto/openssh/cipher-chachapoly.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/cipher-chachapoly.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -14,7 +14,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $OpenBSD: cipher-chachapoly.c,v 1.4 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: cipher-chachapoly.c,v 1.7 2015/01/14 10:24:42 markus Exp $ */
#include "includes.h"
@@ -24,16 +24,18 @@
#include <stdio.h> /* needed for misc.h */
#include "log.h"
-#include "misc.h"
+#include "sshbuf.h"
+#include "ssherr.h"
#include "cipher-chachapoly.h"
-void chachapoly_init(struct chachapoly_ctx *ctx,
+int chachapoly_init(struct chachapoly_ctx *ctx,
const u_char *key, u_int keylen)
{
if (keylen != (32 + 32)) /* 2 x 256 bit keys */
- fatal("%s: invalid keylen %u", __func__, keylen);
+ return SSH_ERR_INVALID_ARGUMENT;
chacha_keysetup(&ctx->main_ctx, key, 256);
chacha_keysetup(&ctx->header_ctx, key + 32, 256);
+ return 0;
}
/*
@@ -52,7 +54,7 @@
u_char seqbuf[8];
const u_char one[8] = { 1, 0, 0, 0, 0, 0, 0, 0 }; /* NB little-endian */
u_char expected_tag[POLY1305_TAGLEN], poly_key[POLY1305_KEYLEN];
- int r = -1;
+ int r = SSH_ERR_INTERNAL_ERROR;
/*
* Run ChaCha20 once to generate the Poly1305 key. The IV is the
@@ -59,12 +61,10 @@
* packet sequence number.
*/
memset(poly_key, 0, sizeof(poly_key));
- put_u64(seqbuf, seqnr);
+ POKE_U64(seqbuf, seqnr);
chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);
chacha_encrypt_bytes(&ctx->main_ctx,
poly_key, poly_key, sizeof(poly_key));
- /* Set Chacha's block counter to 1 */
- chacha_ivsetup(&ctx->main_ctx, seqbuf, one);
/* If decrypting, check tag before anything else */
if (!do_encrypt) {
@@ -71,14 +71,20 @@
const u_char *tag = src + aadlen + len;
poly1305_auth(expected_tag, src, aadlen + len, poly_key);
- if (timingsafe_bcmp(expected_tag, tag, POLY1305_TAGLEN) != 0)
+ if (timingsafe_bcmp(expected_tag, tag, POLY1305_TAGLEN) != 0) {
+ r = SSH_ERR_MAC_INVALID;
goto out;
+ }
}
+
/* Crypt additional data */
if (aadlen) {
chacha_ivsetup(&ctx->header_ctx, seqbuf, NULL);
chacha_encrypt_bytes(&ctx->header_ctx, src, dest, aadlen);
}
+
+ /* Set Chacha's block counter to 1 */
+ chacha_ivsetup(&ctx->main_ctx, seqbuf, one);
chacha_encrypt_bytes(&ctx->main_ctx, src + aadlen,
dest + aadlen, len);
@@ -88,7 +94,6 @@
poly_key);
}
r = 0;
-
out:
explicit_bzero(expected_tag, sizeof(expected_tag));
explicit_bzero(seqbuf, sizeof(seqbuf));
@@ -104,11 +109,10 @@
u_char buf[4], seqbuf[8];
if (len < 4)
- return -1; /* Insufficient length */
- put_u64(seqbuf, seqnr);
+ return SSH_ERR_MESSAGE_INCOMPLETE;
+ POKE_U64(seqbuf, seqnr);
chacha_ivsetup(&ctx->header_ctx, seqbuf, NULL);
chacha_encrypt_bytes(&ctx->header_ctx, cp, buf, 4);
- *plenp = get_u32(buf);
+ *plenp = PEEK_U32(buf);
return 0;
}
-
Modified: trunk/crypto/openssh/cipher-chachapoly.h
===================================================================
--- trunk/crypto/openssh/cipher-chachapoly.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/cipher-chachapoly.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher-chachapoly.h,v 1.1 2013/11/21 00:45:44 djm Exp $ */
+/* $OpenBSD: cipher-chachapoly.h,v 1.4 2014/06/24 01:13:21 djm Exp $ */
/*
* Copyright (c) Damien Miller 2013 <djm at mindrot.org>
@@ -28,7 +28,7 @@
struct chacha_ctx main_ctx, header_ctx;
};
-void chachapoly_init(struct chachapoly_ctx *cpctx,
+int chachapoly_init(struct chachapoly_ctx *cpctx,
const u_char *key, u_int keylen)
__attribute__((__bounded__(__buffer__, 2, 3)));
int chachapoly_crypt(struct chachapoly_ctx *cpctx, u_int seqnr,
Modified: trunk/crypto/openssh/cipher-ctr.c
===================================================================
--- trunk/crypto/openssh/cipher-ctr.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/cipher-ctr.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -16,7 +16,7 @@
*/
#include "includes.h"
-#ifndef OPENSSL_HAVE_EVPCTR
+#if defined(WITH_OPENSSL) && !defined(OPENSSL_HAVE_EVPCTR)
#include <sys/types.h>
#include <stdarg.h>
@@ -143,4 +143,4 @@
return (&aes_ctr);
}
-#endif /* OPENSSL_HAVE_EVPCTR */
+#endif /* defined(WITH_OPENSSL) && !defined(OPENSSL_HAVE_EVPCTR) */
Modified: trunk/crypto/openssh/cipher.c
===================================================================
--- trunk/crypto/openssh/cipher.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/cipher.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher.c,v 1.97 2014/02/07 06:55:54 djm Exp $ */
+/* $OpenBSD: cipher.c,v 1.101 2015/12/10 17:08:40 mmcc Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -43,21 +43,21 @@
#include <stdarg.h>
#include <stdio.h>
-#include "xmalloc.h"
-#include "log.h"
+#include "cipher.h"
#include "misc.h"
-#include "cipher.h"
-#include "buffer.h"
+#include "sshbuf.h"
+#include "ssherr.h"
#include "digest.h"
-/* compatibility with old or broken OpenSSL versions */
#include "openbsd-compat/openssl-compat.h"
+#ifdef WITH_SSH1
extern const EVP_CIPHER *evp_ssh1_bf(void);
extern const EVP_CIPHER *evp_ssh1_3des(void);
-extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
+extern int ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
+#endif
-struct Cipher {
+struct sshcipher {
char *name;
int number; /* for ssh1 only */
u_int block_size;
@@ -68,23 +68,39 @@
u_int flags;
#define CFLAG_CBC (1<<0)
#define CFLAG_CHACHAPOLY (1<<1)
+#define CFLAG_AESCTR (1<<2)
+#define CFLAG_NONE (1<<3)
+#ifdef WITH_OPENSSL
const EVP_CIPHER *(*evptype)(void);
+#else
+ void *ignored;
+#endif
};
-static const struct Cipher ciphers[] = {
- { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+static const struct sshcipher ciphers[] = {
+#ifdef WITH_SSH1
{ "des", SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
{ "3des", SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
+# ifndef OPENSSL_NO_BF
{ "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, 0, 0, 0, 1, evp_ssh1_bf },
-
+# endif /* OPENSSL_NO_BF */
+#endif /* WITH_SSH1 */
+#ifdef WITH_OPENSSL
+ { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
{ "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
+# ifndef OPENSSL_NO_BF
{ "blowfish-cbc",
SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_bf_cbc },
+# endif /* OPENSSL_NO_BF */
+# ifndef OPENSSL_NO_CAST
{ "cast128-cbc",
SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_cast5_cbc },
+# endif /* OPENSSL_NO_CAST */
+# ifndef OPENSSL_NO_RC4
{ "arcfour", SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 0, EVP_rc4 },
{ "arcfour128", SSH_CIPHER_SSH2, 8, 16, 0, 0, 1536, 0, EVP_rc4 },
{ "arcfour256", SSH_CIPHER_SSH2, 8, 32, 0, 0, 1536, 0, EVP_rc4 },
+# endif /* OPENSSL_NO_RC4 */
{ "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
{ "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
{ "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
@@ -93,26 +109,33 @@
{ "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
{ "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },
{ "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },
-#ifdef OPENSSL_HAVE_EVPGCM
+# ifdef OPENSSL_HAVE_EVPGCM
{ "aes128-gcm at openssh.com",
SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
{ "aes256-gcm at openssh.com",
SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
-#endif
+# endif /* OPENSSL_HAVE_EVPGCM */
+#else /* WITH_OPENSSL */
+ { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, CFLAG_AESCTR, NULL },
+ { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, CFLAG_AESCTR, NULL },
+ { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, CFLAG_AESCTR, NULL },
+ { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, CFLAG_NONE, NULL },
+#endif /* WITH_OPENSSL */
{ "chacha20-poly1305 at openssh.com",
SSH_CIPHER_SSH2, 8, 64, 0, 16, 0, CFLAG_CHACHAPOLY, NULL },
+
{ NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
};
/*--*/
-/* Returns a list of supported ciphers separated by the specified char. */
+/* Returns a comma-separated list of supported ciphers. */
char *
cipher_alg_list(char sep, int auth_only)
{
- char *ret = NULL;
+ char *tmp, *ret = NULL;
size_t nlen, rlen = 0;
- const Cipher *c;
+ const struct sshcipher *c;
for (c = ciphers; c->name != NULL; c++) {
if (c->number != SSH_CIPHER_SSH2)
@@ -122,7 +145,11 @@
if (ret != NULL)
ret[rlen++] = sep;
nlen = strlen(c->name);
- ret = xrealloc(ret, 1, rlen + nlen + 2);
+ if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) {
+ free(ret);
+ return NULL;
+ }
+ ret = tmp;
memcpy(ret + rlen, c->name, nlen + 1);
rlen += nlen;
}
@@ -130,19 +157,19 @@
}
u_int
-cipher_blocksize(const Cipher *c)
+cipher_blocksize(const struct sshcipher *c)
{
return (c->block_size);
}
u_int
-cipher_keylen(const Cipher *c)
+cipher_keylen(const struct sshcipher *c)
{
return (c->key_len);
}
u_int
-cipher_seclen(const Cipher *c)
+cipher_seclen(const struct sshcipher *c)
{
if (strcmp("3des-cbc", c->name) == 0)
return 14;
@@ -150,13 +177,13 @@
}
u_int
-cipher_authlen(const Cipher *c)
+cipher_authlen(const struct sshcipher *c)
{
return (c->auth_len);
}
u_int
-cipher_ivlen(const Cipher *c)
+cipher_ivlen(const struct sshcipher *c)
{
/*
* Default is cipher block size, except for chacha20+poly1305 that
@@ -167,13 +194,13 @@
}
u_int
-cipher_get_number(const Cipher *c)
+cipher_get_number(const struct sshcipher *c)
{
return (c->number);
}
u_int
-cipher_is_cbc(const Cipher *c)
+cipher_is_cbc(const struct sshcipher *c)
{
return (c->flags & CFLAG_CBC) != 0;
}
@@ -190,10 +217,10 @@
return mask;
}
-const Cipher *
+const struct sshcipher *
cipher_by_name(const char *name)
{
- const Cipher *c;
+ const struct sshcipher *c;
for (c = ciphers; c->name != NULL; c++)
if (strcmp(c->name, name) == 0)
return c;
@@ -200,10 +227,10 @@
return NULL;
}
-const Cipher *
+const struct sshcipher *
cipher_by_number(int id)
{
- const Cipher *c;
+ const struct sshcipher *c;
for (c = ciphers; c->name != NULL; c++)
if (c->number == id)
return c;
@@ -214,23 +241,22 @@
int
ciphers_valid(const char *names)
{
- const Cipher *c;
+ const struct sshcipher *c;
char *cipher_list, *cp;
char *p;
if (names == NULL || strcmp(names, "") == 0)
return 0;
- cipher_list = cp = xstrdup(names);
+ if ((cipher_list = cp = strdup(names)) == NULL)
+ return 0;
for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
(p = strsep(&cp, CIPHER_SEP))) {
c = cipher_by_name(p);
if (c == NULL || c->number != SSH_CIPHER_SSH2) {
- debug("bad cipher %s [%s]", p, names);
free(cipher_list);
return 0;
}
}
- debug3("ciphers ok: [%s]", names);
free(cipher_list);
return 1;
}
@@ -243,7 +269,7 @@
int
cipher_number(const char *name)
{
- const Cipher *c;
+ const struct sshcipher *c;
if (name == NULL)
return -1;
for (c = ciphers; c->name != NULL; c++)
@@ -255,90 +281,103 @@
char *
cipher_name(int id)
{
- const Cipher *c = cipher_by_number(id);
+ const struct sshcipher *c = cipher_by_number(id);
return (c==NULL) ? "<unknown>" : c->name;
}
-void
-cipher_init(CipherContext *cc, const Cipher *cipher,
+const char *
+cipher_warning_message(const struct sshcipher_ctx *cc)
+{
+ if (cc == NULL || cc->cipher == NULL)
+ return NULL;
+ if (cc->cipher->number == SSH_CIPHER_DES)
+ return "use of DES is strongly discouraged due to "
+ "cryptographic weaknesses";
+ return NULL;
+}
+
+int
+cipher_init(struct sshcipher_ctx *cc, const struct sshcipher *cipher,
const u_char *key, u_int keylen, const u_char *iv, u_int ivlen,
int do_encrypt)
{
- static int dowarn = 1;
-#ifdef SSH_OLD_EVP
- EVP_CIPHER *type;
-#else
+#ifdef WITH_OPENSSL
+ int ret = SSH_ERR_INTERNAL_ERROR;
const EVP_CIPHER *type;
int klen;
-#endif
u_char *junk, *discard;
if (cipher->number == SSH_CIPHER_DES) {
- if (dowarn) {
- error("Warning: use of DES is strongly discouraged "
- "due to cryptographic weaknesses");
- dowarn = 0;
- }
if (keylen > 8)
keylen = 8;
}
+#endif
cc->plaintext = (cipher->number == SSH_CIPHER_NONE);
cc->encrypt = do_encrypt;
- if (keylen < cipher->key_len)
- fatal("cipher_init: key length %d is insufficient for %s.",
- keylen, cipher->name);
- if (iv != NULL && ivlen < cipher_ivlen(cipher))
- fatal("cipher_init: iv length %d is insufficient for %s.",
- ivlen, cipher->name);
+ if (keylen < cipher->key_len ||
+ (iv != NULL && ivlen < cipher_ivlen(cipher)))
+ return SSH_ERR_INVALID_ARGUMENT;
+
cc->cipher = cipher;
-
if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
- chachapoly_init(&cc->cp_ctx, key, keylen);
- return;
+ return chachapoly_init(&cc->cp_ctx, key, keylen);
}
+#ifndef WITH_OPENSSL
+ if ((cc->cipher->flags & CFLAG_AESCTR) != 0) {
+ aesctr_keysetup(&cc->ac_ctx, key, 8 * keylen, 8 * ivlen);
+ aesctr_ivsetup(&cc->ac_ctx, iv);
+ return 0;
+ }
+ if ((cc->cipher->flags & CFLAG_NONE) != 0)
+ return 0;
+ return SSH_ERR_INVALID_ARGUMENT;
+#else
type = (*cipher->evptype)();
EVP_CIPHER_CTX_init(&cc->evp);
-#ifdef SSH_OLD_EVP
- if (type->key_len > 0 && type->key_len != keylen) {
- debug("cipher_init: set keylen (%d -> %d)",
- type->key_len, keylen);
- type->key_len = keylen;
+ if (EVP_CipherInit(&cc->evp, type, NULL, (u_char *)iv,
+ (do_encrypt == CIPHER_ENCRYPT)) == 0) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto bad;
}
- EVP_CipherInit(&cc->evp, type, (u_char *)key, (u_char *)iv,
- (do_encrypt == CIPHER_ENCRYPT));
-#else
- if (EVP_CipherInit(&cc->evp, type, NULL, (u_char *)iv,
- (do_encrypt == CIPHER_ENCRYPT)) == 0)
- fatal("cipher_init: EVP_CipherInit failed for %s",
- cipher->name);
if (cipher_authlen(cipher) &&
!EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_SET_IV_FIXED,
- -1, (u_char *)iv))
- fatal("cipher_init: EVP_CTRL_GCM_SET_IV_FIXED failed for %s",
- cipher->name);
+ -1, (u_char *)iv)) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto bad;
+ }
klen = EVP_CIPHER_CTX_key_length(&cc->evp);
if (klen > 0 && keylen != (u_int)klen) {
- debug2("cipher_init: set keylen (%d -> %d)", klen, keylen);
- if (EVP_CIPHER_CTX_set_key_length(&cc->evp, keylen) == 0)
- fatal("cipher_init: set keylen failed (%d -> %d)",
- klen, keylen);
+ if (EVP_CIPHER_CTX_set_key_length(&cc->evp, keylen) == 0) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto bad;
+ }
}
- if (EVP_CipherInit(&cc->evp, NULL, (u_char *)key, NULL, -1) == 0)
- fatal("cipher_init: EVP_CipherInit: set key failed for %s",
- cipher->name);
-#endif
+ if (EVP_CipherInit(&cc->evp, NULL, (u_char *)key, NULL, -1) == 0) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto bad;
+ }
if (cipher->discard_len > 0) {
- junk = xmalloc(cipher->discard_len);
- discard = xmalloc(cipher->discard_len);
- if (EVP_Cipher(&cc->evp, discard, junk,
- cipher->discard_len) == 0)
- fatal("evp_crypt: EVP_Cipher failed during discard");
+ if ((junk = malloc(cipher->discard_len)) == NULL ||
+ (discard = malloc(cipher->discard_len)) == NULL) {
+ free(junk);
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto bad;
+ }
+ ret = EVP_Cipher(&cc->evp, discard, junk, cipher->discard_len);
explicit_bzero(discard, cipher->discard_len);
free(junk);
free(discard);
+ if (ret != 1) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ bad:
+ EVP_CIPHER_CTX_cleanup(&cc->evp);
+ return ret;
+ }
}
+#endif
+ return 0;
}
/*
@@ -350,61 +389,72 @@
* Use 'authlen' bytes at offset 'len'+'aadlen' as the authentication tag.
* This tag is written on encryption and verified on decryption.
* Both 'aadlen' and 'authlen' can be set to 0.
- * cipher_crypt() returns 0 on success and -1 if the decryption integrity
- * check fails.
*/
int
-cipher_crypt(CipherContext *cc, u_int seqnr, u_char *dest, const u_char *src,
- u_int len, u_int aadlen, u_int authlen)
+cipher_crypt(struct sshcipher_ctx *cc, u_int seqnr, u_char *dest,
+ const u_char *src, u_int len, u_int aadlen, u_int authlen)
{
- if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0)
- return chachapoly_crypt(&cc->cp_ctx, seqnr, dest, src, len,
- aadlen, authlen, cc->encrypt);
+ if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
+ return chachapoly_crypt(&cc->cp_ctx, seqnr, dest, src,
+ len, aadlen, authlen, cc->encrypt);
+ }
+#ifndef WITH_OPENSSL
+ if ((cc->cipher->flags & CFLAG_AESCTR) != 0) {
+ if (aadlen)
+ memcpy(dest, src, aadlen);
+ aesctr_encrypt_bytes(&cc->ac_ctx, src + aadlen,
+ dest + aadlen, len);
+ return 0;
+ }
+ if ((cc->cipher->flags & CFLAG_NONE) != 0) {
+ memcpy(dest, src, aadlen + len);
+ return 0;
+ }
+ return SSH_ERR_INVALID_ARGUMENT;
+#else
if (authlen) {
u_char lastiv[1];
if (authlen != cipher_authlen(cc->cipher))
- fatal("%s: authlen mismatch %d", __func__, authlen);
+ return SSH_ERR_INVALID_ARGUMENT;
/* increment IV */
if (!EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_IV_GEN,
1, lastiv))
- fatal("%s: EVP_CTRL_GCM_IV_GEN", __func__);
+ return SSH_ERR_LIBCRYPTO_ERROR;
/* set tag on decyption */
if (!cc->encrypt &&
!EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_SET_TAG,
authlen, (u_char *)src + aadlen + len))
- fatal("%s: EVP_CTRL_GCM_SET_TAG", __func__);
+ return SSH_ERR_LIBCRYPTO_ERROR;
}
if (aadlen) {
if (authlen &&
EVP_Cipher(&cc->evp, NULL, (u_char *)src, aadlen) < 0)
- fatal("%s: EVP_Cipher(aad) failed", __func__);
+ return SSH_ERR_LIBCRYPTO_ERROR;
memcpy(dest, src, aadlen);
}
if (len % cc->cipher->block_size)
- fatal("%s: bad plaintext length %d", __func__, len);
+ return SSH_ERR_INVALID_ARGUMENT;
if (EVP_Cipher(&cc->evp, dest + aadlen, (u_char *)src + aadlen,
len) < 0)
- fatal("%s: EVP_Cipher failed", __func__);
+ return SSH_ERR_LIBCRYPTO_ERROR;
if (authlen) {
/* compute tag (on encrypt) or verify tag (on decrypt) */
- if (EVP_Cipher(&cc->evp, NULL, NULL, 0) < 0) {
- if (cc->encrypt)
- fatal("%s: EVP_Cipher(final) failed", __func__);
- else
- return -1;
- }
+ if (EVP_Cipher(&cc->evp, NULL, NULL, 0) < 0)
+ return cc->encrypt ?
+ SSH_ERR_LIBCRYPTO_ERROR : SSH_ERR_MAC_INVALID;
if (cc->encrypt &&
!EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_GET_TAG,
authlen, dest + aadlen + len))
- fatal("%s: EVP_CTRL_GCM_GET_TAG", __func__);
+ return SSH_ERR_LIBCRYPTO_ERROR;
}
return 0;
+#endif
}
/* Extract the packet length, including any decryption necessary beforehand */
int
-cipher_get_length(CipherContext *cc, u_int *plenp, u_int seqnr,
+cipher_get_length(struct sshcipher_ctx *cc, u_int *plenp, u_int seqnr,
const u_char *cp, u_int len)
{
if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0)
@@ -411,18 +461,25 @@
return chachapoly_get_length(&cc->cp_ctx, plenp, seqnr,
cp, len);
if (len < 4)
- return -1;
+ return SSH_ERR_MESSAGE_INCOMPLETE;
*plenp = get_u32(cp);
return 0;
}
-void
-cipher_cleanup(CipherContext *cc)
+int
+cipher_cleanup(struct sshcipher_ctx *cc)
{
+ if (cc == NULL || cc->cipher == NULL)
+ return 0;
if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0)
explicit_bzero(&cc->cp_ctx, sizeof(cc->cp_ctx));
+ else if ((cc->cipher->flags & CFLAG_AESCTR) != 0)
+ explicit_bzero(&cc->ac_ctx, sizeof(cc->ac_ctx));
+#ifdef WITH_OPENSSL
else if (EVP_CIPHER_CTX_cleanup(&cc->evp) == 0)
- error("cipher_cleanup: EVP_CIPHER_CTX_cleanup failed");
+ return SSH_ERR_LIBCRYPTO_ERROR;
+#endif
+ return 0;
}
/*
@@ -429,125 +486,155 @@
* Selects the cipher, and keys if by computing the MD5 checksum of the
* passphrase and using the resulting 16 bytes as the key.
*/
-
-void
-cipher_set_key_string(CipherContext *cc, const Cipher *cipher,
+int
+cipher_set_key_string(struct sshcipher_ctx *cc, const struct sshcipher *cipher,
const char *passphrase, int do_encrypt)
{
u_char digest[16];
+ int r = SSH_ERR_INTERNAL_ERROR;
- if (ssh_digest_memory(SSH_DIGEST_MD5, passphrase, strlen(passphrase),
- digest, sizeof(digest)) < 0)
- fatal("%s: md5 failed", __func__);
+ if ((r = ssh_digest_memory(SSH_DIGEST_MD5,
+ passphrase, strlen(passphrase),
+ digest, sizeof(digest))) != 0)
+ goto out;
- cipher_init(cc, cipher, digest, 16, NULL, 0, do_encrypt);
-
+ r = cipher_init(cc, cipher, digest, 16, NULL, 0, do_encrypt);
+ out:
explicit_bzero(digest, sizeof(digest));
+ return r;
}
/*
- * Exports an IV from the CipherContext required to export the key
+ * Exports an IV from the sshcipher_ctx required to export the key
* state back from the unprivileged child to the privileged parent
* process.
*/
-
int
-cipher_get_keyiv_len(const CipherContext *cc)
+cipher_get_keyiv_len(const struct sshcipher_ctx *cc)
{
- const Cipher *c = cc->cipher;
- int ivlen;
+ const struct sshcipher *c = cc->cipher;
+ int ivlen = 0;
if (c->number == SSH_CIPHER_3DES)
ivlen = 24;
else if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0)
ivlen = 0;
+ else if ((cc->cipher->flags & CFLAG_AESCTR) != 0)
+ ivlen = sizeof(cc->ac_ctx.ctr);
+#ifdef WITH_OPENSSL
else
ivlen = EVP_CIPHER_CTX_iv_length(&cc->evp);
+#endif /* WITH_OPENSSL */
return (ivlen);
}
-void
-cipher_get_keyiv(CipherContext *cc, u_char *iv, u_int len)
+int
+cipher_get_keyiv(struct sshcipher_ctx *cc, u_char *iv, u_int len)
{
- const Cipher *c = cc->cipher;
- int evplen;
+ const struct sshcipher *c = cc->cipher;
+#ifdef WITH_OPENSSL
+ int evplen;
+#endif
if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
if (len != 0)
- fatal("%s: wrong iv length %d != %d", __func__, len, 0);
- return;
+ return SSH_ERR_INVALID_ARGUMENT;
+ return 0;
}
+ if ((cc->cipher->flags & CFLAG_AESCTR) != 0) {
+ if (len != sizeof(cc->ac_ctx.ctr))
+ return SSH_ERR_INVALID_ARGUMENT;
+ memcpy(iv, cc->ac_ctx.ctr, len);
+ return 0;
+ }
+ if ((cc->cipher->flags & CFLAG_NONE) != 0)
+ return 0;
switch (c->number) {
+#ifdef WITH_OPENSSL
case SSH_CIPHER_SSH2:
case SSH_CIPHER_DES:
case SSH_CIPHER_BLOWFISH:
evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
- if (evplen <= 0)
- return;
+ if (evplen == 0)
+ return 0;
+ else if (evplen < 0)
+ return SSH_ERR_LIBCRYPTO_ERROR;
if ((u_int)evplen != len)
- fatal("%s: wrong iv length %d != %d", __func__,
- evplen, len);
-#ifdef USE_BUILTIN_RIJNDAEL
- if (c->evptype == evp_rijndael)
- ssh_rijndael_iv(&cc->evp, 0, iv, len);
- else
-#endif
+ return SSH_ERR_INVALID_ARGUMENT;
#ifndef OPENSSL_HAVE_EVPCTR
if (c->evptype == evp_aes_128_ctr)
ssh_aes_ctr_iv(&cc->evp, 0, iv, len);
else
#endif
- memcpy(iv, cc->evp.iv, len);
+ if (cipher_authlen(c)) {
+ if (!EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_IV_GEN,
+ len, iv))
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ } else
+ memcpy(iv, cc->evp.iv, len);
break;
+#endif
+#ifdef WITH_SSH1
case SSH_CIPHER_3DES:
- ssh1_3des_iv(&cc->evp, 0, iv, 24);
- break;
+ return ssh1_3des_iv(&cc->evp, 0, iv, 24);
+#endif
default:
- fatal("%s: bad cipher %d", __func__, c->number);
+ return SSH_ERR_INVALID_ARGUMENT;
}
+ return 0;
}
-void
-cipher_set_keyiv(CipherContext *cc, u_char *iv)
+int
+cipher_set_keyiv(struct sshcipher_ctx *cc, const u_char *iv)
{
- const Cipher *c = cc->cipher;
- int evplen = 0;
+ const struct sshcipher *c = cc->cipher;
+#ifdef WITH_OPENSSL
+ int evplen = 0;
+#endif
if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0)
- return;
+ return 0;
+ if ((cc->cipher->flags & CFLAG_NONE) != 0)
+ return 0;
switch (c->number) {
+#ifdef WITH_OPENSSL
case SSH_CIPHER_SSH2:
case SSH_CIPHER_DES:
case SSH_CIPHER_BLOWFISH:
evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
- if (evplen == 0)
- return;
-#ifdef USE_BUILTIN_RIJNDAEL
- if (c->evptype == evp_rijndael)
- ssh_rijndael_iv(&cc->evp, 1, iv, evplen);
- else
+ if (evplen <= 0)
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ if (cipher_authlen(c)) {
+ /* XXX iv arg is const, but EVP_CIPHER_CTX_ctrl isn't */
+ if (!EVP_CIPHER_CTX_ctrl(&cc->evp,
+ EVP_CTRL_GCM_SET_IV_FIXED, -1, (void *)iv))
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ } else
+ memcpy(cc->evp.iv, iv, evplen);
+ break;
#endif
-#ifndef OPENSSL_HAVE_EVPCTR
- if (c->evptype == evp_aes_128_ctr)
- ssh_aes_ctr_iv(&cc->evp, 1, iv, evplen);
- else
+#ifdef WITH_SSH1
+ case SSH_CIPHER_3DES:
+ return ssh1_3des_iv(&cc->evp, 1, (u_char *)iv, 24);
#endif
- memcpy(cc->evp.iv, iv, evplen);
- break;
- case SSH_CIPHER_3DES:
- ssh1_3des_iv(&cc->evp, 1, iv, 24);
- break;
default:
- fatal("%s: bad cipher %d", __func__, c->number);
+ return SSH_ERR_INVALID_ARGUMENT;
}
+ return 0;
}
+#ifdef WITH_OPENSSL
+#define EVP_X_STATE(evp) (evp).cipher_data
+#define EVP_X_STATE_LEN(evp) (evp).cipher->ctx_size
+#endif
+
int
-cipher_get_keycontext(const CipherContext *cc, u_char *dat)
+cipher_get_keycontext(const struct sshcipher_ctx *cc, u_char *dat)
{
- const Cipher *c = cc->cipher;
+#if defined(WITH_OPENSSL) && !defined(OPENSSL_NO_RC4)
+ const struct sshcipher *c = cc->cipher;
int plen = 0;
if (c->evptype == EVP_rc4) {
@@ -557,12 +644,16 @@
memcpy(dat, EVP_X_STATE(cc->evp), plen);
}
return (plen);
+#else
+ return 0;
+#endif
}
void
-cipher_set_keycontext(CipherContext *cc, u_char *dat)
+cipher_set_keycontext(struct sshcipher_ctx *cc, const u_char *dat)
{
- const Cipher *c = cc->cipher;
+#if defined(WITH_OPENSSL) && !defined(OPENSSL_NO_RC4)
+ const struct sshcipher *c = cc->cipher;
int plen;
if (c->evptype == EVP_rc4) {
@@ -569,4 +660,5 @@
plen = EVP_X_STATE_LEN(cc->evp);
memcpy(EVP_X_STATE(cc->evp), dat, plen);
}
+#endif
}
Modified: trunk/crypto/openssh/cipher.h
===================================================================
--- trunk/crypto/openssh/cipher.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/cipher.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher.h,v 1.44 2014/01/25 10:12:50 dtucker Exp $ */
+/* $OpenBSD: cipher.h,v 1.48 2015/07/08 19:09:25 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -37,8 +37,10 @@
#ifndef CIPHER_H
#define CIPHER_H
+#include <sys/types.h>
#include <openssl/evp.h>
#include "cipher-chachapoly.h"
+#include "cipher-aesctr.h"
/*
* Cipher types for SSH-1. New types can be added, but old types should not
@@ -60,44 +62,44 @@
#define CIPHER_ENCRYPT 1
#define CIPHER_DECRYPT 0
-typedef struct Cipher Cipher;
-typedef struct CipherContext CipherContext;
-
-struct Cipher;
-struct CipherContext {
+struct sshcipher;
+struct sshcipher_ctx {
int plaintext;
int encrypt;
EVP_CIPHER_CTX evp;
struct chachapoly_ctx cp_ctx; /* XXX union with evp? */
- const Cipher *cipher;
+ struct aesctr_ctx ac_ctx; /* XXX union with evp? */
+ const struct sshcipher *cipher;
};
u_int cipher_mask_ssh1(int);
-const Cipher *cipher_by_name(const char *);
-const Cipher *cipher_by_number(int);
+const struct sshcipher *cipher_by_name(const char *);
+const struct sshcipher *cipher_by_number(int);
int cipher_number(const char *);
char *cipher_name(int);
+const char *cipher_warning_message(const struct sshcipher_ctx *);
int ciphers_valid(const char *);
char *cipher_alg_list(char, int);
-void cipher_init(CipherContext *, const Cipher *, const u_char *, u_int,
- const u_char *, u_int, int);
-int cipher_crypt(CipherContext *, u_int, u_char *, const u_char *,
+int cipher_init(struct sshcipher_ctx *, const struct sshcipher *,
+ const u_char *, u_int, const u_char *, u_int, int);
+int cipher_crypt(struct sshcipher_ctx *, u_int, u_char *, const u_char *,
u_int, u_int, u_int);
-int cipher_get_length(CipherContext *, u_int *, u_int,
+int cipher_get_length(struct sshcipher_ctx *, u_int *, u_int,
const u_char *, u_int);
-void cipher_cleanup(CipherContext *);
-void cipher_set_key_string(CipherContext *, const Cipher *, const char *, int);
-u_int cipher_blocksize(const Cipher *);
-u_int cipher_keylen(const Cipher *);
-u_int cipher_seclen(const Cipher *);
-u_int cipher_authlen(const Cipher *);
-u_int cipher_ivlen(const Cipher *);
-u_int cipher_is_cbc(const Cipher *);
+int cipher_cleanup(struct sshcipher_ctx *);
+int cipher_set_key_string(struct sshcipher_ctx *, const struct sshcipher *,
+ const char *, int);
+u_int cipher_blocksize(const struct sshcipher *);
+u_int cipher_keylen(const struct sshcipher *);
+u_int cipher_seclen(const struct sshcipher *);
+u_int cipher_authlen(const struct sshcipher *);
+u_int cipher_ivlen(const struct sshcipher *);
+u_int cipher_is_cbc(const struct sshcipher *);
-u_int cipher_get_number(const Cipher *);
-void cipher_get_keyiv(CipherContext *, u_char *, u_int);
-void cipher_set_keyiv(CipherContext *, u_char *);
-int cipher_get_keyiv_len(const CipherContext *);
-int cipher_get_keycontext(const CipherContext *, u_char *);
-void cipher_set_keycontext(CipherContext *, u_char *);
+u_int cipher_get_number(const struct sshcipher *);
+int cipher_get_keyiv(struct sshcipher_ctx *, u_char *, u_int);
+int cipher_set_keyiv(struct sshcipher_ctx *, const u_char *);
+int cipher_get_keyiv_len(const struct sshcipher_ctx *);
+int cipher_get_keycontext(const struct sshcipher_ctx *, u_char *);
+void cipher_set_keycontext(struct sshcipher_ctx *, const u_char *);
#endif /* CIPHER_H */
Modified: trunk/crypto/openssh/clientloop.c
===================================================================
--- trunk/crypto/openssh/clientloop.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/clientloop.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.258 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.286 2016/07/23 02:54:08 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -61,9 +61,9 @@
#include "includes.h"
+#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
#include <sys/ioctl.h>
-#include <sys/param.h>
#ifdef HAVE_SYS_STAT_H
# include <sys/stat.h>
#endif
@@ -85,6 +85,7 @@
#include <termios.h>
#include <pwd.h>
#include <unistd.h>
+#include <limits.h>
#include "openbsd-compat/sys-queue.h"
#include "xmalloc.h"
@@ -99,7 +100,9 @@
#include "key.h"
#include "cipher.h"
#include "kex.h"
+#include "myproposal.h"
#include "log.h"
+#include "misc.h"
#include "readconf.h"
#include "clientloop.h"
#include "sshconnect.h"
@@ -106,10 +109,10 @@
#include "authfd.h"
#include "atomicio.h"
#include "sshpty.h"
-#include "misc.h"
#include "match.h"
#include "msg.h"
-#include "roaming.h"
+#include "ssherr.h"
+#include "hostfile.h"
/* import options */
extern Options options;
@@ -120,6 +123,9 @@
/* Flag indicating that no shell has been requested */
extern int no_shell_flag;
+/* Flag indicating that ssh should daemonise after authentication is complete */
+extern int fork_after_authentication_flag;
+
/* Control socket */
extern int muxserver_sock; /* XXX use mux_client_cleanup() instead */
@@ -160,13 +166,11 @@
static int connection_out; /* Connection to server (output). */
static int need_rekeying; /* Set to non-zero if rekeying is requested. */
static int session_closed; /* In SSH2: login session closed. */
-static int x11_refuse_time; /* If >0, refuse x11 opens after this time. */
+static u_int x11_refuse_time; /* If >0, refuse x11 opens after this time. */
static void client_init_dispatch(void);
int session_ident = -1;
-int session_resumed = 0;
-
/* Track escape per proto2 channel */
struct escape_filter_ctx {
int escape_pending;
@@ -191,9 +195,6 @@
static struct global_confirms global_confirms =
TAILQ_HEAD_INITIALIZER(global_confirms);
-/*XXX*/
-extern Kex *xxx_kex;
-
void ssh_process_session2_setup(int, int, int, Buffer *);
/* Restores stdin to blocking mode. */
@@ -287,6 +288,9 @@
{
size_t i, dlen;
+ if (display == NULL)
+ return 0;
+
dlen = strlen(display);
for (i = 0; i < dlen; i++) {
if (!isalnum((u_char)display[i]) &&
@@ -298,36 +302,36 @@
return 1;
}
-#define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
-void
+#define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
+#define X11_TIMEOUT_SLACK 60
+int
client_x11_get_proto(const char *display, const char *xauth_path,
u_int trusted, u_int timeout, char **_proto, char **_data)
{
- char cmd[1024];
- char line[512];
- char xdisplay[512];
+ char cmd[1024], line[512], xdisplay[512];
+ char xauthfile[PATH_MAX], xauthdir[PATH_MAX];
static char proto[512], data[512];
FILE *f;
- int got_data = 0, generated = 0, do_unlink = 0, i;
- char *xauthdir, *xauthfile;
+ int got_data = 0, generated = 0, do_unlink = 0, i, r;
struct stat st;
- u_int now;
+ u_int now, x11_timeout_real;
- xauthdir = xauthfile = NULL;
*_proto = proto;
*_data = data;
- proto[0] = data[0] = '\0';
+ proto[0] = data[0] = xauthfile[0] = xauthdir[0] = '\0';
- if (xauth_path == NULL ||(stat(xauth_path, &st) == -1)) {
+ if (!client_x11_display_valid(display)) {
+ if (display != NULL)
+ logit("DISPLAY \"%s\" invalid; disabling X11 forwarding",
+ display);
+ return -1;
+ }
+ if (xauth_path != NULL && stat(xauth_path, &st) == -1) {
debug("No xauth program.");
- } else if (!client_x11_display_valid(display)) {
- logit("DISPLAY '%s' invalid, falling back to fake xauth data",
- display);
- } else {
- if (display == NULL) {
- debug("x11_get_proto: DISPLAY not set");
- return;
- }
+ xauth_path = NULL;
+ }
+
+ if (xauth_path != NULL) {
/*
* Handle FamilyLocal case where $DISPLAY does
* not match an authorization entry. For this we
@@ -336,33 +340,60 @@
* is not perfect.
*/
if (strncmp(display, "localhost:", 10) == 0) {
- snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
- display + 10);
+ if ((r = snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
+ display + 10)) < 0 ||
+ (size_t)r >= sizeof(xdisplay)) {
+ error("%s: display name too long", __func__);
+ return -1;
+ }
display = xdisplay;
}
if (trusted == 0) {
- xauthdir = xmalloc(MAXPATHLEN);
- xauthfile = xmalloc(MAXPATHLEN);
- mktemp_proto(xauthdir, MAXPATHLEN);
- if (mkdtemp(xauthdir) != NULL) {
- do_unlink = 1;
- snprintf(xauthfile, MAXPATHLEN, "%s/xauthfile",
- xauthdir);
- snprintf(cmd, sizeof(cmd),
- "%s -f %s generate %s " SSH_X11_PROTO
- " untrusted timeout %u 2>" _PATH_DEVNULL,
- xauth_path, xauthfile, display, timeout);
- debug2("x11_get_proto: %s", cmd);
- if (system(cmd) == 0)
- generated = 1;
- if (x11_refuse_time == 0) {
- now = monotime() + 1;
- if (UINT_MAX - timeout < now)
- x11_refuse_time = UINT_MAX;
- else
- x11_refuse_time = now + timeout;
- }
+ /*
+ * Generate an untrusted X11 auth cookie.
+ *
+ * The authentication cookie should briefly outlive
+ * ssh's willingness to forward X11 connections to
+ * avoid nasty fail-open behaviour in the X server.
+ */
+ mktemp_proto(xauthdir, sizeof(xauthdir));
+ if (mkdtemp(xauthdir) == NULL) {
+ error("%s: mkdtemp: %s",
+ __func__, strerror(errno));
+ return -1;
}
+ do_unlink = 1;
+ if ((r = snprintf(xauthfile, sizeof(xauthfile),
+ "%s/xauthfile", xauthdir)) < 0 ||
+ (size_t)r >= sizeof(xauthfile)) {
+ error("%s: xauthfile path too long", __func__);
+ unlink(xauthfile);
+ rmdir(xauthdir);
+ return -1;
+ }
+
+ if (timeout >= UINT_MAX - X11_TIMEOUT_SLACK)
+ x11_timeout_real = UINT_MAX;
+ else
+ x11_timeout_real = timeout + X11_TIMEOUT_SLACK;
+ if ((r = snprintf(cmd, sizeof(cmd),
+ "%s -f %s generate %s " SSH_X11_PROTO
+ " untrusted timeout %u 2>" _PATH_DEVNULL,
+ xauth_path, xauthfile, display,
+ x11_timeout_real)) < 0 ||
+ (size_t)r >= sizeof(cmd))
+ fatal("%s: cmd too long", __func__);
+ debug2("%s: %s", __func__, cmd);
+ if (x11_refuse_time == 0) {
+ now = monotime() + 1;
+ if (UINT_MAX - timeout < now)
+ x11_refuse_time = UINT_MAX;
+ else
+ x11_refuse_time = now + timeout;
+ channel_set_x11_refuse_time(x11_refuse_time);
+ }
+ if (system(cmd) == 0)
+ generated = 1;
}
/*
@@ -384,9 +415,7 @@
got_data = 1;
if (f)
pclose(f);
- } else
- error("Warning: untrusted X11 forwarding setup failed: "
- "xauth key data not generated");
+ }
}
if (do_unlink) {
@@ -393,9 +422,14 @@
unlink(xauthfile);
rmdir(xauthdir);
}
- free(xauthdir);
- free(xauthfile);
+ /* Don't fall back to fake X11 data for untrusted forwarding */
+ if (!trusted && !got_data) {
+ error("Warning: untrusted X11 forwarding setup failed: "
+ "xauth key data not generated");
+ return -1;
+ }
+
/*
* If we didn't get authentication data, just make up some
* data. The forwarding code will check the validity of the
@@ -418,6 +452,8 @@
rnd >>= 8;
}
}
+
+ return 0;
}
/*
@@ -538,13 +574,13 @@
}
}
-static void
+static int
client_global_request_reply(int type, u_int32_t seq, void *ctxt)
{
struct global_confirm *gc;
if ((gc = TAILQ_FIRST(&global_confirms)) == NULL)
- return;
+ return 0;
if (gc->cb != NULL)
gc->cb(type, seq, gc->ctx);
if (--gc->ref_count <= 0) {
@@ -554,6 +590,7 @@
}
packet_set_alive_timeouts(0);
+ return 0;
}
static void
@@ -720,7 +757,7 @@
static void
client_process_net_input(fd_set *readset)
{
- int len, cont = 0;
+ int len;
char buf[SSH_IOBUFSZ];
/*
@@ -729,8 +766,8 @@
*/
if (FD_ISSET(connection_in, readset)) {
/* Read as much as possible. */
- len = roaming_read(connection_in, buf, sizeof(buf), &cont);
- if (len == 0 && cont == 0) {
+ len = read(connection_in, buf, sizeof(buf));
+ if (len == 0) {
/*
* Received EOF. The remote host has closed the
* connection.
@@ -871,13 +908,11 @@
process_cmdline(void)
{
void (*handler)(int);
- char *s, *cmd, *cancel_host;
- int delete = 0, local = 0, remote = 0, dynamic = 0;
- int cancel_port, ok;
- Forward fwd;
+ char *s, *cmd;
+ int ok, delete = 0, local = 0, remote = 0, dynamic = 0;
+ struct Forward fwd;
memset(&fwd, 0, sizeof(fwd));
- fwd.listen_host = fwd.connect_host = NULL;
leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
handler = signal(SIGINT, SIG_IGN);
@@ -943,29 +978,20 @@
/* XXX update list of forwards in options */
if (delete) {
- cancel_port = 0;
- cancel_host = hpdelim(&s); /* may be NULL */
- if (s != NULL) {
- cancel_port = a2port(s);
- cancel_host = cleanhostname(cancel_host);
- } else {
- cancel_port = a2port(cancel_host);
- cancel_host = NULL;
- }
- if (cancel_port <= 0) {
- logit("Bad forwarding close port");
+ /* We pass 1 for dynamicfwd to restrict to 1 or 2 fields. */
+ if (!parse_forward(&fwd, s, 1, 0)) {
+ logit("Bad forwarding close specification.");
goto out;
}
if (remote)
- ok = channel_request_rforward_cancel(cancel_host,
- cancel_port) == 0;
+ ok = channel_request_rforward_cancel(&fwd) == 0;
else if (dynamic)
- ok = channel_cancel_lport_listener(cancel_host,
- cancel_port, 0, options.gateway_ports) > 0;
+ ok = channel_cancel_lport_listener(&fwd,
+ 0, &options.fwd_opts) > 0;
else
- ok = channel_cancel_lport_listener(cancel_host,
- cancel_port, CHANNEL_CANCEL_PORT_STATIC,
- options.gateway_ports) > 0;
+ ok = channel_cancel_lport_listener(&fwd,
+ CHANNEL_CANCEL_PORT_STATIC,
+ &options.fwd_opts) > 0;
if (!ok) {
logit("Unkown port forwarding.");
goto out;
@@ -977,16 +1003,13 @@
goto out;
}
if (local || dynamic) {
- if (!channel_setup_local_fwd_listener(fwd.listen_host,
- fwd.listen_port, fwd.connect_host,
- fwd.connect_port, options.gateway_ports)) {
+ if (!channel_setup_local_fwd_listener(&fwd,
+ &options.fwd_opts)) {
logit("Port forwarding failed.");
goto out;
}
} else {
- if (channel_request_remote_forwarding(fwd.listen_host,
- fwd.listen_port, fwd.connect_host,
- fwd.connect_port) < 0) {
+ if (channel_request_remote_forwarding(&fwd) < 0) {
logit("Port forwarding failed.");
goto out;
}
@@ -999,7 +1022,9 @@
enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
free(cmd);
free(fwd.listen_host);
+ free(fwd.listen_path);
free(fwd.connect_host);
+ free(fwd.connect_path);
}
/* reasons to suppress output of an escape command in help output */
@@ -1426,8 +1451,7 @@
static void
client_process_buffered_input_packets(void)
{
- dispatch_run(DISPATCH_NONBLOCK, &quit_pending,
- compat20 ? xxx_kex : NULL);
+ dispatch_run(DISPATCH_NONBLOCK, &quit_pending, active_state);
}
/* scan buf[] for '~' before sending data to the peer */
@@ -1481,7 +1505,7 @@
{
fd_set *readset = NULL, *writeset = NULL;
double start_time, total_time;
- int max_fd = 0, max_fd2 = 0, len, rekeying = 0;
+ int r, max_fd = 0, max_fd2 = 0, len;
u_int64_t ibytes, obytes;
u_int nalloc = 0;
char buf[100];
@@ -1488,6 +1512,37 @@
debug("Entering interactive session.");
+ if (options.control_master &&
+ !option_clear_or_none(options.control_path)) {
+ debug("pledge: id");
+ if (pledge("stdio rpath wpath cpath unix inet dns recvfd proc exec id tty",
+ NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+
+ } else if (options.forward_x11 || options.permit_local_command) {
+ debug("pledge: exec");
+ if (pledge("stdio rpath wpath cpath unix inet dns proc exec tty",
+ NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+
+ } else if (options.update_hostkeys) {
+ debug("pledge: filesystem full");
+ if (pledge("stdio rpath wpath cpath unix inet dns proc tty",
+ NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+
+ } else if (!option_clear_or_none(options.proxy_command) ||
+ fork_after_authentication_flag) {
+ debug("pledge: proc");
+ if (pledge("stdio cpath unix inet dns proc tty", NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+
+ } else {
+ debug("pledge: network");
+ if (pledge("stdio unix inet dns tty", NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+ }
+
start_time = get_current_time();
/* Initialize variables. */
@@ -1566,10 +1621,15 @@
if (compat20 && session_closed && !channel_still_open())
break;
- rekeying = (xxx_kex != NULL && !xxx_kex->done);
-
- if (rekeying) {
+ if (ssh_packet_is_rekeying(active_state)) {
debug("rekeying in progress");
+ } else if (need_rekeying) {
+ /* manual rekey request */
+ debug("need rekeying");
+ if ((r = kex_start_rekex(active_state)) != 0)
+ fatal("%s: kex_start_rekex: %s", __func__,
+ ssh_err(r));
+ need_rekeying = 0;
} else {
/*
* Make packets of buffered stdin data, and buffer
@@ -1600,21 +1660,14 @@
*/
max_fd2 = max_fd;
client_wait_until_can_do_something(&readset, &writeset,
- &max_fd2, &nalloc, rekeying);
+ &max_fd2, &nalloc, ssh_packet_is_rekeying(active_state));
if (quit_pending)
break;
/* Do channel operations unless rekeying in progress. */
- if (!rekeying) {
+ if (!ssh_packet_is_rekeying(active_state))
channel_after_select(readset, writeset);
- if (need_rekeying || packet_need_rekeying()) {
- debug("need rekeying");
- xxx_kex->done = 0;
- kex_send_kexinit(xxx_kex);
- need_rekeying = 0;
- }
- }
/* Buffer input from the connection. */
client_process_net_input(readset);
@@ -1632,14 +1685,6 @@
client_process_output(writeset);
}
- if (session_resumed) {
- connection_in = packet_get_connection_in();
- connection_out = packet_get_connection_out();
- max_fd = MAX(max_fd, connection_out);
- max_fd = MAX(max_fd, connection_in);
- session_resumed = 0;
- }
-
/*
* Send as much buffered packet data as possible to the
* sender.
@@ -1733,7 +1778,7 @@
}
/* Clear and free any buffers. */
- memset(buf, 0, sizeof(buf));
+ explicit_bzero(buf, sizeof(buf));
buffer_free(&stdin_buffer);
buffer_free(&stdout_buffer);
buffer_free(&stderr_buffer);
@@ -1740,8 +1785,7 @@
/* Report bytes transferred, and transfer rates. */
total_time = get_current_time() - start_time;
- packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
- packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
+ packet_get_bytes(&ibytes, &obytes);
verbose("Transferred: sent %llu, received %llu bytes, in %.1f seconds",
(unsigned long long)obytes, (unsigned long long)ibytes, total_time);
if (total_time > 0)
@@ -1754,7 +1798,7 @@
/*********/
-static void
+static int
client_input_stdout_data(int type, u_int32_t seq, void *ctxt)
{
u_int data_len;
@@ -1763,8 +1807,9 @@
buffer_append(&stdout_buffer, data, data_len);
explicit_bzero(data, data_len);
free(data);
+ return 0;
}
-static void
+static int
client_input_stderr_data(int type, u_int32_t seq, void *ctxt)
{
u_int data_len;
@@ -1773,8 +1818,9 @@
buffer_append(&stderr_buffer, data, data_len);
explicit_bzero(data, data_len);
free(data);
+ return 0;
}
-static void
+static int
client_input_exit_status(int type, u_int32_t seq, void *ctxt)
{
exit_status = packet_get_int();
@@ -1789,12 +1835,14 @@
packet_write_wait();
/* Flag that we want to exit. */
quit_pending = 1;
+ return 0;
}
-static void
+
+static int
client_input_agent_open(int type, u_int32_t seq, void *ctxt)
{
Channel *c = NULL;
- int remote_id, sock;
+ int r, remote_id, sock;
/* Read the remote channel number from the message. */
remote_id = packet_get_int();
@@ -1804,8 +1852,12 @@
* Get a connection to the local authentication agent (this may again
* get forwarded).
*/
- sock = ssh_get_authentication_socket();
+ if ((r = ssh_get_authentication_socket(&sock)) != 0 &&
+ r != SSH_ERR_AGENT_NOT_PRESENT)
+ debug("%s: ssh_get_authentication_socket: %s",
+ __func__, ssh_err(r));
+
/*
* If we could not connect the agent, send an error message back to
* the server. This should never happen unless the agent dies,
@@ -1829,6 +1881,7 @@
packet_put_int(c->self);
}
packet_send();
+ return 0;
}
static Channel *
@@ -1845,11 +1898,10 @@
originator_port = packet_get_int();
packet_check_eom();
- debug("client_request_forwarded_tcpip: listen %s port %d, "
- "originator %s port %d", listen_address, listen_port,
- originator_address, originator_port);
+ debug("%s: listen %s port %d, originator %s port %d", __func__,
+ listen_address, listen_port, originator_address, originator_port);
- c = channel_connect_by_listen_address(listen_port,
+ c = channel_connect_by_listen_address(listen_address, listen_port,
"forwarded-tcpip", originator_address);
free(originator_address);
@@ -1858,6 +1910,27 @@
}
static Channel *
+client_request_forwarded_streamlocal(const char *request_type, int rchan)
+{
+ Channel *c = NULL;
+ char *listen_path;
+
+ /* Get the remote path. */
+ listen_path = packet_get_string(NULL);
+ /* XXX: Skip reserved field for now. */
+ if (packet_get_string_ptr(NULL) == NULL)
+ fatal("%s: packet_get_string_ptr failed", __func__);
+ packet_check_eom();
+
+ debug("%s: %s", __func__, listen_path);
+
+ c = channel_connect_by_listen_path(listen_path,
+ "forwarded-streamlocal at openssh.com", "forwarded-streamlocal");
+ free(listen_path);
+ return c;
+}
+
+static Channel *
client_request_x11(const char *request_type, int rchan)
{
Channel *c = NULL;
@@ -1871,7 +1944,7 @@
"malicious server.");
return NULL;
}
- if (x11_refuse_time != 0 && monotime() >= x11_refuse_time) {
+ if (x11_refuse_time != 0 && (u_int)monotime() >= x11_refuse_time) {
verbose("Rejected X11 connection after ForwardX11Timeout "
"expired");
return NULL;
@@ -1902,7 +1975,7 @@
client_request_agent(const char *request_type, int rchan)
{
Channel *c = NULL;
- int sock;
+ int r, sock;
if (!options.forward_agent) {
error("Warning: ssh server tried agent forwarding.");
@@ -1910,9 +1983,12 @@
"malicious server.");
return NULL;
}
- sock = ssh_get_authentication_socket();
- if (sock < 0)
+ if ((r = ssh_get_authentication_socket(&sock)) != 0) {
+ if (r != SSH_ERR_AGENT_NOT_PRESENT)
+ debug("%s: ssh_get_authentication_socket: %s",
+ __func__, ssh_err(r));
return NULL;
+ }
c = channel_new("authentication agent connection",
SSH_CHANNEL_OPEN, sock, sock, -1,
CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
@@ -1966,7 +2042,7 @@
}
/* XXXX move to generic input handler */
-static void
+static int
client_input_channel_open(int type, u_int32_t seq, void *ctxt)
{
Channel *c = NULL;
@@ -1984,6 +2060,8 @@
if (strcmp(ctype, "forwarded-tcpip") == 0) {
c = client_request_forwarded_tcpip(ctype, rchan);
+ } else if (strcmp(ctype, "forwarded-streamlocal at openssh.com") == 0) {
+ c = client_request_forwarded_streamlocal(ctype, rchan);
} else if (strcmp(ctype, "x11") == 0) {
c = client_request_x11(ctype, rchan);
} else if (strcmp(ctype, "auth-agent at openssh.com") == 0) {
@@ -2015,8 +2093,10 @@
packet_send();
}
free(ctype);
+ return 0;
}
-static void
+
+static int
client_input_channel_req(int type, u_int32_t seq, void *ctxt)
{
Channel *c = NULL;
@@ -2054,7 +2134,7 @@
}
packet_check_eom();
}
- if (reply && c != NULL) {
+ if (reply && c != NULL && !(c->flags & CHAN_CLOSE_SENT)) {
packet_start(success ?
SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE);
packet_put_int(c->remote_id);
@@ -2061,8 +2141,383 @@
packet_send();
}
free(rtype);
+ return 0;
}
+
+struct hostkeys_update_ctx {
+ /* The hostname and (optionally) IP address string for the server */
+ char *host_str, *ip_str;
+
+ /*
+ * Keys received from the server and a flag for each indicating
+ * whether they already exist in known_hosts.
+ * keys_seen is filled in by hostkeys_find() and later (for new
+ * keys) by client_global_hostkeys_private_confirm().
+ */
+ struct sshkey **keys;
+ int *keys_seen;
+ size_t nkeys;
+
+ size_t nnew;
+
+ /*
+ * Keys that are in known_hosts, but were not present in the update
+ * from the server (i.e. scheduled to be deleted).
+ * Filled in by hostkeys_find().
+ */
+ struct sshkey **old_keys;
+ size_t nold;
+};
+
static void
+hostkeys_update_ctx_free(struct hostkeys_update_ctx *ctx)
+{
+ size_t i;
+
+ if (ctx == NULL)
+ return;
+ for (i = 0; i < ctx->nkeys; i++)
+ sshkey_free(ctx->keys[i]);
+ free(ctx->keys);
+ free(ctx->keys_seen);
+ for (i = 0; i < ctx->nold; i++)
+ sshkey_free(ctx->old_keys[i]);
+ free(ctx->old_keys);
+ free(ctx->host_str);
+ free(ctx->ip_str);
+ free(ctx);
+}
+
+static int
+hostkeys_find(struct hostkey_foreach_line *l, void *_ctx)
+{
+ struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
+ size_t i;
+ struct sshkey **tmp;
+
+ if (l->status != HKF_STATUS_MATCHED || l->key == NULL ||
+ l->key->type == KEY_RSA1)
+ return 0;
+
+ /* Mark off keys we've already seen for this host */
+ for (i = 0; i < ctx->nkeys; i++) {
+ if (sshkey_equal(l->key, ctx->keys[i])) {
+ debug3("%s: found %s key at %s:%ld", __func__,
+ sshkey_ssh_name(ctx->keys[i]), l->path, l->linenum);
+ ctx->keys_seen[i] = 1;
+ return 0;
+ }
+ }
+ /* This line contained a key that not offered by the server */
+ debug3("%s: deprecated %s key at %s:%ld", __func__,
+ sshkey_ssh_name(l->key), l->path, l->linenum);
+ if ((tmp = reallocarray(ctx->old_keys, ctx->nold + 1,
+ sizeof(*ctx->old_keys))) == NULL)
+ fatal("%s: reallocarray failed nold = %zu",
+ __func__, ctx->nold);
+ ctx->old_keys = tmp;
+ ctx->old_keys[ctx->nold++] = l->key;
+ l->key = NULL;
+
+ return 0;
+}
+
+static void
+update_known_hosts(struct hostkeys_update_ctx *ctx)
+{
+ int r, was_raw = 0;
+ int loglevel = options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK ?
+ SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_VERBOSE;
+ char *fp, *response;
+ size_t i;
+
+ for (i = 0; i < ctx->nkeys; i++) {
+ if (ctx->keys_seen[i] != 2)
+ continue;
+ if ((fp = sshkey_fingerprint(ctx->keys[i],
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+ fatal("%s: sshkey_fingerprint failed", __func__);
+ do_log2(loglevel, "Learned new hostkey: %s %s",
+ sshkey_type(ctx->keys[i]), fp);
+ free(fp);
+ }
+ for (i = 0; i < ctx->nold; i++) {
+ if ((fp = sshkey_fingerprint(ctx->old_keys[i],
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+ fatal("%s: sshkey_fingerprint failed", __func__);
+ do_log2(loglevel, "Deprecating obsolete hostkey: %s %s",
+ sshkey_type(ctx->old_keys[i]), fp);
+ free(fp);
+ }
+ if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK) {
+ if (get_saved_tio() != NULL) {
+ leave_raw_mode(1);
+ was_raw = 1;
+ }
+ response = NULL;
+ for (i = 0; !quit_pending && i < 3; i++) {
+ free(response);
+ response = read_passphrase("Accept updated hostkeys? "
+ "(yes/no): ", RP_ECHO);
+ if (strcasecmp(response, "yes") == 0)
+ break;
+ else if (quit_pending || response == NULL ||
+ strcasecmp(response, "no") == 0) {
+ options.update_hostkeys = 0;
+ break;
+ } else {
+ do_log2(loglevel, "Please enter "
+ "\"yes\" or \"no\"");
+ }
+ }
+ if (quit_pending || i >= 3 || response == NULL)
+ options.update_hostkeys = 0;
+ free(response);
+ if (was_raw)
+ enter_raw_mode(1);
+ }
+
+ /*
+ * Now that all the keys are verified, we can go ahead and replace
+ * them in known_hosts (assuming SSH_UPDATE_HOSTKEYS_ASK didn't
+ * cancel the operation).
+ */
+ if (options.update_hostkeys != 0 &&
+ (r = hostfile_replace_entries(options.user_hostfiles[0],
+ ctx->host_str, ctx->ip_str, ctx->keys, ctx->nkeys,
+ options.hash_known_hosts, 0,
+ options.fingerprint_hash)) != 0)
+ error("%s: hostfile_replace_entries failed: %s",
+ __func__, ssh_err(r));
+}
+
+static void
+client_global_hostkeys_private_confirm(int type, u_int32_t seq, void *_ctx)
+{
+ struct ssh *ssh = active_state; /* XXX */
+ struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
+ size_t i, ndone;
+ struct sshbuf *signdata;
+ int r;
+ const u_char *sig;
+ size_t siglen;
+
+ if (ctx->nnew == 0)
+ fatal("%s: ctx->nnew == 0", __func__); /* sanity */
+ if (type != SSH2_MSG_REQUEST_SUCCESS) {
+ error("Server failed to confirm ownership of "
+ "private host keys");
+ hostkeys_update_ctx_free(ctx);
+ return;
+ }
+ if ((signdata = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ /* Don't want to accidentally accept an unbound signature */
+ if (ssh->kex->session_id_len == 0)
+ fatal("%s: ssh->kex->session_id_len == 0", __func__);
+ /*
+ * Expect a signature for each of the ctx->nnew private keys we
+ * haven't seen before. They will be in the same order as the
+ * ctx->keys where the corresponding ctx->keys_seen[i] == 0.
+ */
+ for (ndone = i = 0; i < ctx->nkeys; i++) {
+ if (ctx->keys_seen[i])
+ continue;
+ /* Prepare data to be signed: session ID, unique string, key */
+ sshbuf_reset(signdata);
+ if ( (r = sshbuf_put_cstring(signdata,
+ "hostkeys-prove-00 at openssh.com")) != 0 ||
+ (r = sshbuf_put_string(signdata, ssh->kex->session_id,
+ ssh->kex->session_id_len)) != 0 ||
+ (r = sshkey_puts(ctx->keys[i], signdata)) != 0)
+ fatal("%s: failed to prepare signature: %s",
+ __func__, ssh_err(r));
+ /* Extract and verify signature */
+ if ((r = sshpkt_get_string_direct(ssh, &sig, &siglen)) != 0) {
+ error("%s: couldn't parse message: %s",
+ __func__, ssh_err(r));
+ goto out;
+ }
+ if ((r = sshkey_verify(ctx->keys[i], sig, siglen,
+ sshbuf_ptr(signdata), sshbuf_len(signdata), 0)) != 0) {
+ error("%s: server gave bad signature for %s key %zu",
+ __func__, sshkey_type(ctx->keys[i]), i);
+ goto out;
+ }
+ /* Key is good. Mark it as 'seen' */
+ ctx->keys_seen[i] = 2;
+ ndone++;
+ }
+ if (ndone != ctx->nnew)
+ fatal("%s: ndone != ctx->nnew (%zu / %zu)", __func__,
+ ndone, ctx->nnew); /* Shouldn't happen */
+ ssh_packet_check_eom(ssh);
+
+ /* Make the edits to known_hosts */
+ update_known_hosts(ctx);
+ out:
+ hostkeys_update_ctx_free(ctx);
+}
+
+/*
+ * Handle hostkeys-00 at openssh.com global request to inform the client of all
+ * the server's hostkeys. The keys are checked against the user's
+ * HostkeyAlgorithms preference before they are accepted.
+ */
+static int
+client_input_hostkeys(void)
+{
+ struct ssh *ssh = active_state; /* XXX */
+ const u_char *blob = NULL;
+ size_t i, len = 0;
+ struct sshbuf *buf = NULL;
+ struct sshkey *key = NULL, **tmp;
+ int r;
+ char *fp;
+ static int hostkeys_seen = 0; /* XXX use struct ssh */
+ extern struct sockaddr_storage hostaddr; /* XXX from ssh.c */
+ struct hostkeys_update_ctx *ctx = NULL;
+
+ if (hostkeys_seen)
+ fatal("%s: server already sent hostkeys", __func__);
+ if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK &&
+ options.batch_mode)
+ return 1; /* won't ask in batchmode, so don't even try */
+ if (!options.update_hostkeys || options.num_user_hostfiles <= 0)
+ return 1;
+
+ ctx = xcalloc(1, sizeof(*ctx));
+ while (ssh_packet_remaining(ssh) > 0) {
+ sshkey_free(key);
+ key = NULL;
+ if ((r = sshpkt_get_string_direct(ssh, &blob, &len)) != 0) {
+ error("%s: couldn't parse message: %s",
+ __func__, ssh_err(r));
+ goto out;
+ }
+ if ((r = sshkey_from_blob(blob, len, &key)) != 0) {
+ error("%s: parse key: %s", __func__, ssh_err(r));
+ goto out;
+ }
+ fp = sshkey_fingerprint(key, options.fingerprint_hash,
+ SSH_FP_DEFAULT);
+ debug3("%s: received %s key %s", __func__,
+ sshkey_type(key), fp);
+ free(fp);
+
+ /* Check that the key is accepted in HostkeyAlgorithms */
+ if (match_pattern_list(sshkey_ssh_name(key),
+ options.hostkeyalgorithms ? options.hostkeyalgorithms :
+ KEX_DEFAULT_PK_ALG, 0) != 1) {
+ debug3("%s: %s key not permitted by HostkeyAlgorithms",
+ __func__, sshkey_ssh_name(key));
+ continue;
+ }
+ /* Skip certs */
+ if (sshkey_is_cert(key)) {
+ debug3("%s: %s key is a certificate; skipping",
+ __func__, sshkey_ssh_name(key));
+ continue;
+ }
+ /* Ensure keys are unique */
+ for (i = 0; i < ctx->nkeys; i++) {
+ if (sshkey_equal(key, ctx->keys[i])) {
+ error("%s: received duplicated %s host key",
+ __func__, sshkey_ssh_name(key));
+ goto out;
+ }
+ }
+ /* Key is good, record it */
+ if ((tmp = reallocarray(ctx->keys, ctx->nkeys + 1,
+ sizeof(*ctx->keys))) == NULL)
+ fatal("%s: reallocarray failed nkeys = %zu",
+ __func__, ctx->nkeys);
+ ctx->keys = tmp;
+ ctx->keys[ctx->nkeys++] = key;
+ key = NULL;
+ }
+
+ if (ctx->nkeys == 0) {
+ debug("%s: server sent no hostkeys", __func__);
+ goto out;
+ }
+
+ if ((ctx->keys_seen = calloc(ctx->nkeys,
+ sizeof(*ctx->keys_seen))) == NULL)
+ fatal("%s: calloc failed", __func__);
+
+ get_hostfile_hostname_ipaddr(host,
+ options.check_host_ip ? (struct sockaddr *)&hostaddr : NULL,
+ options.port, &ctx->host_str,
+ options.check_host_ip ? &ctx->ip_str : NULL);
+
+ /* Find which keys we already know about. */
+ if ((r = hostkeys_foreach(options.user_hostfiles[0], hostkeys_find,
+ ctx, ctx->host_str, ctx->ip_str,
+ HKF_WANT_PARSE_KEY|HKF_WANT_MATCH)) != 0) {
+ error("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
+ goto out;
+ }
+
+ /* Figure out if we have any new keys to add */
+ ctx->nnew = 0;
+ for (i = 0; i < ctx->nkeys; i++) {
+ if (!ctx->keys_seen[i])
+ ctx->nnew++;
+ }
+
+ debug3("%s: %zu keys from server: %zu new, %zu retained. %zu to remove",
+ __func__, ctx->nkeys, ctx->nnew, ctx->nkeys - ctx->nnew, ctx->nold);
+
+ if (ctx->nnew == 0 && ctx->nold != 0) {
+ /* We have some keys to remove. Just do it. */
+ update_known_hosts(ctx);
+ } else if (ctx->nnew != 0) {
+ /*
+ * We have received hitherto-unseen keys from the server.
+ * Ask the server to confirm ownership of the private halves.
+ */
+ debug3("%s: asking server to prove ownership for %zu keys",
+ __func__, ctx->nnew);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 ||
+ (r = sshpkt_put_cstring(ssh,
+ "hostkeys-prove-00 at openssh.com")) != 0 ||
+ (r = sshpkt_put_u8(ssh, 1)) != 0) /* bool: want reply */
+ fatal("%s: cannot prepare packet: %s",
+ __func__, ssh_err(r));
+ if ((buf = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new", __func__);
+ for (i = 0; i < ctx->nkeys; i++) {
+ if (ctx->keys_seen[i])
+ continue;
+ sshbuf_reset(buf);
+ if ((r = sshkey_putb(ctx->keys[i], buf)) != 0)
+ fatal("%s: sshkey_putb: %s",
+ __func__, ssh_err(r));
+ if ((r = sshpkt_put_stringb(ssh, buf)) != 0)
+ fatal("%s: sshpkt_put_string: %s",
+ __func__, ssh_err(r));
+ }
+ if ((r = sshpkt_send(ssh)) != 0)
+ fatal("%s: sshpkt_send: %s", __func__, ssh_err(r));
+ client_register_global_confirm(
+ client_global_hostkeys_private_confirm, ctx);
+ ctx = NULL; /* will be freed in callback */
+ }
+
+ /* Success */
+ out:
+ hostkeys_update_ctx_free(ctx);
+ sshkey_free(key);
+ sshbuf_free(buf);
+ /*
+ * NB. Return success for all cases. The server doesn't need to know
+ * what the client does with its hosts file.
+ */
+ return 1;
+}
+
+static int
client_input_global_request(int type, u_int32_t seq, void *ctxt)
{
char *rtype;
@@ -2069,10 +2524,12 @@
int want_reply;
int success = 0;
- rtype = packet_get_string(NULL);
+ rtype = packet_get_cstring(NULL);
want_reply = packet_get_char();
debug("client_input_global_request: rtype %s want_reply %d",
rtype, want_reply);
+ if (strcmp(rtype, "hostkeys-00 at openssh.com") == 0)
+ success = client_input_hostkeys();
if (want_reply) {
packet_start(success ?
SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
@@ -2080,6 +2537,7 @@
packet_write_wait();
}
free(rtype);
+ return 0;
}
void
Modified: trunk/crypto/openssh/clientloop.h
===================================================================
--- trunk/crypto/openssh/clientloop.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/clientloop.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.h,v 1.31 2013/06/02 23:36:29 dtucker Exp $ */
+/* $OpenBSD: clientloop.h,v 1.32 2016/01/13 23:04:47 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -39,7 +39,7 @@
/* Client side main loop for the interactive session. */
int client_loop(int, int, int);
-void client_x11_get_proto(const char *, const char *, u_int, u_int,
+int client_x11_get_proto(const char *, const char *, u_int, u_int,
char **, char **);
void client_global_request_reply_fwd(int, u_int32_t, void *);
void client_session2_setup(int, int, int, const char *, struct termios *,
Modified: trunk/crypto/openssh/compat.c
===================================================================
--- trunk/crypto/openssh/compat.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/compat.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: compat.c,v 1.82 2013/12/30 23:52:27 djm Exp $ */
+/* $OpenBSD: compat.c,v 1.99 2016/05/24 02:31:57 dtucker Exp $ */
/*
* Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved.
*
@@ -57,7 +57,7 @@
compat13 = 1;
}
/* datafellows bug compatibility */
-void
+u_int
compat_datafellows(const char *version)
{
int i;
@@ -95,6 +95,9 @@
{ "Sun_SSH_1.0*", SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
{ "OpenSSH_4*", 0 },
{ "OpenSSH_5*", SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT},
+ { "OpenSSH_6.6.1*", SSH_NEW_OPENSSH},
+ { "OpenSSH_6.5*,"
+ "OpenSSH_6.6*", SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD},
{ "OpenSSH*", SSH_NEW_OPENSSH },
{ "*MindTerm*", 0 },
{ "2.1.0*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
@@ -149,6 +152,8 @@
"1.2.22*", SSH_BUG_IGNOREMSG },
{ "1.3.2*", /* F-Secure */
SSH_BUG_IGNOREMSG },
+ { "Cisco-1.*", SSH_BUG_DHGEX_LARGE|
+ SSH_BUG_HOSTKEYS },
{ "*SSH Compatible Server*", /* Netscreen */
SSH_BUG_PASSWORDPAD },
{ "*OSU_0*,"
@@ -162,22 +167,54 @@
"OSU_1.5alpha3*", SSH_BUG_PASSWORDPAD },
{ "*SSH_Version_Mapper*",
SSH_BUG_SCANNER },
+ { "PuTTY_Local:*," /* dev versions < Sep 2014 */
+ "PuTTY-Release-0.5*," /* 0.50-0.57, DH-GEX in >=0.52 */
+ "PuTTY_Release_0.5*," /* 0.58-0.59 */
+ "PuTTY_Release_0.60*,"
+ "PuTTY_Release_0.61*,"
+ "PuTTY_Release_0.62*,"
+ "PuTTY_Release_0.63*,"
+ "PuTTY_Release_0.64*",
+ SSH_OLD_DHGEX },
+ { "FuTTY*", SSH_OLD_DHGEX }, /* Putty Fork */
{ "Probe-*",
SSH_BUG_PROBE },
+ { "TeraTerm SSH*,"
+ "TTSSH/1.5.*,"
+ "TTSSH/2.1*,"
+ "TTSSH/2.2*,"
+ "TTSSH/2.3*,"
+ "TTSSH/2.4*,"
+ "TTSSH/2.5*,"
+ "TTSSH/2.6*,"
+ "TTSSH/2.70*,"
+ "TTSSH/2.71*,"
+ "TTSSH/2.72*", SSH_BUG_HOSTKEYS },
+ { "WinSCP_release_4*,"
+ "WinSCP_release_5.0*,"
+ "WinSCP_release_5.1*,"
+ "WinSCP_release_5.5*,"
+ "WinSCP_release_5.6*,"
+ "WinSCP_release_5.7,"
+ "WinSCP_release_5.7.1,"
+ "WinSCP_release_5.7.2,"
+ "WinSCP_release_5.7.3,"
+ "WinSCP_release_5.7.4",
+ SSH_OLD_DHGEX },
{ NULL, 0 }
};
/* process table, return first match */
for (i = 0; check[i].pat; i++) {
- if (match_pattern_list(version, check[i].pat,
- strlen(check[i].pat), 0) == 1) {
- datafellows = check[i].bugs;
+ if (match_pattern_list(version, check[i].pat, 0) == 1) {
debug("match: %s pat %s compat 0x%08x",
- version, check[i].pat, datafellows);
- return;
+ version, check[i].pat, check[i].bugs);
+ datafellows = check[i].bugs; /* XXX for now */
+ return check[i].bugs;
}
}
debug("no match: %s", version);
+ return 0;
}
#define SEP ","
@@ -189,13 +226,17 @@
if (spec == NULL)
return ret;
- q = s = xstrdup(spec);
+ q = s = strdup(spec);
+ if (s == NULL)
+ return ret;
for ((p = strsep(&q, SEP)); p && *p != '\0'; (p = strsep(&q, SEP))) {
switch (atoi(p)) {
case 1:
+#ifdef WITH_SSH1
if (ret == SSH_PROTO_UNKNOWN)
ret |= SSH_PROTO_1_PREFERRED;
ret |= SSH_PROTO_1;
+#endif
break;
case 2:
ret |= SSH_PROTO_2;
@@ -223,7 +264,7 @@
buffer_init(&b);
tmp = orig_prop = xstrdup(proposal);
while ((cp = strsep(&tmp, ",")) != NULL) {
- if (match_pattern_list(cp, filter, strlen(cp), 0) != 1) {
+ if (match_pattern_list(cp, filter, 0) != 1) {
if (buffer_len(&b) > 0)
buffer_append(&b, ",", 1);
buffer_append(&b, cp, strlen(cp));
@@ -231,7 +272,7 @@
debug2("Compat: skipping algorithm \"%s\"", cp);
}
buffer_append(&b, "\0", 1);
- fix_prop = xstrdup(buffer_ptr(&b));
+ fix_prop = xstrdup((char *)buffer_ptr(&b));
buffer_free(&b);
free(orig_prop);
@@ -251,7 +292,6 @@
return cipher_prop;
}
-
char *
compat_pkalg_proposal(char *pkalg_prop)
{
@@ -265,3 +305,21 @@
return pkalg_prop;
}
+char *
+compat_kex_proposal(char *p)
+{
+ if ((datafellows & (SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX)) == 0)
+ return p;
+ debug2("%s: original KEX proposal: %s", __func__, p);
+ if ((datafellows & SSH_BUG_CURVE25519PAD) != 0)
+ p = filter_proposal(p, "curve25519-sha256 at libssh.org");
+ if ((datafellows & SSH_OLD_DHGEX) != 0) {
+ p = filter_proposal(p, "diffie-hellman-group-exchange-sha256");
+ p = filter_proposal(p, "diffie-hellman-group-exchange-sha1");
+ }
+ debug2("%s: compat KEX proposal: %s", __func__, p);
+ if (*p == '\0')
+ fatal("No supported key exchange algorithms found");
+ return p;
+}
+
Modified: trunk/crypto/openssh/compat.h
===================================================================
--- trunk/crypto/openssh/compat.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/compat.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: compat.h,v 1.44 2013/12/30 23:52:27 djm Exp $ */
+/* $OpenBSD: compat.h,v 1.48 2015/05/26 23:23:40 dtucker Exp $ */
/*
* Copyright (c) 1999, 2000, 2001 Markus Friedl. All rights reserved.
@@ -59,13 +59,17 @@
#define SSH_BUG_RFWD_ADDR 0x02000000
#define SSH_NEW_OPENSSH 0x04000000
#define SSH_BUG_DYNAMIC_RPORT 0x08000000
+#define SSH_BUG_CURVE25519PAD 0x10000000
+#define SSH_BUG_HOSTKEYS 0x20000000
+#define SSH_BUG_DHGEX_LARGE 0x40000000
void enable_compat13(void);
void enable_compat20(void);
-void compat_datafellows(const char *);
+u_int compat_datafellows(const char *);
int proto_spec(const char *);
char *compat_cipher_proposal(char *);
char *compat_pkalg_proposal(char *);
+char *compat_kex_proposal(char *);
extern int compat13;
extern int compat20;
Modified: trunk/crypto/openssh/config.guess
===================================================================
--- trunk/crypto/openssh/config.guess 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/config.guess 2016-11-05 20:36:34 UTC (rev 9223)
@@ -982,6 +982,12 @@
ppc:Linux:*:*)
echo powerpc-unknown-linux-gnu
exit ;;
+ ppc64le:Linux:*:*)
+ echo powerpc64le-unknown-linux-gnu
+ exit ;;
+ ppcle:Linux:*:*)
+ echo powerpcle-unknown-linux-gnu
+ exit ;;
s390:Linux:*:* | s390x:Linux:*:*)
echo ${UNAME_MACHINE}-ibm-linux
exit ;;
Modified: trunk/crypto/openssh/config.h.in
===================================================================
--- trunk/crypto/openssh/config.h.in 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/config.h.in 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,8 +1,5 @@
/* config.h.in. Generated from configure.ac by autoheader. */
-/* Define if building universal (internal helper macro) */
-#undef AC_APPLE_UNIVERSAL_BUILD
-
/* Define if you have a getaddrinfo that fails for the all-zeros IPv6 address
*/
#undef AIX_GETNAMEINFO_HACK
@@ -51,7 +48,7 @@
against it */
#undef BROKEN_READ_COMPARISON
-/* Define if you have a broken realpath. */
+/* realpath does not work with nonexistent files */
#undef BROKEN_REALPATH
/* Needed for NeXT */
@@ -78,7 +75,7 @@
/* Define if your snprintf is busted */
#undef BROKEN_SNPRINTF
-/* FreeBSD strnvis argument order is swapped compared to OpenBSD */
+/* missing VIS_ALL */
#undef BROKEN_STRNVIS
/* tcgetattr with ICANON may hang */
@@ -291,6 +288,10 @@
/* Define if your libraries define daemon() */
#undef HAVE_DAEMON
+/* Define to 1 if you have the declaration of `AI_NUMERICSERV', and to 0 if
+ you don't. */
+#undef HAVE_DECL_AI_NUMERICSERV
+
/* Define to 1 if you have the declaration of `authenticate', and to 0 if you
don't. */
#undef HAVE_DECL_AUTHENTICATE
@@ -399,6 +400,15 @@
/* Define to 1 if you have the `endutxent' function. */
#undef HAVE_ENDUTXENT
+/* Define to 1 if you have the `err' function. */
+#undef HAVE_ERR
+
+/* Define to 1 if you have the `errx' function. */
+#undef HAVE_ERRX
+
+/* Define to 1 if you have the <err.h> header file. */
+#undef HAVE_ERR_H
+
/* Define if your system has /etc/default/login */
#undef HAVE_ETC_DEFAULT_LOGIN
@@ -420,6 +430,9 @@
/* Define to 1 if you have the `EVP_MD_CTX_init' function. */
#undef HAVE_EVP_MD_CTX_INIT
+/* Define to 1 if you have the `EVP_ripemd160' function. */
+#undef HAVE_EVP_RIPEMD160
+
/* Define to 1 if you have the `EVP_sha256' function. */
#undef HAVE_EVP_SHA256
@@ -663,6 +676,9 @@
/* Define to 1 if you have the `krb5_get_error_message' function. */
#undef HAVE_KRB5_GET_ERROR_MESSAGE
+/* Define to 1 if you have the <langinfo.h> header file. */
+#undef HAVE_LANGINFO_H
+
/* Define to 1 if you have the <lastlog.h> header file. */
#undef HAVE_LASTLOG_H
@@ -690,9 +706,6 @@
/* Define to 1 if you have the `network' library (-lnetwork). */
#undef HAVE_LIBNETWORK
-/* Define to 1 if you have the `nsl' library (-lnsl). */
-#undef HAVE_LIBNSL
-
/* Define to 1 if you have the `pam' library (-lpam). */
#undef HAVE_LIBPAM
@@ -756,6 +769,9 @@
/* Define to 1 if you have the `mblen' function. */
#undef HAVE_MBLEN
+/* Define to 1 if you have the `mbtowc' function. */
+#undef HAVE_MBTOWC
+
/* Define to 1 if you have the `md5_crypt' function. */
#undef HAVE_MD5_CRYPT
@@ -768,6 +784,9 @@
/* Define to 1 if you have the <memory.h> header file. */
#undef HAVE_MEMORY_H
+/* Define to 1 if you have the `memset_s' function. */
+#undef HAVE_MEMSET_S
+
/* Define to 1 if you have the `mkdtemp' function. */
#undef HAVE_MKDTEMP
@@ -798,6 +817,9 @@
/* Define to 1 if you have the `ngetaddrinfo' function. */
#undef HAVE_NGETADDRINFO
+/* Define to 1 if you have the `nl_langinfo' function. */
+#undef HAVE_NL_LANGINFO
+
/* Define to 1 if you have the `nsleep' function. */
#undef HAVE_NSLEEP
@@ -838,6 +860,9 @@
/* define if you have pid_t data type */
#undef HAVE_PID_T
+/* Define to 1 if you have the `pledge' function. */
+#undef HAVE_PLEDGE
+
/* Define to 1 if you have the `poll' function. */
#undef HAVE_POLL
@@ -847,6 +872,12 @@
/* Define to 1 if you have the `prctl' function. */
#undef HAVE_PRCTL
+/* Define to 1 if you have the `priv_basicset' function. */
+#undef HAVE_PRIV_BASICSET
+
+/* Define to 1 if you have the <priv.h> header file. */
+#undef HAVE_PRIV_H
+
/* Define if you have /proc/$pid/fd */
#undef HAVE_PROC_PID
@@ -868,6 +899,9 @@
/* Define to 1 if you have the <readpassphrase.h> header file. */
#undef HAVE_READPASSPHRASE_H
+/* Define to 1 if you have the `reallocarray' function. */
+#undef HAVE_REALLOCARRAY
+
/* Define to 1 if you have the `realpath' function. */
#undef HAVE_REALPATH
@@ -946,6 +980,12 @@
/* Define to 1 if you have the `setpcred' function. */
#undef HAVE_SETPCRED
+/* Define to 1 if you have the `setpflags' function. */
+#undef HAVE_SETPFLAGS
+
+/* Define to 1 if you have the `setppriv' function. */
+#undef HAVE_SETPPRIV
+
/* Define to 1 if you have the `setproctitle' function. */
#undef HAVE_SETPROCTITLE
@@ -1090,28 +1130,28 @@
/* define if you have struct in6_addr data type */
#undef HAVE_STRUCT_IN6_ADDR
-/* Define to 1 if `pw_change' is a member of `struct passwd'. */
+/* Define to 1 if `pw_change' is member of `struct passwd'. */
#undef HAVE_STRUCT_PASSWD_PW_CHANGE
-/* Define to 1 if `pw_class' is a member of `struct passwd'. */
+/* Define to 1 if `pw_class' is member of `struct passwd'. */
#undef HAVE_STRUCT_PASSWD_PW_CLASS
-/* Define to 1 if `pw_expire' is a member of `struct passwd'. */
+/* Define to 1 if `pw_expire' is member of `struct passwd'. */
#undef HAVE_STRUCT_PASSWD_PW_EXPIRE
-/* Define to 1 if `pw_gecos' is a member of `struct passwd'. */
+/* Define to 1 if `pw_gecos' is member of `struct passwd'. */
#undef HAVE_STRUCT_PASSWD_PW_GECOS
/* define if you have struct sockaddr_in6 data type */
#undef HAVE_STRUCT_SOCKADDR_IN6
-/* Define to 1 if `sin6_scope_id' is a member of `struct sockaddr_in6'. */
+/* Define to 1 if `sin6_scope_id' is member of `struct sockaddr_in6'. */
#undef HAVE_STRUCT_SOCKADDR_IN6_SIN6_SCOPE_ID
/* define if you have struct sockaddr_storage data type */
#undef HAVE_STRUCT_SOCKADDR_STORAGE
-/* Define to 1 if `st_blksize' is a member of `struct stat'. */
+/* Define to 1 if `st_blksize' is member of `struct stat'. */
#undef HAVE_STRUCT_STAT_ST_BLKSIZE
/* Define to 1 if the system has the type `struct timespec'. */
@@ -1324,9 +1364,6 @@
/* Define if va_copy exists */
#undef HAVE_VA_COPY
-/* Define to 1 if you have the `vhangup' function. */
-#undef HAVE_VHANGUP
-
/* Define to 1 if you have the <vis.h> header file. */
#undef HAVE_VIS_H
@@ -1336,6 +1373,15 @@
/* Define to 1 if you have the `waitpid' function. */
#undef HAVE_WAITPID
+/* Define to 1 if you have the `warn' function. */
+#undef HAVE_WARN
+
+/* Define to 1 if you have the <wchar.h> header file. */
+#undef HAVE_WCHAR_H
+
+/* Define to 1 if you have the `wcwidth' function. */
+#undef HAVE_WCWIDTH
+
/* Define to 1 if you have the `_getlong' function. */
#undef HAVE__GETLONG
@@ -1387,9 +1433,6 @@
/* Define if pututxline updates lastlog too */
#undef LASTLOG_WRITE_PUTUTXLINE
-/* Define if you want TCP Wrappers support */
-#undef LIBWRAP
-
/* Define to whatever link() returns for "not supported" if it doesn't return
EOPNOTSUPP. */
#undef LINK_OPNOTSUPP_ERRNO
@@ -1434,12 +1477,12 @@
/* compiler does not accept __attribute__ on return types */
#undef NO_ATTRIBUTE_ON_RETURN_TYPE
-/* Define if the concept of ports only accessible to superusers isn't known */
-#undef NO_IPPORT_RESERVED_CONCEPT
-
/* Define if you don't want to use lastlog in session.c */
#undef NO_SSH_LASTLOG
+/* Define to disable UID restoration test */
+#undef NO_UID_RESTORATION_TEST
+
/* Define if X11 doesn't support AF_UNIX sockets on that system */
#undef NO_X11_UNIX_SOCKETS
@@ -1467,7 +1510,7 @@
/* libcrypto is missing AES 192 and 256 bit functions */
#undef OPENSSL_LOBOTOMISED_AES
-/* Define if you want OpenSSL's internally seeded PRNG only */
+/* Define if you want the OpenSSL internally seeded PRNG only */
#undef OPENSSL_PRNG_ONLY
/* Define to the address where bug reports for this package should be sent. */
@@ -1482,9 +1525,6 @@
/* Define to the one symbol short name of this package. */
#undef PACKAGE_TARNAME
-/* Define to the home page for this package. */
-#undef PACKAGE_URL
-
/* Define to the version of this package. */
#undef PACKAGE_VERSION
@@ -1519,6 +1559,9 @@
/* no privsep sandboxing */
#undef SANDBOX_NULL
+/* Sandbox using pledge(2) */
+#undef SANDBOX_PLEDGE
+
/* Sandbox using setrlimit(2) */
#undef SANDBOX_RLIMIT
@@ -1531,6 +1574,9 @@
/* define if setrlimit RLIMIT_NOFILE breaks things */
#undef SANDBOX_SKIP_RLIMIT_NOFILE
+/* Sandbox using Solaris/Illumos privileges */
+#undef SANDBOX_SOLARIS
+
/* Sandbox using systrace(4) */
#undef SANDBOX_SYSTRACE
@@ -1637,6 +1683,9 @@
/* Use PIPES instead of a socketpair() */
#undef USE_PIPES
+/* Define if you have Solaris privileges */
+#undef USE_SOLARIS_PRIVS
+
/* Define if you have Solaris process contracts */
#undef USE_SOLARIS_PROCESS_CONTRACTS
@@ -1662,21 +1711,19 @@
/* Define if you want IRIX project management */
#undef WITH_IRIX_PROJECT
+/* use libcrypto for cryptography */
+#undef WITH_OPENSSL
+
/* Define if you want SELinux support. */
#undef WITH_SELINUX
-/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
- significant byte first (like Motorola and SPARC, unlike Intel). */
-#if defined AC_APPLE_UNIVERSAL_BUILD
-# if defined __BIG_ENDIAN__
-# define WORDS_BIGENDIAN 1
-# endif
-#else
-# ifndef WORDS_BIGENDIAN
-# undef WORDS_BIGENDIAN
-# endif
-#endif
+/* include SSH protocol version 1 support */
+#undef WITH_SSH1
+/* Define to 1 if your processor stores words with the most significant byte
+ first (like Motorola and SPARC, unlike Intel and VAX). */
+#undef WORDS_BIGENDIAN
+
/* Define if xauth is found in your path */
#undef XAUTH_PATH
Modified: trunk/crypto/openssh/configure
===================================================================
--- trunk/crypto/openssh/configure 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/configure 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,84 +1,63 @@
#! /bin/sh
-# From configure.ac Revision: 1.571 .
+# From configure.ac Revision: 1.583 .
# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for OpenSSH Portable.
+# Generated by GNU Autoconf 2.61 for OpenSSH Portable.
#
# Report bugs to <openssh-unix-dev at mindrot.org>.
#
-#
-# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
-#
-#
+# Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
+# 2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc.
# This configure script is free software; the Free Software Foundation
# gives unlimited permission to copy, distribute and modify it.
-## -------------------- ##
-## M4sh Initialization. ##
-## -------------------- ##
+## --------------------- ##
+## M4sh Initialization. ##
+## --------------------- ##
# Be more Bourne compatible
DUALCASE=1; export DUALCASE # for MKS sh
-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
emulate sh
NULLCMD=:
- # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
+ # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
# is contrary to our usage. Disable this feature.
alias -g '${1+"$@"}'='"$@"'
setopt NO_GLOB_SUBST
else
- case `(set -o) 2>/dev/null` in #(
- *posix*) :
- set -o posix ;; #(
- *) :
- ;;
+ case `(set -o) 2>/dev/null` in
+ *posix*) set -o posix ;;
esac
+
fi
-as_nl='
-'
-export as_nl
-# Printing a long string crashes Solaris 7 /usr/bin/printf.
-as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
-# Prefer a ksh shell builtin over an external printf program on Solaris,
-# but without wasting forks for bash or zsh.
-if test -z "$BASH_VERSION$ZSH_VERSION" \
- && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
- as_echo='print -r --'
- as_echo_n='print -rn --'
-elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
- as_echo='printf %s\n'
- as_echo_n='printf %s'
-else
- if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
- as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
- as_echo_n='/usr/ucb/echo -n'
+
+
+# PATH needs CR
+# Avoid depending upon Character Ranges.
+as_cr_letters='abcdefghijklmnopqrstuvwxyz'
+as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+as_cr_Letters=$as_cr_letters$as_cr_LETTERS
+as_cr_digits='0123456789'
+as_cr_alnum=$as_cr_Letters$as_cr_digits
+
+# The user is always right.
+if test "${PATH_SEPARATOR+set}" != set; then
+ echo "#! /bin/sh" >conf$$.sh
+ echo "exit 0" >>conf$$.sh
+ chmod +x conf$$.sh
+ if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then
+ PATH_SEPARATOR=';'
else
- as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
- as_echo_n_body='eval
- arg=$1;
- case $arg in #(
- *"$as_nl"*)
- expr "X$arg" : "X\\(.*\\)$as_nl";
- arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
- esac;
- expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
- '
- export as_echo_n_body
- as_echo_n='sh -c $as_echo_n_body as_echo'
+ PATH_SEPARATOR=:
fi
- export as_echo_body
- as_echo='sh -c $as_echo_body as_echo'
+ rm -f conf$$.sh
fi
-# The user is always right.
-if test "${PATH_SEPARATOR+set}" != set; then
- PATH_SEPARATOR=:
- (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
- (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
- PATH_SEPARATOR=';'
- }
+# Support unset when possible.
+if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then
+ as_unset=unset
+else
+ as_unset=false
fi
@@ -87,11 +66,12 @@
# there to prevent editors from complaining about space-tab.
# (If _AS_PATH_WALK were called with IFS unset, it would disable word
# splitting by setting IFS to empty value.)
+as_nl='
+'
IFS=" "" $as_nl"
# Find who we are. Look in the path if we contain no directory separator.
-as_myself=
-case $0 in #((
+case $0 in
*[\\/]* ) as_myself=$0 ;;
*) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
for as_dir in $PATH
@@ -98,8 +78,8 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
- done
+ test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+done
IFS=$as_save_IFS
;;
@@ -110,17 +90,13 @@
as_myself=$0
fi
if test ! -f "$as_myself"; then
- $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
- exit 1
+ echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+ { (exit 1); exit 1; }
fi
-# Unset variables that we do not need and which cause bugs (e.g. in
-# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1"
-# suppresses any "Segmentation fault" message there. '((' could
-# trigger a bug in pdksh 5.2.14.
-for as_var in BASH_ENV ENV MAIL MAILPATH
-do eval test x\${$as_var+set} = xset \
- && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+# Work around bugs in pre-3.0 UWIN ksh.
+for as_var in ENV MAIL MAILPATH
+do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
done
PS1='$ '
PS2='> '
@@ -127,350 +103,341 @@
PS4='+ '
# NLS nuisances.
-LC_ALL=C
-export LC_ALL
-LANGUAGE=C
-export LANGUAGE
+for as_var in \
+ LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \
+ LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \
+ LC_TELEPHONE LC_TIME
+do
+ if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then
+ eval $as_var=C; export $as_var
+ else
+ ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
+ fi
+done
+# Required to use basename.
+if expr a : '\(a\)' >/dev/null 2>&1 &&
+ test "X`expr 00001 : '.*\(...\)'`" = X001; then
+ as_expr=expr
+else
+ as_expr=false
+fi
+
+if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
+ as_basename=basename
+else
+ as_basename=false
+fi
+
+
+# Name of the executable.
+as_me=`$as_basename -- "$0" ||
+$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
+ X"$0" : 'X\(//\)$' \| \
+ X"$0" : 'X\(/\)' \| . 2>/dev/null ||
+echo X/"$0" |
+ sed '/^.*\/\([^/][^/]*\)\/*$/{
+ s//\1/
+ q
+ }
+ /^X\/\(\/\/\)$/{
+ s//\1/
+ q
+ }
+ /^X\/\(\/\).*/{
+ s//\1/
+ q
+ }
+ s/.*/./; q'`
+
# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
+$as_unset CDPATH
-# Use a proper internal environment variable to ensure we don't fall
- # into an infinite loop, continuously re-executing ourselves.
- if test x"${_as_can_reexec}" != xno && test "x$CONFIG_SHELL" != x; then
- _as_can_reexec=no; export _as_can_reexec;
- # We cannot yet assume a decent shell, so we have to provide a
-# neutralization value for shells without unset; and this also
-# works around shells that cannot unset nonexistent variables.
-# Preserve -v and -x to the replacement shell.
-BASH_ENV=/dev/null
-ENV=/dev/null
-(unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV
-case $- in # ((((
- *v*x* | *x*v* ) as_opts=-vx ;;
- *v* ) as_opts=-v ;;
- *x* ) as_opts=-x ;;
- * ) as_opts= ;;
-esac
-exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
-# Admittedly, this is quite paranoid, since all the known shells bail
-# out after a failed `exec'.
-$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
-as_fn_exit 255
- fi
- # We don't want this to propagate to other subprocesses.
- { _as_can_reexec=; unset _as_can_reexec;}
+
if test "x$CONFIG_SHELL" = x; then
- as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then :
- emulate sh
- NULLCMD=:
- # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which
- # is contrary to our usage. Disable this feature.
- alias -g '\${1+\"\$@\"}'='\"\$@\"'
- setopt NO_GLOB_SUBST
+ if (eval ":") 2>/dev/null; then
+ as_have_required=yes
else
- case \`(set -o) 2>/dev/null\` in #(
- *posix*) :
- set -o posix ;; #(
- *) :
- ;;
-esac
+ as_have_required=no
fi
-"
- as_required="as_fn_return () { (exit \$1); }
-as_fn_success () { as_fn_return 0; }
-as_fn_failure () { as_fn_return 1; }
-as_fn_ret_success () { return 0; }
-as_fn_ret_failure () { return 1; }
+ if test $as_have_required = yes && (eval ":
+(as_func_return () {
+ (exit \$1)
+}
+as_func_success () {
+ as_func_return 0
+}
+as_func_failure () {
+ as_func_return 1
+}
+as_func_ret_success () {
+ return 0
+}
+as_func_ret_failure () {
+ return 1
+}
+
exitcode=0
-as_fn_success || { exitcode=1; echo as_fn_success failed.; }
-as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; }
-as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; }
-as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; }
-if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then :
+if as_func_success; then
+ :
+else
+ exitcode=1
+ echo as_func_success failed.
+fi
+if as_func_failure; then
+ exitcode=1
+ echo as_func_failure succeeded.
+fi
+
+if as_func_ret_success; then
+ :
else
- exitcode=1; echo positional parameters were not saved.
+ exitcode=1
+ echo as_func_ret_success failed.
fi
-test x\$exitcode = x0 || exit 1
-test -x / || exit 1"
- as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO
- as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO
- eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" &&
- test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1
-test \$(( 1 + 1 )) = 2 || exit 1"
- if (eval "$as_required") 2>/dev/null; then :
- as_have_required=yes
+
+if as_func_ret_failure; then
+ exitcode=1
+ echo as_func_ret_failure succeeded.
+fi
+
+if ( set x; as_func_ret_success y && test x = \"\$1\" ); then
+ :
else
- as_have_required=no
+ exitcode=1
+ echo positional parameters were not saved.
fi
- if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then :
+test \$exitcode = 0) || { (exit 1); exit 1; }
+
+(
+ as_lineno_1=\$LINENO
+ as_lineno_2=\$LINENO
+ test \"x\$as_lineno_1\" != \"x\$as_lineno_2\" &&
+ test \"x\`expr \$as_lineno_1 + 1\`\" = \"x\$as_lineno_2\") || { (exit 1); exit 1; }
+") 2> /dev/null; then
+ :
else
- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-as_found=false
+ as_candidate_shells=
+ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- as_found=:
- case $as_dir in #(
+ case $as_dir in
/*)
for as_base in sh bash ksh sh5; do
- # Try only shells that exist, to save several forks.
- as_shell=$as_dir/$as_base
- if { test -f "$as_shell" || test -f "$as_shell.exe"; } &&
- { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then :
- CONFIG_SHELL=$as_shell as_have_required=yes
- if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then :
- break 2
-fi
-fi
+ as_candidate_shells="$as_candidate_shells $as_dir/$as_base"
done;;
esac
- as_found=false
done
-$as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } &&
- { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then :
- CONFIG_SHELL=$SHELL as_have_required=yes
-fi; }
IFS=$as_save_IFS
- if test "x$CONFIG_SHELL" != x; then :
- export CONFIG_SHELL
- # We cannot yet assume a decent shell, so we have to provide a
-# neutralization value for shells without unset; and this also
-# works around shells that cannot unset nonexistent variables.
-# Preserve -v and -x to the replacement shell.
-BASH_ENV=/dev/null
-ENV=/dev/null
-(unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV
-case $- in # ((((
- *v*x* | *x*v* ) as_opts=-vx ;;
- *v* ) as_opts=-v ;;
- *x* ) as_opts=-x ;;
- * ) as_opts= ;;
+ for as_shell in $as_candidate_shells $SHELL; do
+ # Try only shells that exist, to save several forks.
+ if { test -f "$as_shell" || test -f "$as_shell.exe"; } &&
+ { ("$as_shell") 2> /dev/null <<\_ASEOF
+if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
+ emulate sh
+ NULLCMD=:
+ # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
+ # is contrary to our usage. Disable this feature.
+ alias -g '${1+"$@"}'='"$@"'
+ setopt NO_GLOB_SUBST
+else
+ case `(set -o) 2>/dev/null` in
+ *posix*) set -o posix ;;
esac
-exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
-# Admittedly, this is quite paranoid, since all the known shells bail
-# out after a failed `exec'.
-$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
-exit 255
+
fi
- if test x$as_have_required = xno; then :
- $as_echo "$0: This script requires a shell more modern than all"
- $as_echo "$0: the shells that I found on your system."
- if test x${ZSH_VERSION+set} = xset ; then
- $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should"
- $as_echo "$0: be upgraded to zsh 4.3.4 or later."
- else
- $as_echo "$0: Please tell bug-autoconf at gnu.org and
-$0: openssh-unix-dev at mindrot.org about your system,
-$0: including any error possibly output before this
-$0: message. Then install a modern shell, or manually run
-$0: the script under such a shell if you do have one."
- fi
- exit 1
+
+:
+_ASEOF
+}; then
+ CONFIG_SHELL=$as_shell
+ as_have_required=yes
+ if { "$as_shell" 2> /dev/null <<\_ASEOF
+if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
+ emulate sh
+ NULLCMD=:
+ # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
+ # is contrary to our usage. Disable this feature.
+ alias -g '${1+"$@"}'='"$@"'
+ setopt NO_GLOB_SUBST
+else
+ case `(set -o) 2>/dev/null` in
+ *posix*) set -o posix ;;
+esac
+
fi
+
+
+:
+(as_func_return () {
+ (exit $1)
+}
+as_func_success () {
+ as_func_return 0
+}
+as_func_failure () {
+ as_func_return 1
+}
+as_func_ret_success () {
+ return 0
+}
+as_func_ret_failure () {
+ return 1
+}
+
+exitcode=0
+if as_func_success; then
+ :
+else
+ exitcode=1
+ echo as_func_success failed.
fi
+
+if as_func_failure; then
+ exitcode=1
+ echo as_func_failure succeeded.
fi
-SHELL=${CONFIG_SHELL-/bin/sh}
-export SHELL
-# Unset more variables known to interfere with behavior of common tools.
-CLICOLOR_FORCE= GREP_OPTIONS=
-unset CLICOLOR_FORCE GREP_OPTIONS
-## --------------------- ##
-## M4sh Shell Functions. ##
-## --------------------- ##
-# as_fn_unset VAR
-# ---------------
-# Portably unset VAR.
-as_fn_unset ()
-{
- { eval $1=; unset $1;}
-}
-as_unset=as_fn_unset
+if as_func_ret_success; then
+ :
+else
+ exitcode=1
+ echo as_func_ret_success failed.
+fi
-# as_fn_set_status STATUS
-# -----------------------
-# Set $? to STATUS, without forking.
-as_fn_set_status ()
-{
- return $1
-} # as_fn_set_status
+if as_func_ret_failure; then
+ exitcode=1
+ echo as_func_ret_failure succeeded.
+fi
-# as_fn_exit STATUS
-# -----------------
-# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
-as_fn_exit ()
-{
- set +e
- as_fn_set_status $1
- exit $1
-} # as_fn_exit
+if ( set x; as_func_ret_success y && test x = "$1" ); then
+ :
+else
+ exitcode=1
+ echo positional parameters were not saved.
+fi
-# as_fn_mkdir_p
-# -------------
-# Create "$as_dir" as a directory, including parents if necessary.
-as_fn_mkdir_p ()
-{
+test $exitcode = 0) || { (exit 1); exit 1; }
- case $as_dir in #(
- -*) as_dir=./$as_dir;;
- esac
- test -d "$as_dir" || eval $as_mkdir_p || {
- as_dirs=
- while :; do
- case $as_dir in #(
- *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
- *) as_qdir=$as_dir;;
- esac
- as_dirs="'$as_qdir' $as_dirs"
- as_dir=`$as_dirname -- "$as_dir" ||
-$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
- X"$as_dir" : 'X\(//\)[^/]' \| \
- X"$as_dir" : 'X\(//\)$' \| \
- X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$as_dir" |
- sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
- s//\1/
- q
- }
- /^X\(\/\/\)[^/].*/{
- s//\1/
- q
- }
- /^X\(\/\/\)$/{
- s//\1/
- q
- }
- /^X\(\/\).*/{
- s//\1/
- q
- }
- s/.*/./; q'`
- test -d "$as_dir" && break
- done
- test -z "$as_dirs" || eval "mkdir $as_dirs"
- } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir"
+(
+ as_lineno_1=$LINENO
+ as_lineno_2=$LINENO
+ test "x$as_lineno_1" != "x$as_lineno_2" &&
+ test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2") || { (exit 1); exit 1; }
+_ASEOF
+}; then
+ break
+fi
-} # as_fn_mkdir_p
+fi
-# as_fn_executable_p FILE
-# -----------------------
-# Test if FILE is an executable regular file.
-as_fn_executable_p ()
-{
- test -f "$1" && test -x "$1"
-} # as_fn_executable_p
-# as_fn_append VAR VALUE
-# ----------------------
-# Append the text in VALUE to the end of the definition contained in VAR. Take
-# advantage of any shell optimizations that allow amortized linear growth over
-# repeated appends, instead of the typical quadratic growth present in naive
-# implementations.
-if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
- eval 'as_fn_append ()
- {
- eval $1+=\$2
- }'
-else
- as_fn_append ()
- {
- eval $1=\$$1\$2
- }
-fi # as_fn_append
+ done
-# as_fn_arith ARG...
-# ------------------
-# Perform arithmetic evaluation on the ARGs, and store the result in the
-# global $as_val. Take advantage of shells that can avoid forks. The arguments
-# must be portable across $(()) and expr.
-if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
- eval 'as_fn_arith ()
- {
- as_val=$(( $* ))
- }'
-else
- as_fn_arith ()
- {
- as_val=`expr "$@" || test $? -eq 1`
- }
-fi # as_fn_arith
+ if test "x$CONFIG_SHELL" != x; then
+ for as_var in BASH_ENV ENV
+ do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
+ done
+ export CONFIG_SHELL
+ exec "$CONFIG_SHELL" "$as_myself" ${1+"$@"}
+fi
-# as_fn_error STATUS ERROR [LINENO LOG_FD]
-# ----------------------------------------
-# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
-# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
-# script with STATUS, using 1 if that was 0.
-as_fn_error ()
-{
- as_status=$1; test $as_status -eq 0 && as_status=1
- if test "$4"; then
- as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
- fi
- $as_echo "$as_me: error: $2" >&2
- as_fn_exit $as_status
-} # as_fn_error
+ if test $as_have_required = no; then
+ echo This script requires a shell more modern than all the
+ echo shells that I found on your system. Please install a
+ echo modern shell, or manually run the script under such a
+ echo shell if you do have one.
+ { (exit 1); exit 1; }
+fi
-if expr a : '\(a\)' >/dev/null 2>&1 &&
- test "X`expr 00001 : '.*\(...\)'`" = X001; then
- as_expr=expr
+
+fi
+
+fi
+
+
+
+(eval "as_func_return () {
+ (exit \$1)
+}
+as_func_success () {
+ as_func_return 0
+}
+as_func_failure () {
+ as_func_return 1
+}
+as_func_ret_success () {
+ return 0
+}
+as_func_ret_failure () {
+ return 1
+}
+
+exitcode=0
+if as_func_success; then
+ :
else
- as_expr=false
+ exitcode=1
+ echo as_func_success failed.
fi
-if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
- as_basename=basename
+if as_func_failure; then
+ exitcode=1
+ echo as_func_failure succeeded.
+fi
+
+if as_func_ret_success; then
+ :
else
- as_basename=false
+ exitcode=1
+ echo as_func_ret_success failed.
fi
-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
- as_dirname=dirname
+if as_func_ret_failure; then
+ exitcode=1
+ echo as_func_ret_failure succeeded.
+fi
+
+if ( set x; as_func_ret_success y && test x = \"\$1\" ); then
+ :
else
- as_dirname=false
+ exitcode=1
+ echo positional parameters were not saved.
fi
-as_me=`$as_basename -- "$0" ||
-$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
- X"$0" : 'X\(//\)$' \| \
- X"$0" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X/"$0" |
- sed '/^.*\/\([^/][^/]*\)\/*$/{
- s//\1/
- q
- }
- /^X\/\(\/\/\)$/{
- s//\1/
- q
- }
- /^X\/\(\/\).*/{
- s//\1/
- q
- }
- s/.*/./; q'`
+test \$exitcode = 0") || {
+ echo No shell found that supports shell functions.
+ echo Please tell autoconf at gnu.org about your system,
+ echo including any error possibly output before this
+ echo message
+}
-# Avoid depending upon Character Ranges.
-as_cr_letters='abcdefghijklmnopqrstuvwxyz'
-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
-as_cr_Letters=$as_cr_letters$as_cr_LETTERS
-as_cr_digits='0123456789'
-as_cr_alnum=$as_cr_Letters$as_cr_digits
- as_lineno_1=$LINENO as_lineno_1a=$LINENO
- as_lineno_2=$LINENO as_lineno_2a=$LINENO
- eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" &&
- test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || {
- # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-)
+ as_lineno_1=$LINENO
+ as_lineno_2=$LINENO
+ test "x$as_lineno_1" != "x$as_lineno_2" &&
+ test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || {
+
+ # Create $as_me.lineno as a copy of $as_myself, but with $LINENO
+ # uniformly replaced by the line number. The first 'sed' inserts a
+ # line-number line after each line using $LINENO; the second 'sed'
+ # does the real work. The second script uses 'N' to pair each
+ # line-number line with the line containing $LINENO, and appends
+ # trailing '-' during substitution so that $LINENO is not a special
+ # case at line end.
+ # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the
+ # scripts with optimization help from Paolo Bonzini. Blame Lee
+ # E. McMahon (1931-1989) for sed's syntax. :-)
sed -n '
p
/[$]LINENO/=
@@ -487,7 +454,8 @@
s/-\n.*//
' >$as_me.lineno &&
chmod +x "$as_me.lineno" ||
- { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; }
+ { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2
+ { (exit 1); exit 1; }; }
# If we had to re-execute with $CONFIG_SHELL, we're ensured to have
# already done that, so ensure we don't try to do so again and fall
@@ -501,40 +469,49 @@
exit
}
+
+if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
+ as_dirname=dirname
+else
+ as_dirname=false
+fi
+
ECHO_C= ECHO_N= ECHO_T=
-case `echo -n x` in #(((((
+case `echo -n x` in
-n*)
- case `echo 'xy\c'` in
+ case `echo 'x\c'` in
*c*) ECHO_T=' ';; # ECHO_T is single tab character.
- xy) ECHO_C='\c';;
- *) echo `echo ksh88 bug on AIX 6.1` > /dev/null
- ECHO_T=' ';;
+ *) ECHO_C='\c';;
esac;;
*)
ECHO_N='-n';;
esac
+if expr a : '\(a\)' >/dev/null 2>&1 &&
+ test "X`expr 00001 : '.*\(...\)'`" = X001; then
+ as_expr=expr
+else
+ as_expr=false
+fi
+
rm -f conf$$ conf$$.exe conf$$.file
if test -d conf$$.dir; then
rm -f conf$$.dir/conf$$.file
else
rm -f conf$$.dir
- mkdir conf$$.dir 2>/dev/null
+ mkdir conf$$.dir
fi
-if (echo >conf$$.file) 2>/dev/null; then
- if ln -s conf$$.file conf$$ 2>/dev/null; then
- as_ln_s='ln -s'
- # ... but there are two gotchas:
- # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
- # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
- # In both cases, we have to default to `cp -pR'.
- ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
- as_ln_s='cp -pR'
- elif ln conf$$.file conf$$ 2>/dev/null; then
- as_ln_s=ln
- else
+echo >conf$$.file
+if ln -s conf$$.file conf$$ 2>/dev/null; then
+ as_ln_s='ln -s'
+ # ... but there are two gotchas:
+ # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
+ # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
+ # In both cases, we have to default to `cp -p'.
+ ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
as_ln_s='cp -pR'
- fi
+elif ln conf$$.file conf$$ 2>/dev/null; then
+ as_ln_s=ln
else
as_ln_s='cp -pR'
fi
@@ -542,14 +519,34 @@
rmdir conf$$.dir 2>/dev/null
if mkdir -p . 2>/dev/null; then
- as_mkdir_p='mkdir -p "$as_dir"'
+ as_mkdir_p=:
else
test -d ./-p && rmdir ./-p
as_mkdir_p=false
fi
-as_test_x='test -x'
-as_executable_p=as_fn_executable_p
+if test -x / >/dev/null 2>&1; then
+ as_test_x='test -x'
+else
+ if ls -dL / >/dev/null 2>&1; then
+ as_ls_L_option=L
+ else
+ as_ls_L_option=
+ fi
+ as_test_x='
+ eval sh -c '\''
+ if test -d "$1"; then
+ test -d "$1/.";
+ else
+ case $1 in
+ -*)set "./$1";;
+ esac;
+ case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in
+ ???[sx]*):;;*)false;;esac;fi
+ '\'' sh
+ '
+fi
+as_executable_p=$as_test_x
# Sed expression to map a string onto a valid CPP name.
as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'"
@@ -558,11 +555,11 @@
as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'"
-test -n "$DJDIR" || exec 7<&0 </dev/null
-exec 6>&1
+exec 7<&0 </dev/null 6>&1
+
# Name of the host.
-# hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status,
+# hostname on some systems (SVR3.2, Linux) returns a bogus exit status,
# so uname gets run too.
ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q`
@@ -577,6 +574,7 @@
subdirs=
MFLAGS=
MAKEFLAGS=
+SHELL=${CONFIG_SHELL-/bin/sh}
# Identity of this package.
PACKAGE_NAME='OpenSSH'
@@ -584,7 +582,6 @@
PACKAGE_VERSION='Portable'
PACKAGE_STRING='OpenSSH Portable'
PACKAGE_BUGREPORT='openssh-unix-dev at mindrot.org'
-PACKAGE_URL=''
ac_unique_file="ssh.c"
# Factoring default headers for most tests.
@@ -623,167 +620,111 @@
# include <unistd.h>
#endif"
-ac_subst_vars='LTLIBOBJS
+ac_subst_vars='SHELL
+PATH_SEPARATOR
+PACKAGE_NAME
+PACKAGE_TARNAME
+PACKAGE_VERSION
+PACKAGE_STRING
+PACKAGE_BUGREPORT
+exec_prefix
+prefix
+program_transform_name
+bindir
+sbindir
+libexecdir
+datarootdir
+datadir
+sysconfdir
+sharedstatedir
+localstatedir
+includedir
+oldincludedir
+docdir
+infodir
+htmldir
+dvidir
+pdfdir
+psdir
+libdir
+localedir
+mandir
+DEFS
+ECHO_C
+ECHO_N
+ECHO_T
+LIBS
+build_alias
+host_alias
+target_alias
+CC
+CFLAGS
+LDFLAGS
+CPPFLAGS
+ac_ct_CC
+EXEEXT
+OBJEXT
+build
+build_cpu
+build_vendor
+build_os
+host
+host_cpu
+host_vendor
+host_os
+CPP
+GREP
+EGREP
+AWK
+RANLIB
+INSTALL_PROGRAM
+INSTALL_SCRIPT
+INSTALL_DATA
+AR
+ac_ct_AR
+CAT
+KILL
+PERL
+SED
+ENT
+TEST_MINUS_S_SH
+SH
+GROFF
+NROFF
+MANDOC
+TEST_SHELL
+MANFMT
+PATH_GROUPADD_PROG
+PATH_USERADD_PROG
+MAKE_PACKAGE_SUPPORTED
+STARTUP_SCRIPT_SHELL
+LOGIN_PROGRAM_FALLBACK
+PATH_PASSWD_PROG
+LD
+PKGCONFIG
+LIBEDIT
+TEST_SSH_ECC
+COMMENT_OUT_ECC
+SSH_PRIVSEP_USER
+SSHLIBS
+SSHDLIBS
+KRB5CONF
+GSSLIBS
+K5LIBS
+PRIVSEP_PATH
+xauth_path
+STRIP_OPT
+XAUTH_PATH
+MANTYPE
+mansubdir
+user_path
+piddir
+TEST_SSH_IPV6
+TEST_MALLOC_OPTIONS
+UNSUPPORTED_ALGORITHMS
LIBOBJS
-UNSUPPORTED_ALGORITHMS
-TEST_MALLOC_OPTIONS
-TEST_SSH_IPV6
-piddir
-user_path
-mansubdir
-MANTYPE
-XAUTH_PATH
-STRIP_OPT
-xauth_path
-PRIVSEP_PATH
-K5LIBS
-GSSLIBS
-KRB5CONF
-SSHDLIBS
-SSHLIBS
-SSH_PRIVSEP_USER
-COMMENT_OUT_ECC
-TEST_SSH_ECC
-LIBEDIT
-PKGCONFIG
-LD
-PATH_PASSWD_PROG
-LOGIN_PROGRAM_FALLBACK
-STARTUP_SCRIPT_SHELL
-MAKE_PACKAGE_SUPPORTED
-PATH_USERADD_PROG
-PATH_GROUPADD_PROG
-MANFMT
-TEST_SHELL
-MANDOC
-NROFF
-GROFF
-SH
-TEST_MINUS_S_SH
-ENT
-SED
-PERL
-KILL
-CAT
-AR
-INSTALL_DATA
-INSTALL_SCRIPT
-INSTALL_PROGRAM
-RANLIB
-AWK
-EGREP
-GREP
-CPP
-host_os
-host_vendor
-host_cpu
-host
-build_os
-build_vendor
-build_cpu
-build
-OBJEXT
-EXEEXT
-ac_ct_CC
-CPPFLAGS
-LDFLAGS
-CFLAGS
-CC
-target_alias
-host_alias
-build_alias
-LIBS
-ECHO_T
-ECHO_N
-ECHO_C
-DEFS
-mandir
-localedir
-libdir
-psdir
-pdfdir
-dvidir
-htmldir
-infodir
-docdir
-oldincludedir
-includedir
-localstatedir
-sharedstatedir
-sysconfdir
-datadir
-datarootdir
-libexecdir
-sbindir
-bindir
-program_transform_name
-prefix
-exec_prefix
-PACKAGE_URL
-PACKAGE_BUGREPORT
-PACKAGE_STRING
-PACKAGE_VERSION
-PACKAGE_TARNAME
-PACKAGE_NAME
-PATH_SEPARATOR
-SHELL'
+LTLIBOBJS'
ac_subst_files=''
-ac_user_opts='
-enable_option_checking
-enable_largefile
-with_stackprotect
-with_hardening
-with_rpath
-with_cflags
-with_cppflags
-with_ldflags
-with_libs
-with_Werror
-with_solaris_contracts
-with_solaris_projects
-with_osfsia
-with_zlib
-with_zlib_version_check
-with_skey
-with_tcp_wrappers
-with_ldns
-with_libedit
-with_audit
-with_pie
-with_ssl_dir
-with_openssl_header_check
-with_ssl_engine
-with_prngd_port
-with_prngd_socket
-with_pam
-with_privsep_user
-with_sandbox
-with_selinux
-with_kerberos5
-with_privsep_path
-with_xauth
-enable_strip
-with_maildir
-with_mantype
-with_md5_passwords
-with_shadow
-with_ipaddr_display
-enable_etc_default_login
-with_default_path
-with_superuser_path
-with_4in6
-with_bsd_auth
-with_pid_dir
-enable_lastlog
-enable_utmp
-enable_utmpx
-enable_wtmp
-enable_wtmpx
-enable_libutil
-enable_pututline
-enable_pututxline
-with_lastlog
-'
ac_precious_vars='build_alias
host_alias
target_alias
@@ -798,8 +739,6 @@
# Initialize some variables set by options.
ac_init_help=
ac_init_version=false
-ac_unrecognized_opts=
-ac_unrecognized_sep=
# The variables have the same names as the options, with
# dashes changed to underlines.
cache_file=/dev/null
@@ -855,9 +794,8 @@
fi
case $ac_option in
- *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;;
- *=) ac_optarg= ;;
- *) ac_optarg=yes ;;
+ *=*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;;
+ *) ac_optarg=yes ;;
esac
# Accept the important Cygnus configure options, so we can diagnose typos.
@@ -899,20 +837,13 @@
datarootdir=$ac_optarg ;;
-disable-* | --disable-*)
- ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'`
+ ac_feature=`expr "x$ac_option" : 'x-*disable-\(.*\)'`
# Reject names that are not valid shell variable names.
- expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
- as_fn_error $? "invalid feature name: $ac_useropt"
- ac_useropt_orig=$ac_useropt
- ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
- case $ac_user_opts in
- *"
-"enable_$ac_useropt"
-"*) ;;
- *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig"
- ac_unrecognized_sep=', ';;
- esac
- eval enable_$ac_useropt=no ;;
+ expr "x$ac_feature" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+ { echo "$as_me: error: invalid feature name: $ac_feature" >&2
+ { (exit 1); exit 1; }; }
+ ac_feature=`echo $ac_feature | sed 's/[-.]/_/g'`
+ eval enable_$ac_feature=no ;;
-docdir | --docdir | --docdi | --doc | --do)
ac_prev=docdir ;;
@@ -925,20 +856,13 @@
dvidir=$ac_optarg ;;
-enable-* | --enable-*)
- ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'`
+ ac_feature=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'`
# Reject names that are not valid shell variable names.
- expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
- as_fn_error $? "invalid feature name: $ac_useropt"
- ac_useropt_orig=$ac_useropt
- ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
- case $ac_user_opts in
- *"
-"enable_$ac_useropt"
-"*) ;;
- *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig"
- ac_unrecognized_sep=', ';;
- esac
- eval enable_$ac_useropt=\$ac_optarg ;;
+ expr "x$ac_feature" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+ { echo "$as_me: error: invalid feature name: $ac_feature" >&2
+ { (exit 1); exit 1; }; }
+ ac_feature=`echo $ac_feature | sed 's/[-.]/_/g'`
+ eval enable_$ac_feature=\$ac_optarg ;;
-exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \
| --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \
@@ -1129,36 +1053,22 @@
ac_init_version=: ;;
-with-* | --with-*)
- ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'`
+ ac_package=`expr "x$ac_option" : 'x-*with-\([^=]*\)'`
# Reject names that are not valid shell variable names.
- expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
- as_fn_error $? "invalid package name: $ac_useropt"
- ac_useropt_orig=$ac_useropt
- ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
- case $ac_user_opts in
- *"
-"with_$ac_useropt"
-"*) ;;
- *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig"
- ac_unrecognized_sep=', ';;
- esac
- eval with_$ac_useropt=\$ac_optarg ;;
+ expr "x$ac_package" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+ { echo "$as_me: error: invalid package name: $ac_package" >&2
+ { (exit 1); exit 1; }; }
+ ac_package=`echo $ac_package | sed 's/[-.]/_/g'`
+ eval with_$ac_package=\$ac_optarg ;;
-without-* | --without-*)
- ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'`
+ ac_package=`expr "x$ac_option" : 'x-*without-\(.*\)'`
# Reject names that are not valid shell variable names.
- expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
- as_fn_error $? "invalid package name: $ac_useropt"
- ac_useropt_orig=$ac_useropt
- ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
- case $ac_user_opts in
- *"
-"with_$ac_useropt"
-"*) ;;
- *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig"
- ac_unrecognized_sep=', ';;
- esac
- eval with_$ac_useropt=no ;;
+ expr "x$ac_package" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+ { echo "$as_me: error: invalid package name: $ac_package" >&2
+ { (exit 1); exit 1; }; }
+ ac_package=`echo $ac_package | sed 's/[-.]/_/g'`
+ eval with_$ac_package=no ;;
--x)
# Obsolete; use --with-x.
@@ -1178,26 +1088,26 @@
| --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*)
x_libraries=$ac_optarg ;;
- -*) as_fn_error $? "unrecognized option: \`$ac_option'
-Try \`$0 --help' for more information"
+ -*) { echo "$as_me: error: unrecognized option: $ac_option
+Try \`$0 --help' for more information." >&2
+ { (exit 1); exit 1; }; }
;;
*=*)
ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='`
# Reject names that are not valid shell variable names.
- case $ac_envvar in #(
- '' | [0-9]* | *[!_$as_cr_alnum]* )
- as_fn_error $? "invalid variable name: \`$ac_envvar'" ;;
- esac
+ expr "x$ac_envvar" : ".*[^_$as_cr_alnum]" >/dev/null &&
+ { echo "$as_me: error: invalid variable name: $ac_envvar" >&2
+ { (exit 1); exit 1; }; }
eval $ac_envvar=\$ac_optarg
export $ac_envvar ;;
*)
# FIXME: should be removed in autoconf 3.0.
- $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2
+ echo "$as_me: WARNING: you should use --build, --host, --target" >&2
expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null &&
- $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2
- : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}"
+ echo "$as_me: WARNING: invalid host type: $ac_option" >&2
+ : ${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}
;;
esac
@@ -1205,18 +1115,11 @@
if test -n "$ac_prev"; then
ac_option=--`echo $ac_prev | sed 's/_/-/g'`
- as_fn_error $? "missing argument to $ac_option"
+ { echo "$as_me: error: missing argument to $ac_option" >&2
+ { (exit 1); exit 1; }; }
fi
-if test -n "$ac_unrecognized_opts"; then
- case $enable_option_checking in
- no) ;;
- fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;;
- *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;;
- esac
-fi
-
-# Check all directory arguments for consistency.
+# Be sure to have absolute directory names.
for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \
datadir sysconfdir sharedstatedir localstatedir includedir \
oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
@@ -1223,18 +1126,12 @@
libdir localedir mandir
do
eval ac_val=\$$ac_var
- # Remove trailing slashes.
case $ac_val in
- */ )
- ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'`
- eval $ac_var=\$ac_val;;
- esac
- # Be sure to have absolute directory names.
- case $ac_val in
[\\/$]* | ?:[\\/]* ) continue;;
NONE | '' ) case $ac_var in *prefix ) continue;; esac;;
esac
- as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val"
+ { echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2
+ { (exit 1); exit 1; }; }
done
# There might be people who depend on the old broken behavior: `$host'
@@ -1248,6 +1145,8 @@
if test "x$host_alias" != x; then
if test "x$build_alias" = x; then
cross_compiling=maybe
+ echo "$as_me: WARNING: If you wanted to set the --build type, don't use --host.
+ If a cross compiler is detected then cross compile mode will be used." >&2
elif test "x$build_alias" != "x$host_alias"; then
cross_compiling=yes
fi
@@ -1262,9 +1161,11 @@
ac_pwd=`pwd` && test -n "$ac_pwd" &&
ac_ls_di=`ls -di .` &&
ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` ||
- as_fn_error $? "working directory cannot be determined"
+ { echo "$as_me: error: Working directory cannot be determined" >&2
+ { (exit 1); exit 1; }; }
test "X$ac_ls_di" = "X$ac_pwd_ls_di" ||
- as_fn_error $? "pwd does not report name of working directory"
+ { echo "$as_me: error: pwd does not report name of working directory" >&2
+ { (exit 1); exit 1; }; }
# Find the source files, if location was not specified.
@@ -1271,12 +1172,12 @@
if test -z "$srcdir"; then
ac_srcdir_defaulted=yes
# Try the directory containing this script, then the parent directory.
- ac_confdir=`$as_dirname -- "$as_myself" ||
-$as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
- X"$as_myself" : 'X\(//\)[^/]' \| \
- X"$as_myself" : 'X\(//\)$' \| \
- X"$as_myself" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$as_myself" |
+ ac_confdir=`$as_dirname -- "$0" ||
+$as_expr X"$0" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+ X"$0" : 'X\(//\)[^/]' \| \
+ X"$0" : 'X\(//\)$' \| \
+ X"$0" : 'X\(/\)' \| . 2>/dev/null ||
+echo X"$0" |
sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
s//\1/
q
@@ -1303,11 +1204,13 @@
fi
if test ! -r "$srcdir/$ac_unique_file"; then
test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .."
- as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir"
+ { echo "$as_me: error: cannot find sources ($ac_unique_file) in $srcdir" >&2
+ { (exit 1); exit 1; }; }
fi
ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work"
ac_abs_confdir=`(
- cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg"
+ cd "$srcdir" && test -r "./$ac_unique_file" || { echo "$as_me: error: $ac_msg" >&2
+ { (exit 1); exit 1; }; }
pwd)`
# When building in place, set srcdir=.
if test "$ac_abs_confdir" = "$ac_pwd"; then
@@ -1347,7 +1250,7 @@
--help=short display options specific to this package
--help=recursive display the short help of all the included packages
-V, --version display version information and exit
- -q, --quiet, --silent do not print \`checking ...' messages
+ -q, --quiet, --silent do not print \`checking...' messages
--cache-file=FILE cache test results in FILE [disabled]
-C, --config-cache alias for \`--cache-file=config.cache'
-n, --no-create do not create output files
@@ -1355,9 +1258,9 @@
Installation directories:
--prefix=PREFIX install architecture-independent files in PREFIX
- [$ac_default_prefix]
+ [$ac_default_prefix]
--exec-prefix=EPREFIX install architecture-dependent files in EPREFIX
- [PREFIX]
+ [PREFIX]
By default, \`make install' will install all the files in
\`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify
@@ -1367,25 +1270,25 @@
For better control, use the options below.
Fine tuning of the installation directories:
- --bindir=DIR user executables [EPREFIX/bin]
- --sbindir=DIR system admin executables [EPREFIX/sbin]
- --libexecdir=DIR program executables [EPREFIX/libexec]
- --sysconfdir=DIR read-only single-machine data [PREFIX/etc]
- --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
- --localstatedir=DIR modifiable single-machine data [PREFIX/var]
- --libdir=DIR object code libraries [EPREFIX/lib]
- --includedir=DIR C header files [PREFIX/include]
- --oldincludedir=DIR C header files for non-gcc [/usr/include]
- --datarootdir=DIR read-only arch.-independent data root [PREFIX/share]
- --datadir=DIR read-only architecture-independent data [DATAROOTDIR]
- --infodir=DIR info documentation [DATAROOTDIR/info]
- --localedir=DIR locale-dependent data [DATAROOTDIR/locale]
- --mandir=DIR man documentation [DATAROOTDIR/man]
- --docdir=DIR documentation root [DATAROOTDIR/doc/openssh]
- --htmldir=DIR html documentation [DOCDIR]
- --dvidir=DIR dvi documentation [DOCDIR]
- --pdfdir=DIR pdf documentation [DOCDIR]
- --psdir=DIR ps documentation [DOCDIR]
+ --bindir=DIR user executables [EPREFIX/bin]
+ --sbindir=DIR system admin executables [EPREFIX/sbin]
+ --libexecdir=DIR program executables [EPREFIX/libexec]
+ --sysconfdir=DIR read-only single-machine data [PREFIX/etc]
+ --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
+ --localstatedir=DIR modifiable single-machine data [PREFIX/var]
+ --libdir=DIR object code libraries [EPREFIX/lib]
+ --includedir=DIR C header files [PREFIX/include]
+ --oldincludedir=DIR C header files for non-gcc [/usr/include]
+ --datarootdir=DIR read-only arch.-independent data root [PREFIX/share]
+ --datadir=DIR read-only architecture-independent data [DATAROOTDIR]
+ --infodir=DIR info documentation [DATAROOTDIR/info]
+ --localedir=DIR locale-dependent data [DATAROOTDIR/locale]
+ --mandir=DIR man documentation [DATAROOTDIR/man]
+ --docdir=DIR documentation root [DATAROOTDIR/doc/openssh]
+ --htmldir=DIR html documentation [DOCDIR]
+ --dvidir=DIR dvi documentation [DOCDIR]
+ --pdfdir=DIR pdf documentation [DOCDIR]
+ --psdir=DIR ps documentation [DOCDIR]
_ACEOF
cat <<\_ACEOF
@@ -1403,10 +1306,10 @@
cat <<\_ACEOF
Optional Features:
- --disable-option-checking ignore unrecognized --enable/--with options
--disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no)
--enable-FEATURE[=ARG] include FEATURE [ARG=yes]
--disable-largefile omit support for large files
+ --disable-pkcs11 disable PKCS#11 support code [no]
--disable-strip Disable calling strip(1) on install
--disable-etc-default-login Disable using PATH from /etc/default/login no
--disable-lastlog disable use of lastlog even if detected no
@@ -1421,6 +1324,8 @@
Optional Packages:
--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
--without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no)
+ --without-openssl Disable use of OpenSSL; use only limited internal crypto **EXPERIMENTAL**
+ --with-ssh1 Enable support for SSH protocol 1
--without-stackprotect Don't use compiler's stack protection
--without-hardening Don't use toolchain hardening flags
--without-rpath Disable auto-added -R linker paths
@@ -1431,15 +1336,15 @@
--with-Werror Build main code with -Werror
--with-solaris-contracts Enable Solaris process contracts (experimental)
--with-solaris-projects Enable Solaris projects (experimental)
+ --with-solaris-privs Enable Solaris/Illumos privileges (experimental)
--with-osfsia Enable Digital Unix SIA
--with-zlib=PATH Use zlib in PATH
--without-zlib-version-check Disable zlib version check
--with-skey[=PATH] Enable S/Key support (optionally in PATH)
- --with-tcp-wrappers[=PATH] Enable tcpwrappers support (optionally in PATH)
--with-ldns[=PATH] Use ldns for DNSSEC support (optionally in PATH)
--with-libedit[=PATH] Enable libedit support for sftp
--with-audit=module Enable audit support (modules=debug,bsm,linux)
- --with-pie Build Position Independent Executables if possible
+ --with-pie Build Position Independent Executables if possible
--with-ssl-dir=PATH Specify path to OpenSSL installation
--without-openssl-header-check Disable OpenSSL version consistency check
--with-ssl-engine Enable OpenSSL (hardware) ENGINE support
@@ -1447,7 +1352,7 @@
--with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)
--with-pam Enable PAM support
--with-privsep-user=user Specify non-privileged user for privilege separation
- --with-sandbox=style Specify privilege separation sandbox (no, darwin, rlimit, systrace, seccomp_filter, capsicum)
+ --with-sandbox=style Specify privilege separation sandbox (no, capsicum, darwin, rlimit, seccomp_filter, systrace, pledge)
--with-selinux Enable SELinux support
--with-kerberos5=PATH Enable Kerberos 5 support
--with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)
@@ -1456,8 +1361,8 @@
--with-mantype=man|cat|doc Set man page type
--with-md5-passwords Enable use of MD5 passwords
--without-shadow Disable shadow password support
- --with-ipaddr-display Use ip address instead of hostname in \$DISPLAY
- --with-default-path= Specify default \$PATH environment for server
+ --with-ipaddr-display Use ip address instead of hostname in $DISPLAY
+ --with-default-path= Specify default $PATH environment for server
--with-superuser-path= Specify different path for super-user
--with-4in6 Check for and convert IPv4 in IPv6 mapped addresses
--with-bsd-auth Enable BSD auth support
@@ -1470,7 +1375,7 @@
LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a
nonstandard directory <lib dir>
LIBS libraries to pass to the linker, e.g. -l<library>
- CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if
+ CPPFLAGS C/C++/Objective C preprocessor flags, e.g. -I<include dir> if
you have headers in a nonstandard directory <include dir>
CPP C preprocessor
@@ -1485,17 +1390,15 @@
if test "$ac_init_help" = "recursive"; then
# If there are subdirs, report their specific --help.
for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue
- test -d "$ac_dir" ||
- { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } ||
- continue
+ test -d "$ac_dir" || continue
ac_builddir=.
case "$ac_dir" in
.) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
*)
- ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'`
+ ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'`
# A ".." for each directory in $ac_dir_suffix.
- ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
+ ac_top_builddir_sub=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,/..,g;s,/,,'`
case $ac_top_builddir_sub in
"") ac_top_builddir_sub=. ac_top_build_prefix= ;;
*) ac_top_build_prefix=$ac_top_builddir_sub/ ;;
@@ -1531,7 +1434,7 @@
echo &&
$SHELL "$ac_srcdir/configure" --help=recursive
else
- $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
+ echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
fi || ac_status=$?
cd "$ac_pwd" || { ac_status=$?; break; }
done
@@ -1541,716 +1444,21 @@
if $ac_init_version; then
cat <<\_ACEOF
OpenSSH configure Portable
-generated by GNU Autoconf 2.69
+generated by GNU Autoconf 2.61
-Copyright (C) 2012 Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
+2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc.
This configure script is free software; the Free Software Foundation
gives unlimited permission to copy, distribute and modify it.
_ACEOF
exit
fi
-
-## ------------------------ ##
-## Autoconf initialization. ##
-## ------------------------ ##
-
-# ac_fn_c_try_compile LINENO
-# --------------------------
-# Try to compile conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_compile ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- rm -f conftest.$ac_objext
- if { { ac_try="$ac_compile"
-case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_compile") 2>conftest.err
- ac_status=$?
- if test -s conftest.err; then
- grep -v '^ *+' conftest.err >conftest.er1
- cat conftest.er1 >&5
- mv -f conftest.er1 conftest.err
- fi
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; } && {
- test -z "$ac_c_werror_flag" ||
- test ! -s conftest.err
- } && test -s conftest.$ac_objext; then :
- ac_retval=0
-else
- $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
- ac_retval=1
-fi
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
- as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_compile
-
-# ac_fn_c_try_run LINENO
-# ----------------------
-# Try to link conftest.$ac_ext, and return whether this succeeded. Assumes
-# that executables *can* be run.
-ac_fn_c_try_run ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- if { { ac_try="$ac_link"
-case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_link") 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; } && { ac_try='./conftest$ac_exeext'
- { { case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_try") 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; }; then :
- ac_retval=0
-else
- $as_echo "$as_me: program exited with status $ac_status" >&5
- $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
- ac_retval=$ac_status
-fi
- rm -rf conftest.dSYM conftest_ipa8_conftest.oo
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
- as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_run
-
-# ac_fn_c_try_cpp LINENO
-# ----------------------
-# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_cpp ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- if { { ac_try="$ac_cpp conftest.$ac_ext"
-case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
- ac_status=$?
- if test -s conftest.err; then
- grep -v '^ *+' conftest.err >conftest.er1
- cat conftest.er1 >&5
- mv -f conftest.er1 conftest.err
- fi
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; } > conftest.i && {
- test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
- test ! -s conftest.err
- }; then :
- ac_retval=0
-else
- $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
- ac_retval=1
-fi
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
- as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_cpp
-
-# ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES
-# -------------------------------------------------------
-# Tests whether HEADER exists and can be compiled using the include files in
-# INCLUDES, setting the cache variable VAR accordingly.
-ac_fn_c_check_header_compile ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-#include <$2>
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- eval "$3=yes"
-else
- eval "$3=no"
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-eval ac_res=\$$3
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_c_check_header_compile
-
-# ac_fn_c_check_decl LINENO SYMBOL VAR INCLUDES
-# ---------------------------------------------
-# Tests whether SYMBOL is declared in INCLUDES, setting cache variable VAR
-# accordingly.
-ac_fn_c_check_decl ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- as_decl_name=`echo $2|sed 's/ *(.*//'`
- as_decl_use=`echo $2|sed -e 's/(/((/' -e 's/)/) 0&/' -e 's/,/) 0& (/g'`
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5
-$as_echo_n "checking whether $as_decl_name is declared... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-int
-main ()
-{
-#ifndef $as_decl_name
-#ifdef __cplusplus
- (void) $as_decl_use;
-#else
- (void) $as_decl_name;
-#endif
-#endif
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- eval "$3=yes"
-else
- eval "$3=no"
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-eval ac_res=\$$3
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_c_check_decl
-
-# ac_fn_c_try_link LINENO
-# -----------------------
-# Try to link conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_link ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- rm -f conftest.$ac_objext conftest$ac_exeext
- if { { ac_try="$ac_link"
-case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_link") 2>conftest.err
- ac_status=$?
- if test -s conftest.err; then
- grep -v '^ *+' conftest.err >conftest.er1
- cat conftest.er1 >&5
- mv -f conftest.er1 conftest.err
- fi
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; } && {
- test -z "$ac_c_werror_flag" ||
- test ! -s conftest.err
- } && test -s conftest$ac_exeext && {
- test "$cross_compiling" = yes ||
- test -x conftest$ac_exeext
- }; then :
- ac_retval=0
-else
- $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
- ac_retval=1
-fi
- # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
- # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
- # interfere with the next link command; also delete a directory that is
- # left behind by Apple's compiler. We do this before executing the actions.
- rm -rf conftest.dSYM conftest_ipa8_conftest.oo
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
- as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_link
-
-# ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES
-# -------------------------------------------------------
-# Tests whether HEADER exists, giving a warning if it cannot be compiled using
-# the include files in INCLUDES and setting the cache variable VAR
-# accordingly.
-ac_fn_c_check_header_mongrel ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- if eval \${$3+:} false; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-fi
-eval ac_res=\$$3
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-else
- # Is the header compilable?
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5
-$as_echo_n "checking $2 usability... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-#include <$2>
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- ac_header_compiler=yes
-else
- ac_header_compiler=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5
-$as_echo "$ac_header_compiler" >&6; }
-
-# Is the header present?
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5
-$as_echo_n "checking $2 presence... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <$2>
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
- ac_header_preproc=yes
-else
- ac_header_preproc=no
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5
-$as_echo "$ac_header_preproc" >&6; }
-
-# So? What about this header?
-case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #((
- yes:no: )
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5
-$as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
-$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
- ;;
- no:yes:* )
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5
-$as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5
-$as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5
-$as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5
-$as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
-$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
-( $as_echo "## ------------------------------------------- ##
-## Report this to openssh-unix-dev at mindrot.org ##
-## ------------------------------------------- ##"
- ) | sed "s/^/$as_me: WARNING: /" >&2
- ;;
-esac
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- eval "$3=\$ac_header_compiler"
-fi
-eval ac_res=\$$3
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-fi
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_c_check_header_mongrel
-
-# ac_fn_c_check_func LINENO FUNC VAR
-# ----------------------------------
-# Tests whether FUNC exists, setting the cache variable VAR accordingly
-ac_fn_c_check_func ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-/* Define $2 to an innocuous variant, in case <limits.h> declares $2.
- For example, HP-UX 11i <limits.h> declares gettimeofday. */
-#define $2 innocuous_$2
-
-/* System header to define __stub macros and hopefully few prototypes,
- which can conflict with char $2 (); below.
- Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
- <limits.h> exists even on freestanding compilers. */
-
-#ifdef __STDC__
-# include <limits.h>
-#else
-# include <assert.h>
-#endif
-
-#undef $2
-
-/* Override any GCC internal prototype to avoid an error.
- Use char because int might match the return type of a GCC
- builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
-char $2 ();
-/* The GNU C library defines this for functions which it implements
- to always fail with ENOSYS. Some functions are actually named
- something starting with __ and the normal name is an alias. */
-#if defined __stub_$2 || defined __stub___$2
-choke me
-#endif
-
-int
-main ()
-{
-return $2 ();
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- eval "$3=yes"
-else
- eval "$3=no"
-fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-fi
-eval ac_res=\$$3
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_c_check_func
-
-# ac_fn_c_check_type LINENO TYPE VAR INCLUDES
-# -------------------------------------------
-# Tests whether TYPE exists after having included INCLUDES, setting cache
-# variable VAR accordingly.
-ac_fn_c_check_type ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- eval "$3=no"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-int
-main ()
-{
-if (sizeof ($2))
- return 0;
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-int
-main ()
-{
-if (sizeof (($2)))
- return 0;
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-
-else
- eval "$3=yes"
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-eval ac_res=\$$3
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_c_check_type
-
-# ac_fn_c_compute_int LINENO EXPR VAR INCLUDES
-# --------------------------------------------
-# Tries to find the compile-time value of EXPR in a program that includes
-# INCLUDES, setting VAR accordingly. Returns whether the value could be
-# computed
-ac_fn_c_compute_int ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- if test "$cross_compiling" = yes; then
- # Depending upon the size, compute the lo and hi bounds.
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-int
-main ()
-{
-static int test_array [1 - 2 * !(($2) >= 0)];
-test_array [0] = 0;
-return test_array [0];
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- ac_lo=0 ac_mid=0
- while :; do
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-int
-main ()
-{
-static int test_array [1 - 2 * !(($2) <= $ac_mid)];
-test_array [0] = 0;
-return test_array [0];
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- ac_hi=$ac_mid; break
-else
- as_fn_arith $ac_mid + 1 && ac_lo=$as_val
- if test $ac_lo -le $ac_mid; then
- ac_lo= ac_hi=
- break
- fi
- as_fn_arith 2 '*' $ac_mid + 1 && ac_mid=$as_val
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- done
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-int
-main ()
-{
-static int test_array [1 - 2 * !(($2) < 0)];
-test_array [0] = 0;
-return test_array [0];
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- ac_hi=-1 ac_mid=-1
- while :; do
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-int
-main ()
-{
-static int test_array [1 - 2 * !(($2) >= $ac_mid)];
-test_array [0] = 0;
-return test_array [0];
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- ac_lo=$ac_mid; break
-else
- as_fn_arith '(' $ac_mid ')' - 1 && ac_hi=$as_val
- if test $ac_mid -le $ac_hi; then
- ac_lo= ac_hi=
- break
- fi
- as_fn_arith 2 '*' $ac_mid && ac_mid=$as_val
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- done
-else
- ac_lo= ac_hi=
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-# Binary search between lo and hi bounds.
-while test "x$ac_lo" != "x$ac_hi"; do
- as_fn_arith '(' $ac_hi - $ac_lo ')' / 2 + $ac_lo && ac_mid=$as_val
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-int
-main ()
-{
-static int test_array [1 - 2 * !(($2) <= $ac_mid)];
-test_array [0] = 0;
-return test_array [0];
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- ac_hi=$ac_mid
-else
- as_fn_arith '(' $ac_mid ')' + 1 && ac_lo=$as_val
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-done
-case $ac_lo in #((
-?*) eval "$3=\$ac_lo"; ac_retval=0 ;;
-'') ac_retval=1 ;;
-esac
- else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-static long int longval () { return $2; }
-static unsigned long int ulongval () { return $2; }
-#include <stdio.h>
-#include <stdlib.h>
-int
-main ()
-{
-
- FILE *f = fopen ("conftest.val", "w");
- if (! f)
- return 1;
- if (($2) < 0)
- {
- long int i = longval ();
- if (i != ($2))
- return 1;
- fprintf (f, "%ld", i);
- }
- else
- {
- unsigned long int i = ulongval ();
- if (i != ($2))
- return 1;
- fprintf (f, "%lu", i);
- }
- /* Do not output a trailing newline, as this causes \r\n confusion
- on some platforms. */
- return ferror (f) || fclose (f) != 0;
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- echo >>conftest.val; read $3 <conftest.val; ac_retval=0
-else
- ac_retval=1
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
-rm -f conftest.val
-
- fi
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
- as_fn_set_status $ac_retval
-
-} # ac_fn_c_compute_int
-
-# ac_fn_c_check_member LINENO AGGR MEMBER VAR INCLUDES
-# ----------------------------------------------------
-# Tries to find if the field MEMBER exists in type AGGR, after including
-# INCLUDES, setting cache variable VAR accordingly.
-ac_fn_c_check_member ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2.$3" >&5
-$as_echo_n "checking for $2.$3... " >&6; }
-if eval \${$4+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$5
-int
-main ()
-{
-static $2 ac_aggr;
-if (ac_aggr.$3)
-return 0;
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- eval "$4=yes"
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$5
-int
-main ()
-{
-static $2 ac_aggr;
-if (sizeof ac_aggr.$3)
-return 0;
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- eval "$4=yes"
-else
- eval "$4=no"
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-eval ac_res=\$$4
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_c_check_member
cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by OpenSSH $as_me Portable, which was
-generated by GNU Autoconf 2.69. Invocation command line was
+generated by GNU Autoconf 2.61. Invocation command line was
$ $0 $@
@@ -2286,8 +1494,8 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- $as_echo "PATH: $as_dir"
- done
+ echo "PATH: $as_dir"
+done
IFS=$as_save_IFS
} >&5
@@ -2321,12 +1529,12 @@
| -silent | --silent | --silen | --sile | --sil)
continue ;;
*\'*)
- ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
+ ac_arg=`echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
esac
case $ac_pass in
- 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;;
+ 1) ac_configure_args0="$ac_configure_args0 '$ac_arg'" ;;
2)
- as_fn_append ac_configure_args1 " '$ac_arg'"
+ ac_configure_args1="$ac_configure_args1 '$ac_arg'"
if test $ac_must_keep_next = true; then
ac_must_keep_next=false # Got value, back to normal.
else
@@ -2342,13 +1550,13 @@
-* ) ac_must_keep_next=true ;;
esac
fi
- as_fn_append ac_configure_args " '$ac_arg'"
+ ac_configure_args="$ac_configure_args '$ac_arg'"
;;
esac
done
done
-{ ac_configure_args0=; unset ac_configure_args0;}
-{ ac_configure_args1=; unset ac_configure_args1;}
+$as_unset ac_configure_args0 || test "${ac_configure_args0+set}" != set || { ac_configure_args0=; export ac_configure_args0; }
+$as_unset ac_configure_args1 || test "${ac_configure_args1+set}" != set || { ac_configure_args1=; export ac_configure_args1; }
# When interrupted or exit'd, cleanup temporary files, and complete
# config.log. We remove comments because anyway the quotes in there
@@ -2360,9 +1568,11 @@
{
echo
- $as_echo "## ---------------- ##
+ cat <<\_ASBOX
+## ---------------- ##
## Cache variables. ##
-## ---------------- ##"
+## ---------------- ##
+_ASBOX
echo
# The following way of writing the cache mishandles newlines in values,
(
@@ -2371,13 +1581,12 @@
case $ac_val in #(
*${as_nl}*)
case $ac_var in #(
- *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
-$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+ *_cv_*) { echo "$as_me:$LINENO: WARNING: Cache variable $ac_var contains a newline." >&5
+echo "$as_me: WARNING: Cache variable $ac_var contains a newline." >&2;} ;;
esac
case $ac_var in #(
_ | IFS | as_nl) ;; #(
- BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #(
- *) { eval $ac_var=; unset $ac_var;} ;;
+ *) $as_unset $ac_var ;;
esac ;;
esac
done
@@ -2396,47 +1605,53 @@
)
echo
- $as_echo "## ----------------- ##
+ cat <<\_ASBOX
+## ----------------- ##
## Output variables. ##
-## ----------------- ##"
+## ----------------- ##
+_ASBOX
echo
for ac_var in $ac_subst_vars
do
eval ac_val=\$$ac_var
case $ac_val in
- *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+ *\'\''*) ac_val=`echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
esac
- $as_echo "$ac_var='\''$ac_val'\''"
+ echo "$ac_var='\''$ac_val'\''"
done | sort
echo
if test -n "$ac_subst_files"; then
- $as_echo "## ------------------- ##
+ cat <<\_ASBOX
+## ------------------- ##
## File substitutions. ##
-## ------------------- ##"
+## ------------------- ##
+_ASBOX
echo
for ac_var in $ac_subst_files
do
eval ac_val=\$$ac_var
case $ac_val in
- *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+ *\'\''*) ac_val=`echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
esac
- $as_echo "$ac_var='\''$ac_val'\''"
+ echo "$ac_var='\''$ac_val'\''"
done | sort
echo
fi
if test -s confdefs.h; then
- $as_echo "## ----------- ##
+ cat <<\_ASBOX
+## ----------- ##
## confdefs.h. ##
-## ----------- ##"
+## ----------- ##
+_ASBOX
echo
cat confdefs.h
echo
fi
test "$ac_signal" != 0 &&
- $as_echo "$as_me: caught signal $ac_signal"
- $as_echo "$as_me: exit $exit_status"
+ echo "$as_me: caught signal $ac_signal"
+ echo "$as_me: exit $exit_status"
} >&5
rm -f core *.core core.conftest.* &&
rm -f -r conftest* confdefs* conf$$* $ac_clean_files &&
@@ -2443,7 +1658,7 @@
exit $exit_status
' 0
for ac_signal in 1 2 13 15; do
- trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal
+ trap 'ac_signal='$ac_signal'; { (exit 1); exit 1; }' $ac_signal
done
ac_signal=0
@@ -2450,8 +1665,6 @@
# confdefs.h avoids OS command line length limits that DEFS can exceed.
rm -f -r conftest* confdefs.h
-$as_echo "/* confdefs.h */" > confdefs.h
-
# Predefined preprocessor variables.
cat >>confdefs.h <<_ACEOF
@@ -2458,66 +1671,54 @@
#define PACKAGE_NAME "$PACKAGE_NAME"
_ACEOF
+
cat >>confdefs.h <<_ACEOF
#define PACKAGE_TARNAME "$PACKAGE_TARNAME"
_ACEOF
+
cat >>confdefs.h <<_ACEOF
#define PACKAGE_VERSION "$PACKAGE_VERSION"
_ACEOF
+
cat >>confdefs.h <<_ACEOF
#define PACKAGE_STRING "$PACKAGE_STRING"
_ACEOF
+
cat >>confdefs.h <<_ACEOF
#define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT"
_ACEOF
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_URL "$PACKAGE_URL"
-_ACEOF
-
# Let the site file select an alternate cache file if it wants to.
-# Prefer an explicitly selected file to automatically selected ones.
-ac_site_file1=NONE
-ac_site_file2=NONE
+# Prefer explicitly selected file to automatically selected ones.
if test -n "$CONFIG_SITE"; then
- # We do not want a PATH search for config.site.
- case $CONFIG_SITE in #((
- -*) ac_site_file1=./$CONFIG_SITE;;
- */*) ac_site_file1=$CONFIG_SITE;;
- *) ac_site_file1=./$CONFIG_SITE;;
- esac
+ set x "$CONFIG_SITE"
elif test "x$prefix" != xNONE; then
- ac_site_file1=$prefix/share/config.site
- ac_site_file2=$prefix/etc/config.site
+ set x "$prefix/share/config.site" "$prefix/etc/config.site"
else
- ac_site_file1=$ac_default_prefix/share/config.site
- ac_site_file2=$ac_default_prefix/etc/config.site
+ set x "$ac_default_prefix/share/config.site" \
+ "$ac_default_prefix/etc/config.site"
fi
-for ac_site_file in "$ac_site_file1" "$ac_site_file2"
+shift
+for ac_site_file
do
- test "x$ac_site_file" = xNONE && continue
- if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
-$as_echo "$as_me: loading site script $ac_site_file" >&6;}
+ if test -r "$ac_site_file"; then
+ { echo "$as_me:$LINENO: loading site script $ac_site_file" >&5
+echo "$as_me: loading site script $ac_site_file" >&6;}
sed 's/^/| /' "$ac_site_file" >&5
- . "$ac_site_file" \
- || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "failed to load site script $ac_site_file
-See \`config.log' for more details" "$LINENO" 5; }
+ . "$ac_site_file"
fi
done
if test -r "$cache_file"; then
- # Some versions of bash will fail to source /dev/null (special files
- # actually), so we avoid doing that. DJGPP emulates it as a regular file.
- if test /dev/null != "$cache_file" && test -f "$cache_file"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5
-$as_echo "$as_me: loading cache $cache_file" >&6;}
+ # Some versions of bash will fail to source /dev/null (special
+ # files actually), so we avoid doing that.
+ if test -f "$cache_file"; then
+ { echo "$as_me:$LINENO: loading cache $cache_file" >&5
+echo "$as_me: loading cache $cache_file" >&6;}
case $cache_file in
[\\/]* | ?:[\\/]* ) . "$cache_file";;
*) . "./$cache_file";;
@@ -2524,8 +1725,8 @@
esac
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5
-$as_echo "$as_me: creating cache $cache_file" >&6;}
+ { echo "$as_me:$LINENO: creating cache $cache_file" >&5
+echo "$as_me: creating cache $cache_file" >&6;}
>$cache_file
fi
@@ -2539,57 +1740,69 @@
eval ac_new_val=\$ac_env_${ac_var}_value
case $ac_old_set,$ac_new_set in
set,)
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
-$as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
+ { echo "$as_me:$LINENO: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
+echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
ac_cache_corrupted=: ;;
,set)
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5
-$as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
+ { echo "$as_me:$LINENO: error: \`$ac_var' was not set in the previous run" >&5
+echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
ac_cache_corrupted=: ;;
,);;
*)
if test "x$ac_old_val" != "x$ac_new_val"; then
- # differences in whitespace do not lead to failure.
- ac_old_val_w=`echo x $ac_old_val`
- ac_new_val_w=`echo x $ac_new_val`
- if test "$ac_old_val_w" != "$ac_new_val_w"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5
-$as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
- ac_cache_corrupted=:
- else
- { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5
-$as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;}
- eval $ac_var=\$ac_old_val
- fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5
-$as_echo "$as_me: former value: \`$ac_old_val'" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5
-$as_echo "$as_me: current value: \`$ac_new_val'" >&2;}
+ { echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5
+echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
+ { echo "$as_me:$LINENO: former value: $ac_old_val" >&5
+echo "$as_me: former value: $ac_old_val" >&2;}
+ { echo "$as_me:$LINENO: current value: $ac_new_val" >&5
+echo "$as_me: current value: $ac_new_val" >&2;}
+ ac_cache_corrupted=:
fi;;
esac
# Pass precious variables to config.status.
if test "$ac_new_set" = set; then
case $ac_new_val in
- *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
+ *\'*) ac_arg=$ac_var=`echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
*) ac_arg=$ac_var=$ac_new_val ;;
esac
case " $ac_configure_args " in
*" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy.
- *) as_fn_append ac_configure_args " '$ac_arg'" ;;
+ *) ac_configure_args="$ac_configure_args '$ac_arg'" ;;
esac
fi
done
if $ac_cache_corrupted; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5
-$as_echo "$as_me: error: changes in the environment can compromise the build" >&2;}
- as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5
+ { echo "$as_me:$LINENO: error: changes in the environment can compromise the build" >&5
+echo "$as_me: error: changes in the environment can compromise the build" >&2;}
+ { { echo "$as_me:$LINENO: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&5
+echo "$as_me: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&2;}
+ { (exit 1); exit 1; }; }
fi
-## -------------------- ##
-## Main body of script. ##
-## -------------------- ##
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
ac_ext=c
ac_cpp='$CPP $CPPFLAGS'
ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -2616,10 +1829,10 @@
if test -n "$ac_tool_prefix"; then
# Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args.
set dummy ${ac_tool_prefix}gcc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_CC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$CC"; then
ac_cv_prog_CC="$CC" # Let the user override the test.
@@ -2629,14 +1842,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_CC="${ac_tool_prefix}gcc"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
fi
@@ -2643,11 +1856,11 @@
fi
CC=$ac_cv_prog_CC
if test -n "$CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+ { echo "$as_me:$LINENO: result: $CC" >&5
+echo "${ECHO_T}$CC" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -2656,10 +1869,10 @@
ac_ct_CC=$CC
# Extract the first word of "gcc", so it can be a program name with args.
set dummy gcc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_CC+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_ac_ct_CC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$ac_ct_CC"; then
ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
@@ -2669,14 +1882,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_ac_ct_CC="gcc"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
fi
@@ -2683,11 +1896,11 @@
fi
ac_ct_CC=$ac_cv_prog_ac_ct_CC
if test -n "$ac_ct_CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
-$as_echo "$ac_ct_CC" >&6; }
+ { echo "$as_me:$LINENO: result: $ac_ct_CC" >&5
+echo "${ECHO_T}$ac_ct_CC" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
if test "x$ac_ct_CC" = x; then
@@ -2695,8 +1908,12 @@
else
case $cross_compiling:$ac_tool_warned in
yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&5
+echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&2;}
ac_tool_warned=yes ;;
esac
CC=$ac_ct_CC
@@ -2709,10 +1926,10 @@
if test -n "$ac_tool_prefix"; then
# Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args.
set dummy ${ac_tool_prefix}cc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_CC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$CC"; then
ac_cv_prog_CC="$CC" # Let the user override the test.
@@ -2722,14 +1939,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_CC="${ac_tool_prefix}cc"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
fi
@@ -2736,11 +1953,11 @@
fi
CC=$ac_cv_prog_CC
if test -n "$CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+ { echo "$as_me:$LINENO: result: $CC" >&5
+echo "${ECHO_T}$CC" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -2749,10 +1966,10 @@
if test -z "$CC"; then
# Extract the first word of "cc", so it can be a program name with args.
set dummy cc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_CC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$CC"; then
ac_cv_prog_CC="$CC" # Let the user override the test.
@@ -2763,7 +1980,7 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
ac_prog_rejected=yes
@@ -2770,11 +1987,11 @@
continue
fi
ac_cv_prog_CC="cc"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
if test $ac_prog_rejected = yes; then
@@ -2793,11 +2010,11 @@
fi
CC=$ac_cv_prog_CC
if test -n "$CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+ { echo "$as_me:$LINENO: result: $CC" >&5
+echo "${ECHO_T}$CC" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -2808,10 +2025,10 @@
do
# Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
set dummy $ac_tool_prefix$ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_CC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$CC"; then
ac_cv_prog_CC="$CC" # Let the user override the test.
@@ -2821,14 +2038,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_CC="$ac_tool_prefix$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
fi
@@ -2835,11 +2052,11 @@
fi
CC=$ac_cv_prog_CC
if test -n "$CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+ { echo "$as_me:$LINENO: result: $CC" >&5
+echo "${ECHO_T}$CC" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -2852,10 +2069,10 @@
do
# Extract the first word of "$ac_prog", so it can be a program name with args.
set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_CC+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_ac_ct_CC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$ac_ct_CC"; then
ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
@@ -2865,14 +2082,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_ac_ct_CC="$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
fi
@@ -2879,11 +2096,11 @@
fi
ac_ct_CC=$ac_cv_prog_ac_ct_CC
if test -n "$ac_ct_CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
-$as_echo "$ac_ct_CC" >&6; }
+ { echo "$as_me:$LINENO: result: $ac_ct_CC" >&5
+echo "${ECHO_T}$ac_ct_CC" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -2895,8 +2112,12 @@
else
case $cross_compiling:$ac_tool_warned in
yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&5
+echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&2;}
ac_tool_warned=yes ;;
esac
CC=$ac_ct_CC
@@ -2906,37 +2127,51 @@
fi
-test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "no acceptable C compiler found in \$PATH
-See \`config.log' for more details" "$LINENO" 5; }
+test -z "$CC" && { { echo "$as_me:$LINENO: error: no acceptable C compiler found in \$PATH
+See \`config.log' for more details." >&5
+echo "$as_me: error: no acceptable C compiler found in \$PATH
+See \`config.log' for more details." >&2;}
+ { (exit 1); exit 1; }; }
# Provide some information about the compiler.
-$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
-set X $ac_compile
-ac_compiler=$2
-for ac_option in --version -v -V -qversion; do
- { { ac_try="$ac_compiler $ac_option >&5"
+echo "$as_me:$LINENO: checking for C compiler version" >&5
+ac_compiler=`set X $ac_compile; echo $2`
+{ (ac_try="$ac_compiler --version >&5"
case "(($ac_try" in
*\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
*) ac_try_echo=$ac_try;;
esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_compiler $ac_option >&5") 2>conftest.err
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compiler --version >&5") 2>&5
ac_status=$?
- if test -s conftest.err; then
- sed '10a\
-... rest of stderr output deleted ...
- 10q' conftest.err >conftest.er1
- cat conftest.er1 >&5
- fi
- rm -f conftest.er1 conftest.err
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }
-done
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }
+{ (ac_try="$ac_compiler -v >&5"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compiler -v >&5") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }
+{ (ac_try="$ac_compiler -V >&5"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compiler -V >&5") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -2948,38 +2183,42 @@
}
_ACEOF
ac_clean_files_save=$ac_clean_files
-ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out"
+ac_clean_files="$ac_clean_files a.out a.exe b.out"
# Try to create an executable without -o first, disregard a.out.
# It will help us diagnose broken compilers, and finding out an intuition
# of exeext.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5
-$as_echo_n "checking whether the C compiler works... " >&6; }
-ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'`
-
-# The possible output files:
-ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*"
-
+{ echo "$as_me:$LINENO: checking for C compiler default output file name" >&5
+echo $ECHO_N "checking for C compiler default output file name... $ECHO_C" >&6; }
+ac_link_default=`echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'`
+#
+# List of possible output files, starting from the most likely.
+# The algorithm is not robust to junk in `.', hence go to wildcards (a.*)
+# only as a last resort. b.out is created by i960 compilers.
+ac_files='a_out.exe a.exe conftest.exe a.out conftest a.* conftest.* b.out'
+#
+# The IRIX 6 linker writes into existing files which may not be
+# executable, retaining their permissions. Remove them first so a
+# subsequent execution test works.
ac_rmfiles=
for ac_file in $ac_files
do
case $ac_file in
- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;;
+ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ;;
* ) ac_rmfiles="$ac_rmfiles $ac_file";;
esac
done
rm -f $ac_rmfiles
-if { { ac_try="$ac_link_default"
+if { (ac_try="$ac_link_default"
case "(($ac_try" in
*\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
*) ac_try_echo=$ac_try;;
esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
(eval "$ac_link_default") 2>&5
ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; then :
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; then
# Autoconf-2.13 could set the ac_cv_exeext variable to `no'.
# So ignore a value of `no', otherwise this would lead to `EXEEXT = no'
# in a Makefile. We should not override ac_cv_exeext if it was cached,
@@ -2989,7 +2228,7 @@
do
test -f "$ac_file" || continue
case $ac_file in
- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj )
+ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj )
;;
[ab].out )
# We found the default executable, but exeext='' is most
@@ -2996,7 +2235,7 @@
# certainly right.
break;;
*.* )
- if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no;
+ if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no;
then :; else
ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'`
fi
@@ -3015,41 +2254,78 @@
else
ac_file=''
fi
-if test -z "$ac_file"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-$as_echo "$as_me: failed program was:" >&5
+
+{ echo "$as_me:$LINENO: result: $ac_file" >&5
+echo "${ECHO_T}$ac_file" >&6; }
+if test -z "$ac_file"; then
+ echo "$as_me: failed program was:" >&5
sed 's/^/| /' conftest.$ac_ext >&5
-{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error 77 "C compiler cannot create executables
-See \`config.log' for more details" "$LINENO" 5; }
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ { echo "$as_me:$LINENO: error: C compiler cannot create executables
+See \`config.log' for more details." >&5
+echo "$as_me: error: C compiler cannot create executables
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5
-$as_echo_n "checking for C compiler default output file name... " >&6; }
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5
-$as_echo "$ac_file" >&6; }
+
ac_exeext=$ac_cv_exeext
-rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out
+# Check that the compiler produces executables we can run. If not, either
+# the compiler is broken, or we cross compile.
+{ echo "$as_me:$LINENO: checking whether the C compiler works" >&5
+echo $ECHO_N "checking whether the C compiler works... $ECHO_C" >&6; }
+# FIXME: These cross compiler hacks should be removed for Autoconf 3.0
+# If not cross compiling, check that we can run a simple program.
+if test "$cross_compiling" != yes; then
+ if { ac_try='./$ac_file'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ cross_compiling=no
+ else
+ if test "$cross_compiling" = maybe; then
+ cross_compiling=yes
+ else
+ { { echo "$as_me:$LINENO: error: cannot run C compiled programs.
+If you meant to cross compile, use \`--host'.
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot run C compiled programs.
+If you meant to cross compile, use \`--host'.
+See \`config.log' for more details." >&2;}
+ { (exit 1); exit 1; }; }
+ fi
+ fi
+fi
+{ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+
+rm -f a.out a.exe conftest$ac_cv_exeext b.out
ac_clean_files=$ac_clean_files_save
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5
-$as_echo_n "checking for suffix of executables... " >&6; }
-if { { ac_try="$ac_link"
+# Check that the compiler produces executables we can run. If not, either
+# the compiler is broken, or we cross compile.
+{ echo "$as_me:$LINENO: checking whether we are cross compiling" >&5
+echo $ECHO_N "checking whether we are cross compiling... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: result: $cross_compiling" >&5
+echo "${ECHO_T}$cross_compiling" >&6; }
+
+{ echo "$as_me:$LINENO: checking for suffix of executables" >&5
+echo $ECHO_N "checking for suffix of executables... $ECHO_C" >&6; }
+if { (ac_try="$ac_link"
case "(($ac_try" in
*\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
*) ac_try_echo=$ac_try;;
esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
(eval "$ac_link") 2>&5
ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; then :
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; then
# If both `conftest.exe' and `conftest' are `present' (well, observable)
# catch `conftest.exe'. For instance with Cygwin, `ls conftest' will
# work properly (i.e., refer to `conftest.exe'), while it won't with
@@ -3057,7 +2333,7 @@
for ac_file in conftest.exe conftest conftest.*; do
test -f "$ac_file" || continue
case $ac_file in
- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;;
+ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ;;
*.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'`
break;;
* ) break;;
@@ -3064,83 +2340,30 @@
esac
done
else
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "cannot compute suffix of executables: cannot compile and link
-See \`config.log' for more details" "$LINENO" 5; }
+ { { echo "$as_me:$LINENO: error: cannot compute suffix of executables: cannot compile and link
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute suffix of executables: cannot compile and link
+See \`config.log' for more details." >&2;}
+ { (exit 1); exit 1; }; }
fi
-rm -f conftest conftest$ac_cv_exeext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5
-$as_echo "$ac_cv_exeext" >&6; }
+rm -f conftest$ac_cv_exeext
+{ echo "$as_me:$LINENO: result: $ac_cv_exeext" >&5
+echo "${ECHO_T}$ac_cv_exeext" >&6; }
+
rm -f conftest.$ac_ext
EXEEXT=$ac_cv_exeext
ac_exeext=$EXEEXT
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <stdio.h>
-int
-main ()
-{
-FILE *f = fopen ("conftest.out", "w");
- return ferror (f) || fclose (f) != 0;
-
- ;
- return 0;
-}
+{ echo "$as_me:$LINENO: checking for suffix of object files" >&5
+echo $ECHO_N "checking for suffix of object files... $ECHO_C" >&6; }
+if test "${ac_cv_objext+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
_ACEOF
-ac_clean_files="$ac_clean_files conftest.out"
-# Check that the compiler produces executables we can run. If not, either
-# the compiler is broken, or we cross compile.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5
-$as_echo_n "checking whether we are cross compiling... " >&6; }
-if test "$cross_compiling" != yes; then
- { { ac_try="$ac_link"
-case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_link") 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }
- if { ac_try='./conftest$ac_cv_exeext'
- { { case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_try") 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; }; then
- cross_compiling=no
- else
- if test "$cross_compiling" = maybe; then
- cross_compiling=yes
- else
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "cannot run C compiled programs.
-If you meant to cross compile, use \`--host'.
-See \`config.log' for more details" "$LINENO" 5; }
- fi
- fi
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5
-$as_echo "$cross_compiling" >&6; }
-
-rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out
-ac_clean_files=$ac_clean_files_save
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5
-$as_echo_n "checking for suffix of object files... " >&6; }
-if ${ac_cv_objext+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -3152,46 +2375,51 @@
}
_ACEOF
rm -f conftest.o conftest.obj
-if { { ac_try="$ac_compile"
+if { (ac_try="$ac_compile"
case "(($ac_try" in
*\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
*) ac_try_echo=$ac_try;;
esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
(eval "$ac_compile") 2>&5
ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; then :
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; then
for ac_file in conftest.o conftest.obj conftest.*; do
test -f "$ac_file" || continue;
case $ac_file in
- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;;
+ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf ) ;;
*) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'`
break;;
esac
done
else
- $as_echo "$as_me: failed program was:" >&5
+ echo "$as_me: failed program was:" >&5
sed 's/^/| /' conftest.$ac_ext >&5
-{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "cannot compute suffix of object files: cannot compile
-See \`config.log' for more details" "$LINENO" 5; }
+{ { echo "$as_me:$LINENO: error: cannot compute suffix of object files: cannot compile
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute suffix of object files: cannot compile
+See \`config.log' for more details." >&2;}
+ { (exit 1); exit 1; }; }
fi
+
rm -f conftest.$ac_cv_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5
-$as_echo "$ac_cv_objext" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_objext" >&5
+echo "${ECHO_T}$ac_cv_objext" >&6; }
OBJEXT=$ac_cv_objext
ac_objext=$OBJEXT
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5
-$as_echo_n "checking whether we are using the GNU C compiler... " >&6; }
-if ${ac_cv_c_compiler_gnu+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether we are using the GNU C compiler" >&5
+echo $ECHO_N "checking whether we are using the GNU C compiler... $ECHO_C" >&6; }
+if test "${ac_cv_c_compiler_gnu+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -3205,34 +2433,54 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_compiler_gnu=yes
else
- ac_compiler_gnu=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_compiler_gnu=no
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
ac_cv_c_compiler_gnu=$ac_compiler_gnu
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
-$as_echo "$ac_cv_c_compiler_gnu" >&6; }
-if test $ac_compiler_gnu = yes; then
- GCC=yes
-else
- GCC=
-fi
+{ echo "$as_me:$LINENO: result: $ac_cv_c_compiler_gnu" >&5
+echo "${ECHO_T}$ac_cv_c_compiler_gnu" >&6; }
+GCC=`test $ac_compiler_gnu = yes && echo yes`
ac_test_CFLAGS=${CFLAGS+set}
ac_save_CFLAGS=$CFLAGS
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
-$as_echo_n "checking whether $CC accepts -g... " >&6; }
-if ${ac_cv_prog_cc_g+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether $CC accepts -g" >&5
+echo $ECHO_N "checking whether $CC accepts -g... $ECHO_C" >&6; }
+if test "${ac_cv_prog_cc_g+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_save_c_werror_flag=$ac_c_werror_flag
ac_c_werror_flag=yes
ac_cv_prog_cc_g=no
CFLAGS="-g"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -3243,11 +2491,34 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_prog_cc_g=yes
else
- CFLAGS=""
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ CFLAGS=""
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -3258,12 +2529,35 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ :
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-else
- ac_c_werror_flag=$ac_save_c_werror_flag
+ ac_c_werror_flag=$ac_save_c_werror_flag
CFLAGS="-g"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -3274,18 +2568,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_prog_cc_g=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
ac_c_werror_flag=$ac_save_c_werror_flag
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
-$as_echo "$ac_cv_prog_cc_g" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_prog_cc_g" >&5
+echo "${ECHO_T}$ac_cv_prog_cc_g" >&6; }
if test "$ac_test_CFLAGS" = set; then
CFLAGS=$ac_save_CFLAGS
elif test $ac_cv_prog_cc_g = yes; then
@@ -3301,14 +2619,18 @@
CFLAGS=
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
-$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
-if ${ac_cv_prog_cc_c89+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $CC option to accept ISO C89" >&5
+echo $ECHO_N "checking for $CC option to accept ISO C89... $ECHO_C" >&6; }
+if test "${ac_cv_prog_cc_c89+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_cv_prog_cc_c89=no
ac_save_CC=$CC
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdarg.h>
#include <stdio.h>
@@ -3364,9 +2686,31 @@
-Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
do
CC="$ac_save_CC $ac_arg"
- if ac_fn_c_try_compile "$LINENO"; then :
+ rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_prog_cc_c89=$ac_arg
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext
test "x$ac_cv_prog_cc_c89" != "xno" && break
done
@@ -3377,19 +2721,17 @@
# AC_CACHE_VAL
case "x$ac_cv_prog_cc_c89" in
x)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
-$as_echo "none needed" >&6; } ;;
+ { echo "$as_me:$LINENO: result: none needed" >&5
+echo "${ECHO_T}none needed" >&6; } ;;
xno)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
-$as_echo "unsupported" >&6; } ;;
+ { echo "$as_me:$LINENO: result: unsupported" >&5
+echo "${ECHO_T}unsupported" >&6; } ;;
*)
CC="$CC $ac_cv_prog_cc_c89"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
-$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
+ { echo "$as_me:$LINENO: result: $ac_cv_prog_cc_c89" >&5
+echo "${ECHO_T}$ac_cv_prog_cc_c89" >&6; } ;;
esac
-if test "x$ac_cv_prog_cc_c89" != xno; then :
-fi
ac_ext=c
ac_cpp='$CPP $CPPFLAGS'
@@ -3414,7 +2756,9 @@
fi
done
if test -z "$ac_aux_dir"; then
- as_fn_error $? "cannot find install-sh, install.sh, or shtool in \"$srcdir\" \"$srcdir/..\" \"$srcdir/../..\"" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: cannot find install-sh or install.sh in \"$srcdir\" \"$srcdir/..\" \"$srcdir/../..\"" >&5
+echo "$as_me: error: cannot find install-sh or install.sh in \"$srcdir\" \"$srcdir/..\" \"$srcdir/../..\"" >&2;}
+ { (exit 1); exit 1; }; }
fi
# These three variables are undocumented and unsupported,
@@ -3428,27 +2772,35 @@
# Make sure we can run config.sub.
$SHELL "$ac_aux_dir/config.sub" sun4 >/dev/null 2>&1 ||
- as_fn_error $? "cannot run $SHELL $ac_aux_dir/config.sub" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: cannot run $SHELL $ac_aux_dir/config.sub" >&5
+echo "$as_me: error: cannot run $SHELL $ac_aux_dir/config.sub" >&2;}
+ { (exit 1); exit 1; }; }
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking build system type" >&5
-$as_echo_n "checking build system type... " >&6; }
-if ${ac_cv_build+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking build system type" >&5
+echo $ECHO_N "checking build system type... $ECHO_C" >&6; }
+if test "${ac_cv_build+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_build_alias=$build_alias
test "x$ac_build_alias" = x &&
ac_build_alias=`$SHELL "$ac_aux_dir/config.guess"`
test "x$ac_build_alias" = x &&
- as_fn_error $? "cannot guess build type; you must specify one" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: cannot guess build type; you must specify one" >&5
+echo "$as_me: error: cannot guess build type; you must specify one" >&2;}
+ { (exit 1); exit 1; }; }
ac_cv_build=`$SHELL "$ac_aux_dir/config.sub" $ac_build_alias` ||
- as_fn_error $? "$SHELL $ac_aux_dir/config.sub $ac_build_alias failed" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: $SHELL $ac_aux_dir/config.sub $ac_build_alias failed" >&5
+echo "$as_me: error: $SHELL $ac_aux_dir/config.sub $ac_build_alias failed" >&2;}
+ { (exit 1); exit 1; }; }
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5
-$as_echo "$ac_cv_build" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_build" >&5
+echo "${ECHO_T}$ac_cv_build" >&6; }
case $ac_cv_build in
*-*-*) ;;
-*) as_fn_error $? "invalid value of canonical build" "$LINENO" 5;;
+*) { { echo "$as_me:$LINENO: error: invalid value of canonical build" >&5
+echo "$as_me: error: invalid value of canonical build" >&2;}
+ { (exit 1); exit 1; }; };;
esac
build=$ac_cv_build
ac_save_IFS=$IFS; IFS='-'
@@ -3464,24 +2816,28 @@
case $build_os in *\ *) build_os=`echo "$build_os" | sed 's/ /-/g'`;; esac
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking host system type" >&5
-$as_echo_n "checking host system type... " >&6; }
-if ${ac_cv_host+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking host system type" >&5
+echo $ECHO_N "checking host system type... $ECHO_C" >&6; }
+if test "${ac_cv_host+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test "x$host_alias" = x; then
ac_cv_host=$ac_cv_build
else
ac_cv_host=`$SHELL "$ac_aux_dir/config.sub" $host_alias` ||
- as_fn_error $? "$SHELL $ac_aux_dir/config.sub $host_alias failed" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: $SHELL $ac_aux_dir/config.sub $host_alias failed" >&5
+echo "$as_me: error: $SHELL $ac_aux_dir/config.sub $host_alias failed" >&2;}
+ { (exit 1); exit 1; }; }
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5
-$as_echo "$ac_cv_host" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_host" >&5
+echo "${ECHO_T}$ac_cv_host" >&6; }
case $ac_cv_host in
*-*-*) ;;
-*) as_fn_error $? "invalid value of canonical host" "$LINENO" 5;;
+*) { { echo "$as_me:$LINENO: error: invalid value of canonical host" >&5
+echo "$as_me: error: invalid value of canonical host" >&2;}
+ { (exit 1); exit 1; }; };;
esac
host=$ac_cv_host
ac_save_IFS=$IFS; IFS='-'
@@ -3503,15 +2859,15 @@
ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
ac_compiler_gnu=$ac_cv_c_compiler_gnu
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
-$as_echo_n "checking how to run the C preprocessor... " >&6; }
+{ echo "$as_me:$LINENO: checking how to run the C preprocessor" >&5
+echo $ECHO_N "checking how to run the C preprocessor... $ECHO_C" >&6; }
# On Suns, sometimes $CPP names a directory.
if test -n "$CPP" && test -d "$CPP"; then
CPP=
fi
if test -z "$CPP"; then
- if ${ac_cv_prog_CPP+:} false; then :
- $as_echo_n "(cached) " >&6
+ if test "${ac_cv_prog_CPP+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
# Double quotes because CPP needs to be expanded
for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp"
@@ -3525,7 +2881,11 @@
# <limits.h> exists even on freestanding compilers.
# On the NeXT, cc -E runs the code through the compiler's parser,
# not just through cpp. "Syntax error" is here to catch this case.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#ifdef __STDC__
# include <limits.h>
@@ -3534,34 +2894,76 @@
#endif
Syntax error
_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ :
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-else
# Broken: fails on valid input.
continue
fi
-rm -f conftest.err conftest.i conftest.$ac_ext
+rm -f conftest.err conftest.$ac_ext
+
# OK, works on sane cases. Now check whether nonexistent headers
# can be detected and how.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <ac_nonexistent.h>
_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
# Broken: success on invalid input.
continue
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
# Passes both tests.
ac_preproc_ok=:
break
fi
-rm -f conftest.err conftest.i conftest.$ac_ext
+rm -f conftest.err conftest.$ac_ext
+
done
# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
-rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok; then :
+rm -f conftest.err conftest.$ac_ext
+if $ac_preproc_ok; then
break
fi
@@ -3573,8 +2975,8 @@
else
ac_cv_prog_CPP=$CPP
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
-$as_echo "$CPP" >&6; }
+{ echo "$as_me:$LINENO: result: $CPP" >&5
+echo "${ECHO_T}$CPP" >&6; }
ac_preproc_ok=false
for ac_c_preproc_warn_flag in '' yes
do
@@ -3584,7 +2986,11 @@
# <limits.h> exists even on freestanding compilers.
# On the NeXT, cc -E runs the code through the compiler's parser,
# not just through cpp. "Syntax error" is here to catch this case.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#ifdef __STDC__
# include <limits.h>
@@ -3593,40 +2999,83 @@
#endif
Syntax error
_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ :
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-else
# Broken: fails on valid input.
continue
fi
-rm -f conftest.err conftest.i conftest.$ac_ext
+rm -f conftest.err conftest.$ac_ext
+
# OK, works on sane cases. Now check whether nonexistent headers
# can be detected and how.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <ac_nonexistent.h>
_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
# Broken: success on invalid input.
continue
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
# Passes both tests.
ac_preproc_ok=:
break
fi
-rm -f conftest.err conftest.i conftest.$ac_ext
+rm -f conftest.err conftest.$ac_ext
+
done
# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
-rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok; then :
-
+rm -f conftest.err conftest.$ac_ext
+if $ac_preproc_ok; then
+ :
else
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
-See \`config.log' for more details" "$LINENO" 5; }
+ { { echo "$as_me:$LINENO: error: C preprocessor \"$CPP\" fails sanity check
+See \`config.log' for more details." >&5
+echo "$as_me: error: C preprocessor \"$CPP\" fails sanity check
+See \`config.log' for more details." >&2;}
+ { (exit 1); exit 1; }; }
fi
ac_ext=c
@@ -3636,24 +3085,29 @@
ac_compiler_gnu=$ac_cv_c_compiler_gnu
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5
-$as_echo_n "checking for grep that handles long lines and -e... " >&6; }
-if ${ac_cv_path_GREP+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for grep that handles long lines and -e" >&5
+echo $ECHO_N "checking for grep that handles long lines and -e... $ECHO_C" >&6; }
+if test "${ac_cv_path_GREP+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- if test -z "$GREP"; then
+ # Extract the first word of "grep ggrep" to use in msg output
+if test -z "$GREP"; then
+set dummy grep ggrep; ac_prog_name=$2
+if test "${ac_cv_path_GREP+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_path_GREP_found=false
- # Loop through the user's path and test for each of PROGNAME-LIST
- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+# Loop through the user's path and test for each of PROGNAME-LIST
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_prog in grep ggrep; do
- for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext"
- as_fn_executable_p "$ac_path_GREP" || continue
-# Check for GNU ac_path_GREP and select it if it is found.
+ for ac_prog in grep ggrep; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
+ ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext"
+ { test -f "$ac_path_GREP" && $as_test_x "$ac_path_GREP"; } || continue
+ # Check for GNU ac_path_GREP and select it if it is found.
# Check for GNU $ac_path_GREP
case `"$ac_path_GREP" --version 2>&1` in
*GNU*)
@@ -3660,16 +3114,16 @@
ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;;
*)
ac_count=0
- $as_echo_n 0123456789 >"conftest.in"
+ echo $ECHO_N "0123456789$ECHO_C" >"conftest.in"
while :
do
cat "conftest.in" "conftest.in" >"conftest.tmp"
mv "conftest.tmp" "conftest.in"
cp "conftest.in" "conftest.nl"
- $as_echo 'GREP' >> "conftest.nl"
+ echo 'GREP' >> "conftest.nl"
"$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break
diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
- as_fn_arith $ac_count + 1 && ac_count=$as_val
+ ac_count=`expr $ac_count + 1`
if test $ac_count -gt ${ac_path_GREP_max-0}; then
# Best one so far, save it but keep looking for a better one
ac_cv_path_GREP="$ac_path_GREP"
@@ -3681,45 +3135,61 @@
rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
esac
- $ac_path_GREP_found && break 3
- done
+
+ $ac_path_GREP_found && break 3
done
- done
+done
+
+done
IFS=$as_save_IFS
- if test -z "$ac_cv_path_GREP"; then
- as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
- fi
+
+
+fi
+
+GREP="$ac_cv_path_GREP"
+if test -z "$GREP"; then
+ { { echo "$as_me:$LINENO: error: no acceptable $ac_prog_name could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" >&5
+echo "$as_me: error: no acceptable $ac_prog_name could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" >&2;}
+ { (exit 1); exit 1; }; }
+fi
+
else
ac_cv_path_GREP=$GREP
fi
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5
-$as_echo "$ac_cv_path_GREP" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_path_GREP" >&5
+echo "${ECHO_T}$ac_cv_path_GREP" >&6; }
GREP="$ac_cv_path_GREP"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
-$as_echo_n "checking for egrep... " >&6; }
-if ${ac_cv_path_EGREP+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for egrep" >&5
+echo $ECHO_N "checking for egrep... $ECHO_C" >&6; }
+if test "${ac_cv_path_EGREP+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
then ac_cv_path_EGREP="$GREP -E"
else
- if test -z "$EGREP"; then
+ # Extract the first word of "egrep" to use in msg output
+if test -z "$EGREP"; then
+set dummy egrep; ac_prog_name=$2
+if test "${ac_cv_path_EGREP+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_path_EGREP_found=false
- # Loop through the user's path and test for each of PROGNAME-LIST
- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+# Loop through the user's path and test for each of PROGNAME-LIST
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_prog in egrep; do
- for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
- as_fn_executable_p "$ac_path_EGREP" || continue
-# Check for GNU ac_path_EGREP and select it if it is found.
+ for ac_prog in egrep; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
+ ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
+ { test -f "$ac_path_EGREP" && $as_test_x "$ac_path_EGREP"; } || continue
+ # Check for GNU ac_path_EGREP and select it if it is found.
# Check for GNU $ac_path_EGREP
case `"$ac_path_EGREP" --version 2>&1` in
*GNU*)
@@ -3726,16 +3196,16 @@
ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
*)
ac_count=0
- $as_echo_n 0123456789 >"conftest.in"
+ echo $ECHO_N "0123456789$ECHO_C" >"conftest.in"
while :
do
cat "conftest.in" "conftest.in" >"conftest.tmp"
mv "conftest.tmp" "conftest.in"
cp "conftest.in" "conftest.nl"
- $as_echo 'EGREP' >> "conftest.nl"
+ echo 'EGREP' >> "conftest.nl"
"$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
- as_fn_arith $ac_count + 1 && ac_count=$as_val
+ ac_count=`expr $ac_count + 1`
if test $ac_count -gt ${ac_path_EGREP_max-0}; then
# Best one so far, save it but keep looking for a better one
ac_cv_path_EGREP="$ac_path_EGREP"
@@ -3747,31 +3217,46 @@
rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
esac
- $ac_path_EGREP_found && break 3
- done
+
+ $ac_path_EGREP_found && break 3
done
- done
+done
+
+done
IFS=$as_save_IFS
- if test -z "$ac_cv_path_EGREP"; then
- as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
- fi
+
+
+fi
+
+EGREP="$ac_cv_path_EGREP"
+if test -z "$EGREP"; then
+ { { echo "$as_me:$LINENO: error: no acceptable $ac_prog_name could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" >&5
+echo "$as_me: error: no acceptable $ac_prog_name could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" >&2;}
+ { (exit 1); exit 1; }; }
+fi
+
else
ac_cv_path_EGREP=$EGREP
fi
+
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
-$as_echo "$ac_cv_path_EGREP" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_path_EGREP" >&5
+echo "${ECHO_T}$ac_cv_path_EGREP" >&6; }
EGREP="$ac_cv_path_EGREP"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
-$as_echo_n "checking for ANSI C header files... " >&6; }
-if ${ac_cv_header_stdc+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for ANSI C header files" >&5
+echo $ECHO_N "checking for ANSI C header files... $ECHO_C" >&6; }
+if test "${ac_cv_header_stdc+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
#include <stdarg.h>
@@ -3786,23 +3271,47 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_header_stdc=yes
else
- ac_cv_header_stdc=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_header_stdc=no
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
if test $ac_cv_header_stdc = yes; then
# SunOS 4.x string.h does not declare mem*, contrary to ANSI.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <string.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "memchr" >/dev/null 2>&1; then :
-
+ $EGREP "memchr" >/dev/null 2>&1; then
+ :
else
ac_cv_header_stdc=no
fi
@@ -3812,14 +3321,18 @@
if test $ac_cv_header_stdc = yes; then
# ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "free" >/dev/null 2>&1; then :
-
+ $EGREP "free" >/dev/null 2>&1; then
+ :
else
ac_cv_header_stdc=no
fi
@@ -3829,10 +3342,14 @@
if test $ac_cv_header_stdc = yes; then
# /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
- if test "$cross_compiling" = yes; then :
+ if test "$cross_compiling" = yes; then
:
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <ctype.h>
#include <stdlib.h>
@@ -3859,35 +3376,113 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ :
+else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-else
- ac_cv_header_stdc=no
+( exit $ac_status )
+ac_cv_header_stdc=no
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
-$as_echo "$ac_cv_header_stdc" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_header_stdc" >&5
+echo "${ECHO_T}$ac_cv_header_stdc" >&6; }
if test $ac_cv_header_stdc = yes; then
-$as_echo "#define STDC_HEADERS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define STDC_HEADERS 1
+_ACEOF
fi
# On IRIX 5.3, sys/types and inttypes.h are conflicting.
+
+
+
+
+
+
+
+
+
for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \
inttypes.h stdint.h unistd.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
-"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ eval "$as_ac_Header=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -3895,182 +3490,167 @@
done
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether byte ordering is bigendian" >&5
-$as_echo_n "checking whether byte ordering is bigendian... " >&6; }
-if ${ac_cv_c_bigendian+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether byte ordering is bigendian" >&5
+echo $ECHO_N "checking whether byte ordering is bigendian... $ECHO_C" >&6; }
+if test "${ac_cv_c_bigendian+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- ac_cv_c_bigendian=unknown
- # See if we're dealing with a universal compiler.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#ifndef __APPLE_CC__
- not a universal capable compiler
- #endif
- typedef int dummy;
-
+ # See if sys/param.h defines the BYTE_ORDER macro.
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
-
- # Check for potential -arch flags. It is not universal unless
- # there are at least two -arch flags with different values.
- ac_arch=
- ac_prev=
- for ac_word in $CC $CFLAGS $CPPFLAGS $LDFLAGS; do
- if test -n "$ac_prev"; then
- case $ac_word in
- i?86 | x86_64 | ppc | ppc64)
- if test -z "$ac_arch" || test "$ac_arch" = "$ac_word"; then
- ac_arch=$ac_word
- else
- ac_cv_c_bigendian=universal
- break
- fi
- ;;
- esac
- ac_prev=
- elif test "x$ac_word" = "x-arch"; then
- ac_prev=arch
- fi
- done
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- if test $ac_cv_c_bigendian = unknown; then
- # See if sys/param.h defines the BYTE_ORDER macro.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
- #include <sys/param.h>
+#include <sys/param.h>
int
main ()
{
-#if ! (defined BYTE_ORDER && defined BIG_ENDIAN \
- && defined LITTLE_ENDIAN && BYTE_ORDER && BIG_ENDIAN \
- && LITTLE_ENDIAN)
- bogus endian macros
- #endif
+#if ! (defined BYTE_ORDER && defined BIG_ENDIAN && defined LITTLE_ENDIAN \
+ && BYTE_ORDER && BIG_ENDIAN && LITTLE_ENDIAN)
+ bogus endian macros
+#endif
;
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
# It does; now see whether it defined to BIG_ENDIAN or not.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
- #include <sys/param.h>
+#include <sys/param.h>
int
main ()
{
#if BYTE_ORDER != BIG_ENDIAN
- not big endian
- #endif
+ not big endian
+#endif
;
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_c_bigendian=yes
else
- ac_cv_c_bigendian=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_c_bigendian=no
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- fi
- if test $ac_cv_c_bigendian = unknown; then
- # See if <limits.h> defines _LITTLE_ENDIAN or _BIG_ENDIAN (e.g., Solaris).
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <limits.h>
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-int
-main ()
-{
-#if ! (defined _LITTLE_ENDIAN || defined _BIG_ENDIAN)
- bogus endian macros
- #endif
-
- ;
- return 0;
-}
+ # It does not; compile a test program.
+if test "$cross_compiling" = yes; then
+ # try to guess the endianness by grepping values into an object file
+ ac_cv_c_bigendian=unknown
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- # It does; now see whether it defined to _BIG_ENDIAN or not.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <limits.h>
-
+short int ascii_mm[] = { 0x4249, 0x4765, 0x6E44, 0x6961, 0x6E53, 0x7953, 0 };
+short int ascii_ii[] = { 0x694C, 0x5454, 0x656C, 0x6E45, 0x6944, 0x6E61, 0 };
+void _ascii () { char *s = (char *) ascii_mm; s = (char *) ascii_ii; }
+short int ebcdic_ii[] = { 0x89D3, 0xE3E3, 0x8593, 0x95C5, 0x89C4, 0x9581, 0 };
+short int ebcdic_mm[] = { 0xC2C9, 0xC785, 0x95C4, 0x8981, 0x95E2, 0xA8E2, 0 };
+void _ebcdic () { char *s = (char *) ebcdic_mm; s = (char *) ebcdic_ii; }
int
main ()
{
-#ifndef _BIG_ENDIAN
- not big endian
- #endif
-
+ _ascii (); _ebcdic ();
;
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ if grep BIGenDianSyS conftest.$ac_objext >/dev/null ; then
ac_cv_c_bigendian=yes
-else
- ac_cv_c_bigendian=no
fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+if grep LiTTleEnDian conftest.$ac_objext >/dev/null ; then
+ if test "$ac_cv_c_bigendian" = unknown; then
+ ac_cv_c_bigendian=no
+ else
+ # finding both strings is unlikely to happen, but who knows?
+ ac_cv_c_bigendian=unknown
+ fi
fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- fi
- if test $ac_cv_c_bigendian = unknown; then
- # Compile a test program.
- if test "$cross_compiling" = yes; then :
- # Try to guess by grepping values from an object file.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-short int ascii_mm[] =
- { 0x4249, 0x4765, 0x6E44, 0x6961, 0x6E53, 0x7953, 0 };
- short int ascii_ii[] =
- { 0x694C, 0x5454, 0x656C, 0x6E45, 0x6944, 0x6E61, 0 };
- int use_ascii (int i) {
- return ascii_mm[i] + ascii_ii[i];
- }
- short int ebcdic_ii[] =
- { 0x89D3, 0xE3E3, 0x8593, 0x95C5, 0x89C4, 0x9581, 0 };
- short int ebcdic_mm[] =
- { 0xC2C9, 0xC785, 0x95C4, 0x8981, 0x95E2, 0xA8E2, 0 };
- int use_ebcdic (int i) {
- return ebcdic_mm[i] + ebcdic_ii[i];
- }
- extern int foo;
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-int
-main ()
-{
-return use_ascii (foo) == use_ebcdic (foo);
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- if grep BIGenDianSyS conftest.$ac_objext >/dev/null; then
- ac_cv_c_bigendian=yes
- fi
- if grep LiTTleEnDian conftest.$ac_objext >/dev/null ; then
- if test "$ac_cv_c_bigendian" = unknown; then
- ac_cv_c_bigendian=no
- else
- # finding both strings is unlikely to happen, but who knows?
- ac_cv_c_bigendian=unknown
- fi
- fi
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
$ac_includes_default
int
@@ -4077,47 +3657,74 @@
main ()
{
- /* Are we little or big endian? From Harbison&Steele. */
- union
- {
- long int l;
- char c[sizeof (long int)];
- } u;
- u.l = 1;
- return u.c[sizeof (long int) - 1] == 1;
+ /* Are we little or big endian? From Harbison&Steele. */
+ union
+ {
+ long int l;
+ char c[sizeof (long int)];
+ } u;
+ u.l = 1;
+ return u.c[sizeof (long int) - 1] == 1;
;
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
ac_cv_c_bigendian=no
else
- ac_cv_c_bigendian=yes
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+ac_cv_c_bigendian=yes
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
- fi
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_bigendian" >&5
-$as_echo "$ac_cv_c_bigendian" >&6; }
- case $ac_cv_c_bigendian in #(
- yes)
- $as_echo "#define WORDS_BIGENDIAN 1" >>confdefs.h
-;; #(
- no)
- ;; #(
- universal)
-$as_echo "#define AC_APPLE_UNIVERSAL_BUILD 1" >>confdefs.h
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_c_bigendian" >&5
+echo "${ECHO_T}$ac_cv_c_bigendian" >&6; }
+case $ac_cv_c_bigendian in
+ yes)
- ;; #(
- *)
- as_fn_error $? "unknown endianness
- presetting ac_cv_c_bigendian=no (or yes) will help" "$LINENO" 5 ;;
- esac
+cat >>confdefs.h <<\_ACEOF
+#define WORDS_BIGENDIAN 1
+_ACEOF
+ ;;
+ no)
+ ;;
+ *)
+ { { echo "$as_me:$LINENO: error: unknown endianness
+presetting ac_cv_c_bigendian=no (or yes) will help" >&5
+echo "$as_me: error: unknown endianness
+presetting ac_cv_c_bigendian=no (or yes) will help" >&2;}
+ { (exit 1); exit 1; }; } ;;
+esac
# Checks for programs.
@@ -4125,10 +3732,10 @@
do
# Extract the first word of "$ac_prog", so it can be a program name with args.
set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_AWK+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_AWK+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$AWK"; then
ac_cv_prog_AWK="$AWK" # Let the user override the test.
@@ -4138,14 +3745,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_AWK="$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
fi
@@ -4152,11 +3759,11 @@
fi
AWK=$ac_cv_prog_AWK
if test -n "$AWK"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5
-$as_echo "$AWK" >&6; }
+ { echo "$as_me:$LINENO: result: $AWK" >&5
+echo "${ECHO_T}$AWK" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -4168,15 +3775,15 @@
ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
ac_compiler_gnu=$ac_cv_c_compiler_gnu
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
-$as_echo_n "checking how to run the C preprocessor... " >&6; }
+{ echo "$as_me:$LINENO: checking how to run the C preprocessor" >&5
+echo $ECHO_N "checking how to run the C preprocessor... $ECHO_C" >&6; }
# On Suns, sometimes $CPP names a directory.
if test -n "$CPP" && test -d "$CPP"; then
CPP=
fi
if test -z "$CPP"; then
- if ${ac_cv_prog_CPP+:} false; then :
- $as_echo_n "(cached) " >&6
+ if test "${ac_cv_prog_CPP+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
# Double quotes because CPP needs to be expanded
for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp"
@@ -4190,7 +3797,11 @@
# <limits.h> exists even on freestanding compilers.
# On the NeXT, cc -E runs the code through the compiler's parser,
# not just through cpp. "Syntax error" is here to catch this case.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#ifdef __STDC__
# include <limits.h>
@@ -4199,34 +3810,76 @@
#endif
Syntax error
_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ :
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-else
# Broken: fails on valid input.
continue
fi
-rm -f conftest.err conftest.i conftest.$ac_ext
+rm -f conftest.err conftest.$ac_ext
+
# OK, works on sane cases. Now check whether nonexistent headers
# can be detected and how.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <ac_nonexistent.h>
_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
# Broken: success on invalid input.
continue
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
# Passes both tests.
ac_preproc_ok=:
break
fi
-rm -f conftest.err conftest.i conftest.$ac_ext
+rm -f conftest.err conftest.$ac_ext
+
done
# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
-rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok; then :
+rm -f conftest.err conftest.$ac_ext
+if $ac_preproc_ok; then
break
fi
@@ -4238,8 +3891,8 @@
else
ac_cv_prog_CPP=$CPP
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
-$as_echo "$CPP" >&6; }
+{ echo "$as_me:$LINENO: result: $CPP" >&5
+echo "${ECHO_T}$CPP" >&6; }
ac_preproc_ok=false
for ac_c_preproc_warn_flag in '' yes
do
@@ -4249,7 +3902,11 @@
# <limits.h> exists even on freestanding compilers.
# On the NeXT, cc -E runs the code through the compiler's parser,
# not just through cpp. "Syntax error" is here to catch this case.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#ifdef __STDC__
# include <limits.h>
@@ -4258,40 +3915,83 @@
#endif
Syntax error
_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ :
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-else
# Broken: fails on valid input.
continue
fi
-rm -f conftest.err conftest.i conftest.$ac_ext
+rm -f conftest.err conftest.$ac_ext
+
# OK, works on sane cases. Now check whether nonexistent headers
# can be detected and how.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <ac_nonexistent.h>
_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
# Broken: success on invalid input.
continue
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
# Passes both tests.
ac_preproc_ok=:
break
fi
-rm -f conftest.err conftest.i conftest.$ac_ext
+rm -f conftest.err conftest.$ac_ext
+
done
# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
-rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok; then :
-
+rm -f conftest.err conftest.$ac_ext
+if $ac_preproc_ok; then
+ :
else
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
-See \`config.log' for more details" "$LINENO" 5; }
+ { { echo "$as_me:$LINENO: error: C preprocessor \"$CPP\" fails sanity check
+See \`config.log' for more details." >&5
+echo "$as_me: error: C preprocessor \"$CPP\" fails sanity check
+See \`config.log' for more details." >&2;}
+ { (exit 1); exit 1; }; }
fi
ac_ext=c
@@ -4303,10 +4003,10 @@
if test -n "$ac_tool_prefix"; then
# Extract the first word of "${ac_tool_prefix}ranlib", so it can be a program name with args.
set dummy ${ac_tool_prefix}ranlib; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_RANLIB+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_RANLIB+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$RANLIB"; then
ac_cv_prog_RANLIB="$RANLIB" # Let the user override the test.
@@ -4316,14 +4016,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_RANLIB="${ac_tool_prefix}ranlib"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
fi
@@ -4330,11 +4030,11 @@
fi
RANLIB=$ac_cv_prog_RANLIB
if test -n "$RANLIB"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5
-$as_echo "$RANLIB" >&6; }
+ { echo "$as_me:$LINENO: result: $RANLIB" >&5
+echo "${ECHO_T}$RANLIB" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -4343,10 +4043,10 @@
ac_ct_RANLIB=$RANLIB
# Extract the first word of "ranlib", so it can be a program name with args.
set dummy ranlib; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_RANLIB+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_ac_ct_RANLIB+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$ac_ct_RANLIB"; then
ac_cv_prog_ac_ct_RANLIB="$ac_ct_RANLIB" # Let the user override the test.
@@ -4356,14 +4056,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_ac_ct_RANLIB="ranlib"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
fi
@@ -4370,11 +4070,11 @@
fi
ac_ct_RANLIB=$ac_cv_prog_ac_ct_RANLIB
if test -n "$ac_ct_RANLIB"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5
-$as_echo "$ac_ct_RANLIB" >&6; }
+ { echo "$as_me:$LINENO: result: $ac_ct_RANLIB" >&5
+echo "${ECHO_T}$ac_ct_RANLIB" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
if test "x$ac_ct_RANLIB" = x; then
@@ -4382,8 +4082,12 @@
else
case $cross_compiling:$ac_tool_warned in
yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&5
+echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&2;}
ac_tool_warned=yes ;;
esac
RANLIB=$ac_ct_RANLIB
@@ -4405,12 +4109,11 @@
# SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff"
# OS/2's system install, which has a completely different semantic
# ./install, which can be erroneously created by make from ./install.sh.
-# Reject install programs that cannot install multiple files.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a BSD-compatible install" >&5
-$as_echo_n "checking for a BSD-compatible install... " >&6; }
+{ echo "$as_me:$LINENO: checking for a BSD-compatible install" >&5
+echo $ECHO_N "checking for a BSD-compatible install... $ECHO_C" >&6; }
if test -z "$INSTALL"; then
-if ${ac_cv_path_install+:} false; then :
- $as_echo_n "(cached) " >&6
+if test "${ac_cv_path_install+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
for as_dir in $PATH
@@ -4417,11 +4120,11 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- # Account for people who put trailing slashes in PATH elements.
-case $as_dir/ in #((
- ./ | .// | /[cC]/* | \
+ # Account for people who put trailing slashes in PATH elements.
+case $as_dir/ in
+ ./ | .// | /cC/* | \
/etc/* | /usr/sbin/* | /usr/etc/* | /sbin/* | /usr/afsws/bin/* | \
- ?:[\\/]os2[\\/]install[\\/]* | ?:[\\/]OS2[\\/]INSTALL[\\/]* | \
+ ?:\\/os2\\/install\\/* | ?:\\/OS2\\/INSTALL\\/* | \
/usr/ucb/* ) ;;
*)
# OSF1 and SCO ODT 3.0 have their own names for install.
@@ -4439,18 +4142,8 @@
# program-specific install script used by HP pwplus--don't use.
:
else
- rm -rf conftest.one conftest.two conftest.dir
- echo one > conftest.one
- echo two > conftest.two
- mkdir conftest.dir
- if "$as_dir/$ac_prog$ac_exec_ext" -c conftest.one conftest.two "`pwd`/conftest.dir" &&
- test -s conftest.one && test -s conftest.two &&
- test -s conftest.dir/conftest.one &&
- test -s conftest.dir/conftest.two
- then
- ac_cv_path_install="$as_dir/$ac_prog$ac_exec_ext -c"
- break 3
- fi
+ ac_cv_path_install="$as_dir/$ac_prog$ac_exec_ext -c"
+ break 3
fi
fi
done
@@ -4457,11 +4150,9 @@
done
;;
esac
-
- done
+done
IFS=$as_save_IFS
-rm -rf conftest.one conftest.two conftest.dir
fi
if test "${ac_cv_path_install+set}" = set; then
@@ -4474,8 +4165,8 @@
INSTALL=$ac_install_sh
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $INSTALL" >&5
-$as_echo "$INSTALL" >&6; }
+{ echo "$as_me:$LINENO: result: $INSTALL" >&5
+echo "${ECHO_T}$INSTALL" >&6; }
# Use test -z because SunOS4 sh mishandles braces in ${var-val}.
# It thinks the first close brace ends the variable substitution.
@@ -4485,27 +4176,32 @@
test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644'
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
-$as_echo_n "checking for egrep... " >&6; }
-if ${ac_cv_path_EGREP+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for egrep" >&5
+echo $ECHO_N "checking for egrep... $ECHO_C" >&6; }
+if test "${ac_cv_path_EGREP+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
then ac_cv_path_EGREP="$GREP -E"
else
- if test -z "$EGREP"; then
+ # Extract the first word of "egrep" to use in msg output
+if test -z "$EGREP"; then
+set dummy egrep; ac_prog_name=$2
+if test "${ac_cv_path_EGREP+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_path_EGREP_found=false
- # Loop through the user's path and test for each of PROGNAME-LIST
- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+# Loop through the user's path and test for each of PROGNAME-LIST
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_prog in egrep; do
- for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
- as_fn_executable_p "$ac_path_EGREP" || continue
-# Check for GNU ac_path_EGREP and select it if it is found.
+ for ac_prog in egrep; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
+ ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
+ { test -f "$ac_path_EGREP" && $as_test_x "$ac_path_EGREP"; } || continue
+ # Check for GNU ac_path_EGREP and select it if it is found.
# Check for GNU $ac_path_EGREP
case `"$ac_path_EGREP" --version 2>&1` in
*GNU*)
@@ -4512,16 +4208,16 @@
ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
*)
ac_count=0
- $as_echo_n 0123456789 >"conftest.in"
+ echo $ECHO_N "0123456789$ECHO_C" >"conftest.in"
while :
do
cat "conftest.in" "conftest.in" >"conftest.tmp"
mv "conftest.tmp" "conftest.in"
cp "conftest.in" "conftest.nl"
- $as_echo 'EGREP' >> "conftest.nl"
+ echo 'EGREP' >> "conftest.nl"
"$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
- as_fn_arith $ac_count + 1 && ac_count=$as_val
+ ac_count=`expr $ac_count + 1`
if test $ac_count -gt ${ac_path_EGREP_max-0}; then
# Best one so far, save it but keep looking for a better one
ac_cv_path_EGREP="$ac_path_EGREP"
@@ -4533,71 +4229,146 @@
rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
esac
- $ac_path_EGREP_found && break 3
- done
+
+ $ac_path_EGREP_found && break 3
done
- done
+done
+
+done
IFS=$as_save_IFS
- if test -z "$ac_cv_path_EGREP"; then
- as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
- fi
+
+
+fi
+
+EGREP="$ac_cv_path_EGREP"
+if test -z "$EGREP"; then
+ { { echo "$as_me:$LINENO: error: no acceptable $ac_prog_name could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" >&5
+echo "$as_me: error: no acceptable $ac_prog_name could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" >&2;}
+ { (exit 1); exit 1; }; }
+fi
+
else
ac_cv_path_EGREP=$EGREP
fi
+
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
-$as_echo "$ac_cv_path_EGREP" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_path_EGREP" >&5
+echo "${ECHO_T}$ac_cv_path_EGREP" >&6; }
EGREP="$ac_cv_path_EGREP"
-# Extract the first word of "ar", so it can be a program name with args.
-set dummy ar; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_AR+:} false; then :
- $as_echo_n "(cached) " >&6
+if test -n "$ac_tool_prefix"; then
+ for ac_prog in ar
+ do
+ # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
+set dummy $ac_tool_prefix$ac_prog; ac_word=$2
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_AR+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- case $AR in
- [\\/]* | ?:[\\/]*)
- ac_cv_path_AR="$AR" # Let the user override the test with a path.
- ;;
- *)
- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+ if test -n "$AR"; then
+ ac_cv_prog_AR="$AR" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
for as_dir in $PATH
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
- ac_cv_path_AR="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ ac_cv_prog_AR="$ac_tool_prefix$ac_prog"
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
- ;;
-esac
fi
-AR=$ac_cv_path_AR
+fi
+AR=$ac_cv_prog_AR
if test -n "$AR"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
-$as_echo "$AR" >&6; }
+ { echo "$as_me:$LINENO: result: $AR" >&5
+echo "${ECHO_T}$AR" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
+ test -n "$AR" && break
+ done
+fi
+if test -z "$AR"; then
+ ac_ct_AR=$AR
+ for ac_prog in ar
+do
+ # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_ac_ct_AR+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ if test -n "$ac_ct_AR"; then
+ ac_cv_prog_ac_ct_AR="$ac_ct_AR" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+ for ac_exec_ext in '' $ac_executable_extensions; do
+ if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+ ac_cv_prog_ac_ct_AR="$ac_prog"
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+done
+done
+IFS=$as_save_IFS
+
+fi
+fi
+ac_ct_AR=$ac_cv_prog_ac_ct_AR
+if test -n "$ac_ct_AR"; then
+ { echo "$as_me:$LINENO: result: $ac_ct_AR" >&5
+echo "${ECHO_T}$ac_ct_AR" >&6; }
+else
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+fi
+
+
+ test -n "$ac_ct_AR" && break
+done
+
+ if test "x$ac_ct_AR" = x; then
+ AR=""
+ else
+ case $cross_compiling:$ac_tool_warned in
+yes:)
+{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&5
+echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&2;}
+ac_tool_warned=yes ;;
+esac
+ AR=$ac_ct_AR
+ fi
+fi
+
# Extract the first word of "cat", so it can be a program name with args.
set dummy cat; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_CAT+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_CAT+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $CAT in
[\\/]* | ?:[\\/]*)
@@ -4609,14 +4380,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_CAT="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4624,20 +4395,20 @@
fi
CAT=$ac_cv_path_CAT
if test -n "$CAT"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CAT" >&5
-$as_echo "$CAT" >&6; }
+ { echo "$as_me:$LINENO: result: $CAT" >&5
+echo "${ECHO_T}$CAT" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "kill", so it can be a program name with args.
set dummy kill; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_KILL+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_KILL+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $KILL in
[\\/]* | ?:[\\/]*)
@@ -4649,14 +4420,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_KILL="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4664,11 +4435,11 @@
fi
KILL=$ac_cv_path_KILL
if test -n "$KILL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $KILL" >&5
-$as_echo "$KILL" >&6; }
+ { echo "$as_me:$LINENO: result: $KILL" >&5
+echo "${ECHO_T}$KILL" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -4676,10 +4447,10 @@
do
# Extract the first word of "$ac_prog", so it can be a program name with args.
set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_PERL+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_PERL+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $PERL in
[\\/]* | ?:[\\/]*)
@@ -4691,14 +4462,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_PERL="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4706,11 +4477,11 @@
fi
PERL=$ac_cv_path_PERL
if test -n "$PERL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PERL" >&5
-$as_echo "$PERL" >&6; }
+ { echo "$as_me:$LINENO: result: $PERL" >&5
+echo "${ECHO_T}$PERL" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -4719,10 +4490,10 @@
# Extract the first word of "sed", so it can be a program name with args.
set dummy sed; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_SED+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_SED+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $SED in
[\\/]* | ?:[\\/]*)
@@ -4734,14 +4505,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_SED="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4749,11 +4520,11 @@
fi
SED=$ac_cv_path_SED
if test -n "$SED"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $SED" >&5
-$as_echo "$SED" >&6; }
+ { echo "$as_me:$LINENO: result: $SED" >&5
+echo "${ECHO_T}$SED" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -4760,10 +4531,10 @@
# Extract the first word of "ent", so it can be a program name with args.
set dummy ent; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_ENT+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_ENT+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $ENT in
[\\/]* | ?:[\\/]*)
@@ -4775,14 +4546,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_ENT="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4790,11 +4561,11 @@
fi
ENT=$ac_cv_path_ENT
if test -n "$ENT"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ENT" >&5
-$as_echo "$ENT" >&6; }
+ { echo "$as_me:$LINENO: result: $ENT" >&5
+echo "${ECHO_T}$ENT" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -4801,10 +4572,10 @@
# Extract the first word of "bash", so it can be a program name with args.
set dummy bash; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_TEST_MINUS_S_SH+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_TEST_MINUS_S_SH+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $TEST_MINUS_S_SH in
[\\/]* | ?:[\\/]*)
@@ -4816,14 +4587,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_TEST_MINUS_S_SH="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4831,20 +4602,20 @@
fi
TEST_MINUS_S_SH=$ac_cv_path_TEST_MINUS_S_SH
if test -n "$TEST_MINUS_S_SH"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $TEST_MINUS_S_SH" >&5
-$as_echo "$TEST_MINUS_S_SH" >&6; }
+ { echo "$as_me:$LINENO: result: $TEST_MINUS_S_SH" >&5
+echo "${ECHO_T}$TEST_MINUS_S_SH" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "ksh", so it can be a program name with args.
set dummy ksh; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_TEST_MINUS_S_SH+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_TEST_MINUS_S_SH+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $TEST_MINUS_S_SH in
[\\/]* | ?:[\\/]*)
@@ -4856,14 +4627,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_TEST_MINUS_S_SH="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4871,20 +4642,20 @@
fi
TEST_MINUS_S_SH=$ac_cv_path_TEST_MINUS_S_SH
if test -n "$TEST_MINUS_S_SH"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $TEST_MINUS_S_SH" >&5
-$as_echo "$TEST_MINUS_S_SH" >&6; }
+ { echo "$as_me:$LINENO: result: $TEST_MINUS_S_SH" >&5
+echo "${ECHO_T}$TEST_MINUS_S_SH" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "sh", so it can be a program name with args.
set dummy sh; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_TEST_MINUS_S_SH+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_TEST_MINUS_S_SH+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $TEST_MINUS_S_SH in
[\\/]* | ?:[\\/]*)
@@ -4896,14 +4667,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_TEST_MINUS_S_SH="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4911,20 +4682,20 @@
fi
TEST_MINUS_S_SH=$ac_cv_path_TEST_MINUS_S_SH
if test -n "$TEST_MINUS_S_SH"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $TEST_MINUS_S_SH" >&5
-$as_echo "$TEST_MINUS_S_SH" >&6; }
+ { echo "$as_me:$LINENO: result: $TEST_MINUS_S_SH" >&5
+echo "${ECHO_T}$TEST_MINUS_S_SH" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "sh", so it can be a program name with args.
set dummy sh; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_SH+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_SH+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $SH in
[\\/]* | ?:[\\/]*)
@@ -4936,14 +4707,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_SH="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4951,20 +4722,20 @@
fi
SH=$ac_cv_path_SH
if test -n "$SH"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $SH" >&5
-$as_echo "$SH" >&6; }
+ { echo "$as_me:$LINENO: result: $SH" >&5
+echo "${ECHO_T}$SH" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "groff", so it can be a program name with args.
set dummy groff; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_GROFF+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_GROFF+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $GROFF in
[\\/]* | ?:[\\/]*)
@@ -4976,14 +4747,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_GROFF="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -4991,20 +4762,20 @@
fi
GROFF=$ac_cv_path_GROFF
if test -n "$GROFF"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $GROFF" >&5
-$as_echo "$GROFF" >&6; }
+ { echo "$as_me:$LINENO: result: $GROFF" >&5
+echo "${ECHO_T}$GROFF" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "nroff", so it can be a program name with args.
set dummy nroff; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_NROFF+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_NROFF+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $NROFF in
[\\/]* | ?:[\\/]*)
@@ -5016,14 +4787,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_NROFF="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -5031,20 +4802,20 @@
fi
NROFF=$ac_cv_path_NROFF
if test -n "$NROFF"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $NROFF" >&5
-$as_echo "$NROFF" >&6; }
+ { echo "$as_me:$LINENO: result: $NROFF" >&5
+echo "${ECHO_T}$NROFF" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "mandoc", so it can be a program name with args.
set dummy mandoc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_MANDOC+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_MANDOC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $MANDOC in
[\\/]* | ?:[\\/]*)
@@ -5056,14 +4827,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_MANDOC="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -5071,11 +4842,11 @@
fi
MANDOC=$ac_cv_path_MANDOC
if test -n "$MANDOC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MANDOC" >&5
-$as_echo "$MANDOC" >&6; }
+ { echo "$as_me:$LINENO: result: $MANDOC" >&5
+echo "${ECHO_T}$MANDOC" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -5089,8 +4860,8 @@
elif test "x$GROFF" != "x" ; then
MANFMT="$GROFF -mandoc -Tascii"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: no manpage formatted found" >&5
-$as_echo "$as_me: WARNING: no manpage formatted found" >&2;}
+ { echo "$as_me:$LINENO: WARNING: no manpage formatted found" >&5
+echo "$as_me: WARNING: no manpage formatted found" >&2;}
MANFMT="false"
fi
@@ -5097,10 +4868,10 @@
# Extract the first word of "groupadd", so it can be a program name with args.
set dummy groupadd; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_PATH_GROUPADD_PROG+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_PATH_GROUPADD_PROG+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $PATH_GROUPADD_PROG in
[\\/]* | ?:[\\/]*)
@@ -5112,14 +4883,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_PATH_GROUPADD_PROG="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
test -z "$ac_cv_path_PATH_GROUPADD_PROG" && ac_cv_path_PATH_GROUPADD_PROG="groupadd"
@@ -5128,20 +4899,20 @@
fi
PATH_GROUPADD_PROG=$ac_cv_path_PATH_GROUPADD_PROG
if test -n "$PATH_GROUPADD_PROG"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PATH_GROUPADD_PROG" >&5
-$as_echo "$PATH_GROUPADD_PROG" >&6; }
+ { echo "$as_me:$LINENO: result: $PATH_GROUPADD_PROG" >&5
+echo "${ECHO_T}$PATH_GROUPADD_PROG" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "useradd", so it can be a program name with args.
set dummy useradd; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_PATH_USERADD_PROG+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_PATH_USERADD_PROG+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $PATH_USERADD_PROG in
[\\/]* | ?:[\\/]*)
@@ -5153,14 +4924,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_PATH_USERADD_PROG="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
test -z "$ac_cv_path_PATH_USERADD_PROG" && ac_cv_path_PATH_USERADD_PROG="useradd"
@@ -5169,20 +4940,20 @@
fi
PATH_USERADD_PROG=$ac_cv_path_PATH_USERADD_PROG
if test -n "$PATH_USERADD_PROG"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PATH_USERADD_PROG" >&5
-$as_echo "$PATH_USERADD_PROG" >&6; }
+ { echo "$as_me:$LINENO: result: $PATH_USERADD_PROG" >&5
+echo "${ECHO_T}$PATH_USERADD_PROG" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Extract the first word of "pkgmk", so it can be a program name with args.
set dummy pkgmk; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_MAKE_PACKAGE_SUPPORTED+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_prog_MAKE_PACKAGE_SUPPORTED+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
if test -n "$MAKE_PACKAGE_SUPPORTED"; then
ac_cv_prog_MAKE_PACKAGE_SUPPORTED="$MAKE_PACKAGE_SUPPORTED" # Let the user override the test.
@@ -5192,14 +4963,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_prog_MAKE_PACKAGE_SUPPORTED="yes"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
test -z "$ac_cv_prog_MAKE_PACKAGE_SUPPORTED" && ac_cv_prog_MAKE_PACKAGE_SUPPORTED="no"
@@ -5207,11 +4978,11 @@
fi
MAKE_PACKAGE_SUPPORTED=$ac_cv_prog_MAKE_PACKAGE_SUPPORTED
if test -n "$MAKE_PACKAGE_SUPPORTED"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAKE_PACKAGE_SUPPORTED" >&5
-$as_echo "$MAKE_PACKAGE_SUPPORTED" >&6; }
+ { echo "$as_me:$LINENO: result: $MAKE_PACKAGE_SUPPORTED" >&5
+echo "${ECHO_T}$MAKE_PACKAGE_SUPPORTED" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -5225,16 +4996,16 @@
# System features
# Check whether --enable-largefile was given.
-if test "${enable_largefile+set}" = set; then :
+if test "${enable_largefile+set}" = set; then
enableval=$enable_largefile;
fi
if test "$enable_largefile" != no; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for special C compiler options needed for large files" >&5
-$as_echo_n "checking for special C compiler options needed for large files... " >&6; }
-if ${ac_cv_sys_largefile_CC+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for special C compiler options needed for large files" >&5
+echo $ECHO_N "checking for special C compiler options needed for large files... $ECHO_C" >&6; }
+if test "${ac_cv_sys_largefile_CC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_cv_sys_largefile_CC=no
if test "$GCC" != yes; then
@@ -5242,7 +5013,11 @@
while :; do
# IRIX 6.2 and later do not support large files by default,
# so use the C compiler's -n32 option if that helps.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
/* Check that off_t can represent 2**63 - 1 correctly.
@@ -5261,14 +5036,58 @@
return 0;
}
_ACEOF
- if ac_fn_c_try_compile "$LINENO"; then :
+ rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext
CC="$CC -n32"
- if ac_fn_c_try_compile "$LINENO"; then :
+ rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_sys_largefile_CC=' -n32'; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext
break
done
@@ -5276,19 +5095,23 @@
rm -f conftest.$ac_ext
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_CC" >&5
-$as_echo "$ac_cv_sys_largefile_CC" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_sys_largefile_CC" >&5
+echo "${ECHO_T}$ac_cv_sys_largefile_CC" >&6; }
if test "$ac_cv_sys_largefile_CC" != no; then
CC=$CC$ac_cv_sys_largefile_CC
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _FILE_OFFSET_BITS value needed for large files" >&5
-$as_echo_n "checking for _FILE_OFFSET_BITS value needed for large files... " >&6; }
-if ${ac_cv_sys_file_offset_bits+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for _FILE_OFFSET_BITS value needed for large files" >&5
+echo $ECHO_N "checking for _FILE_OFFSET_BITS value needed for large files... $ECHO_C" >&6; }
+if test "${ac_cv_sys_file_offset_bits+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
while :; do
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
/* Check that off_t can represent 2**63 - 1 correctly.
@@ -5307,11 +5130,37 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_sys_file_offset_bits=no; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#define _FILE_OFFSET_BITS 64
#include <sys/types.h>
@@ -5331,16 +5180,38 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_sys_file_offset_bits=64; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
ac_cv_sys_file_offset_bits=unknown
break
done
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_file_offset_bits" >&5
-$as_echo "$ac_cv_sys_file_offset_bits" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_sys_file_offset_bits" >&5
+echo "${ECHO_T}$ac_cv_sys_file_offset_bits" >&6; }
case $ac_cv_sys_file_offset_bits in #(
no | unknown) ;;
*)
@@ -5349,15 +5220,19 @@
_ACEOF
;;
esac
-rm -rf conftest*
+rm -f conftest*
if test $ac_cv_sys_file_offset_bits = unknown; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGE_FILES value needed for large files" >&5
-$as_echo_n "checking for _LARGE_FILES value needed for large files... " >&6; }
-if ${ac_cv_sys_large_files+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for _LARGE_FILES value needed for large files" >&5
+echo $ECHO_N "checking for _LARGE_FILES value needed for large files... $ECHO_C" >&6; }
+if test "${ac_cv_sys_large_files+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
while :; do
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
/* Check that off_t can represent 2**63 - 1 correctly.
@@ -5376,11 +5251,37 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_sys_large_files=no; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#define _LARGE_FILES 1
#include <sys/types.h>
@@ -5400,16 +5301,38 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_sys_large_files=1; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
ac_cv_sys_large_files=unknown
break
done
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_large_files" >&5
-$as_echo "$ac_cv_sys_large_files" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_sys_large_files" >&5
+echo "${ECHO_T}$ac_cv_sys_large_files" >&6; }
case $ac_cv_sys_large_files in #(
no | unknown) ;;
*)
@@ -5418,7 +5341,7 @@
_ACEOF
;;
esac
-rm -rf conftest*
+rm -f conftest*
fi
@@ -5426,7 +5349,9 @@
if test -z "$AR" ; then
- as_fn_error $? "*** 'ar' missing, please install or fix your \$PATH ***" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: *** 'ar' missing, please install or fix your \$PATH ***" >&5
+echo "$as_me: error: *** 'ar' missing, please install or fix your \$PATH ***" >&2;}
+ { (exit 1); exit 1; }; }
fi
# Use LOGIN_PROGRAM from environment if possible
@@ -5440,10 +5365,10 @@
# Search for login
# Extract the first word of "login", so it can be a program name with args.
set dummy login; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_LOGIN_PROGRAM_FALLBACK+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_LOGIN_PROGRAM_FALLBACK+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $LOGIN_PROGRAM_FALLBACK in
[\\/]* | ?:[\\/]*)
@@ -5455,14 +5380,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_LOGIN_PROGRAM_FALLBACK="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -5470,11 +5395,11 @@
fi
LOGIN_PROGRAM_FALLBACK=$ac_cv_path_LOGIN_PROGRAM_FALLBACK
if test -n "$LOGIN_PROGRAM_FALLBACK"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LOGIN_PROGRAM_FALLBACK" >&5
-$as_echo "$LOGIN_PROGRAM_FALLBACK" >&6; }
+ { echo "$as_me:$LINENO: result: $LOGIN_PROGRAM_FALLBACK" >&5
+echo "${ECHO_T}$LOGIN_PROGRAM_FALLBACK" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -5488,10 +5413,10 @@
# Extract the first word of "passwd", so it can be a program name with args.
set dummy passwd; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_PATH_PASSWD_PROG+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_PATH_PASSWD_PROG+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $PATH_PASSWD_PROG in
[\\/]* | ?:[\\/]*)
@@ -5503,14 +5428,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_PATH_PASSWD_PROG="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -5518,11 +5443,11 @@
fi
PATH_PASSWD_PROG=$ac_cv_path_PATH_PASSWD_PROG
if test -n "$PATH_PASSWD_PROG"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PATH_PASSWD_PROG" >&5
-$as_echo "$PATH_PASSWD_PROG" >&6; }
+ { echo "$as_me:$LINENO: result: $PATH_PASSWD_PROG" >&5
+echo "${ECHO_T}$PATH_PASSWD_PROG" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -5539,14 +5464,18 @@
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for inline" >&5
-$as_echo_n "checking for inline... " >&6; }
-if ${ac_cv_c_inline+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for inline" >&5
+echo $ECHO_N "checking for inline... $ECHO_C" >&6; }
+if test "${ac_cv_c_inline+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_cv_c_inline=no
for ac_kw in inline __inline__ __inline; do
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#ifndef __cplusplus
typedef int foo_t;
@@ -5555,17 +5484,40 @@
#endif
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_c_inline=$ac_kw
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
test "$ac_cv_c_inline" != no && break
done
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_inline" >&5
-$as_echo "$ac_cv_c_inline" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_c_inline" >&5
+echo "${ECHO_T}$ac_cv_c_inline" >&6; }
+
case $ac_cv_c_inline in
inline | yes) ;;
*)
@@ -5582,48 +5534,319 @@
esac
-ac_fn_c_check_decl "$LINENO" "LLONG_MAX" "ac_cv_have_decl_LLONG_MAX" "#include <limits.h>
-"
-if test "x$ac_cv_have_decl_LLONG_MAX" = xyes; then :
+{ echo "$as_me:$LINENO: checking whether LLONG_MAX is declared" >&5
+echo $ECHO_N "checking whether LLONG_MAX is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_LLONG_MAX+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <limits.h>
+
+int
+main ()
+{
+#ifndef LLONG_MAX
+ (void) LLONG_MAX;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_LLONG_MAX=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_LLONG_MAX=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_LLONG_MAX" >&5
+echo "${ECHO_T}$ac_cv_have_decl_LLONG_MAX" >&6; }
+if test $ac_cv_have_decl_LLONG_MAX = yes; then
have_llong_max=1
fi
-ac_fn_c_check_decl "$LINENO" "SYSTR_POLICY_KILL" "ac_cv_have_decl_SYSTR_POLICY_KILL" "
+{ echo "$as_me:$LINENO: checking whether SYSTR_POLICY_KILL is declared" >&5
+echo $ECHO_N "checking whether SYSTR_POLICY_KILL is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_SYSTR_POLICY_KILL+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <sys/param.h>
#include <dev/systrace.h>
-"
-if test "x$ac_cv_have_decl_SYSTR_POLICY_KILL" = xyes; then :
+
+int
+main ()
+{
+#ifndef SYSTR_POLICY_KILL
+ (void) SYSTR_POLICY_KILL;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_SYSTR_POLICY_KILL=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_SYSTR_POLICY_KILL=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_SYSTR_POLICY_KILL" >&5
+echo "${ECHO_T}$ac_cv_have_decl_SYSTR_POLICY_KILL" >&6; }
+if test $ac_cv_have_decl_SYSTR_POLICY_KILL = yes; then
have_systr_policy_kill=1
fi
-ac_fn_c_check_decl "$LINENO" "RLIMIT_NPROC" "ac_cv_have_decl_RLIMIT_NPROC" "
+{ echo "$as_me:$LINENO: checking whether RLIMIT_NPROC is declared" >&5
+echo $ECHO_N "checking whether RLIMIT_NPROC is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_RLIMIT_NPROC+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <sys/resource.h>
-"
-if test "x$ac_cv_have_decl_RLIMIT_NPROC" = xyes; then :
-$as_echo "#define HAVE_RLIMIT_NPROC /**/" >>confdefs.h
+int
+main ()
+{
+#ifndef RLIMIT_NPROC
+ (void) RLIMIT_NPROC;
+#endif
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_RLIMIT_NPROC=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_RLIMIT_NPROC=no
fi
-ac_fn_c_check_decl "$LINENO" "PR_SET_NO_NEW_PRIVS" "ac_cv_have_decl_PR_SET_NO_NEW_PRIVS" "
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_RLIMIT_NPROC" >&5
+echo "${ECHO_T}$ac_cv_have_decl_RLIMIT_NPROC" >&6; }
+if test $ac_cv_have_decl_RLIMIT_NPROC = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_RLIMIT_NPROC
+_ACEOF
+
+fi
+
+{ echo "$as_me:$LINENO: checking whether PR_SET_NO_NEW_PRIVS is declared" >&5
+echo $ECHO_N "checking whether PR_SET_NO_NEW_PRIVS is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_PR_SET_NO_NEW_PRIVS+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <linux/prctl.h>
-"
-if test "x$ac_cv_have_decl_PR_SET_NO_NEW_PRIVS" = xyes; then :
+
+int
+main ()
+{
+#ifndef PR_SET_NO_NEW_PRIVS
+ (void) PR_SET_NO_NEW_PRIVS;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_PR_SET_NO_NEW_PRIVS=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_PR_SET_NO_NEW_PRIVS=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_PR_SET_NO_NEW_PRIVS" >&5
+echo "${ECHO_T}$ac_cv_have_decl_PR_SET_NO_NEW_PRIVS" >&6; }
+if test $ac_cv_have_decl_PR_SET_NO_NEW_PRIVS = yes; then
have_linux_no_new_privs=1
fi
+openssl=yes
+ssh1=no
+
+# Check whether --with-openssl was given.
+if test "${with_openssl+set}" = set; then
+ withval=$with_openssl; if test "x$withval" = "xno" ; then
+ openssl=no
+ ssh1=no
+ fi
+
+
+fi
+
+{ echo "$as_me:$LINENO: checking whether OpenSSL will be used for cryptography" >&5
+echo $ECHO_N "checking whether OpenSSL will be used for cryptography... $ECHO_C" >&6; }
+if test "x$openssl" = "xyes" ; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+
+cat >>confdefs.h <<_ACEOF
+#define WITH_OPENSSL 1
+_ACEOF
+
+else
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+fi
+
+
+# Check whether --with-ssh1 was given.
+if test "${with_ssh1+set}" = set; then
+ withval=$with_ssh1;
+ if test "x$withval" = "xyes" ; then
+ if test "x$openssl" = "xno" ; then
+ { { echo "$as_me:$LINENO: error: Cannot enable SSH protocol 1 with OpenSSL disabled" >&5
+echo "$as_me: error: Cannot enable SSH protocol 1 with OpenSSL disabled" >&2;}
+ { (exit 1); exit 1; }; }
+ fi
+ ssh1=yes
+ elif test "x$withval" = "xno" ; then
+ ssh1=no
+ else
+ { { echo "$as_me:$LINENO: error: unknown --with-ssh1 argument" >&5
+echo "$as_me: error: unknown --with-ssh1 argument" >&2;}
+ { (exit 1); exit 1; }; }
+ fi
+
+
+fi
+
+{ echo "$as_me:$LINENO: checking whether SSH protocol 1 support is enabled" >&5
+echo $ECHO_N "checking whether SSH protocol 1 support is enabled... $ECHO_C" >&6; }
+if test "x$ssh1" = "xyes" ; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+
+cat >>confdefs.h <<_ACEOF
+#define WITH_SSH1 1
+_ACEOF
+
+else
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+fi
+
use_stack_protector=1
use_toolchain_hardening=1
# Check whether --with-stackprotect was given.
-if test "${with_stackprotect+set}" = set; then :
+if test "${with_stackprotect+set}" = set; then
withval=$with_stackprotect;
if test "x$withval" = "xno"; then
use_stack_protector=0
@@ -5632,7 +5855,7 @@
# Check whether --with-hardening was given.
-if test "${with_hardening+set}" = set; then :
+if test "${with_hardening+set}" = set; then
withval=$with_hardening;
if test "x$withval" = "xno"; then
use_toolchain_hardening=0
@@ -5642,36 +5865,64 @@
# We use -Werror for the tests only so that we catch warnings like "this is
# on by default" for things like -fPIE.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports -Werror" >&5
-$as_echo_n "checking if $CC supports -Werror... " >&6; }
+{ echo "$as_me:$LINENO: checking if $CC supports -Werror" >&5
+echo $ECHO_N "checking if $CC supports -Werror... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -Werror"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int main(void) { return 0; }
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
WERROR="-Werror"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
WERROR=""
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
CFLAGS="$saved_CFLAGS"
if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Qunused-arguments" >&5
-$as_echo_n "checking if $CC supports compile flag -Qunused-arguments... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Qunused-arguments" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Qunused-arguments... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Qunused-arguments"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Qunused-arguments"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -5687,34 +5938,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wunknown-warning-option" >&5
-$as_echo_n "checking if $CC supports compile flag -Wunknown-warning-option... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wunknown-warning-option" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wunknown-warning-option... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wunknown-warning-option"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wunknown-warning-option"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -5730,34 +6005,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wall" >&5
-$as_echo_n "checking if $CC supports compile flag -Wall... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wall" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wall... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wall"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wall"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -5773,34 +6072,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wpointer-arith" >&5
-$as_echo_n "checking if $CC supports compile flag -Wpointer-arith... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wpointer-arith" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wpointer-arith... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wpointer-arith"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wpointer-arith"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -5816,34 +6139,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wuninitialized" >&5
-$as_echo_n "checking if $CC supports compile flag -Wuninitialized... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wuninitialized" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wuninitialized... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wuninitialized"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wuninitialized"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -5859,34 +6206,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wsign-compare" >&5
-$as_echo_n "checking if $CC supports compile flag -Wsign-compare... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wsign-compare" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wsign-compare... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wsign-compare"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wsign-compare"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -5902,34 +6273,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wformat-security" >&5
-$as_echo_n "checking if $CC supports compile flag -Wformat-security... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wformat-security" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wformat-security... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wformat-security"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wformat-security"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -5945,34 +6340,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wsizeof-pointer-memaccess" >&5
-$as_echo_n "checking if $CC supports compile flag -Wsizeof-pointer-memaccess... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wsizeof-pointer-memaccess" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wsizeof-pointer-memaccess... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wsizeof-pointer-memaccess"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wsizeof-pointer-memaccess"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -5988,34 +6407,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wpointer-sign" >&5
-$as_echo_n "checking if $CC supports compile flag -Wpointer-sign... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wpointer-sign" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wpointer-sign... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wpointer-sign"
_define_flag="-Wno-pointer-sign"
test "x$_define_flag" = "x" && _define_flag="-Wpointer-sign"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6031,34 +6474,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wunused-result" >&5
-$as_echo_n "checking if $CC supports compile flag -Wunused-result... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wunused-result" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wunused-result... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wunused-result"
_define_flag="-Wno-unused-result"
test "x$_define_flag" = "x" && _define_flag="-Wunused-result"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6074,34 +6541,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -fno-strict-aliasing" >&5
-$as_echo_n "checking if $CC supports compile flag -fno-strict-aliasing... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -fno-strict-aliasing" >&5
+echo $ECHO_N "checking if $CC supports compile flag -fno-strict-aliasing... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -fno-strict-aliasing"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-fno-strict-aliasing"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6117,34 +6608,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -D_FORTIFY_SOURCE=2" >&5
-$as_echo_n "checking if $CC supports compile flag -D_FORTIFY_SOURCE=2... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -D_FORTIFY_SOURCE=2" >&5
+echo $ECHO_N "checking if $CC supports compile flag -D_FORTIFY_SOURCE=2... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -D_FORTIFY_SOURCE=2"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-D_FORTIFY_SOURCE=2"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6160,35 +6675,59 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
if test "x$use_toolchain_hardening" = "x1"; then
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $LD supports link flag -Wl,-z,relro" >&5
-$as_echo_n "checking if $LD supports link flag -Wl,-z,relro... " >&6; }
+ { echo "$as_me:$LINENO: checking if $LD supports link flag -Wl,-z,relro" >&5
+echo $ECHO_N "checking if $LD supports link flag -Wl,-z,relro... $ECHO_C" >&6; }
saved_LDFLAGS="$LDFLAGS"
LDFLAGS="$LDFLAGS $WERROR -Wl,-z,relro"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wl,-z,relro"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6204,27 +6743,52 @@
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
LDFLAGS="$saved_LDFLAGS $_define_flag"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
LDFLAGS="$saved_LDFLAGS"
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $LD supports link flag -Wl,-z,now" >&5
-$as_echo_n "checking if $LD supports link flag -Wl,-z,now... " >&6; }
+ { echo "$as_me:$LINENO: checking if $LD supports link flag -Wl,-z,now" >&5
+echo $ECHO_N "checking if $LD supports link flag -Wl,-z,now... $ECHO_C" >&6; }
saved_LDFLAGS="$LDFLAGS"
LDFLAGS="$LDFLAGS $WERROR -Wl,-z,now"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wl,-z,now"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6240,27 +6804,52 @@
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
LDFLAGS="$saved_LDFLAGS $_define_flag"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
LDFLAGS="$saved_LDFLAGS"
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $LD supports link flag -Wl,-z,noexecstack" >&5
-$as_echo_n "checking if $LD supports link flag -Wl,-z,noexecstack... " >&6; }
+ { echo "$as_me:$LINENO: checking if $LD supports link flag -Wl,-z,noexecstack" >&5
+echo $ECHO_N "checking if $LD supports link flag -Wl,-z,noexecstack... $ECHO_C" >&6; }
saved_LDFLAGS="$LDFLAGS"
LDFLAGS="$LDFLAGS $WERROR -Wl,-z,noexecstack"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wl,-z,noexecstack"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6276,18 +6865,39 @@
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
LDFLAGS="$saved_LDFLAGS $_define_flag"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
LDFLAGS="$saved_LDFLAGS"
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
}
# NB. -ftrapv expects certain support functions to be present in
# the compiler library (libgcc or similar) to detect integer operations
@@ -6295,13 +6905,17 @@
# actually links. The test program compiled/linked includes a number
# of integer operations that should exercise this.
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -ftrapv and linking succeeds" >&5
-$as_echo_n "checking if $CC supports compile flag -ftrapv and linking succeeds... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -ftrapv and linking succeeds" >&5
+echo $ECHO_N "checking if $CC supports compile flag -ftrapv and linking succeeds... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -ftrapv"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-ftrapv"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6317,30 +6931,51 @@
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
}
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking gcc version" >&5
-$as_echo_n "checking gcc version... " >&6; }
+ { echo "$as_me:$LINENO: checking gcc version" >&5
+echo $ECHO_N "checking gcc version... $ECHO_C" >&6; }
GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
case $GCC_VER in
1.*) no_attrib_nonnull=1 ;;
@@ -6350,14 +6985,18 @@
2.*) no_attrib_nonnull=1 ;;
*) ;;
esac
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $GCC_VER" >&5
-$as_echo "$GCC_VER" >&6; }
+ { echo "$as_me:$LINENO: result: $GCC_VER" >&5
+echo "${ECHO_T}$GCC_VER" >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC accepts -fno-builtin-memset" >&5
-$as_echo_n "checking if $CC accepts -fno-builtin-memset... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC accepts -fno-builtin-memset" >&5
+echo $ECHO_N "checking if $CC accepts -fno-builtin-memset... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -fno-builtin-memset"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <string.h>
int
@@ -6368,18 +7007,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
# -fstack-protector-all doesn't always work for some GCC versions
# and/or platforms, so we test if we can. If it's not supported
# on a given platform gcc will emit a warning so we use -Werror.
@@ -6386,13 +7046,17 @@
if test "x$use_stack_protector" = "x1"; then
for t in -fstack-protector-strong -fstack-protector-all \
-fstack-protector; do
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports $t" >&5
-$as_echo_n "checking if $CC supports $t... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports $t" >&5
+echo $ECHO_N "checking if $CC supports $t... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
saved_LDFLAGS="$LDFLAGS"
CFLAGS="$CFLAGS $t -Werror"
LDFLAGS="$LDFLAGS $t -Werror"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
int
@@ -6406,20 +7070,41 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $t"
LDFLAGS="$saved_LDFLAGS $t"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $t works" >&5
-$as_echo_n "checking if $t works... " >&6; }
- if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: cannot test" >&5
-$as_echo "$as_me: WARNING: cross compiling: cannot test" >&2;}
+ { echo "$as_me:$LINENO: checking if $t works" >&5
+echo $ECHO_N "checking if $t works... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: cannot test" >&5
+echo "$as_me: WARNING: cross compiling: cannot test" >&2;}
break
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
int
@@ -6433,26 +7118,54 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
break
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
CFLAGS="$saved_CFLAGS"
LDFLAGS="$saved_LDFLAGS"
done
@@ -6463,10 +7176,61 @@
unset ac_cv_have_decl_LLONG_MAX
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS -std=gnu99"
- ac_fn_c_check_decl "$LINENO" "LLONG_MAX" "ac_cv_have_decl_LLONG_MAX" "#include <limits.h>
+ { echo "$as_me:$LINENO: checking whether LLONG_MAX is declared" >&5
+echo $ECHO_N "checking whether LLONG_MAX is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_LLONG_MAX+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <limits.h>
-"
-if test "x$ac_cv_have_decl_LLONG_MAX" = xyes; then :
+
+int
+main ()
+{
+#ifndef LLONG_MAX
+ (void) LLONG_MAX;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_LLONG_MAX=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_LLONG_MAX=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_LLONG_MAX" >&5
+echo "${ECHO_T}$ac_cv_have_decl_LLONG_MAX" >&6; }
+if test $ac_cv_have_decl_LLONG_MAX = yes; then
have_llong_max=1
else
CFLAGS="$saved_CFLAGS"
@@ -6475,9 +7239,13 @@
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if compiler allows __attribute__ on return types" >&5
-$as_echo_n "checking if compiler allows __attribute__ on return types... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking if compiler allows __attribute__ on return types" >&5
+echo $ECHO_N "checking if compiler allows __attribute__ on return types... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -6490,28 +7258,52 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define NO_ATTRIBUTE_ON_RETURN_TYPE 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define NO_ATTRIBUTE_ON_RETURN_TYPE 1
+_ACEOF
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
if test "x$no_attrib_nonnull" != "x1" ; then
-$as_echo "#define HAVE_ATTRIBUTE__NONNULL__ 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ATTRIBUTE__NONNULL__ 1
+_ACEOF
fi
# Check whether --with-rpath was given.
-if test "${with_rpath+set}" = set; then :
+if test "${with_rpath+set}" = set; then
withval=$with_rpath;
if test "x$withval" = "xno" ; then
need_dash_r=""
@@ -6527,7 +7319,7 @@
# Allow user to specify flags
# Check whether --with-cflags was given.
-if test "${with_cflags+set}" = set; then :
+if test "${with_cflags+set}" = set; then
withval=$with_cflags;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
@@ -6539,7 +7331,7 @@
# Check whether --with-cppflags was given.
-if test "${with_cppflags+set}" = set; then :
+if test "${with_cppflags+set}" = set; then
withval=$with_cppflags;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
@@ -6551,7 +7343,7 @@
# Check whether --with-ldflags was given.
-if test "${with_ldflags+set}" = set; then :
+if test "${with_ldflags+set}" = set; then
withval=$with_ldflags;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
@@ -6563,7 +7355,7 @@
# Check whether --with-libs was given.
-if test "${with_libs+set}" = set; then :
+if test "${with_libs+set}" = set; then
withval=$with_libs;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
@@ -6575,7 +7367,7 @@
# Check whether --with-Werror was given.
-if test "${with_Werror+set}" = set; then :
+if test "${with_Werror+set}" = set; then
withval=$with_Werror;
if test -n "$withval" && test "x$withval" != "xno"; then
werror_flags="-Werror"
@@ -6588,6 +7380,76 @@
fi
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
for ac_header in \
blf.h \
bstring.h \
@@ -6596,6 +7458,7 @@
dirent.h \
endian.h \
elf.h \
+ err.h \
features.h \
fcntl.h \
floatingpoint.h \
@@ -6604,6 +7467,7 @@
ia.h \
iaf.h \
inttypes.h \
+ langinfo.h \
limits.h \
locale.h \
login.h \
@@ -6656,13 +7520,145 @@
utmp.h \
utmpx.h \
vis.h \
+ wchar.h \
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -6671,17 +7667,62 @@
# lastlog.h requires sys/time.h to be included first on Solaris
+
for ac_header in lastlog.h
-do :
- ac_fn_c_check_header_compile "$LINENO" "lastlog.h" "ac_cv_header_lastlog_h" "
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#ifdef HAVE_SYS_TIME_H
# include <sys/time.h>
#endif
-"
-if test "x$ac_cv_header_lastlog_h" = xyes; then :
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ eval "$as_ac_Header=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_LASTLOG_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -6690,17 +7731,62 @@
# sys/ptms.h requires sys/stream.h to be included first on Solaris
+
for ac_header in sys/ptms.h
-do :
- ac_fn_c_check_header_compile "$LINENO" "sys/ptms.h" "ac_cv_header_sys_ptms_h" "
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#ifdef HAVE_SYS_STREAM_H
# include <sys/stream.h>
#endif
-"
-if test "x$ac_cv_header_sys_ptms_h" = xyes; then :
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ eval "$as_ac_Header=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_SYS_PTMS_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -6709,15 +7795,60 @@
# login_cap.h requires sys/types.h on NetBSD
+
for ac_header in login_cap.h
-do :
- ac_fn_c_check_header_compile "$LINENO" "login_cap.h" "ac_cv_header_login_cap_h" "
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
-"
-if test "x$ac_cv_header_login_cap_h" = xyes; then :
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ eval "$as_ac_Header=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_LOGIN_CAP_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -6726,15 +7857,60 @@
# older BSDs need sys/param.h before sys/mount.h
+
for ac_header in sys/mount.h
-do :
- ac_fn_c_check_header_compile "$LINENO" "sys/mount.h" "ac_cv_header_sys_mount_h" "
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/param.h>
-"
-if test "x$ac_cv_header_sys_mount_h" = xyes; then :
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ eval "$as_ac_Header=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_SYS_MOUNT_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -6743,16 +7919,61 @@
# Android requires sys/socket.h to be included before sys/un.h
+
for ac_header in sys/un.h
-do :
- ac_fn_c_check_header_compile "$LINENO" "sys/un.h" "ac_cv_header_sys_un_h" "
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <sys/socket.h>
-"
-if test "x$ac_cv_header_sys_un_h" = xyes; then :
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ eval "$as_ac_Header=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_SYS_UN_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -6764,7 +7985,12 @@
SIA_MSG="no"
SPC_MSG="no"
SP_MSG="no"
+SPP_MSG="no"
+# Support for Solaris/Illumos privileges (this test is used by both
+# the --with-solaris-privs option and --with-sandbox=solaris).
+SOLARIS_PRIVS="no"
+
# Check for some target-specific stuff
case "$host" in
*-*-aix*)
@@ -6773,9 +7999,13 @@
# particularly with older versions of vac or xlc.
# It also throws errors about null macro argments, but these are
# not fatal.
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if compiler allows macro redefinitions" >&5
-$as_echo_n "checking if compiler allows macro redefinitions... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking if compiler allows macro redefinitions" >&5
+echo $ECHO_N "checking if compiler allows macro redefinitions... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#define testmacro foo
@@ -6788,12 +8018,31 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
@@ -6801,10 +8050,11 @@
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to specify blibpath for linker ($LD)" >&5
-$as_echo_n "checking how to specify blibpath for linker ($LD)... " >&6; }
+ { echo "$as_me:$LINENO: checking how to specify blibpath for linker ($LD)" >&5
+echo $ECHO_N "checking how to specify blibpath for linker ($LD)... $ECHO_C" >&6; }
if (test -z "$blibpath"); then
blibpath="/usr/lib:/lib"
fi
@@ -6817,7 +8067,11 @@
for tryflags in $flags ;do
if (test -z "$blibflags"); then
LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -6828,36 +8082,147 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
blibflags=$tryflags
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
fi
done
if (test -z "$blibflags"); then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
- as_fn_error $? "*** must be able to specify blibpath on AIX - check config.log" "$LINENO" 5
+ { echo "$as_me:$LINENO: result: not found" >&5
+echo "${ECHO_T}not found" >&6; }
+ { { echo "$as_me:$LINENO: error: *** must be able to specify blibpath on AIX - check config.log" >&5
+echo "$as_me: error: *** must be able to specify blibpath on AIX - check config.log" >&2;}
+ { (exit 1); exit 1; }; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $blibflags" >&5
-$as_echo "$blibflags" >&6; }
+ { echo "$as_me:$LINENO: result: $blibflags" >&5
+echo "${ECHO_T}$blibflags" >&6; }
fi
LDFLAGS="$saved_LDFLAGS"
- ac_fn_c_check_func "$LINENO" "authenticate" "ac_cv_func_authenticate"
-if test "x$ac_cv_func_authenticate" = xyes; then :
+ { echo "$as_me:$LINENO: checking for authenticate" >&5
+echo $ECHO_N "checking for authenticate... $ECHO_C" >&6; }
+if test "${ac_cv_func_authenticate+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define authenticate to an innocuous variant, in case <limits.h> declares authenticate.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define authenticate innocuous_authenticate
-$as_echo "#define WITH_AIXAUTHENTICATE 1" >>confdefs.h
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char authenticate (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef authenticate
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char authenticate ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_authenticate || defined __stub___authenticate
+choke me
+#endif
+
+int
+main ()
+{
+return authenticate ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_func_authenticate=yes
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for authenticate in -ls" >&5
-$as_echo_n "checking for authenticate in -ls... " >&6; }
-if ${ac_cv_lib_s_authenticate+:} false; then :
- $as_echo_n "(cached) " >&6
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_func_authenticate=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_authenticate" >&5
+echo "${ECHO_T}$ac_cv_func_authenticate" >&6; }
+if test $ac_cv_func_authenticate = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define WITH_AIXAUTHENTICATE 1
+_ACEOF
+
else
+ { echo "$as_me:$LINENO: checking for authenticate in -ls" >&5
+echo $ECHO_N "checking for authenticate in -ls... $ECHO_C" >&6; }
+if test "${ac_cv_lib_s_authenticate+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_check_lib_save_LIBS=$LIBS
LIBS="-ls $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -6875,19 +8240,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_s_authenticate=yes
else
- ac_cv_lib_s_authenticate=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_s_authenticate=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_s_authenticate" >&5
-$as_echo "$ac_cv_lib_s_authenticate" >&6; }
-if test "x$ac_cv_lib_s_authenticate" = xyes; then :
- $as_echo "#define WITH_AIXAUTHENTICATE 1" >>confdefs.h
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_s_authenticate" >&5
+echo "${ECHO_T}$ac_cv_lib_s_authenticate" >&6; }
+if test $ac_cv_lib_s_authenticate = yes; then
+ cat >>confdefs.h <<\_ACEOF
+#define WITH_AIXAUTHENTICATE 1
+_ACEOF
LIBS="$LIBS -ls"
@@ -6896,78 +8284,410 @@
fi
- ac_fn_c_check_decl "$LINENO" "authenticate" "ac_cv_have_decl_authenticate" "#include <usersec.h>
-"
-if test "x$ac_cv_have_decl_authenticate" = xyes; then :
- ac_have_decl=1
+ { echo "$as_me:$LINENO: checking whether authenticate is declared" >&5
+echo $ECHO_N "checking whether authenticate is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_authenticate+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- ac_have_decl=0
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <usersec.h>
+
+int
+main ()
+{
+#ifndef authenticate
+ (void) authenticate;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_authenticate=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_authenticate=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_authenticate" >&5
+echo "${ECHO_T}$ac_cv_have_decl_authenticate" >&6; }
+if test $ac_cv_have_decl_authenticate = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_AUTHENTICATE $ac_have_decl
+#define HAVE_DECL_AUTHENTICATE 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "loginrestrictions" "ac_cv_have_decl_loginrestrictions" "#include <usersec.h>
-"
-if test "x$ac_cv_have_decl_loginrestrictions" = xyes; then :
- ac_have_decl=1
+
+
else
- ac_have_decl=0
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_AUTHENTICATE 0
+_ACEOF
+
+
fi
+{ echo "$as_me:$LINENO: checking whether loginrestrictions is declared" >&5
+echo $ECHO_N "checking whether loginrestrictions is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_loginrestrictions+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <usersec.h>
+int
+main ()
+{
+#ifndef loginrestrictions
+ (void) loginrestrictions;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_loginrestrictions=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_loginrestrictions=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_loginrestrictions" >&5
+echo "${ECHO_T}$ac_cv_have_decl_loginrestrictions" >&6; }
+if test $ac_cv_have_decl_loginrestrictions = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_LOGINRESTRICTIONS $ac_have_decl
+#define HAVE_DECL_LOGINRESTRICTIONS 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "loginsuccess" "ac_cv_have_decl_loginsuccess" "#include <usersec.h>
-"
-if test "x$ac_cv_have_decl_loginsuccess" = xyes; then :
- ac_have_decl=1
+
+
else
- ac_have_decl=0
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_LOGINRESTRICTIONS 0
+_ACEOF
+
+
fi
+{ echo "$as_me:$LINENO: checking whether loginsuccess is declared" >&5
+echo $ECHO_N "checking whether loginsuccess is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_loginsuccess+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <usersec.h>
+int
+main ()
+{
+#ifndef loginsuccess
+ (void) loginsuccess;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_loginsuccess=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_loginsuccess=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_loginsuccess" >&5
+echo "${ECHO_T}$ac_cv_have_decl_loginsuccess" >&6; }
+if test $ac_cv_have_decl_loginsuccess = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_LOGINSUCCESS $ac_have_decl
+#define HAVE_DECL_LOGINSUCCESS 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "passwdexpired" "ac_cv_have_decl_passwdexpired" "#include <usersec.h>
-"
-if test "x$ac_cv_have_decl_passwdexpired" = xyes; then :
- ac_have_decl=1
+
+
else
- ac_have_decl=0
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_LOGINSUCCESS 0
+_ACEOF
+
+
fi
+{ echo "$as_me:$LINENO: checking whether passwdexpired is declared" >&5
+echo $ECHO_N "checking whether passwdexpired is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_passwdexpired+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <usersec.h>
+int
+main ()
+{
+#ifndef passwdexpired
+ (void) passwdexpired;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_passwdexpired=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_passwdexpired=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_passwdexpired" >&5
+echo "${ECHO_T}$ac_cv_have_decl_passwdexpired" >&6; }
+if test $ac_cv_have_decl_passwdexpired = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_PASSWDEXPIRED $ac_have_decl
+#define HAVE_DECL_PASSWDEXPIRED 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "setauthdb" "ac_cv_have_decl_setauthdb" "#include <usersec.h>
-"
-if test "x$ac_cv_have_decl_setauthdb" = xyes; then :
- ac_have_decl=1
+
+
else
- ac_have_decl=0
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_PASSWDEXPIRED 0
+_ACEOF
+
+
fi
+{ echo "$as_me:$LINENO: checking whether setauthdb is declared" >&5
+echo $ECHO_N "checking whether setauthdb is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_setauthdb+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <usersec.h>
+int
+main ()
+{
+#ifndef setauthdb
+ (void) setauthdb;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_setauthdb=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_setauthdb=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_setauthdb" >&5
+echo "${ECHO_T}$ac_cv_have_decl_setauthdb" >&6; }
+if test $ac_cv_have_decl_setauthdb = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_SETAUTHDB $ac_have_decl
+#define HAVE_DECL_SETAUTHDB 1
_ACEOF
- ac_fn_c_check_decl "$LINENO" "loginfailed" "ac_cv_have_decl_loginfailed" "#include <usersec.h>
-"
-if test "x$ac_cv_have_decl_loginfailed" = xyes; then :
- ac_have_decl=1
else
- ac_have_decl=0
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_SETAUTHDB 0
+_ACEOF
+
+
fi
+
+ { echo "$as_me:$LINENO: checking whether loginfailed is declared" >&5
+echo $ECHO_N "checking whether loginfailed is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_loginfailed+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <usersec.h>
+
+
+int
+main ()
+{
+#ifndef loginfailed
+ (void) loginfailed;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_loginfailed=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_loginfailed=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_loginfailed" >&5
+echo "${ECHO_T}$ac_cv_have_decl_loginfailed" >&6; }
+if test $ac_cv_have_decl_loginfailed = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_LOGINFAILED $ac_have_decl
+#define HAVE_DECL_LOGINFAILED 1
_ACEOF
-if test $ac_have_decl = 1; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if loginfailed takes 4 arguments" >&5
-$as_echo_n "checking if loginfailed takes 4 arguments... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+
+{ echo "$as_me:$LINENO: checking if loginfailed takes 4 arguments" >&5
+echo $ECHO_N "checking if loginfailed takes 4 arguments... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <usersec.h>
int
@@ -6978,80 +8698,269 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define AIX_LOGINFAILED_4ARG 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define AIX_LOGINFAILED_4ARG 1
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_LOGINFAILED 0
+_ACEOF
+
+
fi
- for ac_func in getgrset setauthdb
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+
+
+
+for ac_func in getgrset setauthdb
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
- ac_fn_c_check_decl "$LINENO" "F_CLOSEM" "ac_cv_have_decl_F_CLOSEM" " #include <limits.h>
+ { echo "$as_me:$LINENO: checking whether F_CLOSEM is declared" >&5
+echo $ECHO_N "checking whether F_CLOSEM is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_F_CLOSEM+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+ #include <limits.h>
#include <fcntl.h>
-"
-if test "x$ac_cv_have_decl_F_CLOSEM" = xyes; then :
-$as_echo "#define HAVE_FCNTL_CLOSEM 1" >>confdefs.h
+int
+main ()
+{
+#ifndef F_CLOSEM
+ (void) F_CLOSEM;
+#endif
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_F_CLOSEM=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_F_CLOSEM=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_F_CLOSEM" >&5
+echo "${ECHO_T}$ac_cv_have_decl_F_CLOSEM" >&6; }
+if test $ac_cv_have_decl_F_CLOSEM = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_FCNTL_CLOSEM 1
+_ACEOF
+
+fi
+
check_for_aix_broken_getaddrinfo=1
-$as_echo "#define BROKEN_REALPATH 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_REALPATH 1
+_ACEOF
-$as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
-$as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
-$as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
-$as_echo "#define DISABLE_LASTLOG 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_LASTLOG 1
+_ACEOF
-$as_echo "#define LOGIN_NEEDS_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LOGIN_NEEDS_UTMPX 1
+_ACEOF
-$as_echo "#define SPT_TYPE SPT_REUSEARGV" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SPT_TYPE SPT_REUSEARGV
+_ACEOF
-$as_echo "#define SSHPAM_CHAUTHTOK_NEEDS_RUID 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSHPAM_CHAUTHTOK_NEEDS_RUID 1
+_ACEOF
-$as_echo "#define PTY_ZEROREAD 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define PTY_ZEROREAD 1
+_ACEOF
-$as_echo "#define PLATFORM_SYS_DIR_UID 2" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define PLATFORM_SYS_DIR_UID 2
+_ACEOF
;;
*-*-android*)
-$as_echo "#define DISABLE_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_UTMP 1
+_ACEOF
-$as_echo "#define DISABLE_WTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_WTMP 1
+_ACEOF
;;
*-*-cygwin*)
@@ -7058,39 +8967,59 @@
check_for_libcrypt_later=1
LIBS="$LIBS /usr/lib/textreadmode.o"
-$as_echo "#define HAVE_CYGWIN 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_CYGWIN 1
+_ACEOF
-$as_echo "#define USE_PIPES 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
-$as_echo "#define DISABLE_SHADOW 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define NO_UID_RESTORATION_TEST 1
+_ACEOF
-$as_echo "#define NO_X11_UNIX_SOCKETS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_SHADOW 1
+_ACEOF
-$as_echo "#define NO_IPPORT_RESERVED_CONCEPT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define NO_X11_UNIX_SOCKETS 1
+_ACEOF
-$as_echo "#define DISABLE_FD_PASSING 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_FD_PASSING 1
+_ACEOF
-$as_echo "#define SSH_IOBUFSZ 65535" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_IOBUFSZ 65535
+_ACEOF
-$as_echo "#define FILESYSTEM_NO_BACKSLASH 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define FILESYSTEM_NO_BACKSLASH 1
+_ACEOF
# Cygwin defines optargs, optargs as declspec(dllimport) for historical
# reasons which cause compile warnings, so we disable those warnings.
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -Wno-attributes" >&5
-$as_echo_n "checking if $CC supports compile flag -Wno-attributes... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -Wno-attributes" >&5
+echo $ECHO_N "checking if $CC supports compile flag -Wno-attributes... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -Wno-attributes"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-Wno-attributes"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -7106,47 +9035,79 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
;;
*-*-dgux*)
-$as_echo "#define IP_TOS_IS_BROKEN 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define IP_TOS_IS_BROKEN 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
;;
*-*-darwin*)
use_pie=auto
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we have working getaddrinfo" >&5
-$as_echo_n "checking if we have working getaddrinfo... " >&6; }
- if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: assume it is working" >&5
-$as_echo "assume it is working" >&6; }
+ { echo "$as_me:$LINENO: checking if we have working getaddrinfo" >&5
+echo $ECHO_N "checking if we have working getaddrinfo... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: result: assume it is working" >&5
+echo "${ECHO_T}assume it is working" >&6; }
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <mach-o/dyld.h>
main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
@@ -7156,79 +9117,392 @@
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: working" >&5
-$as_echo "working" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: working" >&5
+echo "${ECHO_T}working" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: buggy" >&5
-$as_echo "buggy" >&6; }
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define BROKEN_GETADDRINFO 1" >>confdefs.h
+( exit $ac_status )
+{ echo "$as_me:$LINENO: result: buggy" >&5
+echo "${ECHO_T}buggy" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GETADDRINFO 1
+_ACEOF
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
-$as_echo "#define BROKEN_GLOB 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GLOB 1
+_ACEOF
+
cat >>confdefs.h <<_ACEOF
#define BIND_8_COMPAT 1
_ACEOF
-$as_echo "#define SSH_TUN_FREEBSD 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_FREEBSD 1
+_ACEOF
-$as_echo "#define SSH_TUN_COMPAT_AF 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_COMPAT_AF 1
+_ACEOF
-$as_echo "#define SSH_TUN_PREPEND_AF 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_PREPEND_AF 1
+_ACEOF
- ac_fn_c_check_decl "$LINENO" "AU_IPv4" "ac_cv_have_decl_AU_IPv4" "$ac_includes_default"
-if test "x$ac_cv_have_decl_AU_IPv4" = xyes; then :
+ { echo "$as_me:$LINENO: checking whether AU_IPv4 is declared" >&5
+echo $ECHO_N "checking whether AU_IPv4 is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_AU_IPv4+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+int
+main ()
+{
+#ifndef AU_IPv4
+ (void) AU_IPv4;
+#endif
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_AU_IPv4=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define AU_IPv4 0" >>confdefs.h
+ ac_cv_have_decl_AU_IPv4=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_AU_IPv4" >&5
+echo "${ECHO_T}$ac_cv_have_decl_AU_IPv4" >&6; }
+if test $ac_cv_have_decl_AU_IPv4 = yes; then
+ :
+else
+
+cat >>confdefs.h <<\_ACEOF
+#define AU_IPv4 0
+_ACEOF
+
#include <bsm/audit.h>
-$as_echo "#define LASTLOG_WRITE_PUTUTXLINE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LASTLOG_WRITE_PUTUTXLINE 1
+_ACEOF
fi
-$as_echo "#define SPT_TYPE SPT_REUSEARGV" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SPT_TYPE SPT_REUSEARGV
+_ACEOF
- for ac_func in sandbox_init
-do :
- ac_fn_c_check_func "$LINENO" "sandbox_init" "ac_cv_func_sandbox_init"
-if test "x$ac_cv_func_sandbox_init" = xyes; then :
+
+for ac_func in sandbox_init
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_SANDBOX_INIT 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
- for ac_header in sandbox.h
-do :
- ac_fn_c_check_header_mongrel "$LINENO" "sandbox.h" "ac_cv_header_sandbox_h" "$ac_includes_default"
-if test "x$ac_cv_header_sandbox_h" = xyes; then :
+
+for ac_header in sandbox.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_SANDBOX_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -7235,6 +9509,73 @@
done
+ { echo "$as_me:$LINENO: checking for sandbox_apply in -lsandbox" >&5
+echo $ECHO_N "checking for sandbox_apply in -lsandbox... $ECHO_C" >&6; }
+if test "${ac_cv_lib_sandbox_sandbox_apply+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ ac_check_lib_save_LIBS=$LIBS
+LIBS="-lsandbox $LIBS"
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char sandbox_apply ();
+int
+main ()
+{
+return sandbox_apply ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_lib_sandbox_sandbox_apply=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_sandbox_sandbox_apply=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_sandbox_sandbox_apply" >&5
+echo "${ECHO_T}$ac_cv_lib_sandbox_sandbox_apply" >&6; }
+if test $ac_cv_lib_sandbox_sandbox_apply = yes; then
+
+ SSHDLIBS="$SSHDLIBS -lsandbox"
+
+fi
+
;;
*-*-dragonfly*)
SSHDLIBS="$SSHDLIBS -lcrypt"
@@ -7242,14 +9583,19 @@
;;
*-*-haiku*)
LIBS="$LIBS -lbsd "
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for socket in -lnetwork" >&5
-$as_echo_n "checking for socket in -lnetwork... " >&6; }
-if ${ac_cv_lib_network_socket+:} false; then :
- $as_echo_n "(cached) " >&6
+
+{ echo "$as_me:$LINENO: checking for socket in -lnetwork" >&5
+echo $ECHO_N "checking for socket in -lnetwork... $ECHO_C" >&6; }
+if test "${ac_cv_lib_network_socket+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lnetwork $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -7267,18 +9613,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_network_socket=yes
else
- ac_cv_lib_network_socket=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_network_socket=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_network_socket" >&5
-$as_echo "$ac_cv_lib_network_socket" >&6; }
-if test "x$ac_cv_lib_network_socket" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_network_socket" >&5
+echo "${ECHO_T}$ac_cv_lib_network_socket" >&6; }
+if test $ac_cv_lib_network_socket = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBNETWORK 1
_ACEOF
@@ -7287,7 +9654,9 @@
fi
- $as_echo "#define HAVE_U_INT64_T 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_U_INT64_T 1
+_ACEOF
MANTYPE=man
;;
@@ -7295,31 +9664,48 @@
# first we define all of the options common to all HP-UX releases
CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
IPADDR_IN_DISPLAY=yes
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
-$as_echo "#define LOGIN_NO_ENDOPT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LOGIN_NO_ENDOPT 1
+_ACEOF
- $as_echo "#define LOGIN_NEEDS_UTMPX 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define LOGIN_NEEDS_UTMPX 1
+_ACEOF
-$as_echo "#define LOCKED_PASSWD_STRING \"*\"" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_STRING "*"
+_ACEOF
- $as_echo "#define SPT_TYPE SPT_PSTAT" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SPT_TYPE SPT_PSTAT
+_ACEOF
-$as_echo "#define PLATFORM_SYS_DIR_UID 2" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define PLATFORM_SYS_DIR_UID 2
+_ACEOF
maildir="/var/mail"
LIBS="$LIBS -lsec"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for t_error in -lxnet" >&5
-$as_echo_n "checking for t_error in -lxnet... " >&6; }
-if ${ac_cv_lib_xnet_t_error+:} false; then :
- $as_echo_n "(cached) " >&6
+
+{ echo "$as_me:$LINENO: checking for t_error in -lxnet" >&5
+echo $ECHO_N "checking for t_error in -lxnet... $ECHO_C" >&6; }
+if test "${ac_cv_lib_xnet_t_error+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lxnet $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -7337,18 +9723,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_xnet_t_error=yes
else
- ac_cv_lib_xnet_t_error=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_xnet_t_error=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_xnet_t_error" >&5
-$as_echo "$ac_cv_lib_xnet_t_error" >&6; }
-if test "x$ac_cv_lib_xnet_t_error" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_xnet_t_error" >&5
+echo "${ECHO_T}$ac_cv_lib_xnet_t_error" >&6; }
+if test $ac_cv_lib_xnet_t_error = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBXNET 1
_ACEOF
@@ -7356,7 +9763,9 @@
LIBS="-lxnet $LIBS"
else
- as_fn_error $? "*** -lxnet needed on HP-UX - check config.log ***" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: *** -lxnet needed on HP-UX - check config.log ***" >&5
+echo "$as_me: error: *** -lxnet needed on HP-UX - check config.log ***" >&2;}
+ { (exit 1); exit 1; }; }
fi
@@ -7369,13 +9778,19 @@
;;
*-*-hpux11*)
-$as_echo "#define PAM_SUN_CODEBASE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define PAM_SUN_CODEBASE 1
+_ACEOF
-$as_echo "#define DISABLE_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_UTMP 1
+_ACEOF
-$as_echo "#define USE_BTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_BTMP 1
+_ACEOF
check_for_hpux_broken_getaddrinfo=1
check_for_conflicting_getspnam=1
@@ -7386,7 +9801,9 @@
case "$host" in
*-*-hpux10.26)
-$as_echo "#define HAVE_SECUREWARE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SECUREWARE 1
+_ACEOF
disable_ptmx_check=yes
LIBS="$LIBS -lsecpw"
@@ -7396,67 +9813,191 @@
*-*-irix5*)
PATH="$PATH:/usr/etc"
-$as_echo "#define BROKEN_INET_NTOA 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_INET_NTOA 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
-$as_echo "#define WITH_ABBREV_NO_TTY 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define WITH_ABBREV_NO_TTY 1
+_ACEOF
- $as_echo "#define LOCKED_PASSWD_STRING \"*LK*\"" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_STRING "*LK*"
+_ACEOF
;;
*-*-irix6*)
PATH="$PATH:/usr/etc"
-$as_echo "#define WITH_IRIX_ARRAY 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define WITH_IRIX_ARRAY 1
+_ACEOF
-$as_echo "#define WITH_IRIX_PROJECT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define WITH_IRIX_PROJECT 1
+_ACEOF
-$as_echo "#define WITH_IRIX_AUDIT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define WITH_IRIX_AUDIT 1
+_ACEOF
- ac_fn_c_check_func "$LINENO" "jlimit_startjob" "ac_cv_func_jlimit_startjob"
-if test "x$ac_cv_func_jlimit_startjob" = xyes; then :
+ { echo "$as_me:$LINENO: checking for jlimit_startjob" >&5
+echo $ECHO_N "checking for jlimit_startjob... $ECHO_C" >&6; }
+if test "${ac_cv_func_jlimit_startjob+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define jlimit_startjob to an innocuous variant, in case <limits.h> declares jlimit_startjob.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define jlimit_startjob innocuous_jlimit_startjob
-$as_echo "#define WITH_IRIX_JOBS 1" >>confdefs.h
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char jlimit_startjob (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef jlimit_startjob
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char jlimit_startjob ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_jlimit_startjob || defined __stub___jlimit_startjob
+choke me
+#endif
+
+int
+main ()
+{
+return jlimit_startjob ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_func_jlimit_startjob=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_func_jlimit_startjob=no
fi
- $as_echo "#define BROKEN_INET_NTOA 1" >>confdefs.h
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_jlimit_startjob" >&5
+echo "${ECHO_T}$ac_cv_func_jlimit_startjob" >&6; }
+if test $ac_cv_func_jlimit_startjob = yes; then
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define WITH_IRIX_JOBS 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+fi
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_INET_NTOA 1
+_ACEOF
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
-$as_echo "#define BROKEN_UPDWTMPX 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define WITH_ABBREV_NO_TTY 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
- $as_echo "#define LOCKED_PASSWD_STRING \"*LK*\"" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_UPDWTMPX 1
+_ACEOF
+
+ cat >>confdefs.h <<\_ACEOF
+#define WITH_ABBREV_NO_TTY 1
+_ACEOF
+
+ cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_STRING "*LK*"
+_ACEOF
+
;;
*-*-k*bsd*-gnu | *-*-kopensolaris*-gnu)
check_for_libcrypt_later=1
- $as_echo "#define PAM_TTY_KLUDGE 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define PAM_TTY_KLUDGE 1
+_ACEOF
- $as_echo "#define LOCKED_PASSWD_PREFIX \"!\"" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_PREFIX "!"
+_ACEOF
- $as_echo "#define SPT_TYPE SPT_REUSEARGV" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SPT_TYPE SPT_REUSEARGV
+_ACEOF
-$as_echo "#define _PATH_BTMP \"/var/log/btmp\"" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define _PATH_BTMP "/var/log/btmp"
+_ACEOF
-$as_echo "#define USE_BTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_BTMP 1
+_ACEOF
;;
*-*-linux*)
@@ -7465,39 +10006,188 @@
check_for_libcrypt_later=1
check_for_openpty_ctty_bug=1
-$as_echo "#define PAM_TTY_KLUDGE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define PAM_TTY_KLUDGE 1
+_ACEOF
-$as_echo "#define LOCKED_PASSWD_PREFIX \"!\"" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_PREFIX "!"
+_ACEOF
- $as_echo "#define SPT_TYPE SPT_REUSEARGV" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SPT_TYPE SPT_REUSEARGV
+_ACEOF
-$as_echo "#define LINK_OPNOTSUPP_ERRNO EPERM" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LINK_OPNOTSUPP_ERRNO EPERM
+_ACEOF
-$as_echo "#define _PATH_BTMP \"/var/log/btmp\"" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define _PATH_BTMP "/var/log/btmp"
+_ACEOF
- $as_echo "#define USE_BTMP 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_BTMP 1
+_ACEOF
-$as_echo "#define LINUX_OOM_ADJUST 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LINUX_OOM_ADJUST 1
+_ACEOF
inet6_default_4in6=yes
case `uname -r` in
1.*|2.0.*)
-$as_echo "#define BROKEN_CMSG_TYPE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_CMSG_TYPE 1
+_ACEOF
;;
esac
# tun(4) forwarding compat code
- for ac_header in linux/if_tun.h
-do :
- ac_fn_c_check_header_mongrel "$LINENO" "linux/if_tun.h" "ac_cv_header_linux_if_tun_h" "$ac_includes_default"
-if test "x$ac_cv_header_linux_if_tun_h" = xyes; then :
+
+for ac_header in linux/if_tun.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_LINUX_IF_TUN_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -7506,23 +10196,75 @@
if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
-$as_echo "#define SSH_TUN_LINUX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_LINUX 1
+_ACEOF
-$as_echo "#define SSH_TUN_COMPAT_AF 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_COMPAT_AF 1
+_ACEOF
-$as_echo "#define SSH_TUN_PREPEND_AF 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_PREPEND_AF 1
+_ACEOF
fi
- for ac_header in linux/seccomp.h linux/filter.h linux/audit.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "#include <linux/types.h>
-"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+
+
+
+for ac_header in linux/seccomp.h linux/filter.h linux/audit.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <linux/types.h>
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ eval "$as_ac_Header=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -7529,19 +10271,102 @@
done
- for ac_func in prctl
-do :
- ac_fn_c_check_func "$LINENO" "prctl" "ac_cv_func_prctl"
-if test "x$ac_cv_func_prctl" = xyes; then :
+
+for ac_func in prctl
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_PRCTL 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for seccomp architecture" >&5
-$as_echo_n "checking for seccomp architecture... " >&6; }
+ { echo "$as_me:$LINENO: checking for seccomp architecture" >&5
+echo $ECHO_N "checking for seccomp architecture... $ECHO_C" >&6; }
seccomp_audit_arch=
case "$host" in
x86_64-*)
@@ -7550,13 +10375,40 @@
i*86-*)
seccomp_audit_arch=AUDIT_ARCH_I386
;;
- arm*-*)
+ arm*-*)
seccomp_audit_arch=AUDIT_ARCH_ARM
- ;;
+ ;;
+ aarch64*-*)
+ seccomp_audit_arch=AUDIT_ARCH_AARCH64
+ ;;
+ s390x-*)
+ seccomp_audit_arch=AUDIT_ARCH_S390X
+ ;;
+ s390-*)
+ seccomp_audit_arch=AUDIT_ARCH_S390
+ ;;
+ powerpc64-*)
+ seccomp_audit_arch=AUDIT_ARCH_PPC64
+ ;;
+ powerpc64le-*)
+ seccomp_audit_arch=AUDIT_ARCH_PPC64LE
+ ;;
+ mips-*)
+ seccomp_audit_arch=AUDIT_ARCH_MIPS
+ ;;
+ mipsel-*)
+ seccomp_audit_arch=AUDIT_ARCH_MIPSEL
+ ;;
+ mips64-*)
+ seccomp_audit_arch=AUDIT_ARCH_MIPS64
+ ;;
+ mips64el-*)
+ seccomp_audit_arch=AUDIT_ARCH_MIPSEL64
+ ;;
esac
if test "x$seccomp_audit_arch" != "x" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$seccomp_audit_arch\"" >&5
-$as_echo "\"$seccomp_audit_arch\"" >&6; }
+ { echo "$as_me:$LINENO: result: \"$seccomp_audit_arch\"" >&5
+echo "${ECHO_T}\"$seccomp_audit_arch\"" >&6; }
cat >>confdefs.h <<_ACEOF
#define SECCOMP_AUDIT_ARCH $seccomp_audit_arch
@@ -7563,13 +10415,15 @@
_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: architecture not supported" >&5
-$as_echo "architecture not supported" >&6; }
+ { echo "$as_me:$LINENO: result: architecture not supported" >&5
+echo "${ECHO_T}architecture not supported" >&6; }
fi
;;
mips-sony-bsd|mips-sony-newsos4)
-$as_echo "#define NEED_SETPGRP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define NEED_SETPGRP 1
+_ACEOF
SONY=1
;;
@@ -7578,67 +10432,354 @@
if test "x$withval" != "xno" ; then
need_dash_r=1
fi
+ CPPFLAGS="$CPPFLAGS -D_OPENBSD_SOURCE"
-$as_echo "#define SSH_TUN_FREEBSD 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_FREEBSD 1
+_ACEOF
- ac_fn_c_check_header_mongrel "$LINENO" "net/if_tap.h" "ac_cv_header_net_if_tap_h" "$ac_includes_default"
-if test "x$ac_cv_header_net_if_tap_h" = xyes; then :
+ if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+ { echo "$as_me:$LINENO: checking for net/if_tap.h" >&5
+echo $ECHO_N "checking for net/if_tap.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_net_if_tap_h" >&5
+echo "${ECHO_T}$ac_cv_header_net_if_tap_h" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking net/if_tap.h usability" >&5
+echo $ECHO_N "checking net/if_tap.h usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <net/if_tap.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking net/if_tap.h presence" >&5
+echo $ECHO_N "checking net/if_tap.h presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <net/if_tap.h>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define SSH_TUN_NO_L2 1" >>confdefs.h
+ ac_header_preproc=no
+fi
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: net/if_tap.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: net/if_tap.h: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: net/if_tap.h: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: net/if_tap.h: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: net/if_tap.h: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: net/if_tap.h: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: net/if_tap.h: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: net/if_tap.h: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for net/if_tap.h" >&5
+echo $ECHO_N "checking for net/if_tap.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ ac_cv_header_net_if_tap_h=$ac_header_preproc
fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_net_if_tap_h" >&5
+echo "${ECHO_T}$ac_cv_header_net_if_tap_h" >&6; }
+fi
+if test $ac_cv_header_net_if_tap_h = yes; then
+ :
+else
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_NO_L2 1
+_ACEOF
-$as_echo "#define SSH_TUN_PREPEND_AF 1" >>confdefs.h
+fi
+
+
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_PREPEND_AF 1
+_ACEOF
+
TEST_MALLOC_OPTIONS="AJRX"
-$as_echo "#define BROKEN_STRNVIS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_STRNVIS 1
+_ACEOF
-$as_echo "#define BROKEN_READ_COMPARISON 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_READ_COMPARISON 1
+_ACEOF
;;
*-*-freebsd*)
check_for_libcrypt_later=1
-$as_echo "#define LOCKED_PASSWD_PREFIX \"*LOCKED*\"" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_PREFIX "*LOCKED*"
+_ACEOF
-$as_echo "#define SSH_TUN_FREEBSD 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_FREEBSD 1
+_ACEOF
- ac_fn_c_check_header_mongrel "$LINENO" "net/if_tap.h" "ac_cv_header_net_if_tap_h" "$ac_includes_default"
-if test "x$ac_cv_header_net_if_tap_h" = xyes; then :
+ if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+ { echo "$as_me:$LINENO: checking for net/if_tap.h" >&5
+echo $ECHO_N "checking for net/if_tap.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_net_if_tap_h" >&5
+echo "${ECHO_T}$ac_cv_header_net_if_tap_h" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking net/if_tap.h usability" >&5
+echo $ECHO_N "checking net/if_tap.h usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <net/if_tap.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking net/if_tap.h presence" >&5
+echo $ECHO_N "checking net/if_tap.h presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <net/if_tap.h>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define SSH_TUN_NO_L2 1" >>confdefs.h
+ ac_header_preproc=no
+fi
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: net/if_tap.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: net/if_tap.h: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: net/if_tap.h: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: net/if_tap.h: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: net/if_tap.h: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: net/if_tap.h: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: net/if_tap.h: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: net/if_tap.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: net/if_tap.h: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for net/if_tap.h" >&5
+echo $ECHO_N "checking for net/if_tap.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ ac_cv_header_net_if_tap_h=$ac_header_preproc
fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_net_if_tap_h" >&5
+echo "${ECHO_T}$ac_cv_header_net_if_tap_h" >&6; }
+fi
+if test $ac_cv_header_net_if_tap_h = yes; then
+ :
+else
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_NO_L2 1
+_ACEOF
-$as_echo "#define BROKEN_GLOB 1" >>confdefs.h
+fi
-$as_echo "#define BROKEN_STRNVIS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GLOB 1
+_ACEOF
+
+
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_STRNVIS 1
+_ACEOF
+
TEST_MALLOC_OPTIONS="AJRX"
# Preauth crypto occasionally uses file descriptors for crypto offload
# and will crash if they cannot be opened.
-$as_echo "#define SANDBOX_SKIP_RLIMIT_NOFILE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_SKIP_RLIMIT_NOFILE 1
+_ACEOF
;;
*-*-bsdi*)
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
;;
*-next-*)
@@ -7647,29 +10788,45 @@
conf_wtmp_location=/usr/adm/wtmp
maildir=/usr/spool/mail
-$as_echo "#define HAVE_NEXT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_NEXT 1
+_ACEOF
- $as_echo "#define BROKEN_REALPATH 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_REALPATH 1
+_ACEOF
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
-$as_echo "#define BROKEN_SAVED_UIDS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SAVED_UIDS 1
+_ACEOF
;;
*-*-openbsd*)
use_pie=auto
-$as_echo "#define HAVE_ATTRIBUTE__SENTINEL__ 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ATTRIBUTE__SENTINEL__ 1
+_ACEOF
-$as_echo "#define HAVE_ATTRIBUTE__BOUNDED__ 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ATTRIBUTE__BOUNDED__ 1
+_ACEOF
-$as_echo "#define SSH_TUN_OPENBSD 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_OPENBSD 1
+_ACEOF
-$as_echo "#define SYSLOG_R_SAFE_IN_SIGHAND 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SYSLOG_R_SAFE_IN_SIGHAND 1
+_ACEOF
TEST_MALLOC_OPTIONS="AFGJPRX"
;;
@@ -7677,60 +10834,513 @@
if test "x$withval" != "xno" ; then
need_dash_r=1
fi
- $as_echo "#define PAM_SUN_CODEBASE 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define PAM_SUN_CODEBASE 1
+_ACEOF
- $as_echo "#define LOGIN_NEEDS_UTMPX 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define LOGIN_NEEDS_UTMPX 1
+_ACEOF
-$as_echo "#define LOGIN_NEEDS_TERM 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LOGIN_NEEDS_TERM 1
+_ACEOF
- $as_echo "#define PAM_TTY_KLUDGE 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define PAM_TTY_KLUDGE 1
+_ACEOF
-$as_echo "#define SSHPAM_CHAUTHTOK_NEEDS_RUID 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSHPAM_CHAUTHTOK_NEEDS_RUID 1
+_ACEOF
- $as_echo "#define LOCKED_PASSWD_STRING \"*LK*\"" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_STRING "*LK*"
+_ACEOF
# Pushing STREAMS modules will cause sshd to acquire a controlling tty.
-$as_echo "#define SSHD_ACQUIRES_CTTY 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSHD_ACQUIRES_CTTY 1
+_ACEOF
-$as_echo "#define PASSWD_NEEDS_USERNAME 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define PASSWD_NEEDS_USERNAME 1
+_ACEOF
-$as_echo "#define BROKEN_TCGETATTR_ICANON 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_TCGETATTR_ICANON 1
+_ACEOF
external_path_file=/etc/default/login
# hardwire lastlog location (can't detect it on some versions)
conf_lastlog_location="/var/adm/lastlog"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for obsolete utmp and wtmp in solaris2.x" >&5
-$as_echo_n "checking for obsolete utmp and wtmp in solaris2.x... " >&6; }
+ { echo "$as_me:$LINENO: checking for obsolete utmp and wtmp in solaris2.x" >&5
+echo $ECHO_N "checking for obsolete utmp and wtmp in solaris2.x... $ECHO_C" >&6; }
sol2ver=`echo "$host"| sed -e 's/.*[0-9]\.//'`
if test "$sol2ver" -ge 8; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- $as_echo "#define DISABLE_UTMP 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_UTMP 1
+_ACEOF
-$as_echo "#define DISABLE_WTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_WTMP 1
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
+for ac_func in setpflags
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+
+
+for ac_func in setppriv
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+
+
+for ac_func in priv_basicset
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+
+
+for ac_header in priv.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+
# Check whether --with-solaris-contracts was given.
-if test "${with_solaris_contracts+set}" = set; then :
+if test "${with_solaris_contracts+set}" = set; then
withval=$with_solaris_contracts;
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ct_tmpl_activate in -lcontract" >&5
-$as_echo_n "checking for ct_tmpl_activate in -lcontract... " >&6; }
-if ${ac_cv_lib_contract_ct_tmpl_activate+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ct_tmpl_activate in -lcontract" >&5
+echo $ECHO_N "checking for ct_tmpl_activate in -lcontract... $ECHO_C" >&6; }
+if test "${ac_cv_lib_contract_ct_tmpl_activate+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lcontract $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -7748,22 +11358,45 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_contract_ct_tmpl_activate=yes
else
- ac_cv_lib_contract_ct_tmpl_activate=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_contract_ct_tmpl_activate=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_contract_ct_tmpl_activate" >&5
-$as_echo "$ac_cv_lib_contract_ct_tmpl_activate" >&6; }
-if test "x$ac_cv_lib_contract_ct_tmpl_activate" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_contract_ct_tmpl_activate" >&5
+echo "${ECHO_T}$ac_cv_lib_contract_ct_tmpl_activate" >&6; }
+if test $ac_cv_lib_contract_ct_tmpl_activate = yes; then
-$as_echo "#define USE_SOLARIS_PROCESS_CONTRACTS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_SOLARIS_PROCESS_CONTRACTS 1
+_ACEOF
- SSHDLIBS="$SSHDLIBS -lcontract"
+ LIBS="$LIBS -lcontract"
SPC_MSG="yes"
fi
@@ -7772,16 +11405,20 @@
# Check whether --with-solaris-projects was given.
-if test "${with_solaris_projects+set}" = set; then :
+if test "${with_solaris_projects+set}" = set; then
withval=$with_solaris_projects;
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for setproject in -lproject" >&5
-$as_echo_n "checking for setproject in -lproject... " >&6; }
-if ${ac_cv_lib_project_setproject+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for setproject in -lproject" >&5
+echo $ECHO_N "checking for setproject in -lproject... $ECHO_C" >&6; }
+if test "${ac_cv_lib_project_setproject+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lproject $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -7799,22 +11436,45 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_project_setproject=yes
else
- ac_cv_lib_project_setproject=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_project_setproject=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_project_setproject" >&5
-$as_echo "$ac_cv_lib_project_setproject" >&6; }
-if test "x$ac_cv_lib_project_setproject" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_project_setproject" >&5
+echo "${ECHO_T}$ac_cv_lib_project_setproject" >&6; }
+if test $ac_cv_lib_project_setproject = yes; then
-$as_echo "#define USE_SOLARIS_PROJECTS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_SOLARIS_PROJECTS 1
+_ACEOF
- SSHDLIBS="$SSHDLIBS -lproject"
+ LIBS="$LIBS -lproject"
SP_MSG="yes"
fi
@@ -7821,52 +11481,186 @@
fi
+
+# Check whether --with-solaris-privs was given.
+if test "${with_solaris_privs+set}" = set; then
+ withval=$with_solaris_privs;
+ { echo "$as_me:$LINENO: checking for Solaris/Illumos privilege support" >&5
+echo $ECHO_N "checking for Solaris/Illumos privilege support... $ECHO_C" >&6; }
+ if test "x$ac_cv_func_setppriv" = "xyes" -a \
+ "x$ac_cv_header_priv_h" = "xyes" ; then
+ SOLARIS_PRIVS=yes
+ { echo "$as_me:$LINENO: result: found" >&5
+echo "${ECHO_T}found" >&6; }
+
+cat >>confdefs.h <<\_ACEOF
+#define NO_UID_RESTORATION_TEST 1
+_ACEOF
+
+
+cat >>confdefs.h <<\_ACEOF
+#define USE_SOLARIS_PRIVS 1
+_ACEOF
+
+ SPP_MSG="yes"
+ else
+ { echo "$as_me:$LINENO: result: not found" >&5
+echo "${ECHO_T}not found" >&6; }
+ { { echo "$as_me:$LINENO: error: *** must have support for Solaris privileges to use --with-solaris-privs" >&5
+echo "$as_me: error: *** must have support for Solaris privileges to use --with-solaris-privs" >&2;}
+ { (exit 1); exit 1; }; }
+ fi
+
+fi
+
TEST_SHELL=$SHELL # let configure find us a capable shell
;;
*-*-sunos4*)
CPPFLAGS="$CPPFLAGS -DSUNOS4"
- for ac_func in getpwanam
-do :
- ac_fn_c_check_func "$LINENO" "getpwanam" "ac_cv_func_getpwanam"
-if test "x$ac_cv_func_getpwanam" = xyes; then :
+
+for ac_func in getpwanam
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_GETPWANAM 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
- $as_echo "#define PAM_SUN_CODEBASE 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define PAM_SUN_CODEBASE 1
+_ACEOF
conf_utmp_location=/etc/utmp
conf_wtmp_location=/var/adm/wtmp
conf_lastlog_location=/var/adm/lastlog
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
;;
*-ncr-sysv*)
LIBS="$LIBS -lc89"
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define SSHD_ACQUIRES_CTTY 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SSHD_ACQUIRES_CTTY 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
;;
*-sni-sysv*)
# /usr/ucblib MUST NOT be searched on ReliantUNIX
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlsym in -ldl" >&5
-$as_echo_n "checking for dlsym in -ldl... " >&6; }
-if ${ac_cv_lib_dl_dlsym+:} false; then :
- $as_echo_n "(cached) " >&6
+
+{ echo "$as_me:$LINENO: checking for dlsym in -ldl" >&5
+echo $ECHO_N "checking for dlsym in -ldl... $ECHO_C" >&6; }
+if test "${ac_cv_lib_dl_dlsym+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-ldl $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -7884,18 +11678,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_dl_dlsym=yes
else
- ac_cv_lib_dl_dlsym=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_dl_dlsym=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlsym" >&5
-$as_echo "$ac_cv_lib_dl_dlsym" >&6; }
-if test "x$ac_cv_lib_dl_dlsym" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_dl_dlsym" >&5
+echo "${ECHO_T}$ac_cv_lib_dl_dlsym" >&6; }
+if test $ac_cv_lib_dl_dlsym = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBDL 1
_ACEOF
@@ -7905,14 +11720,18 @@
fi
# -lresolv needs to be at the end of LIBS or DNS lookups break
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for res_query in -lresolv" >&5
-$as_echo_n "checking for res_query in -lresolv... " >&6; }
-if ${ac_cv_lib_resolv_res_query+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for res_query in -lresolv" >&5
+echo $ECHO_N "checking for res_query in -lresolv... $ECHO_C" >&6; }
+if test "${ac_cv_lib_resolv_res_query+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lresolv $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -7930,33 +11749,66 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_resolv_res_query=yes
else
- ac_cv_lib_resolv_res_query=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_resolv_res_query=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_resolv_res_query" >&5
-$as_echo "$ac_cv_lib_resolv_res_query" >&6; }
-if test "x$ac_cv_lib_resolv_res_query" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_resolv_res_query" >&5
+echo "${ECHO_T}$ac_cv_lib_resolv_res_query" >&6; }
+if test $ac_cv_lib_resolv_res_query = yes; then
LIBS="$LIBS -lresolv"
fi
IPADDR_IN_DISPLAY=yes
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define IP_TOS_IS_BROKEN 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define IP_TOS_IS_BROKEN 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
- $as_echo "#define SSHD_ACQUIRES_CTTY 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SSHD_ACQUIRES_CTTY 1
+_ACEOF
external_path_file=/etc/default/login
# /usr/ucblib/libucb.a no longer needed on ReliantUNIX
@@ -7965,18 +11817,30 @@
;;
# UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
*-*-sysv4.2*)
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
-$as_echo "#define PASSWD_NEEDS_USERNAME 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define PASSWD_NEEDS_USERNAME 1
+_ACEOF
- $as_echo "#define LOCKED_PASSWD_STRING \"*LK*\"" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_STRING "*LK*"
+_ACEOF
TEST_SHELL=$SHELL # let configure find us a capable shell
;;
@@ -7984,19 +11848,33 @@
*-*-sysv5*)
CPPFLAGS="$CPPFLAGS -Dvsnprintf=_xvsnprintf -Dsnprintf=_xsnprintf"
-$as_echo "#define UNIXWARE_LONG_PASSWORDS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define UNIXWARE_LONG_PASSWORDS 1
+_ACEOF
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_GETADDRINFO 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GETADDRINFO 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
- $as_echo "#define PASSWD_NEEDS_USERNAME 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define PASSWD_NEEDS_USERNAME 1
+_ACEOF
TEST_SHELL=$SHELL # let configure find us a capable shell
case "$host" in
@@ -8003,18 +11881,26 @@
*-*-sysv5SCO_SV*) # SCO OpenServer 6.x
maildir=/var/spool/mail
-$as_echo "#define BROKEN_LIBIAF 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_LIBIAF 1
+_ACEOF
- $as_echo "#define BROKEN_UPDWTMPX 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_UPDWTMPX 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for getluid in -lprot" >&5
-$as_echo_n "checking for getluid in -lprot... " >&6; }
-if ${ac_cv_lib_prot_getluid+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for getluid in -lprot" >&5
+echo $ECHO_N "checking for getluid in -lprot... $ECHO_C" >&6; }
+if test "${ac_cv_lib_prot_getluid+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lprot $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8032,40 +11918,150 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_prot_getluid=yes
else
- ac_cv_lib_prot_getluid=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_prot_getluid=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_prot_getluid" >&5
-$as_echo "$ac_cv_lib_prot_getluid" >&6; }
-if test "x$ac_cv_lib_prot_getluid" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_prot_getluid" >&5
+echo "${ECHO_T}$ac_cv_lib_prot_getluid" >&6; }
+if test $ac_cv_lib_prot_getluid = yes; then
LIBS="$LIBS -lprot"
- for ac_func in getluid setluid
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+
+
+for ac_func in getluid setluid
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
- $as_echo "#define HAVE_SECUREWARE 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_SECUREWARE 1
+_ACEOF
- $as_echo "#define DISABLE_SHADOW 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_SHADOW 1
+_ACEOF
fi
;;
- *) $as_echo "#define LOCKED_PASSWD_STRING \"*LK*\"" >>confdefs.h
+ *) cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_STRING "*LK*"
+_ACEOF
check_for_libcrypt_later=1
;;
@@ -8075,7 +12071,9 @@
;;
# SCO UNIX and OEM versions of SCO UNIX
*-*-sco3.2v4*)
- as_fn_error $? "\"This Platform is no longer supported.\"" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: \"This Platform is no longer supported.\"" >&5
+echo "$as_me: error: \"This Platform is no longer supported.\"" >&2;}
+ { (exit 1); exit 1; }; }
;;
# SCO OpenServer 5.x
*-*-sco3.2v5*)
@@ -8084,35 +12082,140 @@
fi
LIBS="$LIBS -lprot -lx -ltinfo -lm"
no_dev_ptmx=1
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define HAVE_SECUREWARE 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_SECUREWARE 1
+_ACEOF
- $as_echo "#define DISABLE_SHADOW 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_SHADOW 1
+_ACEOF
- $as_echo "#define DISABLE_FD_PASSING 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_FD_PASSING 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_GETADDRINFO 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GETADDRINFO 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
- $as_echo "#define WITH_ABBREV_NO_TTY 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define WITH_ABBREV_NO_TTY 1
+_ACEOF
- $as_echo "#define BROKEN_UPDWTMPX 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_UPDWTMPX 1
+_ACEOF
- $as_echo "#define PASSWD_NEEDS_USERNAME 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define PASSWD_NEEDS_USERNAME 1
+_ACEOF
- for ac_func in getluid setluid
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+
+
+for ac_func in getluid setluid
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -8124,17 +12227,29 @@
;;
*-*-unicosmk*)
-$as_echo "#define NO_SSH_LASTLOG 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define NO_SSH_LASTLOG 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define DISABLE_FD_PASSING 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_FD_PASSING 1
+_ACEOF
LDFLAGS="$LDFLAGS"
LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
@@ -8141,17 +12256,29 @@
MANTYPE=cat
;;
*-*-unicosmp*)
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
- $as_echo "#define WITH_ABBREV_NO_TTY 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define WITH_ABBREV_NO_TTY 1
+_ACEOF
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define DISABLE_FD_PASSING 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_FD_PASSING 1
+_ACEOF
LDFLAGS="$LDFLAGS"
LIBS="$LIBS -lgen -lacid -ldb"
@@ -8158,17 +12285,29 @@
MANTYPE=cat
;;
*-*-unicos*)
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define DISABLE_FD_PASSING 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_FD_PASSING 1
+_ACEOF
- $as_echo "#define NO_SSH_LASTLOG 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define NO_SSH_LASTLOG 1
+_ACEOF
LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
@@ -8175,16 +12314,16 @@
MANTYPE=cat
;;
*-dec-osf*)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Digital Unix SIA" >&5
-$as_echo_n "checking for Digital Unix SIA... " >&6; }
+ { echo "$as_me:$LINENO: checking for Digital Unix SIA" >&5
+echo $ECHO_N "checking for Digital Unix SIA... $ECHO_C" >&6; }
no_osfsia=""
# Check whether --with-osfsia was given.
-if test "${with_osfsia+set}" = set; then :
+if test "${with_osfsia+set}" = set; then
withval=$with_osfsia;
if test "x$withval" = "xno" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: disabled" >&5
-$as_echo "disabled" >&6; }
+ { echo "$as_me:$LINENO: result: disabled" >&5
+echo "${ECHO_T}disabled" >&6; }
no_osfsia=1
fi
@@ -8192,55 +12331,85 @@
if test -z "$no_osfsia" ; then
if test -f /etc/sia/matrix.conf; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define HAVE_OSF_SIA 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_OSF_SIA 1
+_ACEOF
-$as_echo "#define DISABLE_LOGIN 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_LOGIN 1
+_ACEOF
- $as_echo "#define DISABLE_FD_PASSING 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_FD_PASSING 1
+_ACEOF
LIBS="$LIBS -lsecurity -ldb -lm -laud"
SIA_MSG="yes"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
-$as_echo "#define LOCKED_PASSWD_SUBSTR \"Nologin\"" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_SUBSTR "Nologin"
+_ACEOF
fi
fi
- $as_echo "#define BROKEN_GETADDRINFO 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GETADDRINFO 1
+_ACEOF
- $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SETEUID_BREAKS_SETUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREUID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREUID 1
+_ACEOF
- $as_echo "#define BROKEN_SETREGID 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETREGID 1
+_ACEOF
-$as_echo "#define BROKEN_READV_COMPARISON 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_READV_COMPARISON 1
+_ACEOF
;;
*-*-nto-qnx*)
- $as_echo "#define USE_PIPES 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define USE_PIPES 1
+_ACEOF
- $as_echo "#define NO_X11_UNIX_SOCKETS 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define NO_X11_UNIX_SOCKETS 1
+_ACEOF
- $as_echo "#define DISABLE_LASTLOG 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_LASTLOG 1
+_ACEOF
- $as_echo "#define SSHD_ACQUIRES_CTTY 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define SSHD_ACQUIRES_CTTY 1
+_ACEOF
-$as_echo "#define BROKEN_SHADOW_EXPIRE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SHADOW_EXPIRE 1
+_ACEOF
enable_etc_default_login=no # has incompatible /etc/default/login
case "$host" in
*-*-nto-qnx6*)
- $as_echo "#define DISABLE_FD_PASSING 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_FD_PASSING 1
+_ACEOF
;;
esac
@@ -8248,15 +12417,23 @@
*-*-ultrix*)
-$as_echo "#define BROKEN_GETGROUPS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GETGROUPS 1
+_ACEOF
-$as_echo "#define BROKEN_MMAP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_MMAP 1
+_ACEOF
- $as_echo "#define NEED_SETPGRP 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define NEED_SETPGRP 1
+_ACEOF
-$as_echo "#define HAVE_SYS_SYSLOG_H 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SYS_SYSLOG_H 1
+_ACEOF
;;
@@ -8263,19 +12440,25 @@
*-*-lynxos)
CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
-$as_echo "#define BROKEN_SETVBUF 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETVBUF 1
+_ACEOF
;;
esac
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler and flags for sanity" >&5
-$as_echo_n "checking compiler and flags for sanity... " >&6; }
-if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking compiler sanity" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking compiler sanity" >&2;}
+{ echo "$as_me:$LINENO: checking compiler and flags for sanity" >&5
+echo $ECHO_N "checking compiler and flags for sanity... $ECHO_C" >&6; }
+if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking compiler sanity" >&5
+echo "$as_me: WARNING: cross compiling: not checking compiler sanity" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
int
@@ -8286,36 +12469,76 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- as_fn_error $? "*** compiler cannot create working executables, check config.log ***" "$LINENO" 5
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ { { echo "$as_me:$LINENO: error: *** compiler cannot create working executables, check config.log ***" >&5
+echo "$as_me: error: *** compiler cannot create working executables, check config.log ***" >&2;}
+ { (exit 1); exit 1; }; }
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
# Checks for libraries.
-ac_fn_c_check_func "$LINENO" "yp_match" "ac_cv_func_yp_match"
-if test "x$ac_cv_func_yp_match" = xyes; then :
-
+{ echo "$as_me:$LINENO: checking for setsockopt" >&5
+echo $ECHO_N "checking for setsockopt... $ECHO_C" >&6; }
+if test "${ac_cv_func_setsockopt+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for yp_match in -lnsl" >&5
-$as_echo_n "checking for yp_match in -lnsl... " >&6; }
-if ${ac_cv_lib_nsl_yp_match+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- ac_check_lib_save_LIBS=$LIBS
-LIBS="-lnsl $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
+/* Define setsockopt to an innocuous variant, in case <limits.h> declares setsockopt.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define setsockopt innocuous_setsockopt
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char setsockopt (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef setsockopt
+
/* Override any GCC internal prototype to avoid an error.
Use char because int might match the return type of a GCC
builtin and then its argument prototype would still apply. */
@@ -8322,49 +12545,69 @@
#ifdef __cplusplus
extern "C"
#endif
-char yp_match ();
+char setsockopt ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_setsockopt || defined __stub___setsockopt
+choke me
+#endif
+
int
main ()
{
-return yp_match ();
+return setsockopt ();
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- ac_cv_lib_nsl_yp_match=yes
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_func_setsockopt=yes
else
- ac_cv_lib_nsl_yp_match=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nsl_yp_match" >&5
-$as_echo "$ac_cv_lib_nsl_yp_match" >&6; }
-if test "x$ac_cv_lib_nsl_yp_match" = xyes; then :
- cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBNSL 1
-_ACEOF
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- LIBS="-lnsl $LIBS"
-
+ ac_cv_func_setsockopt=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_setsockopt" >&5
+echo "${ECHO_T}$ac_cv_func_setsockopt" >&6; }
+if test $ac_cv_func_setsockopt = yes; then
+ :
+else
-ac_fn_c_check_func "$LINENO" "setsockopt" "ac_cv_func_setsockopt"
-if test "x$ac_cv_func_setsockopt" = xyes; then :
-
+{ echo "$as_me:$LINENO: checking for setsockopt in -lsocket" >&5
+echo $ECHO_N "checking for setsockopt in -lsocket... $ECHO_C" >&6; }
+if test "${ac_cv_lib_socket_setsockopt+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for setsockopt in -lsocket" >&5
-$as_echo_n "checking for setsockopt in -lsocket... " >&6; }
-if ${ac_cv_lib_socket_setsockopt+:} false; then :
- $as_echo_n "(cached) " >&6
-else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lsocket $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8382,18 +12625,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_socket_setsockopt=yes
else
- ac_cv_lib_socket_setsockopt=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_socket_setsockopt=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_socket_setsockopt" >&5
-$as_echo "$ac_cv_lib_socket_setsockopt" >&6; }
-if test "x$ac_cv_lib_socket_setsockopt" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_socket_setsockopt" >&5
+echo "${ECHO_T}$ac_cv_lib_socket_setsockopt" >&6; }
+if test $ac_cv_lib_socket_setsockopt = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBSOCKET 1
_ACEOF
@@ -8405,19 +12669,235 @@
fi
+
for ac_func in dirname
-do :
- ac_fn_c_check_func "$LINENO" "dirname" "ac_cv_func_dirname"
-if test "x$ac_cv_func_dirname" = xyes; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_DIRNAME 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
- for ac_header in libgen.h
-do :
- ac_fn_c_check_header_mongrel "$LINENO" "libgen.h" "ac_cv_header_libgen_h" "$ac_includes_default"
-if test "x$ac_cv_header_libgen_h" = xyes; then :
+
+for ac_header in libgen.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBGEN_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -8426,14 +12906,18 @@
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dirname in -lgen" >&5
-$as_echo_n "checking for dirname in -lgen... " >&6; }
-if ${ac_cv_lib_gen_dirname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for dirname in -lgen" >&5
+echo $ECHO_N "checking for dirname in -lgen... $ECHO_C" >&6; }
+if test "${ac_cv_lib_gen_dirname+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lgen $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8451,31 +12935,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_gen_dirname=yes
else
- ac_cv_lib_gen_dirname=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_gen_dirname=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gen_dirname" >&5
-$as_echo "$ac_cv_lib_gen_dirname" >&6; }
-if test "x$ac_cv_lib_gen_dirname" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_gen_dirname" >&5
+echo "${ECHO_T}$ac_cv_lib_gen_dirname" >&6; }
+if test $ac_cv_lib_gen_dirname = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for broken dirname" >&5
-$as_echo_n "checking for broken dirname... " >&6; }
-if ${ac_cv_have_broken_dirname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for broken dirname" >&5
+echo $ECHO_N "checking for broken dirname... $ECHO_C" >&6; }
+if test "${ac_cv_have_broken_dirname+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
save_LIBS="$LIBS"
LIBS="$LIBS -lgen"
- if test "$cross_compiling" = yes; then :
+ if test "$cross_compiling" = yes; then
ac_cv_have_broken_dirname="no"
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <libgen.h>
@@ -8494,30 +13003,189 @@
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
ac_cv_have_broken_dirname="no"
else
- ac_cv_have_broken_dirname="yes"
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+ ac_cv_have_broken_dirname="yes"
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
LIBS="$save_LIBS"
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_broken_dirname" >&5
-$as_echo "$ac_cv_have_broken_dirname" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_broken_dirname" >&5
+echo "${ECHO_T}$ac_cv_have_broken_dirname" >&6; }
if test "x$ac_cv_have_broken_dirname" = "xno" ; then
LIBS="$LIBS -lgen"
- $as_echo "#define HAVE_DIRNAME 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_DIRNAME 1
+_ACEOF
- for ac_header in libgen.h
-do :
- ac_fn_c_check_header_mongrel "$LINENO" "libgen.h" "ac_cv_header_libgen_h" "$ac_includes_default"
-if test "x$ac_cv_header_libgen_h" = xyes; then :
+
+for ac_header in libgen.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBGEN_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -8533,18 +13201,102 @@
done
-ac_fn_c_check_func "$LINENO" "getspnam" "ac_cv_func_getspnam"
-if test "x$ac_cv_func_getspnam" = xyes; then :
+{ echo "$as_me:$LINENO: checking for getspnam" >&5
+echo $ECHO_N "checking for getspnam... $ECHO_C" >&6; }
+if test "${ac_cv_func_getspnam+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define getspnam to an innocuous variant, in case <limits.h> declares getspnam.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define getspnam innocuous_getspnam
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char getspnam (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef getspnam
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char getspnam ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_getspnam || defined __stub___getspnam
+choke me
+#endif
+
+int
+main ()
+{
+return getspnam ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_func_getspnam=yes
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for getspnam in -lgen" >&5
-$as_echo_n "checking for getspnam in -lgen... " >&6; }
-if ${ac_cv_lib_gen_getspnam+:} false; then :
- $as_echo_n "(cached) " >&6
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_func_getspnam=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_getspnam" >&5
+echo "${ECHO_T}$ac_cv_func_getspnam" >&6; }
+if test $ac_cv_func_getspnam = yes; then
+ :
else
+ { echo "$as_me:$LINENO: checking for getspnam in -lgen" >&5
+echo $ECHO_N "checking for getspnam in -lgen... $ECHO_C" >&6; }
+if test "${ac_cv_lib_gen_getspnam+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lgen $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8562,30 +13314,55 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_gen_getspnam=yes
else
- ac_cv_lib_gen_getspnam=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_gen_getspnam=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gen_getspnam" >&5
-$as_echo "$ac_cv_lib_gen_getspnam" >&6; }
-if test "x$ac_cv_lib_gen_getspnam" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_gen_getspnam" >&5
+echo "${ECHO_T}$ac_cv_lib_gen_getspnam" >&6; }
+if test $ac_cv_lib_gen_getspnam = yes; then
LIBS="$LIBS -lgen"
fi
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing basename" >&5
-$as_echo_n "checking for library containing basename... " >&6; }
-if ${ac_cv_search_basename+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing basename" >&5
+echo $ECHO_N "checking for library containing basename... $ECHO_C" >&6; }
+if test "${ac_cv_search_basename+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8610,17 +13387,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_basename=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_basename+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_basename+set}" = set; then
break
fi
done
-if ${ac_cv_search_basename+:} false; then :
-
+if test "${ac_cv_search_basename+set}" = set; then
+ :
else
ac_cv_search_basename=no
fi
@@ -8627,13 +13427,15 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_basename" >&5
-$as_echo "$ac_cv_search_basename" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_basename" >&5
+echo "${ECHO_T}$ac_cv_search_basename" >&6; }
ac_res=$ac_cv_search_basename
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
-$as_echo "#define HAVE_BASENAME 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_BASENAME 1
+_ACEOF
fi
@@ -8640,9 +13442,11 @@
# Check whether --with-zlib was given.
-if test "${with_zlib+set}" = set; then :
+if test "${with_zlib+set}" = set; then
withval=$with_zlib; if test "x$withval" = "xno" ; then
- as_fn_error $? "*** zlib is required ***" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: *** zlib is required ***" >&5
+echo "$as_me: error: *** zlib is required ***" >&2;}
+ { (exit 1); exit 1; }; }
elif test "x$withval" != "xyes"; then
if test -d "$withval/lib"; then
if test -n "${need_dash_r}"; then
@@ -8667,22 +13471,158 @@
fi
-ac_fn_c_check_header_mongrel "$LINENO" "zlib.h" "ac_cv_header_zlib_h" "$ac_includes_default"
-if test "x$ac_cv_header_zlib_h" = xyes; then :
+if test "${ac_cv_header_zlib_h+set}" = set; then
+ { echo "$as_me:$LINENO: checking for zlib.h" >&5
+echo $ECHO_N "checking for zlib.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_zlib_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_zlib_h" >&5
+echo "${ECHO_T}$ac_cv_header_zlib_h" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking zlib.h usability" >&5
+echo $ECHO_N "checking zlib.h usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <zlib.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking zlib.h presence" >&5
+echo $ECHO_N "checking zlib.h presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <zlib.h>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
else
- as_fn_error $? "*** zlib.h missing - please install first or check config.log ***" "$LINENO" 5
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
fi
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for deflate in -lz" >&5
-$as_echo_n "checking for deflate in -lz... " >&6; }
-if ${ac_cv_lib_z_deflate+:} false; then :
- $as_echo_n "(cached) " >&6
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: zlib.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: zlib.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: zlib.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: zlib.h: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: zlib.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: zlib.h: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: zlib.h: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: zlib.h: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: zlib.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: zlib.h: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: zlib.h: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: zlib.h: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: zlib.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: zlib.h: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: zlib.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: zlib.h: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for zlib.h" >&5
+echo $ECHO_N "checking for zlib.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_zlib_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
+ ac_cv_header_zlib_h=$ac_header_preproc
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_zlib_h" >&5
+echo "${ECHO_T}$ac_cv_header_zlib_h" >&6; }
+
+fi
+if test $ac_cv_header_zlib_h = yes; then
+ :
+else
+ { { echo "$as_me:$LINENO: error: *** zlib.h missing - please install first or check config.log ***" >&5
+echo "$as_me: error: *** zlib.h missing - please install first or check config.log ***" >&2;}
+ { (exit 1); exit 1; }; }
+fi
+
+
+
+{ echo "$as_me:$LINENO: checking for deflate in -lz" >&5
+echo $ECHO_N "checking for deflate in -lz... $ECHO_C" >&6; }
+if test "${ac_cv_lib_z_deflate+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lz $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8700,18 +13640,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_z_deflate=yes
else
- ac_cv_lib_z_deflate=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_z_deflate=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_z_deflate" >&5
-$as_echo "$ac_cv_lib_z_deflate" >&6; }
-if test "x$ac_cv_lib_z_deflate" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_z_deflate" >&5
+echo "${ECHO_T}$ac_cv_lib_z_deflate" >&6; }
+if test $ac_cv_lib_z_deflate = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBZ 1
_ACEOF
@@ -8730,7 +13691,11 @@
fi
CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
LIBS="$LIBS -lz"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8748,25 +13713,50 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- $as_echo "#define HAVE_LIBZ 1" >>confdefs.h
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_LIBZ 1
+_ACEOF
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- as_fn_error $? "*** zlib missing - please install first or check config.log ***" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: *** zlib missing - please install first or check config.log ***" >&5
+echo "$as_me: error: *** zlib missing - please install first or check config.log ***" >&2;}
+ { (exit 1); exit 1; }; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
# Check whether --with-zlib-version-check was given.
-if test "${with_zlib_version_check+set}" = set; then :
+if test "${with_zlib_version_check+set}" = set; then
withval=$with_zlib_version_check; if test "x$withval" = "xno" ; then
zlib_check_nonfatal=1
fi
@@ -8775,14 +13765,18 @@
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for possibly buggy zlib" >&5
-$as_echo_n "checking for possibly buggy zlib... " >&6; }
-if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking zlib version" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking zlib version" >&2;}
+{ echo "$as_me:$LINENO: checking for possibly buggy zlib" >&5
+echo $ECHO_N "checking for possibly buggy zlib... $ECHO_C" >&6; }
+if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking zlib version" >&5
+echo "$as_me: WARNING: cross compiling: not checking zlib version" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -8814,43 +13808,159 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
if test -z "$zlib_check_nonfatal" ; then
- as_fn_error $? "*** zlib too old - check config.log ***
+ { { echo "$as_me:$LINENO: error: *** zlib too old - check config.log ***
Your reported zlib version has known security problems. It's possible your
vendor has fixed these problems without changing the version number. If you
are sure this is the case, you can disable the check by running
\"./configure --without-zlib-version-check\".
If you are in doubt, upgrade zlib to version 1.2.3 or greater.
-See http://www.gzip.org/zlib/ for details." "$LINENO" 5
+See http://www.gzip.org/zlib/ for details." >&5
+echo "$as_me: error: *** zlib too old - check config.log ***
+Your reported zlib version has known security problems. It's possible your
+vendor has fixed these problems without changing the version number. If you
+are sure this is the case, you can disable the check by running
+\"./configure --without-zlib-version-check\".
+If you are in doubt, upgrade zlib to version 1.2.3 or greater.
+See http://www.gzip.org/zlib/ for details." >&2;}
+ { (exit 1); exit 1; }; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: zlib version may have security problems" >&5
-$as_echo "$as_me: WARNING: zlib version may have security problems" >&2;}
+ { echo "$as_me:$LINENO: WARNING: zlib version may have security problems" >&5
+echo "$as_me: WARNING: zlib version may have security problems" >&2;}
fi
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-ac_fn_c_check_func "$LINENO" "strcasecmp" "ac_cv_func_strcasecmp"
-if test "x$ac_cv_func_strcasecmp" = xyes; then :
+{ echo "$as_me:$LINENO: checking for strcasecmp" >&5
+echo $ECHO_N "checking for strcasecmp... $ECHO_C" >&6; }
+if test "${ac_cv_func_strcasecmp+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for strcasecmp in -lresolv" >&5
-$as_echo_n "checking for strcasecmp in -lresolv... " >&6; }
-if ${ac_cv_lib_resolv_strcasecmp+:} false; then :
- $as_echo_n "(cached) " >&6
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define strcasecmp to an innocuous variant, in case <limits.h> declares strcasecmp.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define strcasecmp innocuous_strcasecmp
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char strcasecmp (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef strcasecmp
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char strcasecmp ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_strcasecmp || defined __stub___strcasecmp
+choke me
+#endif
+
+int
+main ()
+{
+return strcasecmp ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_func_strcasecmp=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_func_strcasecmp=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_strcasecmp" >&5
+echo "${ECHO_T}$ac_cv_func_strcasecmp" >&6; }
+if test $ac_cv_func_strcasecmp = yes; then
+ :
+else
+ { echo "$as_me:$LINENO: checking for strcasecmp in -lresolv" >&5
+echo $ECHO_N "checking for strcasecmp in -lresolv... $ECHO_C" >&6; }
+if test "${ac_cv_lib_resolv_strcasecmp+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lresolv $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8868,18 +13978,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_resolv_strcasecmp=yes
else
- ac_cv_lib_resolv_strcasecmp=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_resolv_strcasecmp=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_resolv_strcasecmp" >&5
-$as_echo "$ac_cv_lib_resolv_strcasecmp" >&6; }
-if test "x$ac_cv_lib_resolv_strcasecmp" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_resolv_strcasecmp" >&5
+echo "${ECHO_T}$ac_cv_lib_resolv_strcasecmp" >&6; }
+if test $ac_cv_lib_resolv_strcasecmp = yes; then
LIBS="$LIBS -lresolv"
fi
@@ -8886,23 +14017,110 @@
fi
+
for ac_func in utimes
-do :
- ac_fn_c_check_func "$LINENO" "utimes" "ac_cv_func_utimes"
-if test "x$ac_cv_func_utimes" = xyes; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_UTIMES 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for utimes in -lc89" >&5
-$as_echo_n "checking for utimes in -lc89... " >&6; }
-if ${ac_cv_lib_c89_utimes+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for utimes in -lc89" >&5
+echo $ECHO_N "checking for utimes in -lc89... $ECHO_C" >&6; }
+if test "${ac_cv_lib_c89_utimes+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lc89 $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8920,19 +14138,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_c89_utimes=yes
else
- ac_cv_lib_c89_utimes=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_c89_utimes=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_c89_utimes" >&5
-$as_echo "$ac_cv_lib_c89_utimes" >&6; }
-if test "x$ac_cv_lib_c89_utimes" = xyes; then :
- $as_echo "#define HAVE_UTIMES 1" >>confdefs.h
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_c89_utimes" >&5
+echo "${ECHO_T}$ac_cv_lib_c89_utimes" >&6; }
+if test $ac_cv_lib_c89_utimes = yes; then
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_UTIMES 1
+_ACEOF
LIBS="$LIBS -lc89"
fi
@@ -8942,13 +14183,146 @@
done
+
+
for ac_header in bsd/libutil.h libutil.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -8955,13 +14329,17 @@
done
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing fmt_scaled" >&5
-$as_echo_n "checking for library containing fmt_scaled... " >&6; }
-if ${ac_cv_search_fmt_scaled+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing fmt_scaled" >&5
+echo $ECHO_N "checking for library containing fmt_scaled... $ECHO_C" >&6; }
+if test "${ac_cv_search_fmt_scaled+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -8986,17 +14364,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_fmt_scaled=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_fmt_scaled+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_fmt_scaled+set}" = set; then
break
fi
done
-if ${ac_cv_search_fmt_scaled+:} false; then :
-
+if test "${ac_cv_search_fmt_scaled+set}" = set; then
+ :
else
ac_cv_search_fmt_scaled=no
fi
@@ -9003,21 +14404,25 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_fmt_scaled" >&5
-$as_echo "$ac_cv_search_fmt_scaled" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_fmt_scaled" >&5
+echo "${ECHO_T}$ac_cv_search_fmt_scaled" >&6; }
ac_res=$ac_cv_search_fmt_scaled
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing scan_scaled" >&5
-$as_echo_n "checking for library containing scan_scaled... " >&6; }
-if ${ac_cv_search_scan_scaled+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing scan_scaled" >&5
+echo $ECHO_N "checking for library containing scan_scaled... $ECHO_C" >&6; }
+if test "${ac_cv_search_scan_scaled+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -9042,17 +14447,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_scan_scaled=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_scan_scaled+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_scan_scaled+set}" = set; then
break
fi
done
-if ${ac_cv_search_scan_scaled+:} false; then :
-
+if test "${ac_cv_search_scan_scaled+set}" = set; then
+ :
else
ac_cv_search_scan_scaled=no
fi
@@ -9059,21 +14487,25 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_scan_scaled" >&5
-$as_echo "$ac_cv_search_scan_scaled" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_scan_scaled" >&5
+echo "${ECHO_T}$ac_cv_search_scan_scaled" >&6; }
ac_res=$ac_cv_search_scan_scaled
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing login" >&5
-$as_echo_n "checking for library containing login... " >&6; }
-if ${ac_cv_search_login+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing login" >&5
+echo $ECHO_N "checking for library containing login... $ECHO_C" >&6; }
+if test "${ac_cv_search_login+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -9098,17 +14530,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_login=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_login+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_login+set}" = set; then
break
fi
done
-if ${ac_cv_search_login+:} false; then :
-
+if test "${ac_cv_search_login+set}" = set; then
+ :
else
ac_cv_search_login=no
fi
@@ -9115,21 +14570,25 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_login" >&5
-$as_echo "$ac_cv_search_login" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_login" >&5
+echo "${ECHO_T}$ac_cv_search_login" >&6; }
ac_res=$ac_cv_search_login
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing logout" >&5
-$as_echo_n "checking for library containing logout... " >&6; }
-if ${ac_cv_search_logout+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing logout" >&5
+echo $ECHO_N "checking for library containing logout... $ECHO_C" >&6; }
+if test "${ac_cv_search_logout+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -9154,17 +14613,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_logout=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_logout+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_logout+set}" = set; then
break
fi
done
-if ${ac_cv_search_logout+:} false; then :
-
+if test "${ac_cv_search_logout+set}" = set; then
+ :
else
ac_cv_search_logout=no
fi
@@ -9171,21 +14653,25 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_logout" >&5
-$as_echo "$ac_cv_search_logout" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_logout" >&5
+echo "${ECHO_T}$ac_cv_search_logout" >&6; }
ac_res=$ac_cv_search_logout
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing logwtmp" >&5
-$as_echo_n "checking for library containing logwtmp... " >&6; }
-if ${ac_cv_search_logwtmp+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing logwtmp" >&5
+echo $ECHO_N "checking for library containing logwtmp... $ECHO_C" >&6; }
+if test "${ac_cv_search_logwtmp+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -9210,17 +14696,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_logwtmp=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_logwtmp+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_logwtmp+set}" = set; then
break
fi
done
-if ${ac_cv_search_logwtmp+:} false; then :
-
+if test "${ac_cv_search_logwtmp+set}" = set; then
+ :
else
ac_cv_search_logwtmp=no
fi
@@ -9227,21 +14736,25 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_logwtmp" >&5
-$as_echo "$ac_cv_search_logwtmp" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_logwtmp" >&5
+echo "${ECHO_T}$ac_cv_search_logwtmp" >&6; }
ac_res=$ac_cv_search_logwtmp
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing openpty" >&5
-$as_echo_n "checking for library containing openpty... " >&6; }
-if ${ac_cv_search_openpty+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing openpty" >&5
+echo $ECHO_N "checking for library containing openpty... $ECHO_C" >&6; }
+if test "${ac_cv_search_openpty+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -9266,17 +14779,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_openpty=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_openpty+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_openpty+set}" = set; then
break
fi
done
-if ${ac_cv_search_openpty+:} false; then :
-
+if test "${ac_cv_search_openpty+set}" = set; then
+ :
else
ac_cv_search_openpty=no
fi
@@ -9283,21 +14819,25 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_openpty" >&5
-$as_echo "$ac_cv_search_openpty" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_openpty" >&5
+echo "${ECHO_T}$ac_cv_search_openpty" >&6; }
ac_res=$ac_cv_search_openpty
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing updwtmp" >&5
-$as_echo_n "checking for library containing updwtmp... " >&6; }
-if ${ac_cv_search_updwtmp+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing updwtmp" >&5
+echo $ECHO_N "checking for library containing updwtmp... $ECHO_C" >&6; }
+if test "${ac_cv_search_updwtmp+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -9322,17 +14862,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_updwtmp=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_updwtmp+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_updwtmp+set}" = set; then
break
fi
done
-if ${ac_cv_search_updwtmp+:} false; then :
-
+if test "${ac_cv_search_updwtmp+set}" = set; then
+ :
else
ac_cv_search_updwtmp=no
fi
@@ -9339,21 +14902,109 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_updwtmp" >&5
-$as_echo "$ac_cv_search_updwtmp" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_updwtmp" >&5
+echo "${ECHO_T}$ac_cv_search_updwtmp" >&6; }
ac_res=$ac_cv_search_updwtmp
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
+
+
+
+
+
+
+
for ac_func in fmt_scaled scan_scaled login logout openpty updwtmp logwtmp
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -9360,14 +15011,19 @@
done
-# On some platforms, inet_ntop may be found in libresolv or libnsl.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing inet_ntop" >&5
-$as_echo_n "checking for library containing inet_ntop... " >&6; }
-if ${ac_cv_search_inet_ntop+:} false; then :
- $as_echo_n "(cached) " >&6
+# On some platforms, inet_ntop and gethostbyname may be found in libresolv
+# or libnsl.
+{ echo "$as_me:$LINENO: checking for library containing inet_ntop" >&5
+echo $ECHO_N "checking for library containing inet_ntop... $ECHO_C" >&6; }
+if test "${ac_cv_search_inet_ntop+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -9392,17 +15048,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_inet_ntop=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_inet_ntop+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_inet_ntop+set}" = set; then
break
fi
done
-if ${ac_cv_search_inet_ntop+:} false; then :
-
+if test "${ac_cv_search_inet_ntop+set}" = set; then
+ :
else
ac_cv_search_inet_ntop=no
fi
@@ -9409,33 +15088,203 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_ntop" >&5
-$as_echo "$ac_cv_search_inet_ntop" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_inet_ntop" >&5
+echo "${ECHO_T}$ac_cv_search_inet_ntop" >&6; }
ac_res=$ac_cv_search_inet_ntop
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
+{ echo "$as_me:$LINENO: checking for library containing gethostbyname" >&5
+echo $ECHO_N "checking for library containing gethostbyname... $ECHO_C" >&6; }
+if test "${ac_cv_search_gethostbyname+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ ac_func_search_save_LIBS=$LIBS
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char gethostbyname ();
+int
+main ()
+{
+return gethostbyname ();
+ ;
+ return 0;
+}
+_ACEOF
+for ac_lib in '' resolv nsl; do
+ if test -z "$ac_lib"; then
+ ac_res="none required"
+ else
+ ac_res=-l$ac_lib
+ LIBS="-l$ac_lib $ac_func_search_save_LIBS"
+ fi
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_search_gethostbyname=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_gethostbyname+set}" = set; then
+ break
+fi
+done
+if test "${ac_cv_search_gethostbyname+set}" = set; then
+ :
+else
+ ac_cv_search_gethostbyname=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_search_gethostbyname" >&5
+echo "${ECHO_T}$ac_cv_search_gethostbyname" >&6; }
+ac_res=$ac_cv_search_gethostbyname
+if test "$ac_res" != no; then
+ test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+
+
for ac_func in strftime
-do :
- ac_fn_c_check_func "$LINENO" "strftime" "ac_cv_func_strftime"
-if test "x$ac_cv_func_strftime" = xyes; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_STRFTIME 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
else
# strftime is in -lintl on SCO UNIX.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for strftime in -lintl" >&5
-$as_echo_n "checking for strftime in -lintl... " >&6; }
-if ${ac_cv_lib_intl_strftime+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for strftime in -lintl" >&5
+echo $ECHO_N "checking for strftime in -lintl... $ECHO_C" >&6; }
+if test "${ac_cv_lib_intl_strftime+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lintl $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -9453,19 +15302,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_intl_strftime=yes
else
- ac_cv_lib_intl_strftime=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_intl_strftime=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_intl_strftime" >&5
-$as_echo "$ac_cv_lib_intl_strftime" >&6; }
-if test "x$ac_cv_lib_intl_strftime" = xyes; then :
- $as_echo "#define HAVE_STRFTIME 1" >>confdefs.h
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_intl_strftime" >&5
+echo "${ECHO_T}$ac_cv_lib_intl_strftime" >&6; }
+if test $ac_cv_lib_intl_strftime = yes; then
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_STRFTIME 1
+_ACEOF
LIBS="-lintl $LIBS"
fi
@@ -9475,9 +15347,13 @@
# Check for ALTDIRFUNC glob() extension
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for GLOB_ALTDIRFUNC support" >&5
-$as_echo_n "checking for GLOB_ALTDIRFUNC support... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking for GLOB_ALTDIRFUNC support" >&5
+echo $ECHO_N "checking for GLOB_ALTDIRFUNC support... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <glob.h>
@@ -9487,18 +15363,20 @@
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "FOUNDIT" >/dev/null 2>&1; then :
+ $EGREP "FOUNDIT" >/dev/null 2>&1; then
-$as_echo "#define GLOB_HAS_ALTDIRFUNC 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define GLOB_HAS_ALTDIRFUNC 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -9506,9 +15384,13 @@
# Check for g.gl_matchc glob() extension
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for gl_matchc field in glob_t" >&5
-$as_echo_n "checking for gl_matchc field in glob_t... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking for gl_matchc field in glob_t" >&5
+echo $ECHO_N "checking for gl_matchc field in glob_t... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <glob.h>
int
@@ -9519,26 +15401,52 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
-$as_echo "#define GLOB_HAS_GL_MATCHC 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define GLOB_HAS_GL_MATCHC 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
# Check for g.gl_statv glob() extension
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for gl_statv and GLOB_KEEPSTAT extensions for glob" >&5
-$as_echo_n "checking for gl_statv and GLOB_KEEPSTAT extensions for glob... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking for gl_statv and GLOB_KEEPSTAT extensions for glob" >&5
+echo $ECHO_N "checking for gl_statv and GLOB_KEEPSTAT extensions for glob... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <glob.h>
int
@@ -9555,50 +15463,199 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
-$as_echo "#define GLOB_HAS_GL_STATV 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define GLOB_HAS_GL_STATV 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-ac_fn_c_check_decl "$LINENO" "GLOB_NOMATCH" "ac_cv_have_decl_GLOB_NOMATCH" "#include <glob.h>
-"
-if test "x$ac_cv_have_decl_GLOB_NOMATCH" = xyes; then :
- ac_have_decl=1
+{ echo "$as_me:$LINENO: checking whether GLOB_NOMATCH is declared" >&5
+echo $ECHO_N "checking whether GLOB_NOMATCH is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_GLOB_NOMATCH+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- ac_have_decl=0
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <glob.h>
+
+int
+main ()
+{
+#ifndef GLOB_NOMATCH
+ (void) GLOB_NOMATCH;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_GLOB_NOMATCH=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_GLOB_NOMATCH=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_GLOB_NOMATCH" >&5
+echo "${ECHO_T}$ac_cv_have_decl_GLOB_NOMATCH" >&6; }
+if test $ac_cv_have_decl_GLOB_NOMATCH = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_GLOB_NOMATCH $ac_have_decl
+#define HAVE_DECL_GLOB_NOMATCH 1
_ACEOF
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether struct dirent allocates space for d_name" >&5
-$as_echo_n "checking whether struct dirent allocates space for d_name... " >&6; }
-if test "$cross_compiling" = yes; then :
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_GLOB_NOMATCH 0
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME" >&5
-$as_echo "$as_me: WARNING: cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME" >&2;}
- $as_echo "#define BROKEN_ONE_BYTE_DIRENT_D_NAME 1" >>confdefs.h
+fi
+
+{ echo "$as_me:$LINENO: checking whether VIS_ALL is declared" >&5
+echo $ECHO_N "checking whether VIS_ALL is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_VIS_ALL+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
+#include <vis.h>
+int
+main ()
+{
+#ifndef VIS_ALL
+ (void) VIS_ALL;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_VIS_ALL=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_VIS_ALL=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_VIS_ALL" >&5
+echo "${ECHO_T}$ac_cv_have_decl_VIS_ALL" >&6; }
+if test $ac_cv_have_decl_VIS_ALL = yes; then
+ :
+else
+
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_STRNVIS 1
+_ACEOF
+
+fi
+
+
+{ echo "$as_me:$LINENO: checking whether struct dirent allocates space for d_name" >&5
+echo $ECHO_N "checking whether struct dirent allocates space for d_name... $ECHO_C" >&6; }
+if test "$cross_compiling" = yes; then
+
+ { echo "$as_me:$LINENO: WARNING: cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME" >&5
+echo "$as_me: WARNING: cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME" >&2;}
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_ONE_BYTE_DIRENT_D_NAME 1
+_ACEOF
+
+
+
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <dirent.h>
int
@@ -9612,34 +15669,62 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+( exit $ac_status )
-$as_echo "#define BROKEN_ONE_BYTE_DIRENT_D_NAME 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_ONE_BYTE_DIRENT_D_NAME 1
+_ACEOF
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for /proc/pid/fd directory" >&5
-$as_echo_n "checking for /proc/pid/fd directory... " >&6; }
+
+{ echo "$as_me:$LINENO: checking for /proc/pid/fd directory" >&5
+echo $ECHO_N "checking for /proc/pid/fd directory... $ECHO_C" >&6; }
if test -d "/proc/$$/fd" ; then
-$as_echo "#define HAVE_PROC_PID 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_PROC_PID 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
# Check whether user wants S/Key support
@@ -9646,7 +15731,7 @@
SKEY_MSG="no"
# Check whether --with-skey was given.
-if test "${with_skey+set}" = set; then :
+if test "${with_skey+set}" = set; then
withval=$with_skey;
if test "x$withval" != "xno" ; then
@@ -9656,14 +15741,20 @@
fi
-$as_echo "#define SKEY 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SKEY 1
+_ACEOF
LIBS="-lskey $LIBS"
SKEY_MSG="yes"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for s/key support" >&5
-$as_echo_n "checking for s/key support... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for s/key support" >&5
+echo $ECHO_N "checking for s/key support... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -9680,21 +15771,48 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- as_fn_error $? "** Incomplete or missing s/key libraries." "$LINENO" 5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ { { echo "$as_me:$LINENO: error: ** Incomplete or missing s/key libraries." >&5
+echo "$as_me: error: ** Incomplete or missing s/key libraries." >&2;}
+ { (exit 1); exit 1; }; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if skeychallenge takes 4 arguments" >&5
-$as_echo_n "checking if skeychallenge takes 4 arguments... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking if skeychallenge takes 4 arguments" >&5
+echo $ECHO_N "checking if skeychallenge takes 4 arguments... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -9710,98 +15828,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define SKEYCHALLENGE_4ARG 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SKEYCHALLENGE_4ARG 1
+_ACEOF
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- fi
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
-
fi
-
-# Check whether user wants TCP wrappers support
-TCPW_MSG="no"
-
-# Check whether --with-tcp-wrappers was given.
-if test "${with_tcp_wrappers+set}" = set; then :
- withval=$with_tcp_wrappers;
- if test "x$withval" != "xno" ; then
- saved_LIBS="$LIBS"
- saved_LDFLAGS="$LDFLAGS"
- saved_CPPFLAGS="$CPPFLAGS"
- if test -n "${withval}" && \
- test "x${withval}" != "xyes"; then
- if test -d "${withval}/lib"; then
- if test -n "${need_dash_r}"; then
- LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
- else
- LDFLAGS="-L${withval}/lib ${LDFLAGS}"
- fi
- else
- if test -n "${need_dash_r}"; then
- LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
- else
- LDFLAGS="-L${withval} ${LDFLAGS}"
- fi
- fi
- if test -d "${withval}/include"; then
- CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
- else
- CPPFLAGS="-I${withval} ${CPPFLAGS}"
- fi
- fi
- LIBS="-lwrap $LIBS"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libwrap" >&5
-$as_echo_n "checking for libwrap... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <tcpd.h>
-int deny_severity = 0, allow_severity = 0;
-
-int
-main ()
-{
-
- hosts_access(0);
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-
-$as_echo "#define LIBWRAP 1" >>confdefs.h
-
- SSHDLIBS="$SSHDLIBS -lwrap"
- TCPW_MSG="yes"
-
-else
-
- as_fn_error $? "*** libwrap missing" "$LINENO" 5
-
-
-fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
- LIBS="$saved_LIBS"
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
@@ -9812,7 +15874,7 @@
LDNS_MSG="no"
# Check whether --with-ldns was given.
-if test "${with_ldns+set}" = set; then :
+if test "${with_ldns+set}" = set; then
withval=$with_ldns;
if test "x$withval" != "xno" ; then
@@ -9822,14 +15884,20 @@
fi
-$as_echo "#define HAVE_LDNS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_LDNS 1
+_ACEOF
LIBS="-lldns $LIBS"
LDNS_MSG="yes"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ldns support" >&5
-$as_echo_n "checking for ldns support... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for ldns support" >&5
+echo $ECHO_N "checking for ldns support... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -9840,18 +15908,41 @@
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- as_fn_error $? "** Incomplete or missing ldns libraries." "$LINENO" 5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ { { echo "$as_me:$LINENO: error: ** Incomplete or missing ldns libraries." >&5
+echo "$as_me: error: ** Incomplete or missing ldns libraries." >&2;}
+ { (exit 1); exit 1; }; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
fi
@@ -9862,16 +15953,16 @@
LIBEDIT_MSG="no"
# Check whether --with-libedit was given.
-if test "${with_libedit+set}" = set; then :
+if test "${with_libedit+set}" = set; then
withval=$with_libedit; if test "x$withval" != "xno" ; then
if test "x$withval" = "xyes" ; then
if test -n "$ac_tool_prefix"; then
# Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args.
set dummy ${ac_tool_prefix}pkg-config; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_PKGCONFIG+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_PKGCONFIG+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $PKGCONFIG in
[\\/]* | ?:[\\/]*)
@@ -9883,14 +15974,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_PKGCONFIG="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -9898,11 +15989,11 @@
fi
PKGCONFIG=$ac_cv_path_PKGCONFIG
if test -n "$PKGCONFIG"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PKGCONFIG" >&5
-$as_echo "$PKGCONFIG" >&6; }
+ { echo "$as_me:$LINENO: result: $PKGCONFIG" >&5
+echo "${ECHO_T}$PKGCONFIG" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -9911,10 +16002,10 @@
ac_pt_PKGCONFIG=$PKGCONFIG
# Extract the first word of "pkg-config", so it can be a program name with args.
set dummy pkg-config; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_ac_pt_PKGCONFIG+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_ac_pt_PKGCONFIG+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $ac_pt_PKGCONFIG in
[\\/]* | ?:[\\/]*)
@@ -9926,14 +16017,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_ac_pt_PKGCONFIG="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -9941,11 +16032,11 @@
fi
ac_pt_PKGCONFIG=$ac_cv_path_ac_pt_PKGCONFIG
if test -n "$ac_pt_PKGCONFIG"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_PKGCONFIG" >&5
-$as_echo "$ac_pt_PKGCONFIG" >&6; }
+ { echo "$as_me:$LINENO: result: $ac_pt_PKGCONFIG" >&5
+echo "${ECHO_T}$ac_pt_PKGCONFIG" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
if test "x$ac_pt_PKGCONFIG" = x; then
@@ -9953,8 +16044,12 @@
else
case $cross_compiling:$ac_tool_warned in
yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&5
+echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools
+whose name does not start with the host triplet. If you think this
+configuration is useful to you, please write to autoconf at gnu.org." >&2;}
ac_tool_warned=yes ;;
esac
PKGCONFIG=$ac_pt_PKGCONFIG
@@ -9964,15 +16059,15 @@
fi
if test "x$PKGCONFIG" != "xno"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $PKGCONFIG knows about libedit" >&5
-$as_echo_n "checking if $PKGCONFIG knows about libedit... " >&6; }
- if "$PKGCONFIG" libedit; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: checking if $PKGCONFIG knows about libedit" >&5
+echo $ECHO_N "checking if $PKGCONFIG knows about libedit... $ECHO_C" >&6; }
+ if "$PKGCONFIG" libedit; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
use_pkgconfig_for_libedit=yes
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
fi
else
@@ -9990,15 +16085,19 @@
LIBEDIT="-ledit -lcurses"
fi
OTHERLIBS=`echo $LIBEDIT | sed 's/-ledit//'`
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for el_init in -ledit" >&5
-$as_echo_n "checking for el_init in -ledit... " >&6; }
-if ${ac_cv_lib_edit_el_init+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for el_init in -ledit" >&5
+echo $ECHO_N "checking for el_init in -ledit... $ECHO_C" >&6; }
+if test "${ac_cv_lib_edit_el_init+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-ledit $OTHERLIBS
$LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -10016,31 +16115,60 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_edit_el_init=yes
else
- ac_cv_lib_edit_el_init=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_edit_el_init=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_edit_el_init" >&5
-$as_echo "$ac_cv_lib_edit_el_init" >&6; }
-if test "x$ac_cv_lib_edit_el_init" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_edit_el_init" >&5
+echo "${ECHO_T}$ac_cv_lib_edit_el_init" >&6; }
+if test $ac_cv_lib_edit_el_init = yes; then
-$as_echo "#define USE_LIBEDIT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_LIBEDIT 1
+_ACEOF
LIBEDIT_MSG="yes"
else
- as_fn_error $? "libedit not found" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: libedit not found" >&5
+echo "$as_me: error: libedit not found" >&2;}
+ { (exit 1); exit 1; }; }
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libedit version is compatible" >&5
-$as_echo_n "checking if libedit version is compatible... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking if libedit version is compatible" >&5
+echo $ECHO_N "checking if libedit version is compatible... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <histedit.h>
int
@@ -10055,15 +16183,37 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- as_fn_error $? "libedit version is not compatible" "$LINENO" 5
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ { { echo "$as_me:$LINENO: error: libedit version is not compatible" >&5
+echo "$as_me: error: libedit version is not compatible" >&2;}
+ { (exit 1); exit 1; }; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
@@ -10073,43 +16223,95 @@
AUDIT_MODULE=none
# Check whether --with-audit was given.
-if test "${with_audit+set}" = set; then :
+if test "${with_audit+set}" = set; then
withval=$with_audit;
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for supported audit module" >&5
-$as_echo_n "checking for supported audit module... " >&6; }
+ { echo "$as_me:$LINENO: checking for supported audit module" >&5
+echo $ECHO_N "checking for supported audit module... $ECHO_C" >&6; }
case "$withval" in
bsm)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: bsm" >&5
-$as_echo "bsm" >&6; }
+ { echo "$as_me:$LINENO: result: bsm" >&5
+echo "${ECHO_T}bsm" >&6; }
AUDIT_MODULE=bsm
- for ac_header in bsm/audit.h
-do :
- ac_fn_c_check_header_compile "$LINENO" "bsm/audit.h" "ac_cv_header_bsm_audit_h" "
+
+for ac_header in bsm/audit.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#ifdef HAVE_TIME_H
# include <time.h>
#endif
-"
-if test "x$ac_cv_header_bsm_audit_h" = xyes; then :
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ eval "$as_ac_Header=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_BSM_AUDIT_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
else
- as_fn_error $? "BSM enabled and bsm/audit.h not found" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: BSM enabled and bsm/audit.h not found" >&5
+echo "$as_me: error: BSM enabled and bsm/audit.h not found" >&2;}
+ { (exit 1); exit 1; }; }
fi
done
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for getaudit in -lbsm" >&5
-$as_echo_n "checking for getaudit in -lbsm... " >&6; }
-if ${ac_cv_lib_bsm_getaudit+:} false; then :
- $as_echo_n "(cached) " >&6
+
+{ echo "$as_me:$LINENO: checking for getaudit in -lbsm" >&5
+echo $ECHO_N "checking for getaudit in -lbsm... $ECHO_C" >&6; }
+if test "${ac_cv_lib_bsm_getaudit+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lbsm $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -10127,18 +16329,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_bsm_getaudit=yes
else
- ac_cv_lib_bsm_getaudit=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_bsm_getaudit=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_bsm_getaudit" >&5
-$as_echo "$ac_cv_lib_bsm_getaudit" >&6; }
-if test "x$ac_cv_lib_bsm_getaudit" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_bsm_getaudit" >&5
+echo "${ECHO_T}$ac_cv_lib_bsm_getaudit" >&6; }
+if test $ac_cv_lib_bsm_getaudit = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBBSM 1
_ACEOF
@@ -10146,30 +16369,200 @@
LIBS="-lbsm $LIBS"
else
- as_fn_error $? "BSM enabled and required library not found" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: BSM enabled and required library not found" >&5
+echo "$as_me: error: BSM enabled and required library not found" >&2;}
+ { (exit 1); exit 1; }; }
fi
- for ac_func in getaudit
-do :
- ac_fn_c_check_func "$LINENO" "getaudit" "ac_cv_func_getaudit"
-if test "x$ac_cv_func_getaudit" = xyes; then :
+
+for ac_func in getaudit
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_GETAUDIT 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
else
- as_fn_error $? "BSM enabled and required function not found" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: BSM enabled and required function not found" >&5
+echo "$as_me: error: BSM enabled and required function not found" >&2;}
+ { (exit 1); exit 1; }; }
fi
done
# These are optional
- for ac_func in getaudit_addr aug_get_machine
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+
+
+for ac_func in getaudit_addr aug_get_machine
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -10176,25 +16569,162 @@
done
-$as_echo "#define USE_BSM_AUDIT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_BSM_AUDIT 1
+_ACEOF
if test "$sol2ver" -ge 11; then
- SSHDLIBS="$SSHDLIBS -lscf"
+ SSHDLIBS="$SSHDLIBS -lscf"
-$as_echo "#define BROKEN_BSM_API 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_BSM_API 1
+_ACEOF
fi
;;
linux)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: linux" >&5
-$as_echo "linux" >&6; }
+ { echo "$as_me:$LINENO: result: linux" >&5
+echo "${ECHO_T}linux" >&6; }
AUDIT_MODULE=linux
- for ac_header in libaudit.h
-do :
- ac_fn_c_check_header_mongrel "$LINENO" "libaudit.h" "ac_cv_header_libaudit_h" "$ac_includes_default"
-if test "x$ac_cv_header_libaudit_h" = xyes; then :
+
+for ac_header in libaudit.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBAUDIT_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -10203,23 +16733,29 @@
SSHDLIBS="$SSHDLIBS -laudit"
-$as_echo "#define USE_LINUX_AUDIT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_LINUX_AUDIT 1
+_ACEOF
;;
debug)
AUDIT_MODULE=debug
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: debug" >&5
-$as_echo "debug" >&6; }
+ { echo "$as_me:$LINENO: result: debug" >&5
+echo "${ECHO_T}debug" >&6; }
-$as_echo "#define SSH_AUDIT_EVENTS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SSH_AUDIT_EVENTS 1
+_ACEOF
;;
no)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
;;
*)
- as_fn_error $? "Unknown audit module $withval" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: Unknown audit module $withval" >&5
+echo "$as_me: error: Unknown audit module $withval" >&2;}
+ { (exit 1); exit 1; }; }
;;
esac
@@ -10228,7 +16764,7 @@
# Check whether --with-pie was given.
-if test "${with_pie+set}" = set; then :
+if test "${with_pie+set}" = set; then
withval=$with_pie;
if test "x$withval" = "xno"; then
use_pie=no
@@ -10249,9 +16785,13 @@
fi
if test "x$use_pie" = "xauto"; then
# Automatic PIE requires gcc >= 4.x
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gcc >= 4.x" >&5
-$as_echo_n "checking for gcc >= 4.x... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for gcc >= 4.x" >&5
+echo $ECHO_N "checking for gcc >= 4.x... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#if !defined(__GNUC__) || __GNUC__ < 4
@@ -10259,15 +16799,35 @@
#endif
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
use_pie=no
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
if test "x$use_pie" != "xno"; then
@@ -10274,13 +16834,17 @@
SAVED_CFLAGS="$CFLAGS"
SAVED_LDFLAGS="$LDFLAGS"
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC supports compile flag -fPIE" >&5
-$as_echo_n "checking if $CC supports compile flag -fPIE... " >&6; }
+ { echo "$as_me:$LINENO: checking if $CC supports compile flag -fPIE" >&5
+echo $ECHO_N "checking if $CC supports compile flag -fPIE... $ECHO_C" >&6; }
saved_CFLAGS="$CFLAGS"
CFLAGS="$CFLAGS $WERROR -fPIE"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-fPIE"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -10296,34 +16860,58 @@
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
if `grep -i "unrecognized option" conftest.err >/dev/null`
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
CFLAGS="$saved_CFLAGS $_define_flag"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$saved_CFLAGS"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
}
{
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $LD supports link flag -pie" >&5
-$as_echo_n "checking if $LD supports link flag -pie... " >&6; }
+ { echo "$as_me:$LINENO: checking if $LD supports link flag -pie" >&5
+echo $ECHO_N "checking if $LD supports link flag -pie... $ECHO_C" >&6; }
saved_LDFLAGS="$LDFLAGS"
LDFLAGS="$LDFLAGS $WERROR -pie"
_define_flag=""
test "x$_define_flag" = "x" && _define_flag="-pie"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -10339,43 +16927,171 @@
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
LDFLAGS="$saved_LDFLAGS $_define_flag"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
LDFLAGS="$saved_LDFLAGS"
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
}
# We use both -fPIE and -pie or neither.
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether both -fPIE and -pie are supported" >&5
-$as_echo_n "checking whether both -fPIE and -pie are supported... " >&6; }
+ { echo "$as_me:$LINENO: checking whether both -fPIE and -pie are supported" >&5
+echo $ECHO_N "checking whether both -fPIE and -pie are supported... $ECHO_C" >&6; }
if echo "x $CFLAGS" | grep ' -fPIE' >/dev/null 2>&1 && \
echo "x $LDFLAGS" | grep ' -pie' >/dev/null 2>&1 ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
CFLAGS="$SAVED_CFLAGS"
LDFLAGS="$SAVED_LDFLAGS"
fi
fi
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
for ac_func in \
Blowfish_initstate \
Blowfish_expandstate \
Blowfish_expand0state \
Blowfish_stream2word \
- arc4random \
- arc4random_buf \
- arc4random_stir \
- arc4random_uniform \
asprintf \
b64_ntop \
__b64_ntop \
@@ -10390,6 +17106,8 @@
closefrom \
dirfd \
endgrent \
+ err \
+ errx \
explicit_bzero \
fchmod \
fchown \
@@ -10416,9 +17134,9 @@
inet_ntop \
innetgr \
login_getcapbool \
- mblen \
md5_crypt \
memmove \
+ memset_s \
mkdtemp \
mmap \
ngetaddrinfo \
@@ -10425,11 +17143,12 @@
nsleep \
ogetaddrinfo \
openlog_r \
+ pledge \
poll \
prctl \
pstat \
readpassphrase \
- realpath \
+ reallocarray \
recvmsg \
rresvport_af \
sendmsg \
@@ -10477,16 +17196,97 @@
user_from_uid \
usleep \
vasprintf \
- vhangup \
vsnprintf \
waitpid \
+ warn \
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -10493,8 +17293,113 @@
done
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+saved_CFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -D_XOPEN_SOURCE"
+
+
+
+
+for ac_func in mblen mbtowc nl_langinfo wcwidth
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+
+CFLAGS="$saved_CFLAGS"
+
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
#include <ctype.h>
int
main ()
@@ -10504,23 +17409,66 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
-$as_echo "#define HAVE_ISBLANK 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ISBLANK 1
+_ACEOF
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-# PKCS#11 support requires dlopen() and co
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing dlopen" >&5
-$as_echo_n "checking for library containing dlopen... " >&6; }
-if ${ac_cv_search_dlopen+:} false; then :
- $as_echo_n "(cached) " >&6
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+disable_pkcs11=
+# Check whether --enable-pkcs11 was given.
+if test "${enable_pkcs11+set}" = set; then
+ enableval=$enable_pkcs11;
+ if test "x$enableval" = "xno" ; then
+ disable_pkcs11=1
+ fi
+
+
+fi
+
+
+# PKCS11 depends on OpenSSL.
+if test "x$openssl" = "xyes" && test "x$disable_pkcs11" = "x"; then
+ # PKCS#11 support requires dlopen() and co
+ { echo "$as_me:$LINENO: checking for library containing dlopen" >&5
+echo $ECHO_N "checking for library containing dlopen... $ECHO_C" >&6; }
+if test "${ac_cv_search_dlopen+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -10545,17 +17493,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_dlopen=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_dlopen+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_dlopen+set}" = set; then
break
fi
done
-if ${ac_cv_search_dlopen+:} false; then :
-
+if test "${ac_cv_search_dlopen+set}" = set; then
+ :
else
ac_cv_search_dlopen=no
fi
@@ -10562,30 +17533,122 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_dlopen" >&5
-$as_echo "$ac_cv_search_dlopen" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_dlopen" >&5
+echo "${ECHO_T}$ac_cv_search_dlopen" >&6; }
ac_res=$ac_cv_search_dlopen
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
-$as_echo "#define ENABLE_PKCS11 /**/" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define ENABLE_PKCS11
+_ACEOF
fi
+fi
# IRIX has a const char return value for gai_strerror()
+
for ac_func in gai_strerror
-do :
- ac_fn_c_check_func "$LINENO" "gai_strerror" "ac_cv_func_gai_strerror"
-if test "x$ac_cv_func_gai_strerror" = xyes; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+ cat >>confdefs.h <<\_ACEOF
#define HAVE_GAI_STRERROR 1
_ACEOF
- $as_echo "#define HAVE_GAI_STRERROR 1" >>confdefs.h
-
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -10605,24 +17668,52 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
-$as_echo "#define HAVE_CONST_GAI_STRERROR_PROTO 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_CONST_GAI_STRERROR_PROTO 1
+_ACEOF
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
done
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing nanosleep" >&5
-$as_echo_n "checking for library containing nanosleep... " >&6; }
-if ${ac_cv_search_nanosleep+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing nanosleep" >&5
+echo $ECHO_N "checking for library containing nanosleep... $ECHO_C" >&6; }
+if test "${ac_cv_search_nanosleep+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -10647,17 +17738,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_nanosleep=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_nanosleep+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_nanosleep+set}" = set; then
break
fi
done
-if ${ac_cv_search_nanosleep+:} false; then :
-
+if test "${ac_cv_search_nanosleep+set}" = set; then
+ :
else
ac_cv_search_nanosleep=no
fi
@@ -10664,24 +17778,30 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_nanosleep" >&5
-$as_echo "$ac_cv_search_nanosleep" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_nanosleep" >&5
+echo "${ECHO_T}$ac_cv_search_nanosleep" >&6; }
ac_res=$ac_cv_search_nanosleep
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
-$as_echo "#define HAVE_NANOSLEEP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_NANOSLEEP 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing clock_gettime" >&5
-$as_echo_n "checking for library containing clock_gettime... " >&6; }
-if ${ac_cv_search_clock_gettime+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing clock_gettime" >&5
+echo $ECHO_N "checking for library containing clock_gettime... $ECHO_C" >&6; }
+if test "${ac_cv_search_clock_gettime+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -10706,17 +17826,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_clock_gettime=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_clock_gettime+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_clock_gettime+set}" = set; then
break
fi
done
-if ${ac_cv_search_clock_gettime+:} false; then :
-
+if test "${ac_cv_search_clock_gettime+set}" = set; then
+ :
else
ac_cv_search_clock_gettime=no
fi
@@ -10723,25 +17866,161 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_clock_gettime" >&5
-$as_echo "$ac_cv_search_clock_gettime" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_clock_gettime" >&5
+echo "${ECHO_T}$ac_cv_search_clock_gettime" >&6; }
ac_res=$ac_cv_search_clock_gettime
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
-$as_echo "#define HAVE_CLOCK_GETTIME 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_CLOCK_GETTIME 1
+_ACEOF
fi
-ac_fn_c_check_decl "$LINENO" "getrusage" "ac_cv_have_decl_getrusage" "$ac_includes_default"
-if test "x$ac_cv_have_decl_getrusage" = xyes; then :
- for ac_func in getrusage
-do :
- ac_fn_c_check_func "$LINENO" "getrusage" "ac_cv_func_getrusage"
-if test "x$ac_cv_func_getrusage" = xyes; then :
+{ echo "$as_me:$LINENO: checking whether getrusage is declared" >&5
+echo $ECHO_N "checking whether getrusage is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_getrusage+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+int
+main ()
+{
+#ifndef getrusage
+ (void) getrusage;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_getrusage=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_getrusage=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_getrusage" >&5
+echo "${ECHO_T}$ac_cv_have_decl_getrusage" >&6; }
+if test $ac_cv_have_decl_getrusage = yes; then
+
+for ac_func in getrusage
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_GETRUSAGE 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -10749,19 +18028,153 @@
fi
-ac_fn_c_check_decl "$LINENO" "strsep" "ac_cv_have_decl_strsep" "
+{ echo "$as_me:$LINENO: checking whether strsep is declared" >&5
+echo $ECHO_N "checking whether strsep is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_strsep+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#ifdef HAVE_STRING_H
# include <string.h>
#endif
-"
-if test "x$ac_cv_have_decl_strsep" = xyes; then :
- for ac_func in strsep
-do :
- ac_fn_c_check_func "$LINENO" "strsep" "ac_cv_func_strsep"
-if test "x$ac_cv_func_strsep" = xyes; then :
+
+int
+main ()
+{
+#ifndef strsep
+ (void) strsep;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_strsep=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_strsep=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_strsep" >&5
+echo "${ECHO_T}$ac_cv_have_decl_strsep" >&6; }
+if test $ac_cv_have_decl_strsep = yes; then
+
+for ac_func in strsep
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_STRSEP 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -10770,57 +18183,318 @@
fi
-ac_fn_c_check_decl "$LINENO" "tcsendbreak" "ac_cv_have_decl_tcsendbreak" "#include <termios.h>
+{ echo "$as_me:$LINENO: checking whether tcsendbreak is declared" >&5
+echo $ECHO_N "checking whether tcsendbreak is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_tcsendbreak+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <termios.h>
-"
-if test "x$ac_cv_have_decl_tcsendbreak" = xyes; then :
- $as_echo "#define HAVE_TCSENDBREAK 1" >>confdefs.h
+int
+main ()
+{
+#ifndef tcsendbreak
+ (void) tcsendbreak;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_tcsendbreak=yes
else
- for ac_func in tcsendbreak
-do :
- ac_fn_c_check_func "$LINENO" "tcsendbreak" "ac_cv_func_tcsendbreak"
-if test "x$ac_cv_func_tcsendbreak" = xyes; then :
- cat >>confdefs.h <<_ACEOF
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_tcsendbreak=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_tcsendbreak" >&5
+echo "${ECHO_T}$ac_cv_have_decl_tcsendbreak" >&6; }
+if test $ac_cv_have_decl_tcsendbreak = yes; then
+ cat >>confdefs.h <<\_ACEOF
#define HAVE_TCSENDBREAK 1
_ACEOF
+else
+
+for ac_func in tcsendbreak
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
done
fi
-ac_fn_c_check_decl "$LINENO" "h_errno" "ac_cv_have_decl_h_errno" "#include <netdb.h>
-"
-if test "x$ac_cv_have_decl_h_errno" = xyes; then :
- ac_have_decl=1
+{ echo "$as_me:$LINENO: checking whether h_errno is declared" >&5
+echo $ECHO_N "checking whether h_errno is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_h_errno+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- ac_have_decl=0
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <netdb.h>
+
+int
+main ()
+{
+#ifndef h_errno
+ (void) h_errno;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_h_errno=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_h_errno=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_h_errno" >&5
+echo "${ECHO_T}$ac_cv_have_decl_h_errno" >&6; }
+if test $ac_cv_have_decl_h_errno = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_H_ERRNO $ac_have_decl
+#define HAVE_DECL_H_ERRNO 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "SHUT_RD" "ac_cv_have_decl_SHUT_RD" "
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_H_ERRNO 0
+_ACEOF
+
+
+fi
+
+
+
+{ echo "$as_me:$LINENO: checking whether SHUT_RD is declared" >&5
+echo $ECHO_N "checking whether SHUT_RD is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_SHUT_RD+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <sys/socket.h>
-"
-if test "x$ac_cv_have_decl_SHUT_RD" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef SHUT_RD
+ (void) SHUT_RD;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_SHUT_RD=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_SHUT_RD=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_SHUT_RD" >&5
+echo "${ECHO_T}$ac_cv_have_decl_SHUT_RD" >&6; }
+if test $ac_cv_have_decl_SHUT_RD = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_SHUT_RD $ac_have_decl
+#define HAVE_DECL_SHUT_RD 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "O_NONBLOCK" "ac_cv_have_decl_O_NONBLOCK" "
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_SHUT_RD 0
+_ACEOF
+
+
+fi
+
+
+
+{ echo "$as_me:$LINENO: checking whether O_NONBLOCK is declared" >&5
+echo $ECHO_N "checking whether O_NONBLOCK is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_O_NONBLOCK+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#ifdef HAVE_SYS_STAT_H
# include <sys/stat.h>
@@ -10829,67 +18503,295 @@
# include <fcntl.h>
#endif
-"
-if test "x$ac_cv_have_decl_O_NONBLOCK" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef O_NONBLOCK
+ (void) O_NONBLOCK;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_O_NONBLOCK=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_O_NONBLOCK=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_O_NONBLOCK" >&5
+echo "${ECHO_T}$ac_cv_have_decl_O_NONBLOCK" >&6; }
+if test $ac_cv_have_decl_O_NONBLOCK = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_O_NONBLOCK $ac_have_decl
+#define HAVE_DECL_O_NONBLOCK 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "writev" "ac_cv_have_decl_writev" "
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_O_NONBLOCK 0
+_ACEOF
+
+
+fi
+
+
+
+{ echo "$as_me:$LINENO: checking whether writev is declared" >&5
+echo $ECHO_N "checking whether writev is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_writev+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <sys/uio.h>
#include <unistd.h>
-"
-if test "x$ac_cv_have_decl_writev" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef writev
+ (void) writev;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_writev=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_writev=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_writev" >&5
+echo "${ECHO_T}$ac_cv_have_decl_writev" >&6; }
+if test $ac_cv_have_decl_writev = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_WRITEV $ac_have_decl
+#define HAVE_DECL_WRITEV 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "MAXSYMLINKS" "ac_cv_have_decl_MAXSYMLINKS" "
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_WRITEV 0
+_ACEOF
+
+
+fi
+
+
+
+{ echo "$as_me:$LINENO: checking whether MAXSYMLINKS is declared" >&5
+echo $ECHO_N "checking whether MAXSYMLINKS is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_MAXSYMLINKS+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/param.h>
-"
-if test "x$ac_cv_have_decl_MAXSYMLINKS" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef MAXSYMLINKS
+ (void) MAXSYMLINKS;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_MAXSYMLINKS=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_MAXSYMLINKS=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_MAXSYMLINKS" >&5
+echo "${ECHO_T}$ac_cv_have_decl_MAXSYMLINKS" >&6; }
+if test $ac_cv_have_decl_MAXSYMLINKS = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_MAXSYMLINKS $ac_have_decl
+#define HAVE_DECL_MAXSYMLINKS 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "offsetof" "ac_cv_have_decl_offsetof" "
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_MAXSYMLINKS 0
+_ACEOF
+
+
+fi
+
+
+
+{ echo "$as_me:$LINENO: checking whether offsetof is declared" >&5
+echo $ECHO_N "checking whether offsetof is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_offsetof+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <stddef.h>
-"
-if test "x$ac_cv_have_decl_offsetof" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef offsetof
+ (void) offsetof;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_offsetof=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_offsetof=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_offsetof" >&5
+echo "${ECHO_T}$ac_cv_have_decl_offsetof" >&6; }
+if test $ac_cv_have_decl_offsetof = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_OFFSETOF $ac_have_decl
+#define HAVE_DECL_OFFSETOF 1
_ACEOF
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_OFFSETOF 0
+_ACEOF
+
+
+fi
+
+
+
# extra bits for select(2)
-ac_fn_c_check_decl "$LINENO" "howmany" "ac_cv_have_decl_howmany" "
+{ echo "$as_me:$LINENO: checking whether howmany is declared" >&5
+echo $ECHO_N "checking whether howmany is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_howmany+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/param.h>
#include <sys/types.h>
#ifdef HAVE_SYS_SYSMACROS_H
@@ -10905,17 +18807,73 @@
#include <unistd.h>
#endif
-"
-if test "x$ac_cv_have_decl_howmany" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef howmany
+ (void) howmany;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_howmany=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_howmany=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_howmany" >&5
+echo "${ECHO_T}$ac_cv_have_decl_howmany" >&6; }
+if test $ac_cv_have_decl_howmany = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_HOWMANY $ac_have_decl
+#define HAVE_DECL_HOWMANY 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "NFDBITS" "ac_cv_have_decl_NFDBITS" "
+
+
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_HOWMANY 0
+_ACEOF
+
+
+fi
+{ echo "$as_me:$LINENO: checking whether NFDBITS is declared" >&5
+echo $ECHO_N "checking whether NFDBITS is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_NFDBITS+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/param.h>
#include <sys/types.h>
#ifdef HAVE_SYS_SYSMACROS_H
@@ -10931,18 +18889,75 @@
#include <unistd.h>
#endif
-"
-if test "x$ac_cv_have_decl_NFDBITS" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef NFDBITS
+ (void) NFDBITS;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_NFDBITS=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_NFDBITS=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_NFDBITS" >&5
+echo "${ECHO_T}$ac_cv_have_decl_NFDBITS" >&6; }
+if test $ac_cv_have_decl_NFDBITS = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_NFDBITS $ac_have_decl
+#define HAVE_DECL_NFDBITS 1
_ACEOF
-ac_fn_c_check_type "$LINENO" "fd_mask" "ac_cv_type_fd_mask" "
+
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_NFDBITS 0
+_ACEOF
+
+
+fi
+
+
+{ echo "$as_me:$LINENO: checking for fd_mask" >&5
+echo $ECHO_N "checking for fd_mask... $ECHO_C" >&6; }
+if test "${ac_cv_type_fd_mask+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/param.h>
#include <sys/types.h>
#ifdef HAVE_SYS_SELECT_H
@@ -10955,9 +18970,50 @@
#include <unistd.h>
#endif
-"
-if test "x$ac_cv_type_fd_mask" = xyes; then :
+typedef fd_mask ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_fd_mask=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_fd_mask=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_fd_mask" >&5
+echo "${ECHO_T}$ac_cv_type_fd_mask" >&6; }
+if test $ac_cv_type_fd_mask = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_FD_MASK 1
_ACEOF
@@ -10966,22 +19022,109 @@
fi
+
for ac_func in setresuid
-do :
- ac_fn_c_check_func "$LINENO" "setresuid" "ac_cv_func_setresuid"
-if test "x$ac_cv_func_setresuid" = xyes; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_SETRESUID 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if setresuid seems to work" >&5
-$as_echo_n "checking if setresuid seems to work... " >&6; }
- if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking setresuid" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking setresuid" >&2;}
+ { echo "$as_me:$LINENO: checking if setresuid seems to work" >&5
+echo $ECHO_N "checking if setresuid seems to work... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking setresuid" >&5
+echo "$as_me: WARNING: cross compiling: not checking setresuid" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -11002,41 +19145,154 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define BROKEN_SETRESUID 1" >>confdefs.h
+( exit $ac_status )
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: not implemented" >&5
-$as_echo "not implemented" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETRESUID 1
+_ACEOF
+
+ { echo "$as_me:$LINENO: result: not implemented" >&5
+echo "${ECHO_T}not implemented" >&6; }
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
done
+
for ac_func in setresgid
-do :
- ac_fn_c_check_func "$LINENO" "setresgid" "ac_cv_func_setresgid"
-if test "x$ac_cv_func_setresgid" = xyes; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_SETRESGID 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if setresgid seems to work" >&5
-$as_echo_n "checking if setresgid seems to work... " >&6; }
- if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking setresuid" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking setresuid" >&2;}
+ { echo "$as_me:$LINENO: checking if setresgid seems to work" >&5
+echo $ECHO_N "checking if setresgid seems to work... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking setresuid" >&5
+echo "$as_me: WARNING: cross compiling: not checking setresuid" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -11057,90 +19313,791 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define BROKEN_SETRESGID 1" >>confdefs.h
+( exit $ac_status )
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: not implemented" >&5
-$as_echo "not implemented" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETRESGID 1
+_ACEOF
+
+ { echo "$as_me:$LINENO: result: not implemented" >&5
+echo "${ECHO_T}not implemented" >&6; }
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
done
+
+for ac_func in realpath
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+ { echo "$as_me:$LINENO: checking if realpath works with non-existent files" >&5
+echo $ECHO_N "checking if realpath works with non-existent files... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: assuming working" >&5
+echo "$as_me: WARNING: cross compiling: assuming working" >&2;}
+
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+#include <limits.h>
+#include <stdlib.h>
+#include <errno.h>
+
+int
+main ()
+{
+
+ char buf[PATH_MAX];
+ if (realpath("/opensshnonexistentfilename1234", buf) == NULL)
+ if (errno == ENOENT)
+ exit(1);
+ exit(0);
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_REALPATH 1
+_ACEOF
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+fi
+
+
+
+fi
+done
+
+
+
+
for ac_func in gettimeofday time
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
+
+
+
+
+
+
for ac_func in endutent getutent getutid getutline pututline setutent
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
+
for ac_func in utmpname
-do :
- ac_fn_c_check_func "$LINENO" "utmpname" "ac_cv_func_utmpname"
-if test "x$ac_cv_func_utmpname" = xyes; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_UTMPNAME 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
+
+
+
+
+
+
for ac_func in endutxent getutxent getutxid getutxline getutxuser pututxline
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
+
+
+
for ac_func in setutxdb setutxent utmpxname
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
+
for ac_func in getlastlogxbyname
-do :
- ac_fn_c_check_func "$LINENO" "getlastlogxbyname" "ac_cv_func_getlastlogxbyname"
-if test "x$ac_cv_func_getlastlogxbyname" = xyes; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_GETLASTLOGXBYNAME 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -11147,20 +20104,106 @@
done
-ac_fn_c_check_func "$LINENO" "daemon" "ac_cv_func_daemon"
-if test "x$ac_cv_func_daemon" = xyes; then :
+{ echo "$as_me:$LINENO: checking for daemon" >&5
+echo $ECHO_N "checking for daemon... $ECHO_C" >&6; }
+if test "${ac_cv_func_daemon+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define daemon to an innocuous variant, in case <limits.h> declares daemon.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define daemon innocuous_daemon
-$as_echo "#define HAVE_DAEMON 1" >>confdefs.h
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char daemon (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef daemon
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char daemon ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_daemon || defined __stub___daemon
+choke me
+#endif
+
+int
+main ()
+{
+return daemon ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_func_daemon=yes
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for daemon in -lbsd" >&5
-$as_echo_n "checking for daemon in -lbsd... " >&6; }
-if ${ac_cv_lib_bsd_daemon+:} false; then :
- $as_echo_n "(cached) " >&6
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_func_daemon=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_daemon" >&5
+echo "${ECHO_T}$ac_cv_func_daemon" >&6; }
+if test $ac_cv_func_daemon = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_DAEMON 1
+_ACEOF
+
else
+ { echo "$as_me:$LINENO: checking for daemon in -lbsd" >&5
+echo $ECHO_N "checking for daemon in -lbsd... $ECHO_C" >&6; }
+if test "${ac_cv_lib_bsd_daemon+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lbsd $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -11178,19 +20221,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_bsd_daemon=yes
else
- ac_cv_lib_bsd_daemon=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_bsd_daemon=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_bsd_daemon" >&5
-$as_echo "$ac_cv_lib_bsd_daemon" >&6; }
-if test "x$ac_cv_lib_bsd_daemon" = xyes; then :
- LIBS="$LIBS -lbsd"; $as_echo "#define HAVE_DAEMON 1" >>confdefs.h
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_bsd_daemon" >&5
+echo "${ECHO_T}$ac_cv_lib_bsd_daemon" >&6; }
+if test $ac_cv_lib_bsd_daemon = yes; then
+ LIBS="$LIBS -lbsd"; cat >>confdefs.h <<\_ACEOF
+#define HAVE_DAEMON 1
+_ACEOF
fi
@@ -11198,20 +20264,106 @@
fi
-ac_fn_c_check_func "$LINENO" "getpagesize" "ac_cv_func_getpagesize"
-if test "x$ac_cv_func_getpagesize" = xyes; then :
+{ echo "$as_me:$LINENO: checking for getpagesize" >&5
+echo $ECHO_N "checking for getpagesize... $ECHO_C" >&6; }
+if test "${ac_cv_func_getpagesize+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define getpagesize to an innocuous variant, in case <limits.h> declares getpagesize.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define getpagesize innocuous_getpagesize
-$as_echo "#define HAVE_GETPAGESIZE 1" >>confdefs.h
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char getpagesize (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef getpagesize
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char getpagesize ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_getpagesize || defined __stub___getpagesize
+choke me
+#endif
+
+int
+main ()
+{
+return getpagesize ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_func_getpagesize=yes
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for getpagesize in -lucb" >&5
-$as_echo_n "checking for getpagesize in -lucb... " >&6; }
-if ${ac_cv_lib_ucb_getpagesize+:} false; then :
- $as_echo_n "(cached) " >&6
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_func_getpagesize=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_getpagesize" >&5
+echo "${ECHO_T}$ac_cv_func_getpagesize" >&6; }
+if test $ac_cv_func_getpagesize = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_GETPAGESIZE 1
+_ACEOF
+
else
+ { echo "$as_me:$LINENO: checking for getpagesize in -lucb" >&5
+echo $ECHO_N "checking for getpagesize in -lucb... $ECHO_C" >&6; }
+if test "${ac_cv_lib_ucb_getpagesize+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lucb $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -11229,19 +20381,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_ucb_getpagesize=yes
else
- ac_cv_lib_ucb_getpagesize=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_ucb_getpagesize=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ucb_getpagesize" >&5
-$as_echo "$ac_cv_lib_ucb_getpagesize" >&6; }
-if test "x$ac_cv_lib_ucb_getpagesize" = xyes; then :
- LIBS="$LIBS -lucb"; $as_echo "#define HAVE_GETPAGESIZE 1" >>confdefs.h
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_ucb_getpagesize" >&5
+echo "${ECHO_T}$ac_cv_lib_ucb_getpagesize" >&6; }
+if test $ac_cv_lib_ucb_getpagesize = yes; then
+ LIBS="$LIBS -lucb"; cat >>confdefs.h <<\_ACEOF
+#define HAVE_GETPAGESIZE 1
+_ACEOF
fi
@@ -11251,14 +20426,18 @@
# Check for broken snprintf
if test "x$ac_cv_func_snprintf" = "xyes" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether snprintf correctly terminates long strings" >&5
-$as_echo_n "checking whether snprintf correctly terminates long strings... " >&6; }
- if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: Assuming working snprintf()" >&5
-$as_echo "$as_me: WARNING: cross compiling: Assuming working snprintf()" >&2;}
+ { echo "$as_me:$LINENO: checking whether snprintf correctly terminates long strings" >&5
+echo $ECHO_N "checking whether snprintf correctly terminates long strings... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: Assuming working snprintf()" >&5
+echo "$as_me: WARNING: cross compiling: Assuming working snprintf()" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
int
@@ -11273,39 +20452,67 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+( exit $ac_status )
-$as_echo "#define BROKEN_SNPRINTF 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: ****** Your snprintf() function is broken, complain to your vendor" >&5
-$as_echo "$as_me: WARNING: ****** Your snprintf() function is broken, complain to your vendor" >&2;}
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SNPRINTF 1
+_ACEOF
+ { echo "$as_me:$LINENO: WARNING: ****** Your snprintf() function is broken, complain to your vendor" >&5
+echo "$as_me: WARNING: ****** Your snprintf() function is broken, complain to your vendor" >&2;}
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
-# If we don't have a working asprintf, then we strongly depend on vsnprintf
-# returning the right thing on overflow: the number of characters it tried to
-# create (as per SUSv3)
-if test "x$ac_cv_func_asprintf" != "xyes" && \
- test "x$ac_cv_func_vsnprintf" = "xyes" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether vsnprintf returns correct values on overflow" >&5
-$as_echo_n "checking whether vsnprintf returns correct values on overflow... " >&6; }
- if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: Assuming working vsnprintf()" >&5
-$as_echo "$as_me: WARNING: cross compiling: Assuming working vsnprintf()" >&2;}
+# We depend on vsnprintf returning the right thing on overflow: the
+# number of characters it tried to create (as per SUSv3)
+if test "x$ac_cv_func_vsnprintf" = "xyes" ; then
+ { echo "$as_me:$LINENO: checking whether vsnprintf returns correct values on overflow" >&5
+echo $ECHO_N "checking whether vsnprintf returns correct values on overflow... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: Assuming working vsnprintf()" >&5
+echo "$as_me: WARNING: cross compiling: Assuming working vsnprintf()" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -11312,10 +20519,14 @@
#include <stdio.h>
#include <stdarg.h>
-int x_snprintf(char *str,size_t count,const char *fmt,...)
+int x_snprintf(char *str, size_t count, const char *fmt, ...)
{
- size_t ret; va_list ap;
- va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
+ size_t ret;
+ va_list ap;
+
+ va_start(ap, fmt);
+ ret = vsnprintf(str, count, fmt, ap);
+ va_end(ap);
return ret;
}
@@ -11323,39 +20534,73 @@
main ()
{
- char x[1];
- exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
+char x[1];
+if (x_snprintf(x, 1, "%s %d", "hello", 12345) != 11)
+ return 1;
+if (x_snprintf(NULL, 0, "%s %d", "hello", 12345) != 11)
+ return 1;
+return 0;
;
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+( exit $ac_status )
-$as_echo "#define BROKEN_SNPRINTF 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: ****** Your vsnprintf() function is broken, complain to your vendor" >&5
-$as_echo "$as_me: WARNING: ****** Your vsnprintf() function is broken, complain to your vendor" >&2;}
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SNPRINTF 1
+_ACEOF
+ { echo "$as_me:$LINENO: WARNING: ****** Your vsnprintf() function is broken, complain to your vendor" >&5
+echo "$as_me: WARNING: ****** Your vsnprintf() function is broken, complain to your vendor" >&2;}
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
# On systems where [v]snprintf is broken, but is declared in stdio,
# check that the fmt argument is const char * or just char *.
# This is only useful for when BROKEN_SNPRINTF
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether snprintf can declare const char *fmt" >&5
-$as_echo_n "checking whether snprintf can declare const char *fmt... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking whether snprintf can declare const char *fmt" >&5
+echo $ECHO_N "checking whether snprintf can declare const char *fmt... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -11371,26 +20616,54 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define SNPRINTF_CONST const" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SNPRINTF_CONST const
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- $as_echo "#define SNPRINTF_CONST /* not const */" >>confdefs.h
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ cat >>confdefs.h <<\_ACEOF
+#define SNPRINTF_CONST /* not const */
+_ACEOF
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
# Check for missing getpeereid (or equiv) support
NO_PEERCHECK=""
if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether system supports SO_PEERCRED getsockopt" >&5
-$as_echo_n "checking whether system supports SO_PEERCRED getsockopt... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking whether system supports SO_PEERCRED getsockopt" >&5
+echo $ECHO_N "checking whether system supports SO_PEERCRED getsockopt... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -11403,35 +20676,63 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define HAVE_SO_PEERCRED 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SO_PEERCRED 1
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
NO_PEERCHECK=1
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for (overly) strict mkstemp" >&5
-$as_echo_n "checking for (overly) strict mkstemp... " >&6; }
-if test "$cross_compiling" = yes; then :
+{ echo "$as_me:$LINENO: checking for (overly) strict mkstemp" >&5
+echo $ECHO_N "checking for (overly) strict mkstemp... $ECHO_C" >&6; }
+if test "$cross_compiling" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- $as_echo "#define HAVE_STRICT_MKSTEMP 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_STRICT_MKSTEMP 1
+_ACEOF
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -11450,37 +20751,67 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+( exit $ac_status )
-$as_echo "#define HAVE_STRICT_MKSTEMP 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_STRICT_MKSTEMP 1
+_ACEOF
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
if test ! -z "$check_for_openpty_ctty_bug"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if openpty correctly handles controlling tty" >&5
-$as_echo_n "checking if openpty correctly handles controlling tty... " >&6; }
- if test "$cross_compiling" = yes; then :
+ { echo "$as_me:$LINENO: checking if openpty correctly handles controlling tty" >&5
+echo $ECHO_N "checking if openpty correctly handles controlling tty... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: cross-compiling, assuming yes" >&5
-$as_echo "cross-compiling, assuming yes" >&6; }
+ { echo "$as_me:$LINENO: result: cross-compiling, assuming yes" >&5
+echo "${ECHO_T}cross-compiling, assuming yes" >&6; }
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -11519,37 +20850,67 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- $as_echo "#define SSHD_ACQUIRES_CTTY 1" >>confdefs.h
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ cat >>confdefs.h <<\_ACEOF
+#define SSHD_ACQUIRES_CTTY 1
+_ACEOF
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if getaddrinfo seems to work" >&5
-$as_echo_n "checking if getaddrinfo seems to work... " >&6; }
- if test "$cross_compiling" = yes; then :
+ { echo "$as_me:$LINENO: checking if getaddrinfo seems to work" >&5
+echo $ECHO_N "checking if getaddrinfo seems to work... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: cross-compiling, assuming yes" >&5
-$as_echo "cross-compiling, assuming yes" >&6; }
+ { echo "$as_me:$LINENO: result: cross-compiling, assuming yes" >&5
+echo "${ECHO_T}cross-compiling, assuming yes" >&6; }
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -11610,37 +20971,67 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- $as_echo "#define BROKEN_GETADDRINFO 1" >>confdefs.h
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GETADDRINFO 1
+_ACEOF
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if getaddrinfo seems to work" >&5
-$as_echo_n "checking if getaddrinfo seems to work... " >&6; }
- if test "$cross_compiling" = yes; then :
+ { echo "$as_me:$LINENO: checking if getaddrinfo seems to work" >&5
+echo $ECHO_N "checking if getaddrinfo seems to work... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: cross-compiling, assuming no" >&5
-$as_echo "cross-compiling, assuming no" >&6; }
+ { echo "$as_me:$LINENO: result: cross-compiling, assuming no" >&5
+echo "${ECHO_T}cross-compiling, assuming no" >&6; }
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -11689,32 +21080,138 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define AIX_GETNAMEINFO_HACK 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define AIX_GETNAMEINFO_HACK 1
+_ACEOF
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- $as_echo "#define BROKEN_GETADDRINFO 1" >>confdefs.h
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GETADDRINFO 1
+_ACEOF
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
+if test "x$ac_cv_func_getaddrinfo" = "xyes"; then
+ { echo "$as_me:$LINENO: checking whether AI_NUMERICSERV is declared" >&5
+echo $ECHO_N "checking whether AI_NUMERICSERV is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_AI_NUMERICSERV+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <sys/types.h>
+ #include <sys/socket.h>
+ #include <netdb.h>
+
+int
+main ()
+{
+#ifndef AI_NUMERICSERV
+ (void) AI_NUMERICSERV;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_AI_NUMERICSERV=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_AI_NUMERICSERV=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_AI_NUMERICSERV" >&5
+echo "${ECHO_T}$ac_cv_have_decl_AI_NUMERICSERV" >&6; }
+if test $ac_cv_have_decl_AI_NUMERICSERV = yes; then
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_AI_NUMERICSERV 1
+_ACEOF
+
+
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_AI_NUMERICSERV 0
+_ACEOF
+
+
+fi
+
+
+fi
+
if test "x$check_for_conflicting_getspnam" = "x1"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for conflicting getspnam in shadow.h" >&5
-$as_echo_n "checking for conflicting getspnam in shadow.h... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for conflicting getspnam in shadow.h" >&5
+echo $ECHO_N "checking for conflicting getspnam in shadow.h... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <shadow.h>
int
@@ -11725,31 +21222,57 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-$as_echo "#define GETSPNAM_CONFLICTING_DEFS 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define GETSPNAM_CONFLICTING_DEFS 1
+_ACEOF
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether getpgrp requires zero arguments" >&5
-$as_echo_n "checking whether getpgrp requires zero arguments... " >&6; }
-if ${ac_cv_func_getpgrp_void+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether getpgrp requires zero arguments" >&5
+echo $ECHO_N "checking whether getpgrp requires zero arguments... $ECHO_C" >&6; }
+if test "${ac_cv_func_getpgrp_void+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
# Use it with a single arg.
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
$ac_includes_default
int
@@ -11760,19 +21283,41 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_func_getpgrp_void=no
else
- ac_cv_func_getpgrp_void=yes
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_func_getpgrp_void=yes
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_getpgrp_void" >&5
-$as_echo "$ac_cv_func_getpgrp_void" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_func_getpgrp_void" >&5
+echo "${ECHO_T}$ac_cv_func_getpgrp_void" >&6; }
if test $ac_cv_func_getpgrp_void = yes; then
-$as_echo "#define GETPGRP_VOID 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define GETPGRP_VOID 1
+_ACEOF
fi
@@ -11782,8 +21327,13 @@
saved_LDFLAGS="$LDFLAGS"
# Check whether --with-ssl-dir was given.
-if test "${with_ssl_dir+set}" = set; then :
+if test "${with_ssl_dir+set}" = set; then
withval=$with_ssl_dir;
+ if test "x$openssl" = "xno" ; then
+ { { echo "$as_me:$LINENO: error: cannot use --with-ssl-dir when OpenSSL disabled" >&5
+echo "$as_me: error: cannot use --with-ssl-dir when OpenSSL disabled" >&2;}
+ { (exit 1); exit 1; }; }
+ fi
if test "x$withval" != "xno" ; then
case "$withval" in
# Relative paths
@@ -11818,8 +21368,44 @@
fi
-LIBS="-lcrypto $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+
+
+# Check whether --with-openssl-header-check was given.
+if test "${with_openssl_header_check+set}" = set; then
+ withval=$with_openssl_header_check;
+ if test "x$withval" = "xno" ; then
+ openssl_check_nonfatal=1
+ fi
+
+
+fi
+
+
+openssl_engine=no
+
+# Check whether --with-ssl-engine was given.
+if test "${with_ssl_engine+set}" = set; then
+ withval=$with_ssl_engine;
+ if test "x$withval" != "xno" ; then
+ if test "x$openssl" = "xno" ; then
+ { { echo "$as_me:$LINENO: error: cannot use --with-ssl-engine when OpenSSL disabled" >&5
+echo "$as_me: error: cannot use --with-ssl-engine when OpenSSL disabled" >&2;}
+ { (exit 1); exit 1; }; }
+ fi
+ openssl_engine=yes
+ fi
+
+
+fi
+
+
+if test "x$openssl" = "xyes" ; then
+ LIBS="-lcrypto $LIBS"
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -11837,29 +21423,186 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
-$as_echo "#define HAVE_OPENSSL 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_OPENSSL 1
+_ACEOF
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- if test -n "${need_dash_r}"; then
- LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
- else
- LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
- fi
- CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
- ac_fn_c_check_header_mongrel "$LINENO" "openssl/opensslv.h" "ac_cv_header_openssl_opensslv_h" "$ac_includes_default"
-if test "x$ac_cv_header_openssl_opensslv_h" = xyes; then :
+ if test -n "${need_dash_r}"; then
+ LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
+ else
+ LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
+ fi
+ CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
+ if test "${ac_cv_header_openssl_opensslv_h+set}" = set; then
+ { echo "$as_me:$LINENO: checking for openssl/opensslv.h" >&5
+echo $ECHO_N "checking for openssl/opensslv.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_openssl_opensslv_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_openssl_opensslv_h" >&5
+echo "${ECHO_T}$ac_cv_header_openssl_opensslv_h" >&6; }
else
- as_fn_error $? "*** OpenSSL headers missing - please install first or check config.log ***" "$LINENO" 5
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking openssl/opensslv.h usability" >&5
+echo $ECHO_N "checking openssl/opensslv.h usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <openssl/opensslv.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+# Is the header present?
+{ echo "$as_me:$LINENO: checking openssl/opensslv.h presence" >&5
+echo $ECHO_N "checking openssl/opensslv.h presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
+#include <openssl/opensslv.h>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: openssl/opensslv.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: openssl/opensslv.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: openssl/opensslv.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: openssl/opensslv.h: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: openssl/opensslv.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: openssl/opensslv.h: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: openssl/opensslv.h: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: openssl/opensslv.h: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: openssl/opensslv.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: openssl/opensslv.h: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: openssl/opensslv.h: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: openssl/opensslv.h: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: openssl/opensslv.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: openssl/opensslv.h: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: openssl/opensslv.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: openssl/opensslv.h: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for openssl/opensslv.h" >&5
+echo $ECHO_N "checking for openssl/opensslv.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_openssl_opensslv_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ ac_cv_header_openssl_opensslv_h=$ac_header_preproc
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_openssl_opensslv_h" >&5
+echo "${ECHO_T}$ac_cv_header_openssl_opensslv_h" >&6; }
+
+fi
+if test $ac_cv_header_openssl_opensslv_h = yes; then
+ :
+else
+ { { echo "$as_me:$LINENO: error: *** OpenSSL headers missing - please install first or check config.log ***" >&5
+echo "$as_me: error: *** OpenSSL headers missing - please install first or check config.log ***" >&2;}
+ { (exit 1); exit 1; }; }
+fi
+
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
/* Override any GCC internal prototype to avoid an error.
Use char because int might match the return type of a GCC
builtin and then its argument prototype would still apply. */
@@ -11875,207 +21618,335 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- $as_echo "#define HAVE_OPENSSL 1" >>confdefs.h
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_OPENSSL 1
+_ACEOF
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- as_fn_error $? "*** Can't find recent OpenSSL libcrypto (see config.log for details) ***" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: *** Can't find recent OpenSSL libcrypto (see config.log for details) ***" >&5
+echo "$as_me: error: *** Can't find recent OpenSSL libcrypto (see config.log for details) ***" >&2;}
+ { (exit 1); exit 1; }; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-# Determine OpenSSL header version
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking OpenSSL header version" >&5
-$as_echo_n "checking OpenSSL header version... " >&6; }
-if test "$cross_compiling" = yes; then :
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking" >&2;}
+ # Determine OpenSSL header version
+ { echo "$as_me:$LINENO: checking OpenSSL header version" >&5
+echo $ECHO_N "checking OpenSSL header version... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking" >&5
+echo "$as_me: WARNING: cross compiling: not checking" >&2;}
+
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <stdio.h>
-#include <string.h>
-#include <openssl/opensslv.h>
-#define DATA "conftest.sslincver"
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <openssl/opensslv.h>
+ #define DATA "conftest.sslincver"
int
main ()
{
- FILE *fd;
- int rc;
+ FILE *fd;
+ int rc;
- fd = fopen(DATA,"w");
- if(fd == NULL)
- exit(1);
+ fd = fopen(DATA,"w");
+ if(fd == NULL)
+ exit(1);
- if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
- exit(1);
+ if ((rc = fprintf(fd, "%08lx (%s)\n",
+ (unsigned long)OPENSSL_VERSION_NUMBER,
+ OPENSSL_VERSION_TEXT)) < 0)
+ exit(1);
- exit(0);
+ exit(0);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- ssl_header_ver=`cat conftest.sslincver`
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ssl_header_ver" >&5
-$as_echo "$ssl_header_ver" >&6; }
+ ssl_header_ver=`cat conftest.sslincver`
+ { echo "$as_me:$LINENO: result: $ssl_header_ver" >&5
+echo "${ECHO_T}$ssl_header_ver" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
- as_fn_error $? "OpenSSL version header not found." "$LINENO" 5
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: not found" >&5
+echo "${ECHO_T}not found" >&6; }
+ { { echo "$as_me:$LINENO: error: OpenSSL version header not found." >&5
+echo "$as_me: error: OpenSSL version header not found." >&2;}
+ { (exit 1); exit 1; }; }
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-# Determine OpenSSL library version
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking OpenSSL library version" >&5
-$as_echo_n "checking OpenSSL library version... " >&6; }
-if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking" >&2;}
+ # Determine OpenSSL library version
+ { echo "$as_me:$LINENO: checking OpenSSL library version" >&5
+echo $ECHO_N "checking OpenSSL library version... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking" >&5
+echo "$as_me: WARNING: cross compiling: not checking" >&2;}
+
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <stdio.h>
-#include <string.h>
-#include <openssl/opensslv.h>
-#include <openssl/crypto.h>
-#define DATA "conftest.ssllibver"
+ #include <stdio.h>
+ #include <string.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/crypto.h>
+ #define DATA "conftest.ssllibver"
int
main ()
{
- FILE *fd;
- int rc;
+ FILE *fd;
+ int rc;
- fd = fopen(DATA,"w");
- if(fd == NULL)
- exit(1);
+ fd = fopen(DATA,"w");
+ if(fd == NULL)
+ exit(1);
- if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
- exit(1);
+ if ((rc = fprintf(fd, "%08lx (%s)\n", (unsigned long)SSLeay(),
+ SSLeay_version(SSLEAY_VERSION))) < 0)
+ exit(1);
- exit(0);
+ exit(0);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- ssl_library_ver=`cat conftest.ssllibver`
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ssl_library_ver" >&5
-$as_echo "$ssl_library_ver" >&6; }
+ ssl_library_ver=`cat conftest.ssllibver`
+ # Check version is supported.
+ case "$ssl_library_ver" in
+ 0090[0-7]*|009080[0-5]*)
+ { { echo "$as_me:$LINENO: error: OpenSSL >= 0.9.8f required (have \"$ssl_library_ver\")" >&5
+echo "$as_me: error: OpenSSL >= 0.9.8f required (have \"$ssl_library_ver\")" >&2;}
+ { (exit 1); exit 1; }; }
+ ;;
+ *) ;;
+ esac
+ { echo "$as_me:$LINENO: result: $ssl_library_ver" >&5
+echo "${ECHO_T}$ssl_library_ver" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
- as_fn_error $? "OpenSSL library not found." "$LINENO" 5
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: not found" >&5
+echo "${ECHO_T}not found" >&6; }
+ { { echo "$as_me:$LINENO: error: OpenSSL library not found." >&5
+echo "$as_me: error: OpenSSL library not found." >&2;}
+ { (exit 1); exit 1; }; }
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-# Check whether --with-openssl-header-check was given.
-if test "${with_openssl_header_check+set}" = set; then :
- withval=$with_openssl_header_check; if test "x$withval" = "xno" ; then
- openssl_check_nonfatal=1
- fi
+ # Sanity check OpenSSL headers
+ { echo "$as_me:$LINENO: checking whether OpenSSL's headers match the library" >&5
+echo $ECHO_N "checking whether OpenSSL's headers match the library... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking" >&5
+echo "$as_me: WARNING: cross compiling: not checking" >&2;}
-fi
-
-# Sanity check OpenSSL headers
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL's headers match the library" >&5
-$as_echo_n "checking whether OpenSSL's headers match the library... " >&6; }
-if test "$cross_compiling" = yes; then :
-
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking" >&2;}
-
-
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <string.h>
-#include <openssl/opensslv.h>
+ #include <string.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/crypto.h>
int
main ()
{
- exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1);
+ exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- if test "x$openssl_check_nonfatal" = "x"; then
- as_fn_error $? "Your OpenSSL headers do not match your
-library. Check config.log for details.
-If you are sure your installation is consistent, you can disable the check
-by running \"./configure --without-openssl-header-check\".
-Also see contrib/findssl.sh for help identifying header/library mismatches.
-" "$LINENO" 5
- else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Your OpenSSL headers do not match your
-library. Check config.log for details.
-Also see contrib/findssl.sh for help identifying header/library mismatches." >&5
-$as_echo "$as_me: WARNING: Your OpenSSL headers do not match your
-library. Check config.log for details.
-Also see contrib/findssl.sh for help identifying header/library mismatches." >&2;}
- fi
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ if test "x$openssl_check_nonfatal" = "x"; then
+ { { echo "$as_me:$LINENO: error: Your OpenSSL headers do not match your
+ library. Check config.log for details.
+ If you are sure your installation is consistent, you can disable the check
+ by running \"./configure --without-openssl-header-check\".
+ Also see contrib/findssl.sh for help identifying header/library mismatches.
+ " >&5
+echo "$as_me: error: Your OpenSSL headers do not match your
+ library. Check config.log for details.
+ If you are sure your installation is consistent, you can disable the check
+ by running \"./configure --without-openssl-header-check\".
+ Also see contrib/findssl.sh for help identifying header/library mismatches.
+ " >&2;}
+ { (exit 1); exit 1; }; }
+ else
+ { echo "$as_me:$LINENO: WARNING: Your OpenSSL headers do not match your
+ library. Check config.log for details.
+ Also see contrib/findssl.sh for help identifying header/library mismatches." >&5
+echo "$as_me: WARNING: Your OpenSSL headers do not match your
+ library. Check config.log for details.
+ Also see contrib/findssl.sh for help identifying header/library mismatches." >&2;}
+ fi
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if programs using OpenSSL functions will link" >&5
-$as_echo_n "checking if programs using OpenSSL functions will link... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+
+ { echo "$as_me:$LINENO: checking if programs using OpenSSL functions will link" >&5
+echo $ECHO_N "checking if programs using OpenSSL functions will link... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <openssl/evp.h>
int
@@ -12086,20 +21957,44 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- saved_LIBS="$LIBS"
- LIBS="$LIBS -ldl"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if programs using OpenSSL need -ldl" >&5
-$as_echo_n "checking if programs using OpenSSL need -ldl... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ saved_LIBS="$LIBS"
+ LIBS="$LIBS -ldl"
+ { echo "$as_me:$LINENO: checking if programs using OpenSSL need -ldl" >&5
+echo $ECHO_N "checking if programs using OpenSSL need -ldl... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <openssl/evp.h>
int
@@ -12110,45 +22005,158 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- LIBS="$saved_LIBS"
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ LIBS="$saved_LIBS"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+
+
+
+
+
+
+
+
+
+
for ac_func in \
- BN_is_prime_ex \
- DSA_generate_parameters_ex \
- EVP_DigestInit_ex \
- EVP_DigestFinal_ex \
- EVP_MD_CTX_init \
- EVP_MD_CTX_cleanup \
- EVP_MD_CTX_copy_ex \
- HMAC_CTX_init \
- RSA_generate_key_ex \
- RSA_get_default_method \
+ BN_is_prime_ex \
+ DSA_generate_parameters_ex \
+ EVP_DigestInit_ex \
+ EVP_DigestFinal_ex \
+ EVP_MD_CTX_init \
+ EVP_MD_CTX_cleanup \
+ EVP_MD_CTX_copy_ex \
+ HMAC_CTX_init \
+ RSA_generate_key_ex \
+ RSA_get_default_method \
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -12155,173 +22163,281 @@
done
-
-# Check whether --with-ssl-engine was given.
-if test "${with_ssl_engine+set}" = set; then :
- withval=$with_ssl_engine; if test "x$withval" != "xno" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL ENGINE support" >&5
-$as_echo_n "checking for OpenSSL ENGINE support... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ if test "x$openssl_engine" = "xyes" ; then
+ { echo "$as_me:$LINENO: checking for OpenSSL ENGINE support" >&5
+echo $ECHO_N "checking for OpenSSL ENGINE support... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <openssl/engine.h>
+ #include <openssl/engine.h>
int
main ()
{
- ENGINE_load_builtin_engines();
- ENGINE_register_all_complete();
+ ENGINE_load_builtin_engines();
+ ENGINE_register_all_complete();
;
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define USE_OPENSSL_ENGINE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_OPENSSL_ENGINE 1
+_ACEOF
else
- as_fn_error $? "OpenSSL ENGINE support not found" "$LINENO" 5
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- fi
+ { { echo "$as_me:$LINENO: error: OpenSSL ENGINE support not found" >&5
+echo "$as_me: error: OpenSSL ENGINE support not found" >&2;}
+ { (exit 1); exit 1; }; }
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ fi
-# Check for OpenSSL without EVP_aes_{192,256}_cbc
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL has crippled AES support" >&5
-$as_echo_n "checking whether OpenSSL has crippled AES support... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ # Check for OpenSSL without EVP_aes_{192,256}_cbc
+ { echo "$as_me:$LINENO: checking whether OpenSSL has crippled AES support" >&5
+echo $ECHO_N "checking whether OpenSSL has crippled AES support... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <string.h>
-#include <openssl/evp.h>
+ #include <string.h>
+ #include <openssl/evp.h>
int
main ()
{
- exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);
+ exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-$as_echo "#define OPENSSL_LOBOTOMISED_AES 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_LOBOTOMISED_AES 1
+_ACEOF
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-# Check for OpenSSL with EVP_aes_*ctr
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL has AES CTR via EVP" >&5
-$as_echo_n "checking whether OpenSSL has AES CTR via EVP... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+ # Check for OpenSSL with EVP_aes_*ctr
+ { echo "$as_me:$LINENO: checking whether OpenSSL has AES CTR via EVP" >&5
+echo $ECHO_N "checking whether OpenSSL has AES CTR via EVP... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <string.h>
-#include <openssl/evp.h>
+ #include <string.h>
+ #include <openssl/evp.h>
int
main ()
{
- exit(EVP_aes_128_ctr() == NULL ||
- EVP_aes_192_cbc() == NULL ||
- EVP_aes_256_cbc() == NULL);
+ exit(EVP_aes_128_ctr() == NULL ||
+ EVP_aes_192_cbc() == NULL ||
+ EVP_aes_256_cbc() == NULL);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define OPENSSL_HAVE_EVPCTR 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_HAVE_EVPCTR 1
+_ACEOF
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-# Check for OpenSSL with EVP_aes_*gcm
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL has AES GCM via EVP" >&5
-$as_echo_n "checking whether OpenSSL has AES GCM via EVP... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+ # Check for OpenSSL with EVP_aes_*gcm
+ { echo "$as_me:$LINENO: checking whether OpenSSL has AES GCM via EVP" >&5
+echo $ECHO_N "checking whether OpenSSL has AES GCM via EVP... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <string.h>
-#include <openssl/evp.h>
+ #include <string.h>
+ #include <openssl/evp.h>
int
main ()
{
- exit(EVP_aes_128_gcm() == NULL ||
- EVP_aes_256_gcm() == NULL ||
- EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
- EVP_CTRL_GCM_IV_GEN == 0 ||
- EVP_CTRL_GCM_SET_TAG == 0 ||
- EVP_CTRL_GCM_GET_TAG == 0 ||
- EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
+ exit(EVP_aes_128_gcm() == NULL ||
+ EVP_aes_256_gcm() == NULL ||
+ EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
+ EVP_CTRL_GCM_IV_GEN == 0 ||
+ EVP_CTRL_GCM_SET_TAG == 0 ||
+ EVP_CTRL_GCM_GET_TAG == 0 ||
+ EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define OPENSSL_HAVE_EVPGCM 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_HAVE_EVPGCM 1
+_ACEOF
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- unsupported_algorithms="$unsupported_cipers \
- aes128-gcm at openssh.com aes256-gcm at openssh.com"
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ unsupported_algorithms="$unsupported_cipers \
+ aes128-gcm at openssh.com \
+ aes256-gcm at openssh.com"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing EVP_CIPHER_CTX_ctrl" >&5
-$as_echo_n "checking for library containing EVP_CIPHER_CTX_ctrl... " >&6; }
-if ${ac_cv_search_EVP_CIPHER_CTX_ctrl+:} false; then :
- $as_echo_n "(cached) " >&6
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+ { echo "$as_me:$LINENO: checking for library containing EVP_CIPHER_CTX_ctrl" >&5
+echo $ECHO_N "checking for library containing EVP_CIPHER_CTX_ctrl... $ECHO_C" >&6; }
+if test "${ac_cv_search_EVP_CIPHER_CTX_ctrl+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -12346,17 +22462,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_EVP_CIPHER_CTX_ctrl=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_EVP_CIPHER_CTX_ctrl+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_EVP_CIPHER_CTX_ctrl+set}" = set; then
break
fi
done
-if ${ac_cv_search_EVP_CIPHER_CTX_ctrl+:} false; then :
-
+if test "${ac_cv_search_EVP_CIPHER_CTX_ctrl+set}" = set; then
+ :
else
ac_cv_search_EVP_CIPHER_CTX_ctrl=no
fi
@@ -12363,65 +22502,99 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_EVP_CIPHER_CTX_ctrl" >&5
-$as_echo "$ac_cv_search_EVP_CIPHER_CTX_ctrl" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_EVP_CIPHER_CTX_ctrl" >&5
+echo "${ECHO_T}$ac_cv_search_EVP_CIPHER_CTX_ctrl" >&6; }
ac_res=$ac_cv_search_EVP_CIPHER_CTX_ctrl
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
-$as_echo "#define HAVE_EVP_CIPHER_CTX_CTRL 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_EVP_CIPHER_CTX_CTRL 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if EVP_DigestUpdate returns an int" >&5
-$as_echo_n "checking if EVP_DigestUpdate returns an int... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking if EVP_DigestUpdate returns an int" >&5
+echo $ECHO_N "checking if EVP_DigestUpdate returns an int... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <string.h>
-#include <openssl/evp.h>
+ #include <string.h>
+ #include <openssl/evp.h>
int
main ()
{
- if(EVP_DigestUpdate(NULL, NULL,0))
- exit(0);
+ if(EVP_DigestUpdate(NULL, NULL,0))
+ exit(0);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-$as_echo "#define OPENSSL_EVP_DIGESTUPDATE_VOID 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_EVP_DIGESTUPDATE_VOID 1
+_ACEOF
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-# Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
-# because the system crypt() is more featureful.
-if test "x$check_for_libcrypt_before" = "x1"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for crypt in -lcrypt" >&5
-$as_echo_n "checking for crypt in -lcrypt... " >&6; }
-if ${ac_cv_lib_crypt_crypt+:} false; then :
- $as_echo_n "(cached) " >&6
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+ # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
+ # because the system crypt() is more featureful.
+ if test "x$check_for_libcrypt_before" = "x1"; then
+
+{ echo "$as_me:$LINENO: checking for crypt in -lcrypt" >&5
+echo $ECHO_N "checking for crypt in -lcrypt... $ECHO_C" >&6; }
+if test "${ac_cv_lib_crypt_crypt+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lcrypt $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -12439,18 +22612,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_crypt_crypt=yes
else
- ac_cv_lib_crypt_crypt=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_crypt_crypt=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypt_crypt" >&5
-$as_echo "$ac_cv_lib_crypt_crypt" >&6; }
-if test "x$ac_cv_lib_crypt_crypt" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_crypt_crypt" >&5
+echo "${ECHO_T}$ac_cv_lib_crypt_crypt" >&6; }
+if test $ac_cv_lib_crypt_crypt = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBCRYPT 1
_ACEOF
@@ -12459,19 +22653,23 @@
fi
-fi
+ fi
-# Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
-# version in OpenSSL.
-if test "x$check_for_libcrypt_later" = "x1"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for crypt in -lcrypt" >&5
-$as_echo_n "checking for crypt in -lcrypt... " >&6; }
-if ${ac_cv_lib_crypt_crypt+:} false; then :
- $as_echo_n "(cached) " >&6
+ # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
+ # version in OpenSSL.
+ if test "x$check_for_libcrypt_later" = "x1"; then
+ { echo "$as_me:$LINENO: checking for crypt in -lcrypt" >&5
+echo $ECHO_N "checking for crypt in -lcrypt... $ECHO_C" >&6; }
+if test "${ac_cv_lib_crypt_crypt+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lcrypt $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -12489,29 +22687,133 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_crypt_crypt=yes
else
- ac_cv_lib_crypt_crypt=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_crypt_crypt=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypt_crypt" >&5
-$as_echo "$ac_cv_lib_crypt_crypt" >&6; }
-if test "x$ac_cv_lib_crypt_crypt" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_crypt_crypt" >&5
+echo "${ECHO_T}$ac_cv_lib_crypt_crypt" >&6; }
+if test $ac_cv_lib_crypt_crypt = yes; then
LIBS="$LIBS -lcrypt"
fi
+ fi
+
+
+for ac_func in crypt DES_crypt
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
fi
-for ac_func in crypt DES_crypt
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -12518,235 +22820,807 @@
done
-# Search for SHA256 support in libc and/or OpenSSL
+ # Search for SHA256 support in libc and/or OpenSSL
+
+
for ac_func in SHA256_Update EVP_sha256
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
else
unsupported_algorithms="$unsupported_algorithms \
- hmac-sha2-256 hmac-sha2-512 \
- diffie-hellman-group-exchange-sha256 \
- hmac-sha2-256-etm at openssh.com hmac-sha2-512-etm at openssh.com"
+ hmac-sha2-256 \
+ hmac-sha2-512 \
+ diffie-hellman-group-exchange-sha256 \
+ hmac-sha2-256-etm at openssh.com \
+ hmac-sha2-512-etm at openssh.com"
fi
done
+ # Search for RIPE-MD support in OpenSSL
-# Check complete ECC support in OpenSSL
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL has NID_X9_62_prime256v1" >&5
-$as_echo_n "checking whether OpenSSL has NID_X9_62_prime256v1... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+for ac_func in EVP_ripemd160
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/ecdsa.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
-# error "OpenSSL < 0.9.8g has unreliable ECC code"
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
#endif
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
int
main ()
{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
- const EVP_MD *m = EVP_sha256(); /* We need this too */
+ eval "$as_ac_var=no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+else
+ unsupported_algorithms="$unsupported_algorithms \
+ hmac-ripemd160 \
+ hmac-ripemd160 at openssh.com \
+ hmac-ripemd160-etm at openssh.com"
+
+
+fi
+done
+
+
+ # Check complete ECC support in OpenSSL
+ { echo "$as_me:$LINENO: checking whether OpenSSL has NID_X9_62_prime256v1" >&5
+echo $ECHO_N "checking whether OpenSSL has NID_X9_62_prime256v1... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+ #include <openssl/ec.h>
+ #include <openssl/ecdh.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/opensslv.h>
+ #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
+ # error "OpenSSL < 0.9.8g has unreliable ECC code"
+ #endif
+
+int
+main ()
+{
+
+ EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+ const EVP_MD *m = EVP_sha256(); /* We need this too */
+
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- enable_nistp256=1
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+ enable_nistp256=1
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL has NID_secp384r1" >&5
-$as_echo_n "checking whether OpenSSL has NID_secp384r1... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+ { echo "$as_me:$LINENO: checking whether OpenSSL has NID_secp384r1" >&5
+echo $ECHO_N "checking whether OpenSSL has NID_secp384r1... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/ecdsa.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
-# error "OpenSSL < 0.9.8g has unreliable ECC code"
-#endif
+ #include <openssl/ec.h>
+ #include <openssl/ecdh.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/opensslv.h>
+ #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
+ # error "OpenSSL < 0.9.8g has unreliable ECC code"
+ #endif
int
main ()
{
- EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
- const EVP_MD *m = EVP_sha384(); /* We need this too */
+ EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
+ const EVP_MD *m = EVP_sha384(); /* We need this too */
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- enable_nistp384=1
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+ enable_nistp384=1
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL has NID_secp521r1" >&5
-$as_echo_n "checking whether OpenSSL has NID_secp521r1... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+ { echo "$as_me:$LINENO: checking whether OpenSSL has NID_secp521r1" >&5
+echo $ECHO_N "checking whether OpenSSL has NID_secp521r1... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/ecdsa.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
-# error "OpenSSL < 0.9.8g has unreliable ECC code"
-#endif
+ #include <openssl/ec.h>
+ #include <openssl/ecdh.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/opensslv.h>
+ #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
+ # error "OpenSSL < 0.9.8g has unreliable ECC code"
+ #endif
int
main ()
{
- EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
- const EVP_MD *m = EVP_sha512(); /* We need this too */
+ EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
+ const EVP_MD *m = EVP_sha512(); /* We need this too */
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if OpenSSL's NID_secp521r1 is functional" >&5
-$as_echo_n "checking if OpenSSL's NID_secp521r1 is functional... " >&6; }
- if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross-compiling: assuming yes" >&5
-$as_echo "$as_me: WARNING: cross-compiling: assuming yes" >&2;}
- enable_nistp521=1
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+ { echo "$as_me:$LINENO: checking if OpenSSL's NID_secp521r1 is functional" >&5
+echo $ECHO_N "checking if OpenSSL's NID_secp521r1 is functional... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross-compiling: assuming yes" >&5
+echo "$as_me: WARNING: cross-compiling: assuming yes" >&2;}
+ enable_nistp521=1
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/ecdsa.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/opensslv.h>
+ #include <openssl/ec.h>
+ #include <openssl/ecdh.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/opensslv.h>
int
main ()
{
- EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
- const EVP_MD *m = EVP_sha512(); /* We need this too */
- exit(e == NULL || m == NULL);
+ EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
+ const EVP_MD *m = EVP_sha512(); /* We need this too */
+ exit(e == NULL || m == NULL);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- enable_nistp521=1
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+ enable_nistp521=1
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
-COMMENT_OUT_ECC="#no ecc#"
-TEST_SSH_ECC=no
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
-if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
- test x$enable_nistp521 = x1; then
+ COMMENT_OUT_ECC="#no ecc#"
+ TEST_SSH_ECC=no
-$as_echo "#define OPENSSL_HAS_ECC 1" >>confdefs.h
+ if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
+ test x$enable_nistp521 = x1; then
-fi
-if test x$enable_nistp256 = x1; then
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_HAS_ECC 1
+_ACEOF
-$as_echo "#define OPENSSL_HAS_NISTP256 1" >>confdefs.h
+ fi
+ if test x$enable_nistp256 = x1; then
- TEST_SSH_ECC=yes
- COMMENT_OUT_ECC=""
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_HAS_NISTP256 1
+_ACEOF
+
+ TEST_SSH_ECC=yes
+ COMMENT_OUT_ECC=""
+ else
+ unsupported_algorithms="$unsupported_algorithms \
+ ecdsa-sha2-nistp256 \
+ ecdh-sha2-nistp256 \
+ ecdsa-sha2-nistp256-cert-v01 at openssh.com"
+ fi
+ if test x$enable_nistp384 = x1; then
+
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_HAS_NISTP384 1
+_ACEOF
+
+ TEST_SSH_ECC=yes
+ COMMENT_OUT_ECC=""
+ else
+ unsupported_algorithms="$unsupported_algorithms \
+ ecdsa-sha2-nistp384 \
+ ecdh-sha2-nistp384 \
+ ecdsa-sha2-nistp384-cert-v01 at openssh.com"
+ fi
+ if test x$enable_nistp521 = x1; then
+
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_HAS_NISTP521 1
+_ACEOF
+
+ TEST_SSH_ECC=yes
+ COMMENT_OUT_ECC=""
+ else
+ unsupported_algorithms="$unsupported_algorithms \
+ ecdh-sha2-nistp521 \
+ ecdsa-sha2-nistp521 \
+ ecdsa-sha2-nistp521-cert-v01 at openssh.com"
+ fi
+
+
+
else
- unsupported_algorithms="$unsupported_algorithms ecdsa-sha2-nistp256 \
- ecdh-sha2-nistp256 ecdsa-sha2-nistp256-cert-v01 at openssh.com"
+ { echo "$as_me:$LINENO: checking for crypt in -lcrypt" >&5
+echo $ECHO_N "checking for crypt in -lcrypt... $ECHO_C" >&6; }
+if test "${ac_cv_lib_crypt_crypt+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ ac_check_lib_save_LIBS=$LIBS
+LIBS="-lcrypt $LIBS"
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char crypt ();
+int
+main ()
+{
+return crypt ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ ac_cv_lib_crypt_crypt=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_crypt_crypt=no
fi
-if test x$enable_nistp384 = x1; then
-$as_echo "#define OPENSSL_HAS_NISTP384 1" >>confdefs.h
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_crypt_crypt" >&5
+echo "${ECHO_T}$ac_cv_lib_crypt_crypt" >&6; }
+if test $ac_cv_lib_crypt_crypt = yes; then
+ LIBS="$LIBS -lcrypt"
+fi
- TEST_SSH_ECC=yes
- COMMENT_OUT_ECC=""
+
+for ac_func in crypt
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- unsupported_algorithms="$unsupported_algorithms ecdsa-sha2-nistp384 \
- ecdh-sha2-nistp384 ecdsa-sha2-nistp384-cert-v01 at openssh.com"
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
fi
-if test x$enable_nistp521 = x1; then
-$as_echo "#define OPENSSL_HAS_NISTP521 1" >>confdefs.h
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
- TEST_SSH_ECC=yes
- COMMENT_OUT_ECC=""
+fi
+done
+
+fi
+
+
+
+
+
+for ac_func in \
+ arc4random \
+ arc4random_buf \
+ arc4random_stir \
+ arc4random_uniform \
+
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- unsupported_algorithms="$unsupported_algorithms ecdh-sha2-nistp521 \
- ecdsa-sha2-nistp521 ecdsa-sha2-nistp521-cert-v01 at openssh.com"
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
fi
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+ cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+fi
+done
saved_LIBS="$LIBS"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ia_openinfo in -liaf" >&5
-$as_echo_n "checking for ia_openinfo in -liaf... " >&6; }
-if ${ac_cv_lib_iaf_ia_openinfo+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for ia_openinfo in -liaf" >&5
+echo $ECHO_N "checking for ia_openinfo in -liaf... $ECHO_C" >&6; }
+if test "${ac_cv_lib_iaf_ia_openinfo+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-liaf $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -12764,30 +23638,136 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_iaf_ia_openinfo=yes
else
- ac_cv_lib_iaf_ia_openinfo=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_iaf_ia_openinfo=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_iaf_ia_openinfo" >&5
-$as_echo "$ac_cv_lib_iaf_ia_openinfo" >&6; }
-if test "x$ac_cv_lib_iaf_ia_openinfo" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_iaf_ia_openinfo" >&5
+echo "${ECHO_T}$ac_cv_lib_iaf_ia_openinfo" >&6; }
+if test $ac_cv_lib_iaf_ia_openinfo = yes; then
LIBS="$LIBS -liaf"
- for ac_func in set_id
-do :
- ac_fn_c_check_func "$LINENO" "set_id" "ac_cv_func_set_id"
-if test "x$ac_cv_func_set_id" = xyes; then :
+
+for ac_func in set_id
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_SET_ID 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
SSHDLIBS="$SSHDLIBS -liaf"
-$as_echo "#define HAVE_LIBIAF 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_LIBIAF 1
+_ACEOF
fi
@@ -12801,55 +23781,85 @@
### Configure cryptographic random number support
# Check wheter OpenSSL seeds itself
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL's PRNG is internally seeded" >&5
-$as_echo_n "checking whether OpenSSL's PRNG is internally seeded... " >&6; }
-if test "$cross_compiling" = yes; then :
+if test "x$openssl" = "xyes" ; then
+ { echo "$as_me:$LINENO: checking whether OpenSSL's PRNG is internally seeded" >&5
+echo $ECHO_N "checking whether OpenSSL's PRNG is internally seeded... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: assuming yes" >&5
-$as_echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
- # This is safe, since we will fatal() at runtime if
- # OpenSSL is not seeded correctly.
- OPENSSL_SEEDS_ITSELF=yes
+ { echo "$as_me:$LINENO: WARNING: cross compiling: assuming yes" >&5
+echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+ # This is safe, since we will fatal() at runtime if
+ # OpenSSL is not seeded correctly.
+ OPENSSL_SEEDS_ITSELF=yes
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
-#include <string.h>
-#include <openssl/rand.h>
+ #include <string.h>
+ #include <openssl/rand.h>
int
main ()
{
- exit(RAND_status() == 1 ? 0 : 1);
+ exit(RAND_status() == 1 ? 0 : 1);
;
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- OPENSSL_SEEDS_ITSELF=yes
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ OPENSSL_SEEDS_ITSELF=yes
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+fi
+
# PRNGD TCP socket
# Check whether --with-prngd-port was given.
-if test "${with_prngd_port+set}" = set; then :
+if test "${with_prngd_port+set}" = set; then
withval=$with_prngd_port;
case "$withval" in
no)
@@ -12858,7 +23868,9 @@
[0-9]*)
;;
*)
- as_fn_error $? "You must specify a numeric port number for --with-prngd-port" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: You must specify a numeric port number for --with-prngd-port" >&5
+echo "$as_me: error: You must specify a numeric port number for --with-prngd-port" >&2;}
+ { (exit 1); exit 1; }; }
;;
esac
if test ! -z "$withval" ; then
@@ -12877,7 +23889,7 @@
# PRNGD Unix domain socket
# Check whether --with-prngd-socket was given.
-if test "${with_prngd_socket+set}" = set; then :
+if test "${with_prngd_socket+set}" = set; then
withval=$with_prngd_socket;
case "$withval" in
yes)
@@ -12889,17 +23901,21 @@
/*)
;;
*)
- as_fn_error $? "You must specify an absolute path to the entropy socket" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: You must specify an absolute path to the entropy socket" >&5
+echo "$as_me: error: You must specify an absolute path to the entropy socket" >&2;}
+ { (exit 1); exit 1; }; }
;;
esac
if test ! -z "$withval" ; then
if test ! -z "$PRNGD_PORT" ; then
- as_fn_error $? "You may not specify both a PRNGD/EGD port and socket" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: You may not specify both a PRNGD/EGD port and socket" >&5
+echo "$as_me: error: You may not specify both a PRNGD/EGD port and socket" >&2;}
+ { (exit 1); exit 1; }; }
fi
if test ! -r "$withval" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Entropy socket is not readable" >&5
-$as_echo "$as_me: WARNING: Entropy socket is not readable" >&2;}
+ { echo "$as_me:$LINENO: WARNING: Entropy socket is not readable" >&5
+echo "$as_me: WARNING: Entropy socket is not readable" >&2;}
fi
PRNGD_SOCKET="$withval"
@@ -12913,8 +23929,8 @@
# Check for existing socket only if we don't have a random device already
if test "x$OPENSSL_SEEDS_ITSELF" != "xyes" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PRNGD/EGD socket" >&5
-$as_echo_n "checking for PRNGD/EGD socket... " >&6; }
+ { echo "$as_me:$LINENO: checking for PRNGD/EGD socket" >&5
+echo $ECHO_N "checking for PRNGD/EGD socket... $ECHO_C" >&6; }
# Insert other locations here
for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
@@ -12927,11 +23943,11 @@
fi
done
if test ! -z "$PRNGD_SOCKET" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PRNGD_SOCKET" >&5
-$as_echo "$PRNGD_SOCKET" >&6; }
+ { echo "$as_me:$LINENO: result: $PRNGD_SOCKET" >&5
+echo "${ECHO_T}$PRNGD_SOCKET" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
+ { echo "$as_me:$LINENO: result: not found" >&5
+echo "${ECHO_T}not found" >&6; }
fi
fi
@@ -12946,11 +23962,18 @@
RAND_MSG="PRNGd socket $PRNGD_SOCKET"
elif test ! -z "$OPENSSL_SEEDS_ITSELF" ; then
-$as_echo "#define OPENSSL_PRNG_ONLY 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_PRNG_ONLY 1
+_ACEOF
RAND_MSG="OpenSSL internal ONLY"
+elif test "x$openssl" = "xno" ; then
+ { echo "$as_me:$LINENO: WARNING: OpenSSH will use /dev/urandom as a source of random numbers. It will fail if this device is not supported or accessible" >&5
+echo "$as_me: WARNING: OpenSSH will use /dev/urandom as a source of random numbers. It will fail if this device is not supported or accessible" >&2;}
else
- as_fn_error $? "OpenSSH has no source of random numbers. Please configure OpenSSL with an entropy source or re-run configure using one of the --with-prngd-port or --with-prngd-socket options" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: OpenSSH has no source of random numbers. Please configure OpenSSL with an entropy source or re-run configure using one of the --with-prngd-port or --with-prngd-socket options" >&5
+echo "$as_me: error: OpenSSH has no source of random numbers. Please configure OpenSSL with an entropy source or re-run configure using one of the --with-prngd-port or --with-prngd-socket options" >&2;}
+ { (exit 1); exit 1; }; }
fi
# Check for PAM libs
@@ -12957,23 +23980,30 @@
PAM_MSG="no"
# Check whether --with-pam was given.
-if test "${with_pam+set}" = set; then :
+if test "${with_pam+set}" = set; then
withval=$with_pam;
if test "x$withval" != "xno" ; then
if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
- as_fn_error $? "PAM headers not found" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: PAM headers not found" >&5
+echo "$as_me: error: PAM headers not found" >&2;}
+ { (exit 1); exit 1; }; }
fi
saved_LIBS="$LIBS"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
-$as_echo_n "checking for dlopen in -ldl... " >&6; }
-if ${ac_cv_lib_dl_dlopen+:} false; then :
- $as_echo_n "(cached) " >&6
+
+{ echo "$as_me:$LINENO: checking for dlopen in -ldl" >&5
+echo $ECHO_N "checking for dlopen in -ldl... $ECHO_C" >&6; }
+if test "${ac_cv_lib_dl_dlopen+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-ldl $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -12991,18 +24021,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_dl_dlopen=yes
else
- ac_cv_lib_dl_dlopen=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_dl_dlopen=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
-$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
-if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_dl_dlopen" >&5
+echo "${ECHO_T}$ac_cv_lib_dl_dlopen" >&6; }
+if test $ac_cv_lib_dl_dlopen = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBDL 1
_ACEOF
@@ -13011,14 +24062,19 @@
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pam_set_item in -lpam" >&5
-$as_echo_n "checking for pam_set_item in -lpam... " >&6; }
-if ${ac_cv_lib_pam_pam_set_item+:} false; then :
- $as_echo_n "(cached) " >&6
+
+{ echo "$as_me:$LINENO: checking for pam_set_item in -lpam" >&5
+echo $ECHO_N "checking for pam_set_item in -lpam... $ECHO_C" >&6; }
+if test "${ac_cv_lib_pam_pam_set_item+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lpam $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -13036,18 +24092,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_pam_pam_set_item=yes
else
- ac_cv_lib_pam_pam_set_item=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_pam_pam_set_item=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pam_pam_set_item" >&5
-$as_echo "$ac_cv_lib_pam_pam_set_item" >&6; }
-if test "x$ac_cv_lib_pam_pam_set_item" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_pam_pam_set_item" >&5
+echo "${ECHO_T}$ac_cv_lib_pam_pam_set_item" >&6; }
+if test $ac_cv_lib_pam_pam_set_item = yes; then
cat >>confdefs.h <<_ACEOF
#define HAVE_LIBPAM 1
_ACEOF
@@ -13055,26 +24132,194 @@
LIBS="-lpam $LIBS"
else
- as_fn_error $? "*** libpam missing" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: *** libpam missing" >&5
+echo "$as_me: error: *** libpam missing" >&2;}
+ { (exit 1); exit 1; }; }
fi
- for ac_func in pam_getenvlist
-do :
- ac_fn_c_check_func "$LINENO" "pam_getenvlist" "ac_cv_func_pam_getenvlist"
-if test "x$ac_cv_func_pam_getenvlist" = xyes; then :
+
+for ac_func in pam_getenvlist
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_PAM_GETENVLIST 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
- for ac_func in pam_putenv
-do :
- ac_fn_c_check_func "$LINENO" "pam_putenv" "ac_cv_func_pam_putenv"
-if test "x$ac_cv_func_pam_putenv" = xyes; then :
+
+for ac_func in pam_putenv
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_PAM_PUTENV 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -13086,7 +24331,9 @@
SSHDLIBS="$SSHDLIBS -lpam"
-$as_echo "#define USE_PAM 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_PAM 1
+_ACEOF
if test $ac_cv_lib_dl_dlopen = yes; then
@@ -13108,9 +24355,13 @@
# Check for older PAM
if test "x$PAM_MSG" = "xyes" ; then
# Check PAM strerror arguments (old PAM)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pam_strerror takes only one argument" >&5
-$as_echo_n "checking whether pam_strerror takes only one argument... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking whether pam_strerror takes only one argument" >&5
+echo $ECHO_N "checking whether pam_strerror takes only one argument... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdlib.h>
@@ -13130,27 +24381,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define HAVE_OLD_PAM 1" >>confdefs.h
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_OLD_PAM 1
+_ACEOF
+
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
PAM_MSG="yes (old library)"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-SSH_PRIVSEP_USER=sshd
+case "$host" in
+*-*-cygwin*)
+ SSH_PRIVSEP_USER=CYGWIN_SSH_PRIVSEP_USER
+ ;;
+*)
+ SSH_PRIVSEP_USER=sshd
+ ;;
+esac
# Check whether --with-privsep-user was given.
-if test "${with_privsep_user+set}" = set; then :
+if test "${with_privsep_user+set}" = set; then
withval=$with_privsep_user;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
@@ -13160,28 +24440,91 @@
fi
+if test "x$SSH_PRIVSEP_USER" = "xCYGWIN_SSH_PRIVSEP_USER" ; then
cat >>confdefs.h <<_ACEOF
+#define SSH_PRIVSEP_USER CYGWIN_SSH_PRIVSEP_USER
+_ACEOF
+
+else
+
+cat >>confdefs.h <<_ACEOF
#define SSH_PRIVSEP_USER "$SSH_PRIVSEP_USER"
_ACEOF
+fi
if test "x$have_linux_no_new_privs" = "x1" ; then
-ac_fn_c_check_decl "$LINENO" "SECCOMP_MODE_FILTER" "ac_cv_have_decl_SECCOMP_MODE_FILTER" "
+{ echo "$as_me:$LINENO: checking whether SECCOMP_MODE_FILTER is declared" >&5
+echo $ECHO_N "checking whether SECCOMP_MODE_FILTER is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_SECCOMP_MODE_FILTER+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <linux/seccomp.h>
-"
-if test "x$ac_cv_have_decl_SECCOMP_MODE_FILTER" = xyes; then :
+
+int
+main ()
+{
+#ifndef SECCOMP_MODE_FILTER
+ (void) SECCOMP_MODE_FILTER;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_SECCOMP_MODE_FILTER=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_SECCOMP_MODE_FILTER=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_SECCOMP_MODE_FILTER" >&5
+echo "${ECHO_T}$ac_cv_have_decl_SECCOMP_MODE_FILTER" >&6; }
+if test $ac_cv_have_decl_SECCOMP_MODE_FILTER = yes; then
have_seccomp_filter=1
fi
fi
if test "x$have_seccomp_filter" = "x1" ; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking kernel for seccomp_filter support" >&5
-$as_echo_n "checking kernel for seccomp_filter support... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking kernel for seccomp_filter support" >&5
+echo $ECHO_N "checking kernel for seccomp_filter support... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <errno.h>
@@ -13202,20 +24545,41 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
# Disable seccomp filter as a target
have_seccomp_filter=0
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
fi
# Decide which sandbox style to use
@@ -13222,7 +24586,7 @@
sandbox_arg=""
# Check whether --with-sandbox was given.
-if test "${with_sandbox+set}" = set; then :
+if test "${with_sandbox+set}" = set; then
withval=$with_sandbox;
if test "x$withval" = "xyes" ; then
sandbox_arg=""
@@ -13237,14 +24601,18 @@
# Some platforms (seems to be the ones that have a kernel poll(2)-type
# function with which they implement select(2)) use an extra file descriptor
# when calling select(2), which means we can't use the rlimit sandbox.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if select works with descriptor rlimit" >&5
-$as_echo_n "checking if select works with descriptor rlimit... " >&6; }
-if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: assuming yes" >&5
-$as_echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+{ echo "$as_me:$LINENO: checking if select works with descriptor rlimit" >&5
+echo $ECHO_N "checking if select works with descriptor rlimit... $ECHO_C" >&6; }
+if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: assuming yes" >&5
+echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -13283,28 +24651,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
select_works_with_rlimit=yes
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
select_works_with_rlimit=no
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if setrlimit(RLIMIT_NOFILE,{0,0}) works" >&5
-$as_echo_n "checking if setrlimit(RLIMIT_NOFILE,{0,0}) works... " >&6; }
-if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: assuming yes" >&5
-$as_echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+{ echo "$as_me:$LINENO: checking if setrlimit(RLIMIT_NOFILE,{0,0}) works" >&5
+echo $ECHO_N "checking if setrlimit(RLIMIT_NOFILE,{0,0}) works... $ECHO_C" >&6; }
+if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: assuming yes" >&5
+echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -13331,28 +24727,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
rlimit_nofile_zero_works=yes
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
rlimit_nofile_zero_works=no
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if setrlimit RLIMIT_FSIZE works" >&5
-$as_echo_n "checking if setrlimit RLIMIT_FSIZE works... " >&6; }
-if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: assuming yes" >&5
-$as_echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+{ echo "$as_me:$LINENO: checking if setrlimit RLIMIT_FSIZE works" >&5
+echo $ECHO_N "checking if setrlimit RLIMIT_FSIZE works... $ECHO_C" >&6; }
+if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: assuming yes" >&5
+echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -13372,28 +24796,70 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define SANDBOX_SKIP_RLIMIT_FSIZE 1" >>confdefs.h
+( exit $ac_status )
+{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_SKIP_RLIMIT_FSIZE 1
+_ACEOF
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-if test "x$sandbox_arg" = "xsystrace" || \
+
+if test "x$sandbox_arg" = "xpledge" || \
+ ( test -z "$sandbox_arg" && test "x$ac_cv_func_pledge" = "xyes" ) ; then
+ test "x$ac_cv_func_pledge" != "xyes" && \
+ { { echo "$as_me:$LINENO: error: pledge sandbox requires pledge(2) support" >&5
+echo "$as_me: error: pledge sandbox requires pledge(2) support" >&2;}
+ { (exit 1); exit 1; }; }
+ SANDBOX_STYLE="pledge"
+
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_PLEDGE 1
+_ACEOF
+
+elif test "x$sandbox_arg" = "xsystrace" || \
( test -z "$sandbox_arg" && test "x$have_systr_policy_kill" = "x1" ) ; then
test "x$have_systr_policy_kill" != "x1" && \
- as_fn_error $? "systrace sandbox requires systrace headers and SYSTR_POLICY_KILL support" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: systrace sandbox requires systrace headers and SYSTR_POLICY_KILL support" >&5
+echo "$as_me: error: systrace sandbox requires systrace headers and SYSTR_POLICY_KILL support" >&2;}
+ { (exit 1); exit 1; }; }
SANDBOX_STYLE="systrace"
-$as_echo "#define SANDBOX_SYSTRACE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_SYSTRACE 1
+_ACEOF
elif test "x$sandbox_arg" = "xdarwin" || \
( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \
@@ -13400,10 +24866,14 @@
test "x$ac_cv_header_sandbox_h" = "xyes") ; then
test "x$ac_cv_func_sandbox_init" != "xyes" -o \
"x$ac_cv_header_sandbox_h" != "xyes" && \
- as_fn_error $? "Darwin seatbelt sandbox requires sandbox.h and sandbox_init function" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: Darwin seatbelt sandbox requires sandbox.h and sandbox_init function" >&5
+echo "$as_me: error: Darwin seatbelt sandbox requires sandbox.h and sandbox_init function" >&2;}
+ { (exit 1); exit 1; }; }
SANDBOX_STYLE="darwin"
-$as_echo "#define SANDBOX_DARWIN 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_DARWIN 1
+_ACEOF
elif test "x$sandbox_arg" = "xseccomp_filter" || \
( test -z "$sandbox_arg" && \
@@ -13415,16 +24885,26 @@
test "x$have_linux_no_new_privs" = "x1" && \
test "x$ac_cv_func_prctl" = "xyes" ) ; then
test "x$seccomp_audit_arch" = "x" && \
- as_fn_error $? "seccomp_filter sandbox not supported on $host" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: seccomp_filter sandbox not supported on $host" >&5
+echo "$as_me: error: seccomp_filter sandbox not supported on $host" >&2;}
+ { (exit 1); exit 1; }; }
test "x$have_linux_no_new_privs" != "x1" && \
- as_fn_error $? "seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS" >&5
+echo "$as_me: error: seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS" >&2;}
+ { (exit 1); exit 1; }; }
test "x$have_seccomp_filter" != "x1" && \
- as_fn_error $? "seccomp_filter sandbox requires seccomp headers" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: seccomp_filter sandbox requires seccomp headers" >&5
+echo "$as_me: error: seccomp_filter sandbox requires seccomp headers" >&2;}
+ { (exit 1); exit 1; }; }
test "x$ac_cv_func_prctl" != "xyes" && \
- as_fn_error $? "seccomp_filter sandbox requires prctl function" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: seccomp_filter sandbox requires prctl function" >&5
+echo "$as_me: error: seccomp_filter sandbox requires prctl function" >&2;}
+ { (exit 1); exit 1; }; }
SANDBOX_STYLE="seccomp_filter"
-$as_echo "#define SANDBOX_SECCOMP_FILTER 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_SECCOMP_FILTER 1
+_ACEOF
elif test "x$sandbox_arg" = "xcapsicum" || \
( test -z "$sandbox_arg" && \
@@ -13431,12 +24911,18 @@
test "x$ac_cv_header_sys_capability_h" = "xyes" && \
test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then
test "x$ac_cv_header_sys_capability_h" != "xyes" && \
- as_fn_error $? "capsicum sandbox requires sys/capability.h header" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: capsicum sandbox requires sys/capability.h header" >&5
+echo "$as_me: error: capsicum sandbox requires sys/capability.h header" >&2;}
+ { (exit 1); exit 1; }; }
test "x$ac_cv_func_cap_rights_limit" != "xyes" && \
- as_fn_error $? "capsicum sandbox requires cap_rights_limit function" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: capsicum sandbox requires cap_rights_limit function" >&5
+echo "$as_me: error: capsicum sandbox requires cap_rights_limit function" >&2;}
+ { (exit 1); exit 1; }; }
SANDBOX_STYLE="capsicum"
-$as_echo "#define SANDBOX_CAPSICUM 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_CAPSICUM 1
+_ACEOF
elif test "x$sandbox_arg" = "xrlimit" || \
( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
@@ -13443,21 +24929,39 @@
test "x$select_works_with_rlimit" = "xyes" && \
test "x$rlimit_nofile_zero_works" = "xyes" ) ; then
test "x$ac_cv_func_setrlimit" != "xyes" && \
- as_fn_error $? "rlimit sandbox requires setrlimit function" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: rlimit sandbox requires setrlimit function" >&5
+echo "$as_me: error: rlimit sandbox requires setrlimit function" >&2;}
+ { (exit 1); exit 1; }; }
test "x$select_works_with_rlimit" != "xyes" && \
- as_fn_error $? "rlimit sandbox requires select to work with rlimit" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: rlimit sandbox requires select to work with rlimit" >&5
+echo "$as_me: error: rlimit sandbox requires select to work with rlimit" >&2;}
+ { (exit 1); exit 1; }; }
SANDBOX_STYLE="rlimit"
-$as_echo "#define SANDBOX_RLIMIT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_RLIMIT 1
+_ACEOF
+elif test "x$sandbox_arg" = "xsolaris" || \
+ ( test -z "$sandbox_arg" && test "x$SOLARIS_PRIVS" = "xyes" ) ; then
+ SANDBOX_STYLE="solaris"
+
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_SOLARIS 1
+_ACEOF
+
elif test -z "$sandbox_arg" || test "x$sandbox_arg" = "xno" || \
test "x$sandbox_arg" = "xnone" || test "x$sandbox_arg" = "xnull" ; then
SANDBOX_STYLE="none"
-$as_echo "#define SANDBOX_NULL 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define SANDBOX_NULL 1
+_ACEOF
else
- as_fn_error $? "unsupported --with-sandbox" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: unsupported --with-sandbox" >&5
+echo "$as_me: error: unsupported --with-sandbox" >&2;}
+ { (exit 1); exit 1; }; }
fi
# Cheap hack to ensure NEWS-OS libraries are arranged right.
@@ -13466,9 +24970,61 @@
fi
# Check for long long datatypes
-ac_fn_c_check_type "$LINENO" "long long" "ac_cv_type_long_long" "$ac_includes_default"
-if test "x$ac_cv_type_long_long" = xyes; then :
+{ echo "$as_me:$LINENO: checking for long long" >&5
+echo $ECHO_N "checking for long long... $ECHO_C" >&6; }
+if test "${ac_cv_type_long_long+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+typedef long long ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_long_long=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_type_long_long=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_long_long" >&5
+echo "${ECHO_T}$ac_cv_type_long_long" >&6; }
+if test $ac_cv_type_long_long = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_LONG_LONG 1
_ACEOF
@@ -13475,9 +25031,61 @@
fi
-ac_fn_c_check_type "$LINENO" "unsigned long long" "ac_cv_type_unsigned_long_long" "$ac_includes_default"
-if test "x$ac_cv_type_unsigned_long_long" = xyes; then :
+{ echo "$as_me:$LINENO: checking for unsigned long long" >&5
+echo $ECHO_N "checking for unsigned long long... $ECHO_C" >&6; }
+if test "${ac_cv_type_unsigned_long_long+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+typedef unsigned long long ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_unsigned_long_long=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_type_unsigned_long_long=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_unsigned_long_long" >&5
+echo "${ECHO_T}$ac_cv_type_unsigned_long_long" >&6; }
+if test $ac_cv_type_unsigned_long_long = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_UNSIGNED_LONG_LONG 1
_ACEOF
@@ -13484,9 +25092,61 @@
fi
-ac_fn_c_check_type "$LINENO" "long double" "ac_cv_type_long_double" "$ac_includes_default"
-if test "x$ac_cv_type_long_double" = xyes; then :
+{ echo "$as_me:$LINENO: checking for long double" >&5
+echo $ECHO_N "checking for long double... $ECHO_C" >&6; }
+if test "${ac_cv_type_long_double+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+typedef long double ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_long_double=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_type_long_double=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_long_double" >&5
+echo "${ECHO_T}$ac_cv_type_long_double" >&6; }
+if test $ac_cv_type_long_double = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_LONG_DOUBLE 1
_ACEOF
@@ -13496,31 +25156,403 @@
# Check datatype sizes
+{ echo "$as_me:$LINENO: checking for short int" >&5
+echo $ECHO_N "checking for short int... $ECHO_C" >&6; }
+if test "${ac_cv_type_short_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+typedef short int ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_short_int=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_short_int=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_short_int" >&5
+echo "${ECHO_T}$ac_cv_type_short_int" >&6; }
+
# The cast to long int works around a bug in the HP C Compiler
# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
# This bug is HP SR number 8606223364.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of short int" >&5
-$as_echo_n "checking size of short int... " >&6; }
-if ${ac_cv_sizeof_short_int+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking size of short int" >&5
+echo $ECHO_N "checking size of short int... $ECHO_C" >&6; }
+if test "${ac_cv_sizeof_short_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (short int))" "ac_cv_sizeof_short_int" "$ac_includes_default"; then :
+ if test "$cross_compiling" = yes; then
+ # Depending upon the size, compute the lo and hi bounds.
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef short int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) >= 0)];
+test_array [0] = 0
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_lo=0 ac_mid=0
+ while :; do
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef short int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) <= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=$ac_mid; break
else
- if test "$ac_cv_type_short_int" = yes; then
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error 77 "cannot compute sizeof (short int)
-See \`config.log' for more details" "$LINENO" 5; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo=`expr $ac_mid + 1`
+ if test $ac_lo -le $ac_mid; then
+ ac_lo= ac_hi=
+ break
+ fi
+ ac_mid=`expr 2 '*' $ac_mid + 1`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ done
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef short int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) < 0)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=-1 ac_mid=-1
+ while :; do
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef short int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) >= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_lo=$ac_mid; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_hi=`expr '(' $ac_mid ')' - 1`
+ if test $ac_mid -le $ac_hi; then
+ ac_lo= ac_hi=
+ break
+ fi
+ ac_mid=`expr 2 '*' $ac_mid`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ done
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo= ac_hi=
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+# Binary search between lo and hi bounds.
+while test "x$ac_lo" != "x$ac_hi"; do
+ ac_mid=`expr '(' $ac_hi - $ac_lo ')' / 2 + $ac_lo`
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef short int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) <= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=$ac_mid
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo=`expr '(' $ac_mid ')' + 1`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+done
+case $ac_lo in
+?*) ac_cv_sizeof_short_int=$ac_lo;;
+'') if test "$ac_cv_type_short_int" = yes; then
+ { { echo "$as_me:$LINENO: error: cannot compute sizeof (short int)
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute sizeof (short int)
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
else
ac_cv_sizeof_short_int=0
+ fi ;;
+esac
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef short int ac__type_sizeof_;
+static long int longval () { return (long int) (sizeof (ac__type_sizeof_)); }
+static unsigned long int ulongval () { return (long int) (sizeof (ac__type_sizeof_)); }
+#include <stdio.h>
+#include <stdlib.h>
+int
+main ()
+{
+
+ FILE *f = fopen ("conftest.val", "w");
+ if (! f)
+ return 1;
+ if (((long int) (sizeof (ac__type_sizeof_))) < 0)
+ {
+ long int i = longval ();
+ if (i != ((long int) (sizeof (ac__type_sizeof_))))
+ return 1;
+ fprintf (f, "%ld\n", i);
+ }
+ else
+ {
+ unsigned long int i = ulongval ();
+ if (i != ((long int) (sizeof (ac__type_sizeof_))))
+ return 1;
+ fprintf (f, "%lu\n", i);
+ }
+ return ferror (f) || fclose (f) != 0;
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ ac_cv_sizeof_short_int=`cat conftest.val`
+else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+if test "$ac_cv_type_short_int" = yes; then
+ { { echo "$as_me:$LINENO: error: cannot compute sizeof (short int)
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute sizeof (short int)
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
+ else
+ ac_cv_sizeof_short_int=0
fi
fi
-
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_short_int" >&5
-$as_echo "$ac_cv_sizeof_short_int" >&6; }
+rm -f conftest.val
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_sizeof_short_int" >&5
+echo "${ECHO_T}$ac_cv_sizeof_short_int" >&6; }
@@ -13529,31 +25561,403 @@
_ACEOF
+{ echo "$as_me:$LINENO: checking for int" >&5
+echo $ECHO_N "checking for int... $ECHO_C" >&6; }
+if test "${ac_cv_type_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+typedef int ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_int=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_int=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_int" >&5
+echo "${ECHO_T}$ac_cv_type_int" >&6; }
+
# The cast to long int works around a bug in the HP C Compiler
# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
# This bug is HP SR number 8606223364.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of int" >&5
-$as_echo_n "checking size of int... " >&6; }
-if ${ac_cv_sizeof_int+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking size of int" >&5
+echo $ECHO_N "checking size of int... $ECHO_C" >&6; }
+if test "${ac_cv_sizeof_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (int))" "ac_cv_sizeof_int" "$ac_includes_default"; then :
+ if test "$cross_compiling" = yes; then
+ # Depending upon the size, compute the lo and hi bounds.
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) >= 0)];
+test_array [0] = 0
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_lo=0 ac_mid=0
+ while :; do
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) <= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=$ac_mid; break
else
- if test "$ac_cv_type_int" = yes; then
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error 77 "cannot compute sizeof (int)
-See \`config.log' for more details" "$LINENO" 5; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo=`expr $ac_mid + 1`
+ if test $ac_lo -le $ac_mid; then
+ ac_lo= ac_hi=
+ break
+ fi
+ ac_mid=`expr 2 '*' $ac_mid + 1`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ done
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) < 0)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=-1 ac_mid=-1
+ while :; do
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) >= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_lo=$ac_mid; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_hi=`expr '(' $ac_mid ')' - 1`
+ if test $ac_mid -le $ac_hi; then
+ ac_lo= ac_hi=
+ break
+ fi
+ ac_mid=`expr 2 '*' $ac_mid`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ done
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo= ac_hi=
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+# Binary search between lo and hi bounds.
+while test "x$ac_lo" != "x$ac_hi"; do
+ ac_mid=`expr '(' $ac_hi - $ac_lo ')' / 2 + $ac_lo`
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) <= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=$ac_mid
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo=`expr '(' $ac_mid ')' + 1`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+done
+case $ac_lo in
+?*) ac_cv_sizeof_int=$ac_lo;;
+'') if test "$ac_cv_type_int" = yes; then
+ { { echo "$as_me:$LINENO: error: cannot compute sizeof (int)
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute sizeof (int)
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
else
ac_cv_sizeof_int=0
+ fi ;;
+esac
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef int ac__type_sizeof_;
+static long int longval () { return (long int) (sizeof (ac__type_sizeof_)); }
+static unsigned long int ulongval () { return (long int) (sizeof (ac__type_sizeof_)); }
+#include <stdio.h>
+#include <stdlib.h>
+int
+main ()
+{
+
+ FILE *f = fopen ("conftest.val", "w");
+ if (! f)
+ return 1;
+ if (((long int) (sizeof (ac__type_sizeof_))) < 0)
+ {
+ long int i = longval ();
+ if (i != ((long int) (sizeof (ac__type_sizeof_))))
+ return 1;
+ fprintf (f, "%ld\n", i);
+ }
+ else
+ {
+ unsigned long int i = ulongval ();
+ if (i != ((long int) (sizeof (ac__type_sizeof_))))
+ return 1;
+ fprintf (f, "%lu\n", i);
+ }
+ return ferror (f) || fclose (f) != 0;
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ ac_cv_sizeof_int=`cat conftest.val`
+else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+if test "$ac_cv_type_int" = yes; then
+ { { echo "$as_me:$LINENO: error: cannot compute sizeof (int)
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute sizeof (int)
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
+ else
+ ac_cv_sizeof_int=0
fi
fi
-
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_int" >&5
-$as_echo "$ac_cv_sizeof_int" >&6; }
+rm -f conftest.val
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_sizeof_int" >&5
+echo "${ECHO_T}$ac_cv_sizeof_int" >&6; }
@@ -13562,31 +25966,403 @@
_ACEOF
+{ echo "$as_me:$LINENO: checking for long int" >&5
+echo $ECHO_N "checking for long int... $ECHO_C" >&6; }
+if test "${ac_cv_type_long_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+typedef long int ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_long_int=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_long_int=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_long_int" >&5
+echo "${ECHO_T}$ac_cv_type_long_int" >&6; }
+
# The cast to long int works around a bug in the HP C Compiler
# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
# This bug is HP SR number 8606223364.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of long int" >&5
-$as_echo_n "checking size of long int... " >&6; }
-if ${ac_cv_sizeof_long_int+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking size of long int" >&5
+echo $ECHO_N "checking size of long int... $ECHO_C" >&6; }
+if test "${ac_cv_sizeof_long_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (long int))" "ac_cv_sizeof_long_int" "$ac_includes_default"; then :
+ if test "$cross_compiling" = yes; then
+ # Depending upon the size, compute the lo and hi bounds.
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) >= 0)];
+test_array [0] = 0
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_lo=0 ac_mid=0
+ while :; do
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) <= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=$ac_mid; break
else
- if test "$ac_cv_type_long_int" = yes; then
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error 77 "cannot compute sizeof (long int)
-See \`config.log' for more details" "$LINENO" 5; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo=`expr $ac_mid + 1`
+ if test $ac_lo -le $ac_mid; then
+ ac_lo= ac_hi=
+ break
+ fi
+ ac_mid=`expr 2 '*' $ac_mid + 1`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ done
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) < 0)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=-1 ac_mid=-1
+ while :; do
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) >= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_lo=$ac_mid; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_hi=`expr '(' $ac_mid ')' - 1`
+ if test $ac_mid -le $ac_hi; then
+ ac_lo= ac_hi=
+ break
+ fi
+ ac_mid=`expr 2 '*' $ac_mid`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ done
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo= ac_hi=
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+# Binary search between lo and hi bounds.
+while test "x$ac_lo" != "x$ac_hi"; do
+ ac_mid=`expr '(' $ac_hi - $ac_lo ')' / 2 + $ac_lo`
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) <= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=$ac_mid
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo=`expr '(' $ac_mid ')' + 1`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+done
+case $ac_lo in
+?*) ac_cv_sizeof_long_int=$ac_lo;;
+'') if test "$ac_cv_type_long_int" = yes; then
+ { { echo "$as_me:$LINENO: error: cannot compute sizeof (long int)
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute sizeof (long int)
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
else
ac_cv_sizeof_long_int=0
+ fi ;;
+esac
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long int ac__type_sizeof_;
+static long int longval () { return (long int) (sizeof (ac__type_sizeof_)); }
+static unsigned long int ulongval () { return (long int) (sizeof (ac__type_sizeof_)); }
+#include <stdio.h>
+#include <stdlib.h>
+int
+main ()
+{
+
+ FILE *f = fopen ("conftest.val", "w");
+ if (! f)
+ return 1;
+ if (((long int) (sizeof (ac__type_sizeof_))) < 0)
+ {
+ long int i = longval ();
+ if (i != ((long int) (sizeof (ac__type_sizeof_))))
+ return 1;
+ fprintf (f, "%ld\n", i);
+ }
+ else
+ {
+ unsigned long int i = ulongval ();
+ if (i != ((long int) (sizeof (ac__type_sizeof_))))
+ return 1;
+ fprintf (f, "%lu\n", i);
+ }
+ return ferror (f) || fclose (f) != 0;
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ ac_cv_sizeof_long_int=`cat conftest.val`
+else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+if test "$ac_cv_type_long_int" = yes; then
+ { { echo "$as_me:$LINENO: error: cannot compute sizeof (long int)
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute sizeof (long int)
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
+ else
+ ac_cv_sizeof_long_int=0
fi
fi
-
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_long_int" >&5
-$as_echo "$ac_cv_sizeof_long_int" >&6; }
+rm -f conftest.val
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_sizeof_long_int" >&5
+echo "${ECHO_T}$ac_cv_sizeof_long_int" >&6; }
@@ -13595,31 +26371,403 @@
_ACEOF
+{ echo "$as_me:$LINENO: checking for long long int" >&5
+echo $ECHO_N "checking for long long int... $ECHO_C" >&6; }
+if test "${ac_cv_type_long_long_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+typedef long long int ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_long_long_int=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_long_long_int=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_long_long_int" >&5
+echo "${ECHO_T}$ac_cv_type_long_long_int" >&6; }
+
# The cast to long int works around a bug in the HP C Compiler
# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
# This bug is HP SR number 8606223364.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of long long int" >&5
-$as_echo_n "checking size of long long int... " >&6; }
-if ${ac_cv_sizeof_long_long_int+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking size of long long int" >&5
+echo $ECHO_N "checking size of long long int... $ECHO_C" >&6; }
+if test "${ac_cv_sizeof_long_long_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (long long int))" "ac_cv_sizeof_long_long_int" "$ac_includes_default"; then :
+ if test "$cross_compiling" = yes; then
+ # Depending upon the size, compute the lo and hi bounds.
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) >= 0)];
+test_array [0] = 0
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_lo=0 ac_mid=0
+ while :; do
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) <= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=$ac_mid; break
else
- if test "$ac_cv_type_long_long_int" = yes; then
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error 77 "cannot compute sizeof (long long int)
-See \`config.log' for more details" "$LINENO" 5; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo=`expr $ac_mid + 1`
+ if test $ac_lo -le $ac_mid; then
+ ac_lo= ac_hi=
+ break
+ fi
+ ac_mid=`expr 2 '*' $ac_mid + 1`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ done
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) < 0)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=-1 ac_mid=-1
+ while :; do
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) >= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_lo=$ac_mid; break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_hi=`expr '(' $ac_mid ')' - 1`
+ if test $ac_mid -le $ac_hi; then
+ ac_lo= ac_hi=
+ break
+ fi
+ ac_mid=`expr 2 '*' $ac_mid`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ done
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo= ac_hi=
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+# Binary search between lo and hi bounds.
+while test "x$ac_lo" != "x$ac_hi"; do
+ ac_mid=`expr '(' $ac_hi - $ac_lo ')' / 2 + $ac_lo`
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long long int ac__type_sizeof_;
+int
+main ()
+{
+static int test_array [1 - 2 * !(((long int) (sizeof (ac__type_sizeof_))) <= $ac_mid)];
+test_array [0] = 0
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_hi=$ac_mid
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_lo=`expr '(' $ac_mid ')' + 1`
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+done
+case $ac_lo in
+?*) ac_cv_sizeof_long_long_int=$ac_lo;;
+'') if test "$ac_cv_type_long_long_int" = yes; then
+ { { echo "$as_me:$LINENO: error: cannot compute sizeof (long long int)
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute sizeof (long long int)
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
else
ac_cv_sizeof_long_long_int=0
+ fi ;;
+esac
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+ typedef long long int ac__type_sizeof_;
+static long int longval () { return (long int) (sizeof (ac__type_sizeof_)); }
+static unsigned long int ulongval () { return (long int) (sizeof (ac__type_sizeof_)); }
+#include <stdio.h>
+#include <stdlib.h>
+int
+main ()
+{
+
+ FILE *f = fopen ("conftest.val", "w");
+ if (! f)
+ return 1;
+ if (((long int) (sizeof (ac__type_sizeof_))) < 0)
+ {
+ long int i = longval ();
+ if (i != ((long int) (sizeof (ac__type_sizeof_))))
+ return 1;
+ fprintf (f, "%ld\n", i);
+ }
+ else
+ {
+ unsigned long int i = ulongval ();
+ if (i != ((long int) (sizeof (ac__type_sizeof_))))
+ return 1;
+ fprintf (f, "%lu\n", i);
+ }
+ return ferror (f) || fclose (f) != 0;
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
+ ac_cv_sizeof_long_long_int=`cat conftest.val`
+else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+if test "$ac_cv_type_long_long_int" = yes; then
+ { { echo "$as_me:$LINENO: error: cannot compute sizeof (long long int)
+See \`config.log' for more details." >&5
+echo "$as_me: error: cannot compute sizeof (long long int)
+See \`config.log' for more details." >&2;}
+ { (exit 77); exit 77; }; }
+ else
+ ac_cv_sizeof_long_long_int=0
fi
fi
-
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_long_long_int" >&5
-$as_echo "$ac_cv_sizeof_long_long_int" >&6; }
+rm -f conftest.val
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_sizeof_long_long_int" >&5
+echo "${ECHO_T}$ac_cv_sizeof_long_long_int" >&6; }
@@ -13636,16 +26784,20 @@
# compute LLONG_MIN and LLONG_MAX if we don't know them.
if test -z "$have_llong_max"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for max value of long long" >&5
-$as_echo_n "checking for max value of long long... " >&6; }
- if test "$cross_compiling" = yes; then :
+ { echo "$as_me:$LINENO: checking for max value of long long" >&5
+echo $ECHO_N "checking for max value of long long... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking" >&2;}
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking" >&5
+echo "$as_me: WARNING: cross compiling: not checking" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -13726,22 +26878,41 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
llong_min=`$AWK '{print $1}' conftest.llminmax`
llong_max=`$AWK '{print $2}' conftest.llminmax`
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $llong_max" >&5
-$as_echo "$llong_max" >&6; }
+ { echo "$as_me:$LINENO: result: $llong_max" >&5
+echo "${ECHO_T}$llong_max" >&6; }
cat >>confdefs.h <<_ACEOF
#define LLONG_MAX ${llong_max}LL
_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for min value of long long" >&5
-$as_echo_n "checking for min value of long long... " >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $llong_min" >&5
-$as_echo "$llong_min" >&6; }
+ { echo "$as_me:$LINENO: checking for min value of long long" >&5
+echo $ECHO_N "checking for min value of long long... $ECHO_C" >&6; }
+ { echo "$as_me:$LINENO: result: $llong_min" >&5
+echo "${ECHO_T}$llong_min" >&6; }
cat >>confdefs.h <<_ACEOF
#define LLONG_MIN ${llong_min}LL
@@ -13749,26 +26920,35 @@
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
+( exit $ac_status )
+ { echo "$as_me:$LINENO: result: not found" >&5
+echo "${ECHO_T}not found" >&6; }
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
# More checks for data types
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for u_int type" >&5
-$as_echo_n "checking for u_int type... " >&6; }
-if ${ac_cv_have_u_int+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for u_int type" >&5
+echo $ECHO_N "checking for u_int type... $ECHO_C" >&6; }
+if test "${ac_cv_have_u_int+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -13779,31 +26959,57 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_u_int="yes"
else
- ac_cv_have_u_int="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_u_int="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_u_int" >&5
-$as_echo "$ac_cv_have_u_int" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_u_int" >&5
+echo "${ECHO_T}$ac_cv_have_u_int" >&6; }
if test "x$ac_cv_have_u_int" = "xyes" ; then
-$as_echo "#define HAVE_U_INT 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_U_INT 1
+_ACEOF
have_u_int=1
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for intXX_t types" >&5
-$as_echo_n "checking for intXX_t types... " >&6; }
-if ${ac_cv_have_intxx_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for intXX_t types" >&5
+echo $ECHO_N "checking for intXX_t types... $ECHO_C" >&6; }
+if test "${ac_cv_have_intxx_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -13814,20 +27020,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_intxx_t="yes"
else
- ac_cv_have_intxx_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_intxx_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_intxx_t" >&5
-$as_echo "$ac_cv_have_intxx_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_intxx_t" >&5
+echo "${ECHO_T}$ac_cv_have_intxx_t" >&6; }
if test "x$ac_cv_have_intxx_t" = "xyes" ; then
-$as_echo "#define HAVE_INTXX_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_INTXX_T 1
+_ACEOF
have_intxx_t=1
fi
@@ -13835,9 +27063,13 @@
if (test -z "$have_intxx_t" && \
test "x$ac_cv_header_stdint_h" = "xyes")
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for intXX_t types in stdint.h" >&5
-$as_echo_n "checking for intXX_t types in stdint.h... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for intXX_t types in stdint.h" >&5
+echo $ECHO_N "checking for intXX_t types in stdint.h... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdint.h>
int
@@ -13848,28 +27080,54 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
- $as_echo "#define HAVE_INTXX_T 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_INTXX_T 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for int64_t type" >&5
-$as_echo_n "checking for int64_t type... " >&6; }
-if ${ac_cv_have_int64_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for int64_t type" >&5
+echo $ECHO_N "checking for int64_t type... $ECHO_C" >&6; }
+if test "${ac_cv_have_int64_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -13891,30 +27149,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_int64_t="yes"
else
- ac_cv_have_int64_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_int64_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_int64_t" >&5
-$as_echo "$ac_cv_have_int64_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_int64_t" >&5
+echo "${ECHO_T}$ac_cv_have_int64_t" >&6; }
if test "x$ac_cv_have_int64_t" = "xyes" ; then
-$as_echo "#define HAVE_INT64_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_INT64_T 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for u_intXX_t types" >&5
-$as_echo_n "checking for u_intXX_t types... " >&6; }
-if ${ac_cv_have_u_intxx_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for u_intXX_t types" >&5
+echo $ECHO_N "checking for u_intXX_t types... $ECHO_C" >&6; }
+if test "${ac_cv_have_u_intxx_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -13925,28 +27209,54 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_u_intxx_t="yes"
else
- ac_cv_have_u_intxx_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_u_intxx_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_u_intxx_t" >&5
-$as_echo "$ac_cv_have_u_intxx_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_u_intxx_t" >&5
+echo "${ECHO_T}$ac_cv_have_u_intxx_t" >&6; }
if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
-$as_echo "#define HAVE_U_INTXX_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_U_INTXX_T 1
+_ACEOF
have_u_intxx_t=1
fi
if test -z "$have_u_intxx_t" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for u_intXX_t types in sys/socket.h" >&5
-$as_echo_n "checking for u_intXX_t types in sys/socket.h... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for u_intXX_t types in sys/socket.h" >&5
+echo $ECHO_N "checking for u_intXX_t types in sys/socket.h... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/socket.h>
int
@@ -13957,28 +27267,54 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
- $as_echo "#define HAVE_U_INTXX_T 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_U_INTXX_T 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for u_int64_t types" >&5
-$as_echo_n "checking for u_int64_t types... " >&6; }
-if ${ac_cv_have_u_int64_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for u_int64_t types" >&5
+echo $ECHO_N "checking for u_int64_t types... $ECHO_C" >&6; }
+if test "${ac_cv_have_u_int64_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -13989,20 +27325,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_u_int64_t="yes"
else
- ac_cv_have_u_int64_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_u_int64_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_u_int64_t" >&5
-$as_echo "$ac_cv_have_u_int64_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_u_int64_t" >&5
+echo "${ECHO_T}$ac_cv_have_u_int64_t" >&6; }
if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
-$as_echo "#define HAVE_U_INT64_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_U_INT64_T 1
+_ACEOF
have_u_int64_t=1
fi
@@ -14010,9 +27368,13 @@
if (test -z "$have_u_int64_t" && \
test "x$ac_cv_header_sys_bitypes_h" = "xyes")
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for u_int64_t type in sys/bitypes.h" >&5
-$as_echo_n "checking for u_int64_t type in sys/bitypes.h... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for u_int64_t type in sys/bitypes.h" >&5
+echo $ECHO_N "checking for u_int64_t type in sys/bitypes.h... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/bitypes.h>
int
@@ -14023,29 +27385,55 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
- $as_echo "#define HAVE_U_INT64_T 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_U_INT64_T 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
if test -z "$have_u_intxx_t" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uintXX_t types" >&5
-$as_echo_n "checking for uintXX_t types... " >&6; }
-if ${ac_cv_have_uintxx_t+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for uintXX_t types" >&5
+echo $ECHO_N "checking for uintXX_t types... $ECHO_C" >&6; }
+if test "${ac_cv_have_uintxx_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -14063,20 +27451,42 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_uintxx_t="yes"
else
- ac_cv_have_uintxx_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_uintxx_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_uintxx_t" >&5
-$as_echo "$ac_cv_have_uintxx_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_uintxx_t" >&5
+echo "${ECHO_T}$ac_cv_have_uintxx_t" >&6; }
if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
-$as_echo "#define HAVE_UINTXX_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_UINTXX_T 1
+_ACEOF
fi
fi
@@ -14084,9 +27494,13 @@
if (test -z "$have_uintxx_t" && \
test "x$ac_cv_header_stdint_h" = "xyes")
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uintXX_t types in stdint.h" >&5
-$as_echo_n "checking for uintXX_t types in stdint.h... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for uintXX_t types in stdint.h" >&5
+echo $ECHO_N "checking for uintXX_t types in stdint.h... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdint.h>
int
@@ -14097,18 +27511,40 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
- $as_echo "#define HAVE_UINTXX_T 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_UINTXX_T 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
@@ -14115,9 +27551,13 @@
if (test -z "$have_uintxx_t" && \
test "x$ac_cv_header_inttypes_h" = "xyes")
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uintXX_t types in inttypes.h" >&5
-$as_echo_n "checking for uintXX_t types in inttypes.h... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for uintXX_t types in inttypes.h" >&5
+echo $ECHO_N "checking for uintXX_t types in inttypes.h... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <inttypes.h>
int
@@ -14128,18 +27568,40 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
- $as_echo "#define HAVE_UINTXX_T 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_UINTXX_T 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
@@ -14146,9 +27608,13 @@
if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
test "x$ac_cv_header_sys_bitypes_h" = "xyes")
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for intXX_t and u_intXX_t types in sys/bitypes.h" >&5
-$as_echo_n "checking for intXX_t and u_intXX_t types in sys/bitypes.h... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for intXX_t and u_intXX_t types in sys/bitypes.h" >&5
+echo $ECHO_N "checking for intXX_t and u_intXX_t types in sys/bitypes.h... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/bitypes.h>
@@ -14165,31 +27631,59 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
- $as_echo "#define HAVE_U_INTXX_T 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_U_INTXX_T 1
+_ACEOF
- $as_echo "#define HAVE_INTXX_T 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define HAVE_INTXX_T 1
+_ACEOF
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for u_char" >&5
-$as_echo_n "checking for u_char... " >&6; }
-if ${ac_cv_have_u_char+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for u_char" >&5
+echo $ECHO_N "checking for u_char... $ECHO_C" >&6; }
+if test "${ac_cv_have_u_char+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -14200,30 +27694,104 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_u_char="yes"
else
- ac_cv_have_u_char="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_u_char="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_u_char" >&5
-$as_echo "$ac_cv_have_u_char" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_u_char" >&5
+echo "${ECHO_T}$ac_cv_have_u_char" >&6; }
if test "x$ac_cv_have_u_char" = "xyes" ; then
-$as_echo "#define HAVE_U_CHAR 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_U_CHAR 1
+_ACEOF
fi
-ac_fn_c_check_type "$LINENO" "intmax_t" "ac_cv_type_intmax_t" "
+{ echo "$as_me:$LINENO: checking for intmax_t" >&5
+echo $ECHO_N "checking for intmax_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_intmax_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <stdint.h>
-"
-if test "x$ac_cv_type_intmax_t" = xyes; then :
+typedef intmax_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_intmax_t=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_intmax_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_intmax_t" >&5
+echo "${ECHO_T}$ac_cv_type_intmax_t" >&6; }
+if test $ac_cv_type_intmax_t = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_INTMAX_T 1
_ACEOF
@@ -14230,13 +27798,65 @@
fi
-ac_fn_c_check_type "$LINENO" "uintmax_t" "ac_cv_type_uintmax_t" "
+{ echo "$as_me:$LINENO: checking for uintmax_t" >&5
+echo $ECHO_N "checking for uintmax_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_uintmax_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <stdint.h>
-"
-if test "x$ac_cv_type_uintmax_t" = xyes; then :
+typedef uintmax_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_uintmax_t=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_uintmax_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_uintmax_t" >&5
+echo "${ECHO_T}$ac_cv_type_uintmax_t" >&6; }
+if test $ac_cv_type_uintmax_t = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_UINTMAX_T 1
_ACEOF
@@ -14246,25 +27866,81 @@
- ac_fn_c_check_type "$LINENO" "socklen_t" "ac_cv_type_socklen_t" "#include <sys/types.h>
+ { echo "$as_me:$LINENO: checking for socklen_t" >&5
+echo $ECHO_N "checking for socklen_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_socklen_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <sys/types.h>
#include <sys/socket.h>
-"
-if test "x$ac_cv_type_socklen_t" = xyes; then :
+typedef socklen_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_socklen_t=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for socklen_t equivalent" >&5
-$as_echo_n "checking for socklen_t equivalent... " >&6; }
- if ${curl_cv_socklen_t_equiv+:} false; then :
- $as_echo_n "(cached) " >&6
+ ac_cv_type_socklen_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_socklen_t" >&5
+echo "${ECHO_T}$ac_cv_type_socklen_t" >&6; }
+if test $ac_cv_type_socklen_t = yes; then
+ :
else
+ { echo "$as_me:$LINENO: checking for socklen_t equivalent" >&5
+echo $ECHO_N "checking for socklen_t equivalent... $ECHO_C" >&6; }
+ if test "${curl_cv_socklen_t_equiv+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+
# Systems have either "struct sockaddr *" or
# "void *" as the second argument to getpeername
curl_cv_socklen_t_equiv=
for arg2 in "struct sockaddr" void; do
for t in int size_t unsigned long "unsigned long"; do
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -14283,24 +27959,48 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
curl_cv_socklen_t_equiv="$t"
break
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
done
done
if test "x$curl_cv_socklen_t_equiv" = x; then
- as_fn_error $? "Cannot find a type to use in place of socklen_t" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: Cannot find a type to use in place of socklen_t" >&5
+echo "$as_me: error: Cannot find a type to use in place of socklen_t" >&2;}
+ { (exit 1); exit 1; }; }
fi
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $curl_cv_socklen_t_equiv" >&5
-$as_echo "$curl_cv_socklen_t_equiv" >&6; }
+ { echo "$as_me:$LINENO: result: $curl_cv_socklen_t_equiv" >&5
+echo "${ECHO_T}$curl_cv_socklen_t_equiv" >&6; }
cat >>confdefs.h <<_ACEOF
#define socklen_t $curl_cv_socklen_t_equiv
@@ -14310,10 +28010,62 @@
-ac_fn_c_check_type "$LINENO" "sig_atomic_t" "ac_cv_type_sig_atomic_t" "#include <signal.h>
-"
-if test "x$ac_cv_type_sig_atomic_t" = xyes; then :
+{ echo "$as_me:$LINENO: checking for sig_atomic_t" >&5
+echo $ECHO_N "checking for sig_atomic_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_sig_atomic_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <signal.h>
+typedef sig_atomic_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_sig_atomic_t=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_sig_atomic_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_sig_atomic_t" >&5
+echo "${ECHO_T}$ac_cv_type_sig_atomic_t" >&6; }
+if test $ac_cv_type_sig_atomic_t = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_SIG_ATOMIC_T 1
_ACEOF
@@ -14321,7 +28073,18 @@
fi
-ac_fn_c_check_type "$LINENO" "fsblkcnt_t" "ac_cv_type_fsblkcnt_t" "
+{ echo "$as_me:$LINENO: checking for fsblkcnt_t" >&5
+echo $ECHO_N "checking for fsblkcnt_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_fsblkcnt_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#ifdef HAVE_SYS_BITYPES_H
#include <sys/bitypes.h>
@@ -14333,9 +28096,50 @@
#include <sys/statvfs.h>
#endif
-"
-if test "x$ac_cv_type_fsblkcnt_t" = xyes; then :
+typedef fsblkcnt_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_fsblkcnt_t=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_fsblkcnt_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_fsblkcnt_t" >&5
+echo "${ECHO_T}$ac_cv_type_fsblkcnt_t" >&6; }
+if test $ac_cv_type_fsblkcnt_t = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_FSBLKCNT_T 1
_ACEOF
@@ -14342,7 +28146,18 @@
fi
-ac_fn_c_check_type "$LINENO" "fsfilcnt_t" "ac_cv_type_fsfilcnt_t" "
+{ echo "$as_me:$LINENO: checking for fsfilcnt_t" >&5
+echo $ECHO_N "checking for fsfilcnt_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_fsfilcnt_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#ifdef HAVE_SYS_BITYPES_H
#include <sys/bitypes.h>
@@ -14354,9 +28169,50 @@
#include <sys/statvfs.h>
#endif
-"
-if test "x$ac_cv_type_fsfilcnt_t" = xyes; then :
+typedef fsfilcnt_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_fsfilcnt_t=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_fsfilcnt_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_fsfilcnt_t" >&5
+echo "${ECHO_T}$ac_cv_type_fsfilcnt_t" >&6; }
+if test $ac_cv_type_fsfilcnt_t = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_FSFILCNT_T 1
_ACEOF
@@ -14365,11 +28221,63 @@
fi
-ac_fn_c_check_type "$LINENO" "in_addr_t" "ac_cv_type_in_addr_t" "#include <sys/types.h>
+{ echo "$as_me:$LINENO: checking for in_addr_t" >&5
+echo $ECHO_N "checking for in_addr_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_in_addr_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <sys/types.h>
#include <netinet/in.h>
-"
-if test "x$ac_cv_type_in_addr_t" = xyes; then :
+typedef in_addr_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_in_addr_t=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_in_addr_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_in_addr_t" >&5
+echo "${ECHO_T}$ac_cv_type_in_addr_t" >&6; }
+if test $ac_cv_type_in_addr_t = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_IN_ADDR_T 1
_ACEOF
@@ -14376,11 +28284,63 @@
fi
-ac_fn_c_check_type "$LINENO" "in_port_t" "ac_cv_type_in_port_t" "#include <sys/types.h>
+{ echo "$as_me:$LINENO: checking for in_port_t" >&5
+echo $ECHO_N "checking for in_port_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_in_port_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <sys/types.h>
#include <netinet/in.h>
-"
-if test "x$ac_cv_type_in_port_t" = xyes; then :
+typedef in_port_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_in_port_t=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_type_in_port_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_in_port_t" >&5
+echo "${ECHO_T}$ac_cv_type_in_port_t" >&6; }
+if test $ac_cv_type_in_port_t = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_IN_PORT_T 1
_ACEOF
@@ -14389,13 +28349,17 @@
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for size_t" >&5
-$as_echo_n "checking for size_t... " >&6; }
-if ${ac_cv_have_size_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for size_t" >&5
+echo $ECHO_N "checking for size_t... $ECHO_C" >&6; }
+if test "${ac_cv_have_size_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -14406,30 +28370,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_size_t="yes"
else
- ac_cv_have_size_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_size_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_size_t" >&5
-$as_echo "$ac_cv_have_size_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_size_t" >&5
+echo "${ECHO_T}$ac_cv_have_size_t" >&6; }
if test "x$ac_cv_have_size_t" = "xyes" ; then
-$as_echo "#define HAVE_SIZE_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SIZE_T 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ssize_t" >&5
-$as_echo_n "checking for ssize_t... " >&6; }
-if ${ac_cv_have_ssize_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for ssize_t" >&5
+echo $ECHO_N "checking for ssize_t... $ECHO_C" >&6; }
+if test "${ac_cv_have_ssize_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -14440,30 +28430,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_ssize_t="yes"
else
- ac_cv_have_ssize_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_ssize_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_ssize_t" >&5
-$as_echo "$ac_cv_have_ssize_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_ssize_t" >&5
+echo "${ECHO_T}$ac_cv_have_ssize_t" >&6; }
if test "x$ac_cv_have_ssize_t" = "xyes" ; then
-$as_echo "#define HAVE_SSIZE_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SSIZE_T 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for clock_t" >&5
-$as_echo_n "checking for clock_t... " >&6; }
-if ${ac_cv_have_clock_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for clock_t" >&5
+echo $ECHO_N "checking for clock_t... $ECHO_C" >&6; }
+if test "${ac_cv_have_clock_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <time.h>
int
@@ -14474,30 +28490,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_clock_t="yes"
else
- ac_cv_have_clock_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_clock_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_clock_t" >&5
-$as_echo "$ac_cv_have_clock_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_clock_t" >&5
+echo "${ECHO_T}$ac_cv_have_clock_t" >&6; }
if test "x$ac_cv_have_clock_t" = "xyes" ; then
-$as_echo "#define HAVE_CLOCK_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_CLOCK_T 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sa_family_t" >&5
-$as_echo_n "checking for sa_family_t... " >&6; }
-if ${ac_cv_have_sa_family_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for sa_family_t" >&5
+echo $ECHO_N "checking for sa_family_t... $ECHO_C" >&6; }
+if test "${ac_cv_have_sa_family_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -14511,10 +28553,33 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_sa_family_t="yes"
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -14529,33 +28594,60 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_sa_family_t="yes"
else
- ac_cv_have_sa_family_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_sa_family_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_sa_family_t" >&5
-$as_echo "$ac_cv_have_sa_family_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_sa_family_t" >&5
+echo "${ECHO_T}$ac_cv_have_sa_family_t" >&6; }
if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
-$as_echo "#define HAVE_SA_FAMILY_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SA_FAMILY_T 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for pid_t" >&5
-$as_echo_n "checking for pid_t... " >&6; }
-if ${ac_cv_have_pid_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for pid_t" >&5
+echo $ECHO_N "checking for pid_t... $ECHO_C" >&6; }
+if test "${ac_cv_have_pid_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -14566,30 +28658,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_pid_t="yes"
else
- ac_cv_have_pid_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_pid_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_pid_t" >&5
-$as_echo "$ac_cv_have_pid_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_pid_t" >&5
+echo "${ECHO_T}$ac_cv_have_pid_t" >&6; }
if test "x$ac_cv_have_pid_t" = "xyes" ; then
-$as_echo "#define HAVE_PID_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_PID_T 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for mode_t" >&5
-$as_echo_n "checking for mode_t... " >&6; }
-if ${ac_cv_have_mode_t+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for mode_t" >&5
+echo $ECHO_N "checking for mode_t... $ECHO_C" >&6; }
+if test "${ac_cv_have_mode_t+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
int
@@ -14600,31 +28718,57 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_mode_t="yes"
else
- ac_cv_have_mode_t="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_mode_t="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_mode_t" >&5
-$as_echo "$ac_cv_have_mode_t" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_mode_t" >&5
+echo "${ECHO_T}$ac_cv_have_mode_t" >&6; }
if test "x$ac_cv_have_mode_t" = "xyes" ; then
-$as_echo "#define HAVE_MODE_T 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_MODE_T 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for struct sockaddr_storage" >&5
-$as_echo_n "checking for struct sockaddr_storage... " >&6; }
-if ${ac_cv_have_struct_sockaddr_storage+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for struct sockaddr_storage" >&5
+echo $ECHO_N "checking for struct sockaddr_storage... $ECHO_C" >&6; }
+if test "${ac_cv_have_struct_sockaddr_storage+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -14638,30 +28782,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_struct_sockaddr_storage="yes"
else
- ac_cv_have_struct_sockaddr_storage="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_struct_sockaddr_storage="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_struct_sockaddr_storage" >&5
-$as_echo "$ac_cv_have_struct_sockaddr_storage" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_struct_sockaddr_storage" >&5
+echo "${ECHO_T}$ac_cv_have_struct_sockaddr_storage" >&6; }
if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
-$as_echo "#define HAVE_STRUCT_SOCKADDR_STORAGE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_STRUCT_SOCKADDR_STORAGE 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for struct sockaddr_in6" >&5
-$as_echo_n "checking for struct sockaddr_in6... " >&6; }
-if ${ac_cv_have_struct_sockaddr_in6+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for struct sockaddr_in6" >&5
+echo $ECHO_N "checking for struct sockaddr_in6... $ECHO_C" >&6; }
+if test "${ac_cv_have_struct_sockaddr_in6+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -14675,30 +28845,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_struct_sockaddr_in6="yes"
else
- ac_cv_have_struct_sockaddr_in6="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_struct_sockaddr_in6="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_struct_sockaddr_in6" >&5
-$as_echo "$ac_cv_have_struct_sockaddr_in6" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_struct_sockaddr_in6" >&5
+echo "${ECHO_T}$ac_cv_have_struct_sockaddr_in6" >&6; }
if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
-$as_echo "#define HAVE_STRUCT_SOCKADDR_IN6 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_STRUCT_SOCKADDR_IN6 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for struct in6_addr" >&5
-$as_echo_n "checking for struct in6_addr... " >&6; }
-if ${ac_cv_have_struct_in6_addr+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for struct in6_addr" >&5
+echo $ECHO_N "checking for struct in6_addr... $ECHO_C" >&6; }
+if test "${ac_cv_have_struct_in6_addr+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -14712,31 +28908,151 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_struct_in6_addr="yes"
else
- ac_cv_have_struct_in6_addr="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_struct_in6_addr="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_struct_in6_addr" >&5
-$as_echo "$ac_cv_have_struct_in6_addr" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_struct_in6_addr" >&5
+echo "${ECHO_T}$ac_cv_have_struct_in6_addr" >&6; }
if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
-$as_echo "#define HAVE_STRUCT_IN6_ADDR 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_STRUCT_IN6_ADDR 1
+_ACEOF
- ac_fn_c_check_member "$LINENO" "struct sockaddr_in6" "sin6_scope_id" "ac_cv_member_struct_sockaddr_in6_sin6_scope_id" "
+ { echo "$as_me:$LINENO: checking for struct sockaddr_in6.sin6_scope_id" >&5
+echo $ECHO_N "checking for struct sockaddr_in6.sin6_scope_id... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_sockaddr_in6_sin6_scope_id+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#ifdef HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
#include <netinet/in.h>
-"
-if test "x$ac_cv_member_struct_sockaddr_in6_sin6_scope_id" = xyes; then :
+int
+main ()
+{
+static struct sockaddr_in6 ac_aggr;
+if (ac_aggr.sin6_scope_id)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_sockaddr_in6_sin6_scope_id=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#include <netinet/in.h>
+
+
+int
+main ()
+{
+static struct sockaddr_in6 ac_aggr;
+if (sizeof ac_aggr.sin6_scope_id)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_sockaddr_in6_sin6_scope_id=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct_sockaddr_in6_sin6_scope_id=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_sockaddr_in6_sin6_scope_id" >&5
+echo "${ECHO_T}$ac_cv_member_struct_sockaddr_in6_sin6_scope_id" >&6; }
+if test $ac_cv_member_struct_sockaddr_in6_sin6_scope_id = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_STRUCT_SOCKADDR_IN6_SIN6_SCOPE_ID 1
_ACEOF
@@ -14746,13 +29062,17 @@
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for struct addrinfo" >&5
-$as_echo_n "checking for struct addrinfo... " >&6; }
-if ${ac_cv_have_struct_addrinfo+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for struct addrinfo" >&5
+echo $ECHO_N "checking for struct addrinfo... $ECHO_C" >&6; }
+if test "${ac_cv_have_struct_addrinfo+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -14767,30 +29087,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_struct_addrinfo="yes"
else
- ac_cv_have_struct_addrinfo="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_struct_addrinfo="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_struct_addrinfo" >&5
-$as_echo "$ac_cv_have_struct_addrinfo" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_struct_addrinfo" >&5
+echo "${ECHO_T}$ac_cv_have_struct_addrinfo" >&6; }
if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
-$as_echo "#define HAVE_STRUCT_ADDRINFO 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_STRUCT_ADDRINFO 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for struct timeval" >&5
-$as_echo_n "checking for struct timeval... " >&6; }
-if ${ac_cv_have_struct_timeval+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for struct timeval" >&5
+echo $ECHO_N "checking for struct timeval... $ECHO_C" >&6; }
+if test "${ac_cv_have_struct_timeval+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/time.h>
int
@@ -14801,27 +29147,101 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_struct_timeval="yes"
else
- ac_cv_have_struct_timeval="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_struct_timeval="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_struct_timeval" >&5
-$as_echo "$ac_cv_have_struct_timeval" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_struct_timeval" >&5
+echo "${ECHO_T}$ac_cv_have_struct_timeval" >&6; }
if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
-$as_echo "#define HAVE_STRUCT_TIMEVAL 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_STRUCT_TIMEVAL 1
+_ACEOF
have_struct_timeval=1
fi
-ac_fn_c_check_type "$LINENO" "struct timespec" "ac_cv_type_struct_timespec" "$ac_includes_default"
-if test "x$ac_cv_type_struct_timespec" = xyes; then :
+{ echo "$as_me:$LINENO: checking for struct timespec" >&5
+echo $ECHO_N "checking for struct timespec... $ECHO_C" >&6; }
+if test "${ac_cv_type_struct_timespec+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+typedef struct timespec ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+ return 0;
+if (sizeof (ac__type_new_))
+ return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_type_struct_timespec=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_type_struct_timespec=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_struct_timespec" >&5
+echo "${ECHO_T}$ac_cv_type_struct_timespec" >&6; }
+if test $ac_cv_type_struct_timespec = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_STRUCT_TIMESPEC 1
_ACEOF
@@ -14839,12 +29259,16 @@
echo ""
exit 1;
else
- if test "$cross_compiling" = yes; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: Assuming working snprintf()" >&5
-$as_echo "$as_me: WARNING: cross compiling: Assuming working snprintf()" >&2;}
+ if test "$cross_compiling" = yes; then
+ { echo "$as_me:$LINENO: WARNING: cross compiling: Assuming working snprintf()" >&5
+echo "$as_me: WARNING: cross compiling: Assuming working snprintf()" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -14871,16 +29295,42 @@
#endif
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
true
else
- $as_echo "#define BROKEN_SNPRINTF 1" >>confdefs.h
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+( exit $ac_status )
+ cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SNPRINTF 1
+_ACEOF
+
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
@@ -14887,19 +29337,23 @@
# look for field 'ut_host' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_host
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_host field in utmp.h" >&5
-$as_echo_n "checking for ut_host field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_host field in utmp.h" >&5
+echo $ECHO_N "checking for ut_host field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_host" >/dev/null 2>&1; then :
+ $EGREP "ut_host" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -14910,16 +29364,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_HOST_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_HOST_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -14926,19 +29382,23 @@
# look for field 'ut_host' in header 'utmpx.h'
ossh_safe=`echo "utmpx.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_host
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_host field in utmpx.h" >&5
-$as_echo_n "checking for ut_host field in utmpx.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_host field in utmpx.h" >&5
+echo $ECHO_N "checking for ut_host field in utmpx.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmpx.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_host" >/dev/null 2>&1; then :
+ $EGREP "ut_host" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -14949,16 +29409,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_HOST_IN_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_HOST_IN_UTMPX 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -14965,19 +29427,23 @@
# look for field 'syslen' in header 'utmpx.h'
ossh_safe=`echo "utmpx.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"syslen
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for syslen field in utmpx.h" >&5
-$as_echo_n "checking for syslen field in utmpx.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for syslen field in utmpx.h" >&5
+echo $ECHO_N "checking for syslen field in utmpx.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmpx.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "syslen" >/dev/null 2>&1; then :
+ $EGREP "syslen" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -14988,16 +29454,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_SYSLEN_IN_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SYSLEN_IN_UTMPX 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15004,19 +29472,23 @@
# look for field 'ut_pid' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_pid
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_pid field in utmp.h" >&5
-$as_echo_n "checking for ut_pid field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_pid field in utmp.h" >&5
+echo $ECHO_N "checking for ut_pid field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_pid" >/dev/null 2>&1; then :
+ $EGREP "ut_pid" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15027,16 +29499,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_PID_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_PID_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15043,19 +29517,23 @@
# look for field 'ut_type' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_type
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_type field in utmp.h" >&5
-$as_echo_n "checking for ut_type field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_type field in utmp.h" >&5
+echo $ECHO_N "checking for ut_type field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_type" >/dev/null 2>&1; then :
+ $EGREP "ut_type" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15066,16 +29544,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_TYPE_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_TYPE_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15082,19 +29562,23 @@
# look for field 'ut_type' in header 'utmpx.h'
ossh_safe=`echo "utmpx.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_type
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_type field in utmpx.h" >&5
-$as_echo_n "checking for ut_type field in utmpx.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_type field in utmpx.h" >&5
+echo $ECHO_N "checking for ut_type field in utmpx.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmpx.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_type" >/dev/null 2>&1; then :
+ $EGREP "ut_type" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15105,16 +29589,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_TYPE_IN_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_TYPE_IN_UTMPX 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15121,19 +29607,23 @@
# look for field 'ut_tv' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_tv
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_tv field in utmp.h" >&5
-$as_echo_n "checking for ut_tv field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_tv field in utmp.h" >&5
+echo $ECHO_N "checking for ut_tv field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_tv" >/dev/null 2>&1; then :
+ $EGREP "ut_tv" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15144,16 +29634,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_TV_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_TV_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15160,19 +29652,23 @@
# look for field 'ut_id' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_id
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_id field in utmp.h" >&5
-$as_echo_n "checking for ut_id field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_id field in utmp.h" >&5
+echo $ECHO_N "checking for ut_id field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_id" >/dev/null 2>&1; then :
+ $EGREP "ut_id" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15183,16 +29679,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_ID_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ID_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15199,19 +29697,23 @@
# look for field 'ut_id' in header 'utmpx.h'
ossh_safe=`echo "utmpx.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_id
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_id field in utmpx.h" >&5
-$as_echo_n "checking for ut_id field in utmpx.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_id field in utmpx.h" >&5
+echo $ECHO_N "checking for ut_id field in utmpx.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmpx.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_id" >/dev/null 2>&1; then :
+ $EGREP "ut_id" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15222,16 +29724,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_ID_IN_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ID_IN_UTMPX 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15238,19 +29742,23 @@
# look for field 'ut_addr' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_addr
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_addr field in utmp.h" >&5
-$as_echo_n "checking for ut_addr field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_addr field in utmp.h" >&5
+echo $ECHO_N "checking for ut_addr field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_addr" >/dev/null 2>&1; then :
+ $EGREP "ut_addr" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15261,16 +29769,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_ADDR_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ADDR_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15277,19 +29787,23 @@
# look for field 'ut_addr' in header 'utmpx.h'
ossh_safe=`echo "utmpx.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_addr
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_addr field in utmpx.h" >&5
-$as_echo_n "checking for ut_addr field in utmpx.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_addr field in utmpx.h" >&5
+echo $ECHO_N "checking for ut_addr field in utmpx.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmpx.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_addr" >/dev/null 2>&1; then :
+ $EGREP "ut_addr" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15300,16 +29814,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_ADDR_IN_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ADDR_IN_UTMPX 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15316,19 +29832,23 @@
# look for field 'ut_addr_v6' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_addr_v6
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_addr_v6 field in utmp.h" >&5
-$as_echo_n "checking for ut_addr_v6 field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_addr_v6 field in utmp.h" >&5
+echo $ECHO_N "checking for ut_addr_v6 field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_addr_v6" >/dev/null 2>&1; then :
+ $EGREP "ut_addr_v6" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15339,16 +29859,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_ADDR_V6_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ADDR_V6_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15355,19 +29877,23 @@
# look for field 'ut_addr_v6' in header 'utmpx.h'
ossh_safe=`echo "utmpx.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_addr_v6
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_addr_v6 field in utmpx.h" >&5
-$as_echo_n "checking for ut_addr_v6 field in utmpx.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_addr_v6 field in utmpx.h" >&5
+echo $ECHO_N "checking for ut_addr_v6 field in utmpx.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmpx.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_addr_v6" >/dev/null 2>&1; then :
+ $EGREP "ut_addr_v6" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15378,16 +29904,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_ADDR_V6_IN_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ADDR_V6_IN_UTMPX 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15394,19 +29922,23 @@
# look for field 'ut_exit' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_exit
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_exit field in utmp.h" >&5
-$as_echo_n "checking for ut_exit field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_exit field in utmp.h" >&5
+echo $ECHO_N "checking for ut_exit field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_exit" >/dev/null 2>&1; then :
+ $EGREP "ut_exit" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15417,16 +29949,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_EXIT_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_EXIT_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15433,19 +29967,23 @@
# look for field 'ut_time' in header 'utmp.h'
ossh_safe=`echo "utmp.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_time
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_time field in utmp.h" >&5
-$as_echo_n "checking for ut_time field in utmp.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_time field in utmp.h" >&5
+echo $ECHO_N "checking for ut_time field in utmp.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmp.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_time" >/dev/null 2>&1; then :
+ $EGREP "ut_time" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15456,16 +29994,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_TIME_IN_UTMP 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_TIME_IN_UTMP 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15472,19 +30012,23 @@
# look for field 'ut_time' in header 'utmpx.h'
ossh_safe=`echo "utmpx.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_time
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_time field in utmpx.h" >&5
-$as_echo_n "checking for ut_time field in utmpx.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_time field in utmpx.h" >&5
+echo $ECHO_N "checking for ut_time field in utmpx.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmpx.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_time" >/dev/null 2>&1; then :
+ $EGREP "ut_time" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15495,16 +30039,18 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_TIME_IN_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_TIME_IN_UTMPX 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -15511,19 +30057,23 @@
# look for field 'ut_tv' in header 'utmpx.h'
ossh_safe=`echo "utmpx.h" | sed 'y%./+-%__p_%'`
ossh_varname="ossh_cv_$ossh_safe""_has_"ut_tv
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ut_tv field in utmpx.h" >&5
-$as_echo_n "checking for ut_tv field in utmpx.h... " >&6; }
- if eval \${$ossh_varname+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for ut_tv field in utmpx.h" >&5
+echo $ECHO_N "checking for ut_tv field in utmpx.h... $ECHO_C" >&6; }
+ if { as_var=$ossh_varname; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <utmpx.h>
_ACEOF
if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "ut_tv" >/dev/null 2>&1; then :
+ $EGREP "ut_tv" >/dev/null 2>&1; then
eval "$ossh_varname=yes"
else
eval "$ossh_varname=no"
@@ -15534,22 +30084,116 @@
ossh_result=`eval 'echo $'"$ossh_varname"`
if test -n "`echo $ossh_varname`"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ossh_result" >&5
-$as_echo "$ossh_result" >&6; }
+ { echo "$as_me:$LINENO: result: $ossh_result" >&5
+echo "${ECHO_T}$ossh_result" >&6; }
if test "x$ossh_result" = "xyes"; then
-$as_echo "#define HAVE_TV_IN_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_TV_IN_UTMPX 1
+_ACEOF
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
-ac_fn_c_check_member "$LINENO" "struct stat" "st_blksize" "ac_cv_member_struct_stat_st_blksize" "$ac_includes_default"
-if test "x$ac_cv_member_struct_stat_st_blksize" = xyes; then :
+{ echo "$as_me:$LINENO: checking for struct stat.st_blksize" >&5
+echo $ECHO_N "checking for struct stat.st_blksize... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_stat_st_blksize+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+int
+main ()
+{
+static struct stat ac_aggr;
+if (ac_aggr.st_blksize)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_stat_st_blksize=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+int
+main ()
+{
+static struct stat ac_aggr;
+if (sizeof ac_aggr.st_blksize)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_stat_st_blksize=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct_stat_st_blksize=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_stat_st_blksize" >&5
+echo "${ECHO_T}$ac_cv_member_struct_stat_st_blksize" >&6; }
+if test $ac_cv_member_struct_stat_st_blksize = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_STRUCT_STAT_ST_BLKSIZE 1
_ACEOF
@@ -15557,13 +30201,109 @@
fi
-ac_fn_c_check_member "$LINENO" "struct passwd" "pw_gecos" "ac_cv_member_struct_passwd_pw_gecos" "
+{ echo "$as_me:$LINENO: checking for struct passwd.pw_gecos" >&5
+echo $ECHO_N "checking for struct passwd.pw_gecos... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_passwd_pw_gecos+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <pwd.h>
-"
-if test "x$ac_cv_member_struct_passwd_pw_gecos" = xyes; then :
+int
+main ()
+{
+static struct passwd ac_aggr;
+if (ac_aggr.pw_gecos)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_passwd_pw_gecos=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+#include <sys/types.h>
+#include <pwd.h>
+
+
+int
+main ()
+{
+static struct passwd ac_aggr;
+if (sizeof ac_aggr.pw_gecos)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_passwd_pw_gecos=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct_passwd_pw_gecos=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_passwd_pw_gecos" >&5
+echo "${ECHO_T}$ac_cv_member_struct_passwd_pw_gecos" >&6; }
+if test $ac_cv_member_struct_passwd_pw_gecos = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_STRUCT_PASSWD_PW_GECOS 1
_ACEOF
@@ -15570,13 +30310,109 @@
fi
-ac_fn_c_check_member "$LINENO" "struct passwd" "pw_class" "ac_cv_member_struct_passwd_pw_class" "
+{ echo "$as_me:$LINENO: checking for struct passwd.pw_class" >&5
+echo $ECHO_N "checking for struct passwd.pw_class... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_passwd_pw_class+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <pwd.h>
-"
-if test "x$ac_cv_member_struct_passwd_pw_class" = xyes; then :
+int
+main ()
+{
+static struct passwd ac_aggr;
+if (ac_aggr.pw_class)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_passwd_pw_class=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+#include <sys/types.h>
+#include <pwd.h>
+
+
+int
+main ()
+{
+static struct passwd ac_aggr;
+if (sizeof ac_aggr.pw_class)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_passwd_pw_class=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct_passwd_pw_class=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_passwd_pw_class" >&5
+echo "${ECHO_T}$ac_cv_member_struct_passwd_pw_class" >&6; }
+if test $ac_cv_member_struct_passwd_pw_class = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_STRUCT_PASSWD_PW_CLASS 1
_ACEOF
@@ -15583,13 +30419,109 @@
fi
-ac_fn_c_check_member "$LINENO" "struct passwd" "pw_change" "ac_cv_member_struct_passwd_pw_change" "
+{ echo "$as_me:$LINENO: checking for struct passwd.pw_change" >&5
+echo $ECHO_N "checking for struct passwd.pw_change... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_passwd_pw_change+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <pwd.h>
-"
-if test "x$ac_cv_member_struct_passwd_pw_change" = xyes; then :
+int
+main ()
+{
+static struct passwd ac_aggr;
+if (ac_aggr.pw_change)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_passwd_pw_change=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+#include <sys/types.h>
+#include <pwd.h>
+
+
+int
+main ()
+{
+static struct passwd ac_aggr;
+if (sizeof ac_aggr.pw_change)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_passwd_pw_change=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct_passwd_pw_change=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_passwd_pw_change" >&5
+echo "${ECHO_T}$ac_cv_member_struct_passwd_pw_change" >&6; }
+if test $ac_cv_member_struct_passwd_pw_change = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_STRUCT_PASSWD_PW_CHANGE 1
_ACEOF
@@ -15596,13 +30528,109 @@
fi
-ac_fn_c_check_member "$LINENO" "struct passwd" "pw_expire" "ac_cv_member_struct_passwd_pw_expire" "
+{ echo "$as_me:$LINENO: checking for struct passwd.pw_expire" >&5
+echo $ECHO_N "checking for struct passwd.pw_expire... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_passwd_pw_expire+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <sys/types.h>
#include <pwd.h>
-"
-if test "x$ac_cv_member_struct_passwd_pw_expire" = xyes; then :
+int
+main ()
+{
+static struct passwd ac_aggr;
+if (ac_aggr.pw_expire)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_passwd_pw_expire=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+#include <sys/types.h>
+#include <pwd.h>
+
+
+int
+main ()
+{
+static struct passwd ac_aggr;
+if (sizeof ac_aggr.pw_expire)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_passwd_pw_expire=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct_passwd_pw_expire=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_passwd_pw_expire" >&5
+echo "${ECHO_T}$ac_cv_member_struct_passwd_pw_expire" >&6; }
+if test $ac_cv_member_struct_passwd_pw_expire = yes; then
+
cat >>confdefs.h <<_ACEOF
#define HAVE_STRUCT_PASSWD_PW_EXPIRE 1
_ACEOF
@@ -15611,7 +30639,18 @@
fi
-ac_fn_c_check_member "$LINENO" "struct __res_state" "retrans" "ac_cv_member_struct___res_state_retrans" "
+{ echo "$as_me:$LINENO: checking for struct __res_state.retrans" >&5
+echo $ECHO_N "checking for struct __res_state.retrans... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct___res_state_retrans+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#include <stdio.h>
#if HAVE_SYS_TYPES_H
# include <sys/types.h>
@@ -15620,23 +30659,119 @@
#include <arpa/nameser.h>
#include <resolv.h>
-"
-if test "x$ac_cv_member_struct___res_state_retrans" = xyes; then :
+int
+main ()
+{
+static struct __res_state ac_aggr;
+if (ac_aggr.retrans)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct___res_state_retrans=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
-$as_echo "#define __res_state state" >>confdefs.h
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <stdio.h>
+#if HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+
+int
+main ()
+{
+static struct __res_state ac_aggr;
+if (sizeof ac_aggr.retrans)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct___res_state_retrans=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct___res_state_retrans=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ss_family field in struct sockaddr_storage" >&5
-$as_echo_n "checking for ss_family field in struct sockaddr_storage... " >&6; }
-if ${ac_cv_have_ss_family_in_struct_ss+:} false; then :
- $as_echo_n "(cached) " >&6
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct___res_state_retrans" >&5
+echo "${ECHO_T}$ac_cv_member_struct___res_state_retrans" >&6; }
+if test $ac_cv_member_struct___res_state_retrans = yes; then
+ :
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >>confdefs.h <<\_ACEOF
+#define __res_state state
+_ACEOF
+
+fi
+
+
+{ echo "$as_me:$LINENO: checking for ss_family field in struct sockaddr_storage" >&5
+echo $ECHO_N "checking for ss_family field in struct sockaddr_storage... $ECHO_C" >&6; }
+if test "${ac_cv_have_ss_family_in_struct_ss+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -15650,29 +30785,55 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_ss_family_in_struct_ss="yes"
else
- ac_cv_have_ss_family_in_struct_ss="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_ss_family_in_struct_ss="no"
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_ss_family_in_struct_ss" >&5
-$as_echo "$ac_cv_have_ss_family_in_struct_ss" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_ss_family_in_struct_ss" >&5
+echo "${ECHO_T}$ac_cv_have_ss_family_in_struct_ss" >&6; }
if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
-$as_echo "#define HAVE_SS_FAMILY_IN_SS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SS_FAMILY_IN_SS 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for __ss_family field in struct sockaddr_storage" >&5
-$as_echo_n "checking for __ss_family field in struct sockaddr_storage... " >&6; }
-if ${ac_cv_have___ss_family_in_struct_ss+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for __ss_family field in struct sockaddr_storage" >&5
+echo $ECHO_N "checking for __ss_family field in struct sockaddr_storage... $ECHO_C" >&6; }
+if test "${ac_cv_have___ss_family_in_struct_ss+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -15686,30 +30847,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have___ss_family_in_struct_ss="yes"
else
- ac_cv_have___ss_family_in_struct_ss="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have___ss_family_in_struct_ss="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have___ss_family_in_struct_ss" >&5
-$as_echo "$ac_cv_have___ss_family_in_struct_ss" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have___ss_family_in_struct_ss" >&5
+echo "${ECHO_T}$ac_cv_have___ss_family_in_struct_ss" >&6; }
if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
-$as_echo "#define HAVE___SS_FAMILY_IN_SS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE___SS_FAMILY_IN_SS 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for msg_accrights field in struct msghdr" >&5
-$as_echo_n "checking for msg_accrights field in struct msghdr... " >&6; }
-if ${ac_cv_have_accrights_in_msghdr+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for msg_accrights field in struct msghdr" >&5
+echo $ECHO_N "checking for msg_accrights field in struct msghdr... $ECHO_C" >&6; }
+if test "${ac_cv_have_accrights_in_msghdr+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -15732,26 +30919,52 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_accrights_in_msghdr="yes"
else
- ac_cv_have_accrights_in_msghdr="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_accrights_in_msghdr="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_accrights_in_msghdr" >&5
-$as_echo "$ac_cv_have_accrights_in_msghdr" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_accrights_in_msghdr" >&5
+echo "${ECHO_T}$ac_cv_have_accrights_in_msghdr" >&6; }
if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
-$as_echo "#define HAVE_ACCRIGHTS_IN_MSGHDR 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ACCRIGHTS_IN_MSGHDR 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if struct statvfs.f_fsid is integral type" >&5
-$as_echo_n "checking if struct statvfs.f_fsid is integral type... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking if struct statvfs.f_fsid is integral type" >&5
+echo $ECHO_N "checking if struct statvfs.f_fsid is integral type... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/param.h>
@@ -15774,16 +30987,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if fsid_t has member val" >&5
-$as_echo_n "checking if fsid_t has member val... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
+ { echo "$as_me:$LINENO: checking if fsid_t has member val" >&5
+echo $ECHO_N "checking if fsid_t has member val... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -15797,21 +31033,47 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define FSID_HAS_VAL 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define FSID_HAS_VAL 1
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if f_fsid has member __val" >&5
-$as_echo_n "checking if f_fsid has member __val... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking if f_fsid has member __val" >&5
+echo $ECHO_N "checking if f_fsid has member __val... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -15825,28 +31087,55 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define FSID_HAS___VAL 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define FSID_HAS___VAL 1
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for msg_control field in struct msghdr" >&5
-$as_echo_n "checking for msg_control field in struct msghdr... " >&6; }
-if ${ac_cv_have_control_in_msghdr+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for msg_control field in struct msghdr" >&5
+echo $ECHO_N "checking for msg_control field in struct msghdr... $ECHO_C" >&6; }
+if test "${ac_cv_have_control_in_msghdr+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -15869,30 +31158,56 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
ac_cv_have_control_in_msghdr="yes"
else
- ac_cv_have_control_in_msghdr="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_control_in_msghdr="no"
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_control_in_msghdr" >&5
-$as_echo "$ac_cv_have_control_in_msghdr" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_control_in_msghdr" >&5
+echo "${ECHO_T}$ac_cv_have_control_in_msghdr" >&6; }
if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
-$as_echo "#define HAVE_CONTROL_IN_MSGHDR 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_CONTROL_IN_MSGHDR 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if libc defines __progname" >&5
-$as_echo_n "checking if libc defines __progname... " >&6; }
-if ${ac_cv_libc_defines___progname+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking if libc defines __progname" >&5
+echo $ECHO_N "checking if libc defines __progname... $ECHO_C" >&6; }
+if test "${ac_cv_libc_defines___progname+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -15903,31 +31218,58 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_libc_defines___progname="yes"
else
- ac_cv_libc_defines___progname="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_libc_defines___progname="no"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_libc_defines___progname" >&5
-$as_echo "$ac_cv_libc_defines___progname" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_libc_defines___progname" >&5
+echo "${ECHO_T}$ac_cv_libc_defines___progname" >&6; }
if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
-$as_echo "#define HAVE___PROGNAME 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE___PROGNAME 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC implements __FUNCTION__" >&5
-$as_echo_n "checking whether $CC implements __FUNCTION__... " >&6; }
-if ${ac_cv_cc_implements___FUNCTION__+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether $CC implements __FUNCTION__" >&5
+echo $ECHO_N "checking whether $CC implements __FUNCTION__... $ECHO_C" >&6; }
+if test "${ac_cv_cc_implements___FUNCTION__+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
int
@@ -15938,31 +31280,58 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_cc_implements___FUNCTION__="yes"
else
- ac_cv_cc_implements___FUNCTION__="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_cc_implements___FUNCTION__="no"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_cc_implements___FUNCTION__" >&5
-$as_echo "$ac_cv_cc_implements___FUNCTION__" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_cc_implements___FUNCTION__" >&5
+echo "${ECHO_T}$ac_cv_cc_implements___FUNCTION__" >&6; }
if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
-$as_echo "#define HAVE___FUNCTION__ 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE___FUNCTION__ 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC implements __func__" >&5
-$as_echo_n "checking whether $CC implements __func__... " >&6; }
-if ${ac_cv_cc_implements___func__+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether $CC implements __func__" >&5
+echo $ECHO_N "checking whether $CC implements __func__... $ECHO_C" >&6; }
+if test "${ac_cv_cc_implements___func__+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
int
@@ -15973,31 +31342,58 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_cc_implements___func__="yes"
else
- ac_cv_cc_implements___func__="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_cc_implements___func__="no"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_cc_implements___func__" >&5
-$as_echo "$ac_cv_cc_implements___func__" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_cc_implements___func__" >&5
+echo "${ECHO_T}$ac_cv_cc_implements___func__" >&6; }
if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
-$as_echo "#define HAVE___func__ 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE___func__ 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether va_copy exists" >&5
-$as_echo_n "checking whether va_copy exists... " >&6; }
-if ${ac_cv_have_va_copy+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether va_copy exists" >&5
+echo $ECHO_N "checking whether va_copy exists... $ECHO_C" >&6; }
+if test "${ac_cv_have_va_copy+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdarg.h>
@@ -16011,31 +31407,58 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_have_va_copy="yes"
else
- ac_cv_have_va_copy="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_va_copy="no"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_va_copy" >&5
-$as_echo "$ac_cv_have_va_copy" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_va_copy" >&5
+echo "${ECHO_T}$ac_cv_have_va_copy" >&6; }
if test "x$ac_cv_have_va_copy" = "xyes" ; then
-$as_echo "#define HAVE_VA_COPY 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_VA_COPY 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether __va_copy exists" >&5
-$as_echo_n "checking whether __va_copy exists... " >&6; }
-if ${ac_cv_have___va_copy+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether __va_copy exists" >&5
+echo $ECHO_N "checking whether __va_copy exists... $ECHO_C" >&6; }
+if test "${ac_cv_have___va_copy+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdarg.h>
@@ -16049,31 +31472,58 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_have___va_copy="yes"
else
- ac_cv_have___va_copy="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have___va_copy="no"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have___va_copy" >&5
-$as_echo "$ac_cv_have___va_copy" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have___va_copy" >&5
+echo "${ECHO_T}$ac_cv_have___va_copy" >&6; }
if test "x$ac_cv_have___va_copy" = "xyes" ; then
-$as_echo "#define HAVE___VA_COPY 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE___VA_COPY 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether getopt has optreset support" >&5
-$as_echo_n "checking whether getopt has optreset support... " >&6; }
-if ${ac_cv_have_getopt_optreset+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking whether getopt has optreset support" >&5
+echo $ECHO_N "checking whether getopt has optreset support... $ECHO_C" >&6; }
+if test "${ac_cv_have_getopt_optreset+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <getopt.h>
int
@@ -16084,31 +31534,58 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_have_getopt_optreset="yes"
else
- ac_cv_have_getopt_optreset="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_getopt_optreset="no"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_have_getopt_optreset" >&5
-$as_echo "$ac_cv_have_getopt_optreset" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_have_getopt_optreset" >&5
+echo "${ECHO_T}$ac_cv_have_getopt_optreset" >&6; }
if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
-$as_echo "#define HAVE_GETOPT_OPTRESET 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_GETOPT_OPTRESET 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if libc defines sys_errlist" >&5
-$as_echo_n "checking if libc defines sys_errlist... " >&6; }
-if ${ac_cv_libc_defines_sys_errlist+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking if libc defines sys_errlist" >&5
+echo $ECHO_N "checking if libc defines sys_errlist... $ECHO_C" >&6; }
+if test "${ac_cv_libc_defines_sys_errlist+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -16119,32 +31596,59 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_libc_defines_sys_errlist="yes"
else
- ac_cv_libc_defines_sys_errlist="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_libc_defines_sys_errlist="no"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_libc_defines_sys_errlist" >&5
-$as_echo "$ac_cv_libc_defines_sys_errlist" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_libc_defines_sys_errlist" >&5
+echo "${ECHO_T}$ac_cv_libc_defines_sys_errlist" >&6; }
if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
-$as_echo "#define HAVE_SYS_ERRLIST 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SYS_ERRLIST 1
+_ACEOF
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if libc defines sys_nerr" >&5
-$as_echo_n "checking if libc defines sys_nerr... " >&6; }
-if ${ac_cv_libc_defines_sys_nerr+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking if libc defines sys_nerr" >&5
+echo $ECHO_N "checking if libc defines sys_nerr... $ECHO_C" >&6; }
+if test "${ac_cv_libc_defines_sys_nerr+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
int
@@ -16155,32 +31659,59 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_libc_defines_sys_nerr="yes"
else
- ac_cv_libc_defines_sys_nerr="no"
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_libc_defines_sys_nerr="no"
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_libc_defines_sys_nerr" >&5
-$as_echo "$ac_cv_libc_defines_sys_nerr" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_libc_defines_sys_nerr" >&5
+echo "${ECHO_T}$ac_cv_libc_defines_sys_nerr" >&6; }
if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
-$as_echo "#define HAVE_SYS_NERR 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SYS_NERR 1
+_ACEOF
fi
# Check libraries needed by DNS fingerprint support
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing getrrsetbyname" >&5
-$as_echo_n "checking for library containing getrrsetbyname... " >&6; }
-if ${ac_cv_search_getrrsetbyname+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for library containing getrrsetbyname" >&5
+echo $ECHO_N "checking for library containing getrrsetbyname... $ECHO_C" >&6; }
+if test "${ac_cv_search_getrrsetbyname+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16205,17 +31736,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_getrrsetbyname=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_getrrsetbyname+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_getrrsetbyname+set}" = set; then
break
fi
done
-if ${ac_cv_search_getrrsetbyname+:} false; then :
-
+if test "${ac_cv_search_getrrsetbyname+set}" = set; then
+ :
else
ac_cv_search_getrrsetbyname=no
fi
@@ -16222,24 +31776,30 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_getrrsetbyname" >&5
-$as_echo "$ac_cv_search_getrrsetbyname" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_getrrsetbyname" >&5
+echo "${ECHO_T}$ac_cv_search_getrrsetbyname" >&6; }
ac_res=$ac_cv_search_getrrsetbyname
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
-$as_echo "#define HAVE_GETRRSETBYNAME 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_GETRRSETBYNAME 1
+_ACEOF
else
# Needed by our getrrsetbyname()
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing res_query" >&5
-$as_echo_n "checking for library containing res_query... " >&6; }
-if ${ac_cv_search_res_query+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for library containing res_query" >&5
+echo $ECHO_N "checking for library containing res_query... $ECHO_C" >&6; }
+if test "${ac_cv_search_res_query+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16264,17 +31824,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_res_query=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_res_query+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_res_query+set}" = set; then
break
fi
done
-if ${ac_cv_search_res_query+:} false; then :
-
+if test "${ac_cv_search_res_query+set}" = set; then
+ :
else
ac_cv_search_res_query=no
fi
@@ -16281,21 +31864,25 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_res_query" >&5
-$as_echo "$ac_cv_search_res_query" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_res_query" >&5
+echo "${ECHO_T}$ac_cv_search_res_query" >&6; }
ac_res=$ac_cv_search_res_query
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing dn_expand" >&5
-$as_echo_n "checking for library containing dn_expand... " >&6; }
-if ${ac_cv_search_dn_expand+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for library containing dn_expand" >&5
+echo $ECHO_N "checking for library containing dn_expand... $ECHO_C" >&6; }
+if test "${ac_cv_search_dn_expand+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16320,17 +31907,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_dn_expand=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_dn_expand+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_dn_expand+set}" = set; then
break
fi
done
-if ${ac_cv_search_dn_expand+:} false; then :
-
+if test "${ac_cv_search_dn_expand+set}" = set; then
+ :
else
ac_cv_search_dn_expand=no
fi
@@ -16337,17 +31947,21 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_dn_expand" >&5
-$as_echo "$ac_cv_search_dn_expand" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_dn_expand" >&5
+echo "${ECHO_T}$ac_cv_search_dn_expand" >&6; }
ac_res=$ac_cv_search_dn_expand
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if res_query will link" >&5
-$as_echo_n "checking if res_query will link... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking if res_query will link" >&5
+echo $ECHO_N "checking if res_query will link... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -16366,17 +31980,41 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
saved_LIBS="$LIBS"
LIBS="$LIBS -lresolv"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for res_query in -lresolv" >&5
-$as_echo_n "checking for res_query in -lresolv... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking for res_query in -lresolv" >&5
+echo $ECHO_N "checking for res_query in -lresolv... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -16395,72 +32033,389 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- LIBS="$saved_LIBS"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ LIBS="$saved_LIBS"
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
- for ac_func in _getshort _getlong
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
+
+for ac_func in _getshort _getlong
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
done
- ac_fn_c_check_decl "$LINENO" "_getshort" "ac_cv_have_decl__getshort" "#include <sys/types.h>
+ { echo "$as_me:$LINENO: checking whether _getshort is declared" >&5
+echo $ECHO_N "checking whether _getshort is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl__getshort+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <sys/types.h>
#include <arpa/nameser.h>
-"
-if test "x$ac_cv_have_decl__getshort" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef _getshort
+ (void) _getshort;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl__getshort=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl__getshort=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl__getshort" >&5
+echo "${ECHO_T}$ac_cv_have_decl__getshort" >&6; }
+if test $ac_cv_have_decl__getshort = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL__GETSHORT $ac_have_decl
+#define HAVE_DECL__GETSHORT 1
_ACEOF
-ac_fn_c_check_decl "$LINENO" "_getlong" "ac_cv_have_decl__getlong" "#include <sys/types.h>
+
+
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL__GETSHORT 0
+_ACEOF
+
+
+fi
+{ echo "$as_me:$LINENO: checking whether _getlong is declared" >&5
+echo $ECHO_N "checking whether _getlong is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl__getlong+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <sys/types.h>
#include <arpa/nameser.h>
-"
-if test "x$ac_cv_have_decl__getlong" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef _getlong
+ (void) _getlong;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl__getlong=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl__getlong=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl__getlong" >&5
+echo "${ECHO_T}$ac_cv_have_decl__getlong" >&6; }
+if test $ac_cv_have_decl__getlong = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL__GETLONG $ac_have_decl
+#define HAVE_DECL__GETLONG 1
_ACEOF
- ac_fn_c_check_member "$LINENO" "HEADER" "ad" "ac_cv_member_HEADER_ad" "#include <arpa/nameser.h>
-"
-if test "x$ac_cv_member_HEADER_ad" = xyes; then :
-$as_echo "#define HAVE_HEADER_AD 1" >>confdefs.h
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL__GETLONG 0
+_ACEOF
+
fi
+ { echo "$as_me:$LINENO: checking for HEADER.ad" >&5
+echo $ECHO_N "checking for HEADER.ad... $ECHO_C" >&6; }
+if test "${ac_cv_member_HEADER_ad+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <arpa/nameser.h>
+
+int
+main ()
+{
+static HEADER ac_aggr;
+if (ac_aggr.ad)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_HEADER_ad=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <arpa/nameser.h>
+
+int
+main ()
+{
+static HEADER ac_aggr;
+if (sizeof ac_aggr.ad)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_HEADER_ad=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_HEADER_ad=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if struct __res_state _res is an extern" >&5
-$as_echo_n "checking if struct __res_state _res is an extern... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_HEADER_ad" >&5
+echo "${ECHO_T}$ac_cv_member_HEADER_ad" >&6; }
+if test $ac_cv_member_HEADER_ad = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_HEADER_AD 1
+_ACEOF
+
+fi
+
+
+fi
+
+
+{ echo "$as_me:$LINENO: checking if struct __res_state _res is an extern" >&5
+echo $ECHO_N "checking if struct __res_state _res is an extern... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -16476,53 +32431,216 @@
main ()
{
+struct __res_state *volatile p = &_res; /* force resolution of _res */
+return 0;
+
;
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define HAVE__RES_EXTERN 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE__RES_EXTERN 1
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+
# Check whether user wants SELinux support
SELINUX_MSG="no"
LIBSELINUX=""
# Check whether --with-selinux was given.
-if test "${with_selinux+set}" = set; then :
+if test "${with_selinux+set}" = set; then
withval=$with_selinux; if test "x$withval" != "xno" ; then
save_LIBS="$LIBS"
-$as_echo "#define WITH_SELINUX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define WITH_SELINUX 1
+_ACEOF
SELINUX_MSG="yes"
- ac_fn_c_check_header_mongrel "$LINENO" "selinux/selinux.h" "ac_cv_header_selinux_selinux_h" "$ac_includes_default"
-if test "x$ac_cv_header_selinux_selinux_h" = xyes; then :
+ if test "${ac_cv_header_selinux_selinux_h+set}" = set; then
+ { echo "$as_me:$LINENO: checking for selinux/selinux.h" >&5
+echo $ECHO_N "checking for selinux/selinux.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_selinux_selinux_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_selinux_selinux_h" >&5
+echo "${ECHO_T}$ac_cv_header_selinux_selinux_h" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking selinux/selinux.h usability" >&5
+echo $ECHO_N "checking selinux/selinux.h usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <selinux/selinux.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking selinux/selinux.h presence" >&5
+echo $ECHO_N "checking selinux/selinux.h presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <selinux/selinux.h>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
else
- as_fn_error $? "SELinux support requires selinux.h header" "$LINENO" 5
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
fi
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for setexeccon in -lselinux" >&5
-$as_echo_n "checking for setexeccon in -lselinux... " >&6; }
-if ${ac_cv_lib_selinux_setexeccon+:} false; then :
- $as_echo_n "(cached) " >&6
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: selinux/selinux.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: selinux/selinux.h: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: selinux/selinux.h: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: selinux/selinux.h: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: selinux/selinux.h: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: selinux/selinux.h: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: selinux/selinux.h: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: selinux/selinux.h: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for selinux/selinux.h" >&5
+echo $ECHO_N "checking for selinux/selinux.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_selinux_selinux_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
+ ac_cv_header_selinux_selinux_h=$ac_header_preproc
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_selinux_selinux_h" >&5
+echo "${ECHO_T}$ac_cv_header_selinux_selinux_h" >&6; }
+
+fi
+if test $ac_cv_header_selinux_selinux_h = yes; then
+ :
+else
+ { { echo "$as_me:$LINENO: error: SELinux support requires selinux.h header" >&5
+echo "$as_me: error: SELinux support requires selinux.h header" >&2;}
+ { (exit 1); exit 1; }; }
+fi
+
+
+ { echo "$as_me:$LINENO: checking for setexeccon in -lselinux" >&5
+echo $ECHO_N "checking for setexeccon in -lselinux... $ECHO_C" >&6; }
+if test "${ac_cv_lib_selinux_setexeccon+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lselinux $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16540,34 +32658,140 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_selinux_setexeccon=yes
else
- ac_cv_lib_selinux_setexeccon=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_selinux_setexeccon=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_selinux_setexeccon" >&5
-$as_echo "$ac_cv_lib_selinux_setexeccon" >&6; }
-if test "x$ac_cv_lib_selinux_setexeccon" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_setexeccon" >&5
+echo "${ECHO_T}$ac_cv_lib_selinux_setexeccon" >&6; }
+if test $ac_cv_lib_selinux_setexeccon = yes; then
LIBSELINUX="-lselinux"
LIBS="$LIBS -lselinux"
else
- as_fn_error $? "SELinux support requires libselinux library" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: SELinux support requires libselinux library" >&5
+echo "$as_me: error: SELinux support requires libselinux library" >&2;}
+ { (exit 1); exit 1; }; }
fi
SSHLIBS="$SSHLIBS $LIBSELINUX"
SSHDLIBS="$SSHDLIBS $LIBSELINUX"
- for ac_func in getseuserbyname get_default_context_with_level
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+
+
+for ac_func in getseuserbyname get_default_context_with_level
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -16585,7 +32809,7 @@
KRB5_MSG="no"
# Check whether --with-kerberos5 was given.
-if test "${with_kerberos5+set}" = set; then :
+if test "${with_kerberos5+set}" = set; then
withval=$with_kerberos5; if test "x$withval" != "xno" ; then
if test "x$withval" = "xyes" ; then
KRB5ROOT="/usr/local"
@@ -16594,16 +32818,18 @@
fi
-$as_echo "#define KRB5 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define KRB5 1
+_ACEOF
KRB5_MSG="yes"
# Extract the first word of "krb5-config", so it can be a program name with args.
set dummy krb5-config; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_KRB5CONF+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_KRB5CONF+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $KRB5CONF in
[\\/]* | ?:[\\/]*)
@@ -16616,14 +32842,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_KRB5CONF="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
test -z "$ac_cv_path_KRB5CONF" && ac_cv_path_KRB5CONF="$KRB5ROOT/bin/krb5-config"
@@ -16632,11 +32858,11 @@
fi
KRB5CONF=$ac_cv_path_KRB5CONF
if test -n "$KRB5CONF"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $KRB5CONF" >&5
-$as_echo "$KRB5CONF" >&6; }
+ { echo "$as_me:$LINENO: result: $KRB5CONF" >&5
+echo "${ECHO_T}$KRB5CONF" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -16645,24 +32871,30 @@
K5LIBS="`$KRB5CONF --libs`"
CPPFLAGS="$CPPFLAGS $K5CFLAGS"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gssapi support" >&5
-$as_echo_n "checking for gssapi support... " >&6; }
+ { echo "$as_me:$LINENO: checking for gssapi support" >&5
+echo $ECHO_N "checking for gssapi support... $ECHO_C" >&6; }
if $KRB5CONF | grep gssapi >/dev/null ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define GSSAPI 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define GSSAPI 1
+_ACEOF
GSSCFLAGS="`$KRB5CONF --cflags gssapi`"
GSSLIBS="`$KRB5CONF --libs gssapi`"
CPPFLAGS="$CPPFLAGS $GSSCFLAGS"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using Heimdal" >&5
-$as_echo_n "checking whether we are using Heimdal... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking whether we are using Heimdal" >&5
+echo $ECHO_N "checking whether we are using Heimdal... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <krb5.h>
@@ -16674,24 +32906,50 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define HEIMDAL 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HEIMDAL 1
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
else
CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using Heimdal" >&5
-$as_echo_n "checking whether we are using Heimdal... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking whether we are using Heimdal" >&5
+echo $ECHO_N "checking whether we are using Heimdal... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <krb5.h>
@@ -16703,21 +32961,43 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- $as_echo "#define HEIMDAL 1" >>confdefs.h
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+ cat >>confdefs.h <<\_ACEOF
+#define HEIMDAL 1
+_ACEOF
K5LIBS="-lkrb5"
K5LIBS="$K5LIBS -lcom_err -lasn1"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for net_write in -lroken" >&5
-$as_echo_n "checking for net_write in -lroken... " >&6; }
-if ${ac_cv_lib_roken_net_write+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for net_write in -lroken" >&5
+echo $ECHO_N "checking for net_write in -lroken... $ECHO_C" >&6; }
+if test "${ac_cv_lib_roken_net_write+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lroken $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16735,29 +33015,54 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_roken_net_write=yes
else
- ac_cv_lib_roken_net_write=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_roken_net_write=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_roken_net_write" >&5
-$as_echo "$ac_cv_lib_roken_net_write" >&6; }
-if test "x$ac_cv_lib_roken_net_write" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_roken_net_write" >&5
+echo "${ECHO_T}$ac_cv_lib_roken_net_write" >&6; }
+if test $ac_cv_lib_roken_net_write = yes; then
K5LIBS="$K5LIBS -lroken"
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for des_cbc_encrypt in -ldes" >&5
-$as_echo_n "checking for des_cbc_encrypt in -ldes... " >&6; }
-if ${ac_cv_lib_des_des_cbc_encrypt+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for des_cbc_encrypt in -ldes" >&5
+echo $ECHO_N "checking for des_cbc_encrypt in -ldes... $ECHO_C" >&6; }
+if test "${ac_cv_lib_des_des_cbc_encrypt+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-ldes $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16775,37 +33080,65 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_des_des_cbc_encrypt=yes
else
- ac_cv_lib_des_des_cbc_encrypt=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_des_des_cbc_encrypt=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_des_des_cbc_encrypt" >&5
-$as_echo "$ac_cv_lib_des_des_cbc_encrypt" >&6; }
-if test "x$ac_cv_lib_des_des_cbc_encrypt" = xyes; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_des_des_cbc_encrypt" >&5
+echo "${ECHO_T}$ac_cv_lib_des_des_cbc_encrypt" >&6; }
+if test $ac_cv_lib_des_des_cbc_encrypt = yes; then
K5LIBS="$K5LIBS -ldes"
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
K5LIBS="-lkrb5 -lk5crypto -lcom_err"
+fi
-fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing dn_expand" >&5
-$as_echo_n "checking for library containing dn_expand... " >&6; }
-if ${ac_cv_search_dn_expand+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for library containing dn_expand" >&5
+echo $ECHO_N "checking for library containing dn_expand... $ECHO_C" >&6; }
+if test "${ac_cv_search_dn_expand+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16830,17 +33163,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_dn_expand=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_dn_expand+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_dn_expand+set}" = set; then
break
fi
done
-if ${ac_cv_search_dn_expand+:} false; then :
-
+if test "${ac_cv_search_dn_expand+set}" = set; then
+ :
else
ac_cv_search_dn_expand=no
fi
@@ -16847,23 +33203,27 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_dn_expand" >&5
-$as_echo "$ac_cv_search_dn_expand" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_dn_expand" >&5
+echo "${ECHO_T}$ac_cv_search_dn_expand" >&6; }
ac_res=$ac_cv_search_dn_expand
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gss_init_sec_context in -lgssapi_krb5" >&5
-$as_echo_n "checking for gss_init_sec_context in -lgssapi_krb5... " >&6; }
-if ${ac_cv_lib_gssapi_krb5_gss_init_sec_context+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for gss_init_sec_context in -lgssapi_krb5" >&5
+echo $ECHO_N "checking for gss_init_sec_context in -lgssapi_krb5... $ECHO_C" >&6; }
+if test "${ac_cv_lib_gssapi_krb5_gss_init_sec_context+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lgssapi_krb5 $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16881,30 +33241,57 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_gssapi_krb5_gss_init_sec_context=yes
else
- ac_cv_lib_gssapi_krb5_gss_init_sec_context=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_gssapi_krb5_gss_init_sec_context=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&5
-$as_echo "$ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&6; }
-if test "x$ac_cv_lib_gssapi_krb5_gss_init_sec_context" = xyes; then :
- $as_echo "#define GSSAPI 1" >>confdefs.h
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&5
+echo "${ECHO_T}$ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&6; }
+if test $ac_cv_lib_gssapi_krb5_gss_init_sec_context = yes; then
+ cat >>confdefs.h <<\_ACEOF
+#define GSSAPI 1
+_ACEOF
GSSLIBS="-lgssapi_krb5"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gss_init_sec_context in -lgssapi" >&5
-$as_echo_n "checking for gss_init_sec_context in -lgssapi... " >&6; }
-if ${ac_cv_lib_gssapi_gss_init_sec_context+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for gss_init_sec_context in -lgssapi" >&5
+echo $ECHO_N "checking for gss_init_sec_context in -lgssapi... $ECHO_C" >&6; }
+if test "${ac_cv_lib_gssapi_gss_init_sec_context+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lgssapi $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16922,30 +33309,57 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_gssapi_gss_init_sec_context=yes
else
- ac_cv_lib_gssapi_gss_init_sec_context=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_gssapi_gss_init_sec_context=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gssapi_gss_init_sec_context" >&5
-$as_echo "$ac_cv_lib_gssapi_gss_init_sec_context" >&6; }
-if test "x$ac_cv_lib_gssapi_gss_init_sec_context" = xyes; then :
- $as_echo "#define GSSAPI 1" >>confdefs.h
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_gssapi_gss_init_sec_context" >&5
+echo "${ECHO_T}$ac_cv_lib_gssapi_gss_init_sec_context" >&6; }
+if test $ac_cv_lib_gssapi_gss_init_sec_context = yes; then
+ cat >>confdefs.h <<\_ACEOF
+#define GSSAPI 1
+_ACEOF
GSSLIBS="-lgssapi"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gss_init_sec_context in -lgss" >&5
-$as_echo_n "checking for gss_init_sec_context in -lgss... " >&6; }
-if ${ac_cv_lib_gss_gss_init_sec_context+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for gss_init_sec_context in -lgss" >&5
+echo $ECHO_N "checking for gss_init_sec_context in -lgss... $ECHO_C" >&6; }
+if test "${ac_cv_lib_gss_gss_init_sec_context+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
LIBS="-lgss $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -16963,24 +33377,47 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_lib_gss_gss_init_sec_context=yes
else
- ac_cv_lib_gss_gss_init_sec_context=no
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_lib_gss_gss_init_sec_context=no
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gss_gss_init_sec_context" >&5
-$as_echo "$ac_cv_lib_gss_gss_init_sec_context" >&6; }
-if test "x$ac_cv_lib_gss_gss_init_sec_context" = xyes; then :
- $as_echo "#define GSSAPI 1" >>confdefs.h
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_gss_gss_init_sec_context" >&5
+echo "${ECHO_T}$ac_cv_lib_gss_gss_init_sec_context" >&6; }
+if test $ac_cv_lib_gss_gss_init_sec_context = yes; then
+ cat >>confdefs.h <<\_ACEOF
+#define GSSAPI 1
+_ACEOF
GSSLIBS="-lgss"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Cannot find any suitable gss-api library - build may fail" >&5
-$as_echo "$as_me: WARNING: Cannot find any suitable gss-api library - build may fail" >&2;}
+ { echo "$as_me:$LINENO: WARNING: Cannot find any suitable gss-api library - build may fail" >&5
+echo "$as_me: WARNING: Cannot find any suitable gss-api library - build may fail" >&2;}
fi
@@ -16990,23 +33427,285 @@
fi
- ac_fn_c_check_header_mongrel "$LINENO" "gssapi.h" "ac_cv_header_gssapi_h" "$ac_includes_default"
-if test "x$ac_cv_header_gssapi_h" = xyes; then :
+ if test "${ac_cv_header_gssapi_h+set}" = set; then
+ { echo "$as_me:$LINENO: checking for gssapi.h" >&5
+echo $ECHO_N "checking for gssapi.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_gssapi_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_gssapi_h" >&5
+echo "${ECHO_T}$ac_cv_header_gssapi_h" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking gssapi.h usability" >&5
+echo $ECHO_N "checking gssapi.h usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <gssapi.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking gssapi.h presence" >&5
+echo $ECHO_N "checking gssapi.h presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <gssapi.h>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: gssapi.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: gssapi.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: gssapi.h: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: gssapi.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: gssapi.h: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi.h: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: gssapi.h: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: gssapi.h: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi.h: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: gssapi.h: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: gssapi.h: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: gssapi.h: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for gssapi.h" >&5
+echo $ECHO_N "checking for gssapi.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_gssapi_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ ac_cv_header_gssapi_h=$ac_header_preproc
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_gssapi_h" >&5
+echo "${ECHO_T}$ac_cv_header_gssapi_h" >&6; }
+
+fi
+if test $ac_cv_header_gssapi_h = yes; then
+ :
+else
unset ac_cv_header_gssapi_h
CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
- for ac_header in gssapi.h
-do :
- ac_fn_c_check_header_mongrel "$LINENO" "gssapi.h" "ac_cv_header_gssapi_h" "$ac_includes_default"
-if test "x$ac_cv_header_gssapi_h" = xyes; then :
+
+for ac_header in gssapi.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define HAVE_GSSAPI_H 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Cannot find any suitable gss-api header - build may fail" >&5
-$as_echo "$as_me: WARNING: Cannot find any suitable gss-api header - build may fail" >&2;}
+ { echo "$as_me:$LINENO: WARNING: Cannot find any suitable gss-api header - build may fail" >&5
+echo "$as_me: WARNING: Cannot find any suitable gss-api header - build may fail" >&2;}
fi
@@ -17020,10 +33719,139 @@
oldCPP="$CPPFLAGS"
CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
- ac_fn_c_check_header_mongrel "$LINENO" "gssapi_krb5.h" "ac_cv_header_gssapi_krb5_h" "$ac_includes_default"
-if test "x$ac_cv_header_gssapi_krb5_h" = xyes; then :
+ if test "${ac_cv_header_gssapi_krb5_h+set}" = set; then
+ { echo "$as_me:$LINENO: checking for gssapi_krb5.h" >&5
+echo $ECHO_N "checking for gssapi_krb5.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_gssapi_krb5_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_gssapi_krb5_h" >&5
+echo "${ECHO_T}$ac_cv_header_gssapi_krb5_h" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking gssapi_krb5.h usability" >&5
+echo $ECHO_N "checking gssapi_krb5.h usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <gssapi_krb5.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking gssapi_krb5.h presence" >&5
+echo $ECHO_N "checking gssapi_krb5.h presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <gssapi_krb5.h>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: gssapi_krb5.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: gssapi_krb5.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi_krb5.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: gssapi_krb5.h: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: gssapi_krb5.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: gssapi_krb5.h: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi_krb5.h: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: gssapi_krb5.h: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi_krb5.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: gssapi_krb5.h: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi_krb5.h: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: gssapi_krb5.h: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi_krb5.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: gssapi_krb5.h: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: gssapi_krb5.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: gssapi_krb5.h: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for gssapi_krb5.h" >&5
+echo $ECHO_N "checking for gssapi_krb5.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_gssapi_krb5_h+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ ac_cv_header_gssapi_krb5_h=$ac_header_preproc
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_gssapi_krb5_h" >&5
+echo "${ECHO_T}$ac_cv_header_gssapi_krb5_h" >&6; }
+
+fi
+if test $ac_cv_header_gssapi_krb5_h = yes; then
+ :
+else
CPPFLAGS="$oldCPP"
fi
@@ -17037,13 +33865,146 @@
blibpath="$blibpath:${KRB5ROOT}/lib"
fi
- for ac_header in gssapi.h gssapi/gssapi.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+
+
+for ac_header in gssapi.h gssapi/gssapi.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -17050,13 +34011,146 @@
done
- for ac_header in gssapi_krb5.h gssapi/gssapi_krb5.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+
+
+for ac_header in gssapi_krb5.h gssapi/gssapi_krb5.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -17063,13 +34157,146 @@
done
- for ac_header in gssapi_generic.h gssapi/gssapi_generic.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+
+
+for ac_header in gssapi_generic.h gssapi/gssapi_generic.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+ # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_header_compiler=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } >/dev/null && {
+ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ }; then
+ ac_header_preproc=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So? What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+ yes:no: )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+ ac_header_preproc=yes
+ ;;
+ no:yes:* )
+ { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+ ( cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev at mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+ ) | sed "s/^/$as_me: WARNING: /" >&2
+ ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
_ACEOF
fi
@@ -17077,13 +34304,17 @@
done
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing k_hasafs" >&5
-$as_echo_n "checking for library containing k_hasafs... " >&6; }
-if ${ac_cv_search_k_hasafs+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for library containing k_hasafs" >&5
+echo $ECHO_N "checking for library containing k_hasafs... $ECHO_C" >&6; }
+if test "${ac_cv_search_k_hasafs+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_func_search_save_LIBS=$LIBS
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
@@ -17108,17 +34339,40 @@
ac_res=-l$ac_lib
LIBS="-l$ac_lib $ac_func_search_save_LIBS"
fi
- if ac_fn_c_try_link "$LINENO"; then :
+ rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
ac_cv_search_k_hasafs=$ac_res
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext
- if ${ac_cv_search_k_hasafs+:} false; then :
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext
+ if test "${ac_cv_search_k_hasafs+set}" = set; then
break
fi
done
-if ${ac_cv_search_k_hasafs+:} false; then :
-
+if test "${ac_cv_search_k_hasafs+set}" = set; then
+ :
else
ac_cv_search_k_hasafs=no
fi
@@ -17125,18 +34379,31 @@
rm conftest.$ac_ext
LIBS=$ac_func_search_save_LIBS
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_k_hasafs" >&5
-$as_echo "$ac_cv_search_k_hasafs" >&6; }
+{ echo "$as_me:$LINENO: result: $ac_cv_search_k_hasafs" >&5
+echo "${ECHO_T}$ac_cv_search_k_hasafs" >&6; }
ac_res=$ac_cv_search_k_hasafs
-if test "$ac_res" != no; then :
+if test "$ac_res" != no; then
test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
-$as_echo "#define USE_AFS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define USE_AFS 1
+_ACEOF
fi
- ac_fn_c_check_decl "$LINENO" "GSS_C_NT_HOSTBASED_SERVICE" "ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE" "
+ { echo "$as_me:$LINENO: checking whether GSS_C_NT_HOSTBASED_SERVICE is declared" >&5
+echo $ECHO_N "checking whether GSS_C_NT_HOSTBASED_SERVICE is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#ifdef HAVE_GSSAPI_H
# include <gssapi.h>
#elif defined(HAVE_GSSAPI_GSSAPI_H)
@@ -17149,26 +34416,156 @@
# include <gssapi/gssapi_generic.h>
#endif
-"
-if test "x$ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE" = xyes; then :
- ac_have_decl=1
+
+int
+main ()
+{
+#ifndef GSS_C_NT_HOSTBASED_SERVICE
+ (void) GSS_C_NT_HOSTBASED_SERVICE;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE=yes
else
- ac_have_decl=0
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE" >&5
+echo "${ECHO_T}$ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE" >&6; }
+if test $ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE = yes; then
+
cat >>confdefs.h <<_ACEOF
-#define HAVE_DECL_GSS_C_NT_HOSTBASED_SERVICE $ac_have_decl
+#define HAVE_DECL_GSS_C_NT_HOSTBASED_SERVICE 1
_ACEOF
+
+else
+ cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_GSS_C_NT_HOSTBASED_SERVICE 0
+_ACEOF
+
+
+fi
+
+
saved_LIBS="$LIBS"
LIBS="$LIBS $K5LIBS"
- for ac_func in krb5_cc_new_unique krb5_get_error_message krb5_free_error_message
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+
+
+
+for ac_func in krb5_cc_new_unique krb5_get_error_message krb5_free_error_message
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+ For example, HP-UX 11i <limits.h> declares gettimeofday. */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+ which can conflict with char $ac_func (); below.
+ Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+ <limits.h> exists even on freestanding compilers. */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+ to always fail with ENOSYS. Some functions are actually named
+ something starting with __ and the normal name is an alias. */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext &&
+ $as_test_x conftest$ac_exeext; then
+ eval "$as_ac_var=yes"
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
_ACEOF
fi
@@ -17189,7 +34586,7 @@
PRIVSEP_PATH=/var/empty
# Check whether --with-privsep-path was given.
-if test "${with_privsep_path+set}" = set; then :
+if test "${with_privsep_path+set}" = set; then
withval=$with_privsep_path;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
@@ -17203,7 +34600,7 @@
# Check whether --with-xauth was given.
-if test "${with_xauth+set}" = set; then :
+if test "${with_xauth+set}" = set; then
withval=$with_xauth;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
@@ -17219,10 +34616,10 @@
TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
# Extract the first word of "xauth", so it can be a program name with args.
set dummy xauth; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_xauth_path+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_xauth_path+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $xauth_path in
[\\/]* | ?:[\\/]*)
@@ -17234,14 +34631,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_xauth_path="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -17249,11 +34646,11 @@
fi
xauth_path=$ac_cv_path_xauth_path
if test -n "$xauth_path"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $xauth_path" >&5
-$as_echo "$xauth_path" >&6; }
+ { echo "$as_me:$LINENO: result: $xauth_path" >&5
+echo "${ECHO_T}$xauth_path" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -17267,7 +34664,7 @@
STRIP_OPT=-s
# Check whether --enable-strip was given.
-if test "${enable_strip+set}" = set; then :
+if test "${enable_strip+set}" = set; then
enableval=$enable_strip;
if test "x$enableval" = "xno" ; then
STRIP_OPT=
@@ -17294,7 +34691,7 @@
# Check for mail directory
# Check whether --with-maildir was given.
-if test "${with_maildir+set}" = set; then :
+if test "${with_maildir+set}" = set; then
withval=$with_maildir;
if test "X$withval" != X && test "x$withval" != xno && \
test "x${withval}" != xyes; then
@@ -17313,16 +34710,20 @@
_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking Discovering system mail directory" >&5
-$as_echo_n "checking Discovering system mail directory... " >&6; }
- if test "$cross_compiling" = yes; then :
+ { echo "$as_me:$LINENO: checking Discovering system mail directory" >&5
+echo $ECHO_N "checking Discovering system mail directory... $ECHO_C" >&6; }
+ if test "$cross_compiling" = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: use --with-maildir=/path/to/mail" >&5
-$as_echo "$as_me: WARNING: cross compiling: use --with-maildir=/path/to/mail" >&2;}
+ { echo "$as_me:$LINENO: WARNING: cross compiling: use --with-maildir=/path/to/mail" >&5
+echo "$as_me: WARNING: cross compiling: use --with-maildir=/path/to/mail" >&2;}
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
@@ -17365,13 +34766,32 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
- maildir_what=`awk -F: '{print $1}' conftest.maildir`
+ maildir_what=`awk -F: '{print $1}' conftest.maildir`
maildir=`awk -F: '{print $2}' conftest.maildir \
| sed 's|/$||'`
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: Using: $maildir from $maildir_what" >&5
-$as_echo "Using: $maildir from $maildir_what" >&6; }
+ { echo "$as_me:$LINENO: result: Using: $maildir from $maildir_what" >&5
+echo "${ECHO_T}Using: $maildir from $maildir_what" >&6; }
if test "x$maildir_what" != "x_PATH_MAILDIR"; then
cat >>confdefs.h <<_ACEOF
#define MAIL_DIRECTORY "$maildir"
@@ -17380,25 +34800,30 @@
fi
else
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+( exit $ac_status )
+
if test "X$ac_status" = "X2";then
# our test program didn't find it. Default to /var/spool/mail
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: Using: default value of /var/spool/mail" >&5
-$as_echo "Using: default value of /var/spool/mail" >&6; }
+ { echo "$as_me:$LINENO: result: Using: default value of /var/spool/mail" >&5
+echo "${ECHO_T}Using: default value of /var/spool/mail" >&6; }
cat >>confdefs.h <<_ACEOF
#define MAIL_DIRECTORY "/var/spool/mail"
_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: *** not found ***" >&5
-$as_echo "*** not found ***" >&6; }
+ { echo "$as_me:$LINENO: result: *** not found ***" >&5
+echo "${ECHO_T}*** not found ***" >&6; }
fi
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
fi
@@ -17406,30 +34831,30 @@
# maildir
if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: Disabling /dev/ptmx test" >&5
-$as_echo "$as_me: WARNING: cross compiling: Disabling /dev/ptmx test" >&2;}
+ { echo "$as_me:$LINENO: WARNING: cross compiling: Disabling /dev/ptmx test" >&5
+echo "$as_me: WARNING: cross compiling: Disabling /dev/ptmx test" >&2;}
disable_ptmx_check=yes
fi
if test -z "$no_dev_ptmx" ; then
if test "x$disable_ptmx_check" != "xyes" ; then
- as_ac_File=`$as_echo "ac_cv_file_"/dev/ptmx"" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for \"/dev/ptmx\"" >&5
-$as_echo_n "checking for \"/dev/ptmx\"... " >&6; }
-if eval \${$as_ac_File+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for \"/dev/ptmx\"" >&5
+echo $ECHO_N "checking for \"/dev/ptmx\"... $ECHO_C" >&6; }
+if test "${ac_cv_file___dev_ptmx_+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
test "$cross_compiling" = yes &&
- as_fn_error $? "cannot check for file existence when cross compiling" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: cannot check for file existence when cross compiling" >&5
+echo "$as_me: error: cannot check for file existence when cross compiling" >&2;}
+ { (exit 1); exit 1; }; }
if test -r ""/dev/ptmx""; then
- eval "$as_ac_File=yes"
+ ac_cv_file___dev_ptmx_=yes
else
- eval "$as_ac_File=no"
+ ac_cv_file___dev_ptmx_=no
fi
fi
-eval ac_res=\$$as_ac_File
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_ac_File"\" = x"yes"; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_file___dev_ptmx_" >&5
+echo "${ECHO_T}$ac_cv_file___dev_ptmx_" >&6; }
+if test $ac_cv_file___dev_ptmx_ = yes; then
cat >>confdefs.h <<_ACEOF
@@ -17445,24 +34870,24 @@
fi
if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
- as_ac_File=`$as_echo "ac_cv_file_"/dev/ptc"" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for \"/dev/ptc\"" >&5
-$as_echo_n "checking for \"/dev/ptc\"... " >&6; }
-if eval \${$as_ac_File+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for \"/dev/ptc\"" >&5
+echo $ECHO_N "checking for \"/dev/ptc\"... $ECHO_C" >&6; }
+if test "${ac_cv_file___dev_ptc_+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
test "$cross_compiling" = yes &&
- as_fn_error $? "cannot check for file existence when cross compiling" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: cannot check for file existence when cross compiling" >&5
+echo "$as_me: error: cannot check for file existence when cross compiling" >&2;}
+ { (exit 1); exit 1; }; }
if test -r ""/dev/ptc""; then
- eval "$as_ac_File=yes"
+ ac_cv_file___dev_ptc_=yes
else
- eval "$as_ac_File=no"
+ ac_cv_file___dev_ptc_=no
fi
fi
-eval ac_res=\$$as_ac_File
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_ac_File"\" = x"yes"; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_file___dev_ptc_" >&5
+echo "${ECHO_T}$ac_cv_file___dev_ptc_" >&6; }
+if test $ac_cv_file___dev_ptc_ = yes; then
cat >>confdefs.h <<_ACEOF
@@ -17475,14 +34900,14 @@
fi
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: Disabling /dev/ptc test" >&5
-$as_echo "$as_me: WARNING: cross compiling: Disabling /dev/ptc test" >&2;}
+ { echo "$as_me:$LINENO: WARNING: cross compiling: Disabling /dev/ptc test" >&5
+echo "$as_me: WARNING: cross compiling: Disabling /dev/ptc test" >&2;}
fi
# Options from here on. Some of these are preset by platform above
# Check whether --with-mantype was given.
-if test "${with_mantype+set}" = set; then :
+if test "${with_mantype+set}" = set; then
withval=$with_mantype;
case "$withval" in
man|cat|doc)
@@ -17489,7 +34914,9 @@
MANTYPE=$withval
;;
*)
- as_fn_error $? "invalid man type: $withval" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: invalid man type: $withval" >&5
+echo "$as_me: error: invalid man type: $withval" >&2;}
+ { (exit 1); exit 1; }; }
;;
esac
@@ -17502,10 +34929,10 @@
do
# Extract the first word of "$ac_prog", so it can be a program name with args.
set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_NROFF+:} false; then :
- $as_echo_n "(cached) " >&6
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_NROFF+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
case $NROFF in
[\\/]* | ?:[\\/]*)
@@ -17517,14 +34944,14 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
+ for ac_exec_ext in '' $ac_executable_extensions; do
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
ac_cv_path_NROFF="$as_dir/$ac_word$ac_exec_ext"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
break 2
fi
done
- done
+done
IFS=$as_save_IFS
;;
@@ -17532,11 +34959,11 @@
fi
NROFF=$ac_cv_path_NROFF
if test -n "$NROFF"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $NROFF" >&5
-$as_echo "$NROFF" >&6; }
+ { echo "$as_me:$LINENO: result: $NROFF" >&5
+echo "${ECHO_T}$NROFF" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
@@ -17564,11 +34991,13 @@
MD5_MSG="no"
# Check whether --with-md5-passwords was given.
-if test "${with_md5_passwords+set}" = set; then :
+if test "${with_md5_passwords+set}" = set; then
withval=$with_md5_passwords;
if test "x$withval" != "xno" ; then
-$as_echo "#define HAVE_MD5_PASSWORDS 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_MD5_PASSWORDS 1
+_ACEOF
MD5_MSG="yes"
fi
@@ -17580,10 +35009,12 @@
# Whether to disable shadow password support
# Check whether --with-shadow was given.
-if test "${with_shadow+set}" = set; then :
+if test "${with_shadow+set}" = set; then
withval=$with_shadow;
if test "x$withval" = "xno" ; then
- $as_echo "#define DISABLE_SHADOW 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_SHADOW 1
+_ACEOF
disable_shadow=yes
fi
@@ -17593,9 +35024,13 @@
if test -z "$disable_shadow" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if the systems has expire shadow information" >&5
-$as_echo_n "checking if the systems has expire shadow information... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ { echo "$as_me:$LINENO: checking if the systems has expire shadow information" >&5
+echo $ECHO_N "checking if the systems has expire shadow information... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -17610,20 +35045,45 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
sp_expire_available=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
if test "x$sp_expire_available" = "xyes" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define HAS_SHADOW_EXPIRE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAS_SHADOW_EXPIRE 1
+_ACEOF
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
fi
@@ -17631,16 +35091,20 @@
if test ! -z "$IPADDR_IN_DISPLAY" ; then
DISPLAY_HACK_MSG="yes"
-$as_echo "#define IPADDR_IN_DISPLAY 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define IPADDR_IN_DISPLAY 1
+_ACEOF
else
DISPLAY_HACK_MSG="no"
# Check whether --with-ipaddr-display was given.
-if test "${with_ipaddr_display+set}" = set; then :
+if test "${with_ipaddr_display+set}" = set; then
withval=$with_ipaddr_display;
if test "x$withval" != "xno" ; then
- $as_echo "#define IPADDR_IN_DISPLAY 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define IPADDR_IN_DISPLAY 1
+_ACEOF
DISPLAY_HACK_MSG="yes"
fi
@@ -17652,10 +35116,10 @@
# check for /etc/default/login and use it if present.
# Check whether --enable-etc-default-login was given.
-if test "${enable_etc_default_login+set}" = set; then :
+if test "${enable_etc_default_login+set}" = set; then
enableval=$enable_etc_default_login; if test "x$enableval" = "xno"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: /etc/default/login handling disabled" >&5
-$as_echo "$as_me: /etc/default/login handling disabled" >&6;}
+ { echo "$as_me:$LINENO: /etc/default/login handling disabled" >&5
+echo "$as_me: /etc/default/login handling disabled" >&6;}
etc_default_login=no
else
etc_default_login=yes
@@ -17663,8 +35127,8 @@
else
if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: not checking /etc/default/login" >&5
-$as_echo "$as_me: WARNING: cross compiling: not checking /etc/default/login" >&2;}
+ { echo "$as_me:$LINENO: WARNING: cross compiling: not checking /etc/default/login" >&5
+echo "$as_me: WARNING: cross compiling: not checking /etc/default/login" >&2;}
etc_default_login=no
else
etc_default_login=yes
@@ -17674,30 +35138,32 @@
if test "x$etc_default_login" != "xno"; then
- as_ac_File=`$as_echo "ac_cv_file_"/etc/default/login"" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for \"/etc/default/login\"" >&5
-$as_echo_n "checking for \"/etc/default/login\"... " >&6; }
-if eval \${$as_ac_File+:} false; then :
- $as_echo_n "(cached) " >&6
+ { echo "$as_me:$LINENO: checking for \"/etc/default/login\"" >&5
+echo $ECHO_N "checking for \"/etc/default/login\"... $ECHO_C" >&6; }
+if test "${ac_cv_file___etc_default_login_+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
else
test "$cross_compiling" = yes &&
- as_fn_error $? "cannot check for file existence when cross compiling" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: cannot check for file existence when cross compiling" >&5
+echo "$as_me: error: cannot check for file existence when cross compiling" >&2;}
+ { (exit 1); exit 1; }; }
if test -r ""/etc/default/login""; then
- eval "$as_ac_File=yes"
+ ac_cv_file___etc_default_login_=yes
else
- eval "$as_ac_File=no"
+ ac_cv_file___etc_default_login_=no
fi
fi
-eval ac_res=\$$as_ac_File
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_ac_File"\" = x"yes"; then :
+{ echo "$as_me:$LINENO: result: $ac_cv_file___etc_default_login_" >&5
+echo "${ECHO_T}$ac_cv_file___etc_default_login_" >&6; }
+if test $ac_cv_file___etc_default_login_ = yes; then
external_path_file=/etc/default/login
fi
if test "x$external_path_file" = "x/etc/default/login"; then
-$as_echo "#define HAVE_ETC_DEFAULT_LOGIN 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ETC_DEFAULT_LOGIN 1
+_ACEOF
fi
fi
@@ -17711,21 +35177,21 @@
SERVER_PATH_MSG="(default)"
# Check whether --with-default-path was given.
-if test "${with_default_path+set}" = set; then :
+if test "${with_default_path+set}" = set; then
withval=$with_default_path;
if test "x$external_path_file" = "x/etc/login.conf" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING:
+ { echo "$as_me:$LINENO: WARNING:
--with-default-path=PATH has no effect on this system.
Edit /etc/login.conf instead." >&5
-$as_echo "$as_me: WARNING:
+echo "$as_me: WARNING:
--with-default-path=PATH has no effect on this system.
Edit /etc/login.conf instead." >&2;}
elif test "x$withval" != "xno" ; then
if test ! -z "$external_path_file" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING:
+ { echo "$as_me:$LINENO: WARNING:
--with-default-path=PATH will only be used if PATH is not defined in
$external_path_file ." >&5
-$as_echo "$as_me: WARNING:
+echo "$as_me: WARNING:
--with-default-path=PATH will only be used if PATH is not defined in
$external_path_file ." >&2;}
fi
@@ -17735,22 +35201,26 @@
else
if test "x$external_path_file" = "x/etc/login.conf" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Make sure the path to scp is in /etc/login.conf" >&5
-$as_echo "$as_me: WARNING: Make sure the path to scp is in /etc/login.conf" >&2;}
+ { echo "$as_me:$LINENO: WARNING: Make sure the path to scp is in /etc/login.conf" >&5
+echo "$as_me: WARNING: Make sure the path to scp is in /etc/login.conf" >&2;}
else
if test ! -z "$external_path_file" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING:
+ { echo "$as_me:$LINENO: WARNING:
If PATH is defined in $external_path_file, ensure the path to scp is included,
otherwise scp will not work." >&5
-$as_echo "$as_me: WARNING:
+echo "$as_me: WARNING:
If PATH is defined in $external_path_file, ensure the path to scp is included,
otherwise scp will not work." >&2;}
fi
- if test "$cross_compiling" = yes; then :
+ if test "$cross_compiling" = yes; then
user_path="/usr/bin:/bin:/usr/sbin:/sbin"
else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
/* find out what STDPATH is */
@@ -17790,15 +35260,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_link") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+ { (case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }; }; then
user_path=`cat conftest.stdpath`
else
- user_path="/usr/bin:/bin:/usr/sbin:/sbin"
+ echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+ user_path="/usr/bin:/bin:/usr/sbin:/sbin"
fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
fi
+
# make sure $bindir is in USER_PATH so scp will work
t_bindir="${bindir}"
while echo "${t_bindir}" | egrep '\$\{|NONE/' >/dev/null 2>&1; do
@@ -17815,8 +35309,8 @@
echo $user_path | grep "^$t_bindir" > /dev/null 2>&1
if test $? -ne 0 ; then
user_path=$user_path:$t_bindir
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: Adding $t_bindir to USER_PATH so scp will work" >&5
-$as_echo "Adding $t_bindir to USER_PATH so scp will work" >&6; }
+ { echo "$as_me:$LINENO: result: Adding $t_bindir to USER_PATH so scp will work" >&5
+echo "${ECHO_T}Adding $t_bindir to USER_PATH so scp will work" >&6; }
fi
fi
fi
@@ -17835,7 +35329,7 @@
# Set superuser path separately to user path
# Check whether --with-superuser-path was given.
-if test "${with_superuser_path+set}" = set; then :
+if test "${with_superuser_path+set}" = set; then
withval=$with_superuser_path;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
@@ -17852,36 +35346,40 @@
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if we need to convert IPv4 in IPv6-mapped addresses" >&5
-$as_echo_n "checking if we need to convert IPv4 in IPv6-mapped addresses... " >&6; }
+{ echo "$as_me:$LINENO: checking if we need to convert IPv4 in IPv6-mapped addresses" >&5
+echo $ECHO_N "checking if we need to convert IPv4 in IPv6-mapped addresses... $ECHO_C" >&6; }
IPV4_IN6_HACK_MSG="no"
# Check whether --with-4in6 was given.
-if test "${with_4in6+set}" = set; then :
+if test "${with_4in6+set}" = set; then
withval=$with_4in6;
if test "x$withval" != "xno" ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
-$as_echo "#define IPV4_IN_IPV6 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define IPV4_IN_IPV6 1
+_ACEOF
IPV4_IN6_HACK_MSG="yes"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
fi
else
if test "x$inet6_default_4in6" = "xyes"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes (default)" >&5
-$as_echo "yes (default)" >&6; }
- $as_echo "#define IPV4_IN_IPV6 1" >>confdefs.h
+ { echo "$as_me:$LINENO: result: yes (default)" >&5
+echo "${ECHO_T}yes (default)" >&6; }
+ cat >>confdefs.h <<\_ACEOF
+#define IPV4_IN_IPV6 1
+_ACEOF
IPV4_IN6_HACK_MSG="yes"
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no (default)" >&5
-$as_echo "no (default)" >&6; }
+ { echo "$as_me:$LINENO: result: no (default)" >&5
+echo "${ECHO_T}no (default)" >&6; }
fi
@@ -17892,11 +35390,13 @@
BSD_AUTH_MSG=no
# Check whether --with-bsd-auth was given.
-if test "${with_bsd_auth+set}" = set; then :
+if test "${with_bsd_auth+set}" = set; then
withval=$with_bsd_auth;
if test "x$withval" != "xno" ; then
-$as_echo "#define BSD_AUTH 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define BSD_AUTH 1
+_ACEOF
BSD_AUTH_MSG=yes
fi
@@ -17917,14 +35417,14 @@
# Check whether --with-pid-dir was given.
-if test "${with_pid_dir+set}" = set; then :
+if test "${with_pid_dir+set}" = set; then
withval=$with_pid_dir;
if test -n "$withval" && test "x$withval" != "xno" && \
test "x${withval}" != "xyes"; then
piddir=$withval
if test ! -d $piddir ; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: ** no $piddir directory on this system **" >&5
-$as_echo "$as_me: WARNING: ** no $piddir directory on this system **" >&2;}
+ { echo "$as_me:$LINENO: WARNING: ** no $piddir directory on this system **" >&5
+echo "$as_me: WARNING: ** no $piddir directory on this system **" >&2;}
fi
fi
@@ -17940,10 +35440,12 @@
# Check whether --enable-lastlog was given.
-if test "${enable_lastlog+set}" = set; then :
+if test "${enable_lastlog+set}" = set; then
enableval=$enable_lastlog;
if test "x$enableval" = "xno" ; then
- $as_echo "#define DISABLE_LASTLOG 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_LASTLOG 1
+_ACEOF
fi
@@ -17951,10 +35453,12 @@
fi
# Check whether --enable-utmp was given.
-if test "${enable_utmp+set}" = set; then :
+if test "${enable_utmp+set}" = set; then
enableval=$enable_utmp;
if test "x$enableval" = "xno" ; then
- $as_echo "#define DISABLE_UTMP 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_UTMP 1
+_ACEOF
fi
@@ -17962,11 +35466,13 @@
fi
# Check whether --enable-utmpx was given.
-if test "${enable_utmpx+set}" = set; then :
+if test "${enable_utmpx+set}" = set; then
enableval=$enable_utmpx;
if test "x$enableval" = "xno" ; then
-$as_echo "#define DISABLE_UTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_UTMPX 1
+_ACEOF
fi
@@ -17974,10 +35480,12 @@
fi
# Check whether --enable-wtmp was given.
-if test "${enable_wtmp+set}" = set; then :
+if test "${enable_wtmp+set}" = set; then
enableval=$enable_wtmp;
if test "x$enableval" = "xno" ; then
- $as_echo "#define DISABLE_WTMP 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_WTMP 1
+_ACEOF
fi
@@ -17985,11 +35493,13 @@
fi
# Check whether --enable-wtmpx was given.
-if test "${enable_wtmpx+set}" = set; then :
+if test "${enable_wtmpx+set}" = set; then
enableval=$enable_wtmpx;
if test "x$enableval" = "xno" ; then
-$as_echo "#define DISABLE_WTMPX 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_WTMPX 1
+_ACEOF
fi
@@ -17997,10 +35507,12 @@
fi
# Check whether --enable-libutil was given.
-if test "${enable_libutil+set}" = set; then :
+if test "${enable_libutil+set}" = set; then
enableval=$enable_libutil;
if test "x$enableval" = "xno" ; then
- $as_echo "#define DISABLE_LOGIN 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_LOGIN 1
+_ACEOF
fi
@@ -18008,11 +35520,13 @@
fi
# Check whether --enable-pututline was given.
-if test "${enable_pututline+set}" = set; then :
+if test "${enable_pututline+set}" = set; then
enableval=$enable_pututline;
if test "x$enableval" = "xno" ; then
-$as_echo "#define DISABLE_PUTUTLINE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_PUTUTLINE 1
+_ACEOF
fi
@@ -18020,11 +35534,13 @@
fi
# Check whether --enable-pututxline was given.
-if test "${enable_pututxline+set}" = set; then :
+if test "${enable_pututxline+set}" = set; then
enableval=$enable_pututxline;
if test "x$enableval" = "xno" ; then
-$as_echo "#define DISABLE_PUTUTXLINE 1" >>confdefs.h
+cat >>confdefs.h <<\_ACEOF
+#define DISABLE_PUTUTXLINE 1
+_ACEOF
fi
@@ -18033,10 +35549,12 @@
# Check whether --with-lastlog was given.
-if test "${with_lastlog+set}" = set; then :
+if test "${with_lastlog+set}" = set; then
withval=$with_lastlog;
if test "x$withval" = "xno" ; then
- $as_echo "#define DISABLE_LASTLOG 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_LASTLOG 1
+_ACEOF
elif test -n "$withval" && test "x${withval}" != "xyes"; then
conf_lastlog_location=$withval
@@ -18047,9 +35565,13 @@
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if your system defines LASTLOG_FILE" >&5
-$as_echo_n "checking if your system defines LASTLOG_FILE... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking if your system defines LASTLOG_FILE" >&5
+echo $ECHO_N "checking if your system defines LASTLOG_FILE... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -18072,16 +35594,39 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if your system defines _PATH_LASTLOG" >&5
-$as_echo_n "checking if your system defines _PATH_LASTLOG... " >&6; }
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+ { echo "$as_me:$LINENO: checking if your system defines _PATH_LASTLOG" >&5
+echo $ECHO_N "checking if your system defines _PATH_LASTLOG... $ECHO_C" >&6; }
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -18101,19 +35646,40 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
system_lastlog_path=no
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
if test -z "$conf_lastlog_location"; then
@@ -18124,8 +35690,8 @@
fi
done
if test -z "$conf_lastlog_location"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: ** Cannot find lastlog **" >&5
-$as_echo "$as_me: WARNING: ** Cannot find lastlog **" >&2;}
+ { echo "$as_me:$LINENO: WARNING: ** Cannot find lastlog **" >&5
+echo "$as_me: WARNING: ** Cannot find lastlog **" >&2;}
fi
fi
fi
@@ -18138,9 +35704,13 @@
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if your system defines UTMP_FILE" >&5
-$as_echo_n "checking if your system defines UTMP_FILE... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking if your system defines UTMP_FILE" >&5
+echo $ECHO_N "checking if your system defines UTMP_FILE... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -18157,15 +35727,35 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
system_utmp_path=no
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
if test -z "$conf_utmp_location"; then
if test x"$system_utmp_path" = x"no" ; then
@@ -18175,7 +35765,9 @@
fi
done
if test -z "$conf_utmp_location"; then
- $as_echo "#define DISABLE_UTMP 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_UTMP 1
+_ACEOF
fi
fi
@@ -18188,9 +35780,13 @@
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if your system defines WTMP_FILE" >&5
-$as_echo_n "checking if your system defines WTMP_FILE... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking if your system defines WTMP_FILE" >&5
+echo $ECHO_N "checking if your system defines WTMP_FILE... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -18207,15 +35803,35 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
system_wtmp_path=no
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
if test -z "$conf_wtmp_location"; then
if test x"$system_wtmp_path" = x"no" ; then
@@ -18225,7 +35841,9 @@
fi
done
if test -z "$conf_wtmp_location"; then
- $as_echo "#define DISABLE_WTMP 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_WTMP 1
+_ACEOF
fi
fi
@@ -18238,9 +35856,13 @@
fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if your system defines WTMPX_FILE" >&5
-$as_echo_n "checking if your system defines WTMPX_FILE... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+{ echo "$as_me:$LINENO: checking if your system defines WTMPX_FILE" >&5
+echo $ECHO_N "checking if your system defines WTMPX_FILE... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <sys/types.h>
@@ -18260,19 +35882,41 @@
return 0;
}
_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
system_wtmpx_path=no
fi
+
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
if test -z "$conf_wtmpx_location"; then
if test x"$system_wtmpx_path" = x"no" ; then
- $as_echo "#define DISABLE_WTMPX 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_WTMPX 1
+_ACEOF
fi
else
@@ -18286,11 +35930,22 @@
if test ! -z "$blibpath" ; then
LDFLAGS="$LDFLAGS $blibflags$blibpath"
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Please check and edit blibpath in LDFLAGS in Makefile" >&5
-$as_echo "$as_me: WARNING: Please check and edit blibpath in LDFLAGS in Makefile" >&2;}
+ { echo "$as_me:$LINENO: WARNING: Please check and edit blibpath in LDFLAGS in Makefile" >&5
+echo "$as_me: WARNING: Please check and edit blibpath in LDFLAGS in Makefile" >&2;}
fi
-ac_fn_c_check_member "$LINENO" "struct lastlog" "ll_line" "ac_cv_member_struct_lastlog_ll_line" "
+{ echo "$as_me:$LINENO: checking for struct lastlog.ll_line" >&5
+echo $ECHO_N "checking for struct lastlog.ll_line... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_lastlog_ll_line+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#ifdef HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
@@ -18304,13 +35959,110 @@
#include <lastlog.h>
#endif
-"
-if test "x$ac_cv_member_struct_lastlog_ll_line" = xyes; then :
+int
+main ()
+{
+static struct lastlog ac_aggr;
+if (ac_aggr.ll_line)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_lastlog_ll_line=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_UTMP_H
+#include <utmp.h>
+#endif
+#ifdef HAVE_UTMPX_H
+#include <utmpx.h>
+#endif
+#ifdef HAVE_LASTLOG_H
+#include <lastlog.h>
+#endif
+
+
+int
+main ()
+{
+static struct lastlog ac_aggr;
+if (sizeof ac_aggr.ll_line)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_lastlog_ll_line=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct_lastlog_ll_line=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_lastlog_ll_line" >&5
+echo "${ECHO_T}$ac_cv_member_struct_lastlog_ll_line" >&6; }
+if test $ac_cv_member_struct_lastlog_ll_line = yes; then
+ :
+else
+
if test x$SKIP_DISABLE_LASTLOG_DEFINE != "xyes" ; then
- $as_echo "#define DISABLE_LASTLOG 1" >>confdefs.h
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_LASTLOG 1
+_ACEOF
fi
@@ -18317,7 +36069,18 @@
fi
-ac_fn_c_check_member "$LINENO" "struct utmp" "ut_line" "ac_cv_member_struct_utmp_ut_line" "
+{ echo "$as_me:$LINENO: checking for struct utmp.ut_line" >&5
+echo $ECHO_N "checking for struct utmp.ut_line... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_utmp_ut_line+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+
#ifdef HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
@@ -18331,19 +36094,118 @@
#include <lastlog.h>
#endif
-"
-if test "x$ac_cv_member_struct_utmp_ut_line" = xyes; then :
+int
+main ()
+{
+static struct utmp ac_aggr;
+if (ac_aggr.ut_line)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_utmp_ut_line=yes
else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
- $as_echo "#define DISABLE_UTMP 1" >>confdefs.h
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
- $as_echo "#define DISABLE_WTMP 1" >>confdefs.h
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_UTMP_H
+#include <utmp.h>
+#endif
+#ifdef HAVE_UTMPX_H
+#include <utmpx.h>
+#endif
+#ifdef HAVE_LASTLOG_H
+#include <lastlog.h>
+#endif
+int
+main ()
+{
+static struct utmp ac_aggr;
+if (sizeof ac_aggr.ut_line)
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_member_struct_utmp_ut_line=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_member_struct_utmp_ut_line=no
fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_utmp_ut_line" >&5
+echo "${ECHO_T}$ac_cv_member_struct_utmp_ut_line" >&6; }
+if test $ac_cv_member_struct_utmp_ut_line = yes; then
+ :
+else
+
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_UTMP 1
+_ACEOF
+
+ cat >>confdefs.h <<\_ACEOF
+#define DISABLE_WTMP 1
+_ACEOF
+
+
+fi
+
+
CFLAGS="$CFLAGS $werror_flags"
if test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
@@ -18351,8 +36213,59 @@
else
TEST_SSH_IPV6=yes
fi
-ac_fn_c_check_decl "$LINENO" "BROKEN_GETADDRINFO" "ac_cv_have_decl_BROKEN_GETADDRINFO" "$ac_includes_default"
-if test "x$ac_cv_have_decl_BROKEN_GETADDRINFO" = xyes; then :
+{ echo "$as_me:$LINENO: checking whether BROKEN_GETADDRINFO is declared" >&5
+echo $ECHO_N "checking whether BROKEN_GETADDRINFO is declared... $ECHO_C" >&6; }
+if test "${ac_cv_have_decl_BROKEN_GETADDRINFO+set}" = set; then
+ echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+ cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h. */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h. */
+$ac_includes_default
+int
+main ()
+{
+#ifndef BROKEN_GETADDRINFO
+ (void) BROKEN_GETADDRINFO;
+#endif
+
+ ;
+ return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+ (eval "$ac_compile") 2>conftest.er1
+ ac_status=$?
+ grep -v '^ *+' conftest.er1 >conftest.err
+ rm -f conftest.er1
+ cat conftest.err >&5
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest.$ac_objext; then
+ ac_cv_have_decl_BROKEN_GETADDRINFO=yes
+else
+ echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_cv_have_decl_BROKEN_GETADDRINFO=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_have_decl_BROKEN_GETADDRINFO" >&5
+echo "${ECHO_T}$ac_cv_have_decl_BROKEN_GETADDRINFO" >&6; }
+if test $ac_cv_have_decl_BROKEN_GETADDRINFO = yes; then
TEST_SSH_IPV6=no
fi
@@ -18393,13 +36306,12 @@
case $ac_val in #(
*${as_nl}*)
case $ac_var in #(
- *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
-$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+ *_cv_*) { echo "$as_me:$LINENO: WARNING: Cache variable $ac_var contains a newline." >&5
+echo "$as_me: WARNING: Cache variable $ac_var contains a newline." >&2;} ;;
esac
case $ac_var in #(
_ | IFS | as_nl) ;; #(
- BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #(
- *) { eval $ac_var=; unset $ac_var;} ;;
+ *) $as_unset $ac_var ;;
esac ;;
esac
done
@@ -18407,8 +36319,8 @@
(set) 2>&1 |
case $as_nl`(ac_space=' '; set) 2>&1` in #(
*${as_nl}ac_space=\ *)
- # `set' does not quote correctly, so add quotes: double-quote
- # substitution turns \\\\ into \\, and sed turns \\ into \.
+ # `set' does not quote correctly, so add quotes (double-quote
+ # substitution turns \\\\ into \\, and sed turns \\ into \).
sed -n \
"s/'/'\\\\''/g;
s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p"
@@ -18430,24 +36342,13 @@
:end' >>confcache
if diff "$cache_file" confcache >/dev/null 2>&1; then :; else
if test -w "$cache_file"; then
- if test "x$cache_file" != "x/dev/null"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5
-$as_echo "$as_me: updating cache $cache_file" >&6;}
- if test ! -f "$cache_file" || test -h "$cache_file"; then
- cat confcache >"$cache_file"
- else
- case $cache_file in #(
- */* | ?:*)
- mv -f confcache "$cache_file"$$ &&
- mv -f "$cache_file"$$ "$cache_file" ;; #(
- *)
- mv -f confcache "$cache_file" ;;
- esac
- fi
- fi
+ test "x$cache_file" != "x/dev/null" &&
+ { echo "$as_me:$LINENO: updating cache $cache_file" >&5
+echo "$as_me: updating cache $cache_file" >&6;}
+ cat confcache >$cache_file
else
- { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5
-$as_echo "$as_me: not updating unwritable cache $cache_file" >&6;}
+ { echo "$as_me:$LINENO: not updating unwritable cache $cache_file" >&5
+echo "$as_me: not updating unwritable cache $cache_file" >&6;}
fi
fi
rm -f confcache
@@ -18460,15 +36361,14 @@
ac_libobjs=
ac_ltlibobjs=
-U=
for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue
# 1. Remove the extension, and $U if already installed.
ac_script='s/\$U\././;s/\.o$//;s/\.obj$//'
- ac_i=`$as_echo "$ac_i" | sed "$ac_script"`
+ ac_i=`echo "$ac_i" | sed "$ac_script"`
# 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR
# will be set to the directory where LIBOBJS objects are built.
- as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext"
- as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo'
+ ac_libobjs="$ac_libobjs \${LIBOBJDIR}$ac_i\$U.$ac_objext"
+ ac_ltlibobjs="$ac_ltlibobjs \${LIBOBJDIR}$ac_i"'$U.lo'
done
LIBOBJS=$ac_libobjs
@@ -18476,15 +36376,12 @@
-
-: "${CONFIG_STATUS=./config.status}"
-ac_write_fail=0
+: ${CONFIG_STATUS=./config.status}
ac_clean_files_save=$ac_clean_files
ac_clean_files="$ac_clean_files $CONFIG_STATUS"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5
-$as_echo "$as_me: creating $CONFIG_STATUS" >&6;}
-as_write_fail=0
-cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1
+{ echo "$as_me:$LINENO: creating $CONFIG_STATUS" >&5
+echo "$as_me: creating $CONFIG_STATUS" >&6;}
+cat >$CONFIG_STATUS <<_ACEOF
#! $SHELL
# Generated by $as_me.
# Run this file to recreate the current configuration.
@@ -18494,79 +36391,59 @@
debug=false
ac_cs_recheck=false
ac_cs_silent=false
-
SHELL=\${CONFIG_SHELL-$SHELL}
-export SHELL
-_ASEOF
-cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1
-## -------------------- ##
-## M4sh Initialization. ##
-## -------------------- ##
+_ACEOF
+cat >>$CONFIG_STATUS <<\_ACEOF
+## --------------------- ##
+## M4sh Initialization. ##
+## --------------------- ##
+
# Be more Bourne compatible
DUALCASE=1; export DUALCASE # for MKS sh
-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
emulate sh
NULLCMD=:
- # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
+ # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
# is contrary to our usage. Disable this feature.
alias -g '${1+"$@"}'='"$@"'
setopt NO_GLOB_SUBST
else
- case `(set -o) 2>/dev/null` in #(
- *posix*) :
- set -o posix ;; #(
- *) :
- ;;
+ case `(set -o) 2>/dev/null` in
+ *posix*) set -o posix ;;
esac
+
fi
-as_nl='
-'
-export as_nl
-# Printing a long string crashes Solaris 7 /usr/bin/printf.
-as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
-# Prefer a ksh shell builtin over an external printf program on Solaris,
-# but without wasting forks for bash or zsh.
-if test -z "$BASH_VERSION$ZSH_VERSION" \
- && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
- as_echo='print -r --'
- as_echo_n='print -rn --'
-elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
- as_echo='printf %s\n'
- as_echo_n='printf %s'
-else
- if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
- as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
- as_echo_n='/usr/ucb/echo -n'
+
+
+# PATH needs CR
+# Avoid depending upon Character Ranges.
+as_cr_letters='abcdefghijklmnopqrstuvwxyz'
+as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+as_cr_Letters=$as_cr_letters$as_cr_LETTERS
+as_cr_digits='0123456789'
+as_cr_alnum=$as_cr_Letters$as_cr_digits
+
+# The user is always right.
+if test "${PATH_SEPARATOR+set}" != set; then
+ echo "#! /bin/sh" >conf$$.sh
+ echo "exit 0" >>conf$$.sh
+ chmod +x conf$$.sh
+ if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then
+ PATH_SEPARATOR=';'
else
- as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
- as_echo_n_body='eval
- arg=$1;
- case $arg in #(
- *"$as_nl"*)
- expr "X$arg" : "X\\(.*\\)$as_nl";
- arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
- esac;
- expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
- '
- export as_echo_n_body
- as_echo_n='sh -c $as_echo_n_body as_echo'
+ PATH_SEPARATOR=:
fi
- export as_echo_body
- as_echo='sh -c $as_echo_body as_echo'
+ rm -f conf$$.sh
fi
-# The user is always right.
-if test "${PATH_SEPARATOR+set}" != set; then
- PATH_SEPARATOR=:
- (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
- (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
- PATH_SEPARATOR=';'
- }
+# Support unset when possible.
+if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then
+ as_unset=unset
+else
+ as_unset=false
fi
@@ -18575,11 +36452,12 @@
# there to prevent editors from complaining about space-tab.
# (If _AS_PATH_WALK were called with IFS unset, it would disable word
# splitting by setting IFS to empty value.)
+as_nl='
+'
IFS=" "" $as_nl"
# Find who we are. Look in the path if we contain no directory separator.
-as_myself=
-case $0 in #((
+case $0 in
*[\\/]* ) as_myself=$0 ;;
*) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
for as_dir in $PATH
@@ -18586,8 +36464,8 @@
do
IFS=$as_save_IFS
test -z "$as_dir" && as_dir=.
- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
- done
+ test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+done
IFS=$as_save_IFS
;;
@@ -18598,17 +36476,13 @@
as_myself=$0
fi
if test ! -f "$as_myself"; then
- $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
- exit 1
+ echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+ { (exit 1); exit 1; }
fi
-# Unset variables that we do not need and which cause bugs (e.g. in
-# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1"
-# suppresses any "Segmentation fault" message there. '((' could
-# trigger a bug in pdksh 5.2.14.
-for as_var in BASH_ENV ENV MAIL MAILPATH
-do eval test x\${$as_var+set} = xset \
- && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+# Work around bugs in pre-3.0 UWIN ksh.
+for as_var in ENV MAIL MAILPATH
+do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
done
PS1='$ '
PS2='> '
@@ -18615,94 +36489,19 @@
PS4='+ '
# NLS nuisances.
-LC_ALL=C
-export LC_ALL
-LANGUAGE=C
-export LANGUAGE
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
-
-
-# as_fn_error STATUS ERROR [LINENO LOG_FD]
-# ----------------------------------------
-# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
-# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
-# script with STATUS, using 1 if that was 0.
-as_fn_error ()
-{
- as_status=$1; test $as_status -eq 0 && as_status=1
- if test "$4"; then
- as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
+for as_var in \
+ LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \
+ LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \
+ LC_TELEPHONE LC_TIME
+do
+ if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then
+ eval $as_var=C; export $as_var
+ else
+ ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
fi
- $as_echo "$as_me: error: $2" >&2
- as_fn_exit $as_status
-} # as_fn_error
+done
-
-# as_fn_set_status STATUS
-# -----------------------
-# Set $? to STATUS, without forking.
-as_fn_set_status ()
-{
- return $1
-} # as_fn_set_status
-
-# as_fn_exit STATUS
-# -----------------
-# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
-as_fn_exit ()
-{
- set +e
- as_fn_set_status $1
- exit $1
-} # as_fn_exit
-
-# as_fn_unset VAR
-# ---------------
-# Portably unset VAR.
-as_fn_unset ()
-{
- { eval $1=; unset $1;}
-}
-as_unset=as_fn_unset
-# as_fn_append VAR VALUE
-# ----------------------
-# Append the text in VALUE to the end of the definition contained in VAR. Take
-# advantage of any shell optimizations that allow amortized linear growth over
-# repeated appends, instead of the typical quadratic growth present in naive
-# implementations.
-if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
- eval 'as_fn_append ()
- {
- eval $1+=\$2
- }'
-else
- as_fn_append ()
- {
- eval $1=\$$1\$2
- }
-fi # as_fn_append
-
-# as_fn_arith ARG...
-# ------------------
-# Perform arithmetic evaluation on the ARGs, and store the result in the
-# global $as_val. Take advantage of shells that can avoid forks. The arguments
-# must be portable across $(()) and expr.
-if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
- eval 'as_fn_arith ()
- {
- as_val=$(( $* ))
- }'
-else
- as_fn_arith ()
- {
- as_val=`expr "$@" || test $? -eq 1`
- }
-fi # as_fn_arith
-
-
+# Required to use basename.
if expr a : '\(a\)' >/dev/null 2>&1 &&
test "X`expr 00001 : '.*\(...\)'`" = X001; then
as_expr=expr
@@ -18716,17 +36515,13 @@
as_basename=false
fi
-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
- as_dirname=dirname
-else
- as_dirname=false
-fi
+# Name of the executable.
as_me=`$as_basename -- "$0" ||
$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
X"$0" : 'X\(//\)$' \| \
X"$0" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X/"$0" |
+echo X/"$0" |
sed '/^.*\/\([^/][^/]*\)\/*$/{
s//\1/
q
@@ -18741,47 +36536,96 @@
}
s/.*/./; q'`
-# Avoid depending upon Character Ranges.
-as_cr_letters='abcdefghijklmnopqrstuvwxyz'
-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
-as_cr_Letters=$as_cr_letters$as_cr_LETTERS
-as_cr_digits='0123456789'
-as_cr_alnum=$as_cr_Letters$as_cr_digits
+# CDPATH.
+$as_unset CDPATH
+
+
+ as_lineno_1=$LINENO
+ as_lineno_2=$LINENO
+ test "x$as_lineno_1" != "x$as_lineno_2" &&
+ test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || {
+
+ # Create $as_me.lineno as a copy of $as_myself, but with $LINENO
+ # uniformly replaced by the line number. The first 'sed' inserts a
+ # line-number line after each line using $LINENO; the second 'sed'
+ # does the real work. The second script uses 'N' to pair each
+ # line-number line with the line containing $LINENO, and appends
+ # trailing '-' during substitution so that $LINENO is not a special
+ # case at line end.
+ # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the
+ # scripts with optimization help from Paolo Bonzini. Blame Lee
+ # E. McMahon (1931-1989) for sed's syntax. :-)
+ sed -n '
+ p
+ /[$]LINENO/=
+ ' <$as_myself |
+ sed '
+ s/[$]LINENO.*/&-/
+ t lineno
+ b
+ :lineno
+ N
+ :loop
+ s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/
+ t loop
+ s/-\n.*//
+ ' >$as_me.lineno &&
+ chmod +x "$as_me.lineno" ||
+ { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2
+ { (exit 1); exit 1; }; }
+
+ # Don't try to exec as it changes $[0], causing all sort of problems
+ # (the dirname of $[0] is not the place where we might find the
+ # original and so on. Autoconf is especially sensitive to this).
+ . "./$as_me.lineno"
+ # Exit status is that of the last command.
+ exit
+}
+
+
+if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
+ as_dirname=dirname
+else
+ as_dirname=false
+fi
+
ECHO_C= ECHO_N= ECHO_T=
-case `echo -n x` in #(((((
+case `echo -n x` in
-n*)
- case `echo 'xy\c'` in
+ case `echo 'x\c'` in
*c*) ECHO_T=' ';; # ECHO_T is single tab character.
- xy) ECHO_C='\c';;
- *) echo `echo ksh88 bug on AIX 6.1` > /dev/null
- ECHO_T=' ';;
+ *) ECHO_C='\c';;
esac;;
*)
ECHO_N='-n';;
esac
+if expr a : '\(a\)' >/dev/null 2>&1 &&
+ test "X`expr 00001 : '.*\(...\)'`" = X001; then
+ as_expr=expr
+else
+ as_expr=false
+fi
+
rm -f conf$$ conf$$.exe conf$$.file
if test -d conf$$.dir; then
rm -f conf$$.dir/conf$$.file
else
rm -f conf$$.dir
- mkdir conf$$.dir 2>/dev/null
+ mkdir conf$$.dir
fi
-if (echo >conf$$.file) 2>/dev/null; then
- if ln -s conf$$.file conf$$ 2>/dev/null; then
- as_ln_s='ln -s'
- # ... but there are two gotchas:
- # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
- # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
- # In both cases, we have to default to `cp -pR'.
- ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
- as_ln_s='cp -pR'
- elif ln conf$$.file conf$$ 2>/dev/null; then
- as_ln_s=ln
- else
+echo >conf$$.file
+if ln -s conf$$.file conf$$ 2>/dev/null; then
+ as_ln_s='ln -s'
+ # ... but there are two gotchas:
+ # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
+ # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
+ # In both cases, we have to default to `cp -p'.
+ ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
as_ln_s='cp -pR'
- fi
+elif ln conf$$.file conf$$ 2>/dev/null; then
+ as_ln_s=ln
else
as_ln_s='cp -pR'
fi
@@ -18788,61 +36632,35 @@
rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file
rmdir conf$$.dir 2>/dev/null
-
-# as_fn_mkdir_p
-# -------------
-# Create "$as_dir" as a directory, including parents if necessary.
-as_fn_mkdir_p ()
-{
-
- case $as_dir in #(
- -*) as_dir=./$as_dir;;
- esac
- test -d "$as_dir" || eval $as_mkdir_p || {
- as_dirs=
- while :; do
- case $as_dir in #(
- *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
- *) as_qdir=$as_dir;;
- esac
- as_dirs="'$as_qdir' $as_dirs"
- as_dir=`$as_dirname -- "$as_dir" ||
-$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
- X"$as_dir" : 'X\(//\)[^/]' \| \
- X"$as_dir" : 'X\(//\)$' \| \
- X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$as_dir" |
- sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
- s//\1/
- q
- }
- /^X\(\/\/\)[^/].*/{
- s//\1/
- q
- }
- /^X\(\/\/\)$/{
- s//\1/
- q
- }
- /^X\(\/\).*/{
- s//\1/
- q
- }
- s/.*/./; q'`
- test -d "$as_dir" && break
- done
- test -z "$as_dirs" || eval "mkdir $as_dirs"
- } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir"
-
-
-} # as_fn_mkdir_p
if mkdir -p . 2>/dev/null; then
- as_mkdir_p='mkdir -p "$as_dir"'
+ as_mkdir_p=:
else
test -d ./-p && rmdir ./-p
as_mkdir_p=false
fi
+if test -x / >/dev/null 2>&1; then
+ as_test_x='test -x'
+else
+ if ls -dL / >/dev/null 2>&1; then
+ as_ls_L_option=L
+ else
+ as_ls_L_option=
+ fi
+ as_test_x='
+ eval sh -c '\''
+ if test -d "$1"; then
+ test -d "$1/.";
+ else
+ case $1 in
+ -*)set "./$1";;
+ esac;
+ case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in
+ ???[sx]*):;;*)false;;esac;fi
+ '\'' sh
+ '
+fi
+as_executable_p=$as_test_x
# as_fn_executable_p FILE
# -----------------------
@@ -18862,19 +36680,13 @@
exec 6>&1
-## ----------------------------------- ##
-## Main body of $CONFIG_STATUS script. ##
-## ----------------------------------- ##
-_ASEOF
-test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
-# Save the log message, to keep $0 and so on meaningful, and to
+# Save the log message, to keep $[0] and so on meaningful, and to
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by OpenSSH $as_me Portable, which was
-generated by GNU Autoconf 2.69. Invocation command line was
+generated by GNU Autoconf 2.61. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
CONFIG_HEADERS = $CONFIG_HEADERS
@@ -18887,16 +36699,7 @@
_ACEOF
-case $ac_config_files in *"
-"*) set x $ac_config_files; shift; ac_config_files=$*;;
-esac
-
-case $ac_config_headers in *"
-"*) set x $ac_config_headers; shift; ac_config_headers=$*;;
-esac
-
-
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<_ACEOF
# Files that config.status was made for.
config_files="$ac_config_files"
config_headers="$ac_config_headers"
@@ -18903,25 +36706,22 @@
_ACEOF
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<\_ACEOF
ac_cs_usage="\
-\`$as_me' instantiates files and other configuration actions
-from templates according to the current configuration. Unless the files
-and actions are specified as TAGs, all are instantiated by default.
+\`$as_me' instantiates files from templates according to the
+current configuration.
-Usage: $0 [OPTION]... [TAG]...
+Usage: $0 [OPTIONS] [FILE]...
-h, --help print this help, then exit
-V, --version print version number and configuration settings, then exit
- --config print configuration, then exit
- -q, --quiet, --silent
- do not print progress messages
+ -q, --quiet do not print progress messages
-d, --debug don't remove temporary files
--recheck update $as_me by reconfiguring in the same conditions
- --file=FILE[:TEMPLATE]
- instantiate the configuration file FILE
- --header=FILE[:TEMPLATE]
- instantiate the configuration header FILE
+ --file=FILE[:TEMPLATE]
+ instantiate the configuration file FILE
+ --header=FILE[:TEMPLATE]
+ instantiate the configuration header FILE
Configuration files:
$config_files
@@ -18929,17 +36729,16 @@
Configuration headers:
$config_headers
-Report bugs to <openssh-unix-dev at mindrot.org>."
+Report bugs to <bug-autoconf at gnu.org>."
_ACEOF
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
-ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+cat >>$CONFIG_STATUS <<_ACEOF
ac_cs_version="\\
OpenSSH config.status Portable
-configured by $0, generated by GNU Autoconf 2.69,
- with options \\"\$ac_cs_config\\"
+configured by $0, generated by GNU Autoconf 2.61,
+ with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
-Copyright (C) 2012 Free Software Foundation, Inc.
+Copyright (C) 2006 Free Software Foundation, Inc.
This config.status script is free software; the Free Software Foundation
gives unlimited permission to copy, distribute and modify it."
@@ -18946,26 +36745,20 @@
ac_pwd='$ac_pwd'
srcdir='$srcdir'
INSTALL='$INSTALL'
-AWK='$AWK'
-test -n "\$AWK" || AWK=awk
_ACEOF
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
-# The default lists apply if the user does not specify any file.
+cat >>$CONFIG_STATUS <<\_ACEOF
+# If no file are specified by the user, then we need to provide default
+# value. By we need to know if files were specified by the user.
ac_need_defaults=:
while test $# != 0
do
case $1 in
- --*=?*)
+ --*=*)
ac_option=`expr "X$1" : 'X\([^=]*\)='`
ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'`
ac_shift=:
;;
- --*=)
- ac_option=`expr "X$1" : 'X\([^=]*\)='`
- ac_optarg=
- ac_shift=:
- ;;
*)
ac_option=$1
ac_optarg=$2
@@ -18978,41 +36771,34 @@
-recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r)
ac_cs_recheck=: ;;
--version | --versio | --versi | --vers | --ver | --ve | --v | -V )
- $as_echo "$ac_cs_version"; exit ;;
- --config | --confi | --conf | --con | --co | --c )
- $as_echo "$ac_cs_config"; exit ;;
+ echo "$ac_cs_version"; exit ;;
--debug | --debu | --deb | --de | --d | -d )
debug=: ;;
--file | --fil | --fi | --f )
$ac_shift
- case $ac_optarg in
- *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
- '') as_fn_error $? "missing file argument" ;;
- esac
- as_fn_append CONFIG_FILES " '$ac_optarg'"
+ CONFIG_FILES="$CONFIG_FILES $ac_optarg"
ac_need_defaults=false;;
--header | --heade | --head | --hea )
$ac_shift
- case $ac_optarg in
- *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
- esac
- as_fn_append CONFIG_HEADERS " '$ac_optarg'"
+ CONFIG_HEADERS="$CONFIG_HEADERS $ac_optarg"
ac_need_defaults=false;;
--he | --h)
# Conflict between --help and --header
- as_fn_error $? "ambiguous option: \`$1'
-Try \`$0 --help' for more information.";;
+ { echo "$as_me: error: ambiguous option: $1
+Try \`$0 --help' for more information." >&2
+ { (exit 1); exit 1; }; };;
--help | --hel | -h )
- $as_echo "$ac_cs_usage"; exit ;;
+ echo "$ac_cs_usage"; exit ;;
-q | -quiet | --quiet | --quie | --qui | --qu | --q \
| -silent | --silent | --silen | --sile | --sil | --si | --s)
ac_cs_silent=: ;;
# This is an error.
- -*) as_fn_error $? "unrecognized option: \`$1'
-Try \`$0 --help' for more information." ;;
+ -*) { echo "$as_me: error: unrecognized option: $1
+Try \`$0 --help' for more information." >&2
+ { (exit 1); exit 1; }; } ;;
- *) as_fn_append ac_config_targets " $1"
+ *) ac_config_targets="$ac_config_targets $1"
ac_need_defaults=false ;;
esac
@@ -19027,18 +36813,16 @@
fi
_ACEOF
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<_ACEOF
if \$ac_cs_recheck; then
- set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion
- shift
- \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6
- CONFIG_SHELL='$SHELL'
+ echo "running CONFIG_SHELL=$SHELL $SHELL $0 "$ac_configure_args \$ac_configure_extra_args " --no-create --no-recursion" >&6
+ CONFIG_SHELL=$SHELL
export CONFIG_SHELL
- exec "\$@"
+ exec $SHELL "$0"$ac_configure_args \$ac_configure_extra_args --no-create --no-recursion
fi
_ACEOF
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<\_ACEOF
exec 5>>config.log
{
echo
@@ -19045,14 +36829,14 @@
sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX
## Running $as_me. ##
_ASBOX
- $as_echo "$ac_log"
+ echo "$ac_log"
} >&5
_ACEOF
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<_ACEOF
_ACEOF
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<\_ACEOF
# Handling of arguments.
for ac_config_target in $ac_config_targets
@@ -19067,7 +36851,9 @@
"openbsd-compat/regress/Makefile") CONFIG_FILES="$CONFIG_FILES openbsd-compat/regress/Makefile" ;;
"survey.sh") CONFIG_FILES="$CONFIG_FILES survey.sh" ;;
- *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
+ *) { { echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5
+echo "$as_me: error: invalid argument: $ac_config_target" >&2;}
+ { (exit 1); exit 1; }; };;
esac
done
@@ -19089,295 +36875,247 @@
# after its creation but before its name has been assigned to `$tmp'.
$debug ||
{
- tmp= ac_tmp=
+ tmp=
trap 'exit_status=$?
- : "${ac_tmp:=$tmp}"
- { test ! -d "$ac_tmp" || rm -fr "$ac_tmp"; } && exit $exit_status
+ { test -z "$tmp" || test ! -d "$tmp" || rm -fr "$tmp"; } && exit $exit_status
' 0
- trap 'as_fn_exit 1' 1 2 13 15
+ trap '{ (exit 1); exit 1; }' 1 2 13 15
}
# Create a (secure) tmp directory for tmp files.
{
tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` &&
- test -d "$tmp"
+ test -n "$tmp" && test -d "$tmp"
} ||
{
tmp=./conf$$-$RANDOM
(umask 077 && mkdir "$tmp")
-} || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5
-ac_tmp=$tmp
+} ||
+{
+ echo "$me: cannot create a temporary directory in ." >&2
+ { (exit 1); exit 1; }
+}
-# Set up the scripts for CONFIG_FILES section.
-# No need to generate them if there are no CONFIG_FILES.
-# This happens for instance with `./config.status config.h'.
+#
+# Set up the sed scripts for CONFIG_FILES section.
+#
+
+# No need to generate the scripts if there are no CONFIG_FILES.
+# This happens for instance when ./config.status config.h
if test -n "$CONFIG_FILES"; then
+_ACEOF
-ac_cr=`echo X | tr X '\015'`
-# On cygwin, bash can eat \r inside `` if the user requested igncr.
-# But we know of no other shell where ac_cr would be empty at this
-# point, so we can use a bashism as a fallback.
-if test "x$ac_cr" = x; then
- eval ac_cr=\$\'\\r\'
+
+
+ac_delim='%!_!# '
+for ac_last_try in false false false false false :; do
+ cat >conf$$subs.sed <<_ACEOF
+SHELL!$SHELL$ac_delim
+PATH_SEPARATOR!$PATH_SEPARATOR$ac_delim
+PACKAGE_NAME!$PACKAGE_NAME$ac_delim
+PACKAGE_TARNAME!$PACKAGE_TARNAME$ac_delim
+PACKAGE_VERSION!$PACKAGE_VERSION$ac_delim
+PACKAGE_STRING!$PACKAGE_STRING$ac_delim
+PACKAGE_BUGREPORT!$PACKAGE_BUGREPORT$ac_delim
+exec_prefix!$exec_prefix$ac_delim
+prefix!$prefix$ac_delim
+program_transform_name!$program_transform_name$ac_delim
+bindir!$bindir$ac_delim
+sbindir!$sbindir$ac_delim
+libexecdir!$libexecdir$ac_delim
+datarootdir!$datarootdir$ac_delim
+datadir!$datadir$ac_delim
+sysconfdir!$sysconfdir$ac_delim
+sharedstatedir!$sharedstatedir$ac_delim
+localstatedir!$localstatedir$ac_delim
+includedir!$includedir$ac_delim
+oldincludedir!$oldincludedir$ac_delim
+docdir!$docdir$ac_delim
+infodir!$infodir$ac_delim
+htmldir!$htmldir$ac_delim
+dvidir!$dvidir$ac_delim
+pdfdir!$pdfdir$ac_delim
+psdir!$psdir$ac_delim
+libdir!$libdir$ac_delim
+localedir!$localedir$ac_delim
+mandir!$mandir$ac_delim
+DEFS!$DEFS$ac_delim
+ECHO_C!$ECHO_C$ac_delim
+ECHO_N!$ECHO_N$ac_delim
+ECHO_T!$ECHO_T$ac_delim
+LIBS!$LIBS$ac_delim
+build_alias!$build_alias$ac_delim
+host_alias!$host_alias$ac_delim
+target_alias!$target_alias$ac_delim
+CC!$CC$ac_delim
+CFLAGS!$CFLAGS$ac_delim
+LDFLAGS!$LDFLAGS$ac_delim
+CPPFLAGS!$CPPFLAGS$ac_delim
+ac_ct_CC!$ac_ct_CC$ac_delim
+EXEEXT!$EXEEXT$ac_delim
+OBJEXT!$OBJEXT$ac_delim
+build!$build$ac_delim
+build_cpu!$build_cpu$ac_delim
+build_vendor!$build_vendor$ac_delim
+build_os!$build_os$ac_delim
+host!$host$ac_delim
+host_cpu!$host_cpu$ac_delim
+host_vendor!$host_vendor$ac_delim
+host_os!$host_os$ac_delim
+CPP!$CPP$ac_delim
+GREP!$GREP$ac_delim
+EGREP!$EGREP$ac_delim
+AWK!$AWK$ac_delim
+RANLIB!$RANLIB$ac_delim
+INSTALL_PROGRAM!$INSTALL_PROGRAM$ac_delim
+INSTALL_SCRIPT!$INSTALL_SCRIPT$ac_delim
+INSTALL_DATA!$INSTALL_DATA$ac_delim
+AR!$AR$ac_delim
+ac_ct_AR!$ac_ct_AR$ac_delim
+CAT!$CAT$ac_delim
+KILL!$KILL$ac_delim
+PERL!$PERL$ac_delim
+SED!$SED$ac_delim
+ENT!$ENT$ac_delim
+TEST_MINUS_S_SH!$TEST_MINUS_S_SH$ac_delim
+SH!$SH$ac_delim
+GROFF!$GROFF$ac_delim
+NROFF!$NROFF$ac_delim
+MANDOC!$MANDOC$ac_delim
+TEST_SHELL!$TEST_SHELL$ac_delim
+MANFMT!$MANFMT$ac_delim
+PATH_GROUPADD_PROG!$PATH_GROUPADD_PROG$ac_delim
+PATH_USERADD_PROG!$PATH_USERADD_PROG$ac_delim
+MAKE_PACKAGE_SUPPORTED!$MAKE_PACKAGE_SUPPORTED$ac_delim
+STARTUP_SCRIPT_SHELL!$STARTUP_SCRIPT_SHELL$ac_delim
+LOGIN_PROGRAM_FALLBACK!$LOGIN_PROGRAM_FALLBACK$ac_delim
+PATH_PASSWD_PROG!$PATH_PASSWD_PROG$ac_delim
+LD!$LD$ac_delim
+PKGCONFIG!$PKGCONFIG$ac_delim
+LIBEDIT!$LIBEDIT$ac_delim
+TEST_SSH_ECC!$TEST_SSH_ECC$ac_delim
+COMMENT_OUT_ECC!$COMMENT_OUT_ECC$ac_delim
+SSH_PRIVSEP_USER!$SSH_PRIVSEP_USER$ac_delim
+SSHLIBS!$SSHLIBS$ac_delim
+SSHDLIBS!$SSHDLIBS$ac_delim
+KRB5CONF!$KRB5CONF$ac_delim
+GSSLIBS!$GSSLIBS$ac_delim
+K5LIBS!$K5LIBS$ac_delim
+PRIVSEP_PATH!$PRIVSEP_PATH$ac_delim
+xauth_path!$xauth_path$ac_delim
+STRIP_OPT!$STRIP_OPT$ac_delim
+XAUTH_PATH!$XAUTH_PATH$ac_delim
+MANTYPE!$MANTYPE$ac_delim
+mansubdir!$mansubdir$ac_delim
+_ACEOF
+
+ if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 97; then
+ break
+ elif $ac_last_try; then
+ { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
+echo "$as_me: error: could not make $CONFIG_STATUS" >&2;}
+ { (exit 1); exit 1; }; }
+ else
+ ac_delim="$ac_delim!$ac_delim _$ac_delim!! "
+ fi
+done
+
+ac_eof=`sed -n '/^CEOF[0-9]*$/s/CEOF/0/p' conf$$subs.sed`
+if test -n "$ac_eof"; then
+ ac_eof=`echo "$ac_eof" | sort -nru | sed 1q`
+ ac_eof=`expr $ac_eof + 1`
fi
-ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' </dev/null 2>/dev/null`
-if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then
- ac_cs_awk_cr='\\r'
-else
- ac_cs_awk_cr=$ac_cr
-fi
-echo 'BEGIN {' >"$ac_tmp/subs1.awk" &&
+cat >>$CONFIG_STATUS <<_ACEOF
+cat >"\$tmp/subs-1.sed" <<\CEOF$ac_eof
+/@[a-zA-Z_][a-zA-Z_0-9]*@/!b
_ACEOF
+sed '
+s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g
+s/^/s,@/; s/!/@,|#_!!_#|/
+:n
+t n
+s/'"$ac_delim"'$/,g/; t
+s/$/\\/; p
+N; s/^.*\n//; s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g; b n
+' >>$CONFIG_STATUS <conf$$subs.sed
+rm -f conf$$subs.sed
+cat >>$CONFIG_STATUS <<_ACEOF
+CEOF$ac_eof
+_ACEOF
-{
- echo "cat >conf$$subs.awk <<_ACEOF" &&
- echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' &&
- echo "_ACEOF"
-} >conf$$subs.sh ||
- as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
-ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'`
ac_delim='%!_!# '
for ac_last_try in false false false false false :; do
- . ./conf$$subs.sh ||
- as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
+ cat >conf$$subs.sed <<_ACEOF
+user_path!$user_path$ac_delim
+piddir!$piddir$ac_delim
+TEST_SSH_IPV6!$TEST_SSH_IPV6$ac_delim
+TEST_MALLOC_OPTIONS!$TEST_MALLOC_OPTIONS$ac_delim
+UNSUPPORTED_ALGORITHMS!$UNSUPPORTED_ALGORITHMS$ac_delim
+LIBOBJS!$LIBOBJS$ac_delim
+LTLIBOBJS!$LTLIBOBJS$ac_delim
+_ACEOF
- ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X`
- if test $ac_delim_n = $ac_delim_num; then
+ if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 7; then
break
elif $ac_last_try; then
- as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
+ { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
+echo "$as_me: error: could not make $CONFIG_STATUS" >&2;}
+ { (exit 1); exit 1; }; }
else
ac_delim="$ac_delim!$ac_delim _$ac_delim!! "
fi
done
-rm -f conf$$subs.sh
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
-cat >>"\$ac_tmp/subs1.awk" <<\\_ACAWK &&
-_ACEOF
-sed -n '
-h
-s/^/S["/; s/!.*/"]=/
-p
-g
-s/^[^!]*!//
-:repl
-t repl
-s/'"$ac_delim"'$//
-t delim
-:nl
-h
-s/\(.\{148\}\)..*/\1/
-t more1
-s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/
-p
-n
-b repl
-:more1
-s/["\\]/\\&/g; s/^/"/; s/$/"\\/
-p
-g
-s/.\{148\}//
-t nl
-:delim
-h
-s/\(.\{148\}\)..*/\1/
-t more2
-s/["\\]/\\&/g; s/^/"/; s/$/"/
-p
-b
-:more2
-s/["\\]/\\&/g; s/^/"/; s/$/"\\/
-p
-g
-s/.\{148\}//
-t delim
-' <conf$$subs.awk | sed '
-/^[^""]/{
- N
- s/\n//
-}
-' >>$CONFIG_STATUS || ac_write_fail=1
-rm -f conf$$subs.awk
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
-_ACAWK
-cat >>"\$ac_tmp/subs1.awk" <<_ACAWK &&
- for (key in S) S_is_set[key] = 1
- FS = ""
+ac_eof=`sed -n '/^CEOF[0-9]*$/s/CEOF/0/p' conf$$subs.sed`
+if test -n "$ac_eof"; then
+ ac_eof=`echo "$ac_eof" | sort -nru | sed 1q`
+ ac_eof=`expr $ac_eof + 1`
+fi
-}
-{
- line = $ 0
- nfields = split(line, field, "@")
- substed = 0
- len = length(field[1])
- for (i = 2; i < nfields; i++) {
- key = field[i]
- keylen = length(key)
- if (S_is_set[key]) {
- value = S[key]
- line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3)
- len += length(value) + length(field[++i])
- substed = 1
- } else
- len += 1 + keylen
- }
-
- print line
-}
-
-_ACAWK
+cat >>$CONFIG_STATUS <<_ACEOF
+cat >"\$tmp/subs-2.sed" <<\CEOF$ac_eof
+/@[a-zA-Z_][a-zA-Z_0-9]*@/!b end
_ACEOF
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
-if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then
- sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g"
-else
- cat
-fi < "$ac_tmp/subs1.awk" > "$ac_tmp/subs.awk" \
- || as_fn_error $? "could not setup config files machinery" "$LINENO" 5
+sed '
+s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g
+s/^/s,@/; s/!/@,|#_!!_#|/
+:n
+t n
+s/'"$ac_delim"'$/,g/; t
+s/$/\\/; p
+N; s/^.*\n//; s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g; b n
+' >>$CONFIG_STATUS <conf$$subs.sed
+rm -f conf$$subs.sed
+cat >>$CONFIG_STATUS <<_ACEOF
+:end
+s/|#_!!_#|//g
+CEOF$ac_eof
_ACEOF
-# VPATH may cause trouble with some makes, so we remove sole $(srcdir),
-# ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and
+
+# VPATH may cause trouble with some makes, so we remove $(srcdir),
+# ${srcdir} and @srcdir@ from VPATH if srcdir is ".", strip leading and
# trailing colons and then remove the whole line if VPATH becomes empty
# (actually we leave an empty line to preserve line numbers).
if test "x$srcdir" = x.; then
- ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{
-h
-s///
-s/^/:/
-s/[ ]*$/:/
-s/:\$(srcdir):/:/g
-s/:\${srcdir}:/:/g
-s/:@srcdir@:/:/g
-s/^:*//
+ ac_vpsub='/^[ ]*VPATH[ ]*=/{
+s/:*\$(srcdir):*/:/
+s/:*\${srcdir}:*/:/
+s/:*@srcdir@:*/:/
+s/^\([^=]*=[ ]*\):*/\1/
s/:*$//
-x
-s/\(=[ ]*\).*/\1/
-G
-s/\n//
s/^[^=]*=[ ]*$//
}'
fi
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<\_ACEOF
fi # test -n "$CONFIG_FILES"
-# Set up the scripts for CONFIG_HEADERS section.
-# No need to generate them if there are no CONFIG_HEADERS.
-# This happens for instance with `./config.status Makefile'.
-if test -n "$CONFIG_HEADERS"; then
-cat >"$ac_tmp/defines.awk" <<\_ACAWK ||
-BEGIN {
-_ACEOF
-# Transform confdefs.h into an awk script `defines.awk', embedded as
-# here-document in config.status, that substitutes the proper values into
-# config.h.in to produce config.h.
-
-# Create a delimiter string that does not exist in confdefs.h, to ease
-# handling of long lines.
-ac_delim='%!_!# '
-for ac_last_try in false false :; do
- ac_tt=`sed -n "/$ac_delim/p" confdefs.h`
- if test -z "$ac_tt"; then
- break
- elif $ac_last_try; then
- as_fn_error $? "could not make $CONFIG_HEADERS" "$LINENO" 5
- else
- ac_delim="$ac_delim!$ac_delim _$ac_delim!! "
- fi
-done
-
-# For the awk script, D is an array of macro values keyed by name,
-# likewise P contains macro parameters if any. Preserve backslash
-# newline sequences.
-
-ac_word_re=[_$as_cr_Letters][_$as_cr_alnum]*
-sed -n '
-s/.\{148\}/&'"$ac_delim"'/g
-t rset
-:rset
-s/^[ ]*#[ ]*define[ ][ ]*/ /
-t def
-d
-:def
-s/\\$//
-t bsnl
-s/["\\]/\\&/g
-s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\
-D["\1"]=" \3"/p
-s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2"/p
-d
-:bsnl
-s/["\\]/\\&/g
-s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\
-D["\1"]=" \3\\\\\\n"\\/p
-t cont
-s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2\\\\\\n"\\/p
-t cont
-d
-:cont
-n
-s/.\{148\}/&'"$ac_delim"'/g
-t clear
-:clear
-s/\\$//
-t bsnlc
-s/["\\]/\\&/g; s/^/"/; s/$/"/p
-d
-:bsnlc
-s/["\\]/\\&/g; s/^/"/; s/$/\\\\\\n"\\/p
-b cont
-' <confdefs.h | sed '
-s/'"$ac_delim"'/"\\\
-"/g' >>$CONFIG_STATUS || ac_write_fail=1
-
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
- for (key in D) D_is_set[key] = 1
- FS = ""
-}
-/^[\t ]*#[\t ]*(define|undef)[\t ]+$ac_word_re([\t (]|\$)/ {
- line = \$ 0
- split(line, arg, " ")
- if (arg[1] == "#") {
- defundef = arg[2]
- mac1 = arg[3]
- } else {
- defundef = substr(arg[1], 2)
- mac1 = arg[2]
- }
- split(mac1, mac2, "(") #)
- macro = mac2[1]
- prefix = substr(line, 1, index(line, defundef) - 1)
- if (D_is_set[macro]) {
- # Preserve the white space surrounding the "#".
- print prefix "define", macro P[macro] D[macro]
- next
- } else {
- # Replace #undef with comments. This is necessary, for example,
- # in the case of _POSIX_SOURCE, which is predefined and required
- # on some systems where configure will not decide to define it.
- if (defundef == "undef") {
- print "/*", prefix defundef, macro, "*/"
- next
- }
- }
-}
-{ print }
-_ACAWK
-_ACEOF
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
- as_fn_error $? "could not setup config headers machinery" "$LINENO" 5
-fi # test -n "$CONFIG_HEADERS"
-
-
-eval set X " :F $CONFIG_FILES :H $CONFIG_HEADERS "
-shift
-for ac_tag
+for ac_tag in :F $CONFIG_FILES :H $CONFIG_HEADERS
do
case $ac_tag in
:[FHLC]) ac_mode=$ac_tag; continue;;
@@ -19384,7 +37122,9 @@
esac
case $ac_mode$ac_tag in
:[FHL]*:*);;
- :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5;;
+ :L* | :C*:*) { { echo "$as_me:$LINENO: error: Invalid tag $ac_tag." >&5
+echo "$as_me: error: Invalid tag $ac_tag." >&2;}
+ { (exit 1); exit 1; }; };;
:[FH]-) ac_tag=-:-;;
:[FH]*) ac_tag=$ac_tag:$ac_tag.in;;
esac
@@ -19403,7 +37143,7 @@
for ac_f
do
case $ac_f in
- -) ac_f="$ac_tmp/stdin";;
+ -) ac_f="$tmp/stdin";;
*) # Look for the file first in the build tree, then in the source tree
# (if the path is not absolute). The absolute path cannot be DOS-style,
# because $ac_f cannot contain `:'.
@@ -19412,34 +37152,26 @@
[\\/$]*) false;;
*) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";;
esac ||
- as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;;
+ { { echo "$as_me:$LINENO: error: cannot find input file: $ac_f" >&5
+echo "$as_me: error: cannot find input file: $ac_f" >&2;}
+ { (exit 1); exit 1; }; };;
esac
- case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac
- as_fn_append ac_file_inputs " '$ac_f'"
+ ac_file_inputs="$ac_file_inputs $ac_f"
done
# Let's still pretend it is `configure' which instantiates (i.e., don't
# use $as_me), people would be surprised to read:
# /* config.h. Generated by config.status. */
- configure_input='Generated from '`
- $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g'
- `' by configure.'
+ configure_input="Generated from "`IFS=:
+ echo $* | sed 's|^[^:]*/||;s|:[^:]*/|, |g'`" by configure."
if test x"$ac_file" != x-; then
configure_input="$ac_file. $configure_input"
- { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5
-$as_echo "$as_me: creating $ac_file" >&6;}
+ { echo "$as_me:$LINENO: creating $ac_file" >&5
+echo "$as_me: creating $ac_file" >&6;}
fi
- # Neutralize special characters interpreted by sed in replacement strings.
- case $configure_input in #(
- *\&* | *\|* | *\\* )
- ac_sed_conf_input=`$as_echo "$configure_input" |
- sed 's/[\\\\&|]/\\\\&/g'`;; #(
- *) ac_sed_conf_input=$configure_input;;
- esac
case $ac_tag in
- *:-:* | *:-) cat >"$ac_tmp/stdin" \
- || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;;
+ *:-:* | *:-) cat >"$tmp/stdin";;
esac
;;
esac
@@ -19449,7 +37181,7 @@
X"$ac_file" : 'X\(//\)[^/]' \| \
X"$ac_file" : 'X\(//\)$' \| \
X"$ac_file" : 'X\(/\)' \| . 2>/dev/null ||
-$as_echo X"$ac_file" |
+echo X"$ac_file" |
sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
s//\1/
q
@@ -19467,15 +37199,55 @@
q
}
s/.*/./; q'`
- as_dir="$ac_dir"; as_fn_mkdir_p
+ { as_dir="$ac_dir"
+ case $as_dir in #(
+ -*) as_dir=./$as_dir;;
+ esac
+ test -d "$as_dir" || { $as_mkdir_p && mkdir -p "$as_dir"; } || {
+ as_dirs=
+ while :; do
+ case $as_dir in #(
+ *\'*) as_qdir=`echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #(
+ *) as_qdir=$as_dir;;
+ esac
+ as_dirs="'$as_qdir' $as_dirs"
+ as_dir=`$as_dirname -- "$as_dir" ||
+$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+ X"$as_dir" : 'X\(//\)[^/]' \| \
+ X"$as_dir" : 'X\(//\)$' \| \
+ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
+echo X"$as_dir" |
+ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+ s//\1/
+ q
+ }
+ /^X\(\/\/\)[^/].*/{
+ s//\1/
+ q
+ }
+ /^X\(\/\/\)$/{
+ s//\1/
+ q
+ }
+ /^X\(\/\).*/{
+ s//\1/
+ q
+ }
+ s/.*/./; q'`
+ test -d "$as_dir" && break
+ done
+ test -z "$as_dirs" || eval "mkdir $as_dirs"
+ } || test -d "$as_dir" || { { echo "$as_me:$LINENO: error: cannot create directory $as_dir" >&5
+echo "$as_me: error: cannot create directory $as_dir" >&2;}
+ { (exit 1); exit 1; }; }; }
ac_builddir=.
case "$ac_dir" in
.) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
*)
- ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'`
+ ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'`
# A ".." for each directory in $ac_dir_suffix.
- ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
+ ac_top_builddir_sub=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,/..,g;s,/,,'`
case $ac_top_builddir_sub in
"") ac_top_builddir_sub=. ac_top_build_prefix= ;;
*) ac_top_build_prefix=$ac_top_builddir_sub/ ;;
@@ -19515,12 +37287,12 @@
esac
_ACEOF
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<\_ACEOF
# If the template does not know about datarootdir, expand it.
# FIXME: This hack should be removed a few years after 2.60.
ac_datarootdir_hack=; ac_datarootdir_seen=
-ac_sed_dataroot='
-/datarootdir/ {
+
+case `sed -n '/datarootdir/ {
p
q
}
@@ -19528,14 +37300,14 @@
/@docdir@/p
/@infodir@/p
/@localedir@/p
-/@mandir@/p'
-case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in
+/@mandir@/p
+' $ac_file_inputs` in
*datarootdir*) ac_datarootdir_seen=yes;;
*@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*)
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
-$as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
+ { echo "$as_me:$LINENO: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
+echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
_ACEOF
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<_ACEOF
ac_datarootdir_hack='
s&@datadir@&$datadir&g
s&@docdir@&$docdir&g
@@ -19542,7 +37314,7 @@
s&@infodir@&$infodir&g
s&@localedir@&$localedir&g
s&@mandir@&$mandir&g
- s&\\\${datarootdir}&$datarootdir&g' ;;
+ s&\\\${datarootdir}&$datarootdir&g' ;;
esac
_ACEOF
@@ -19549,16 +37321,15 @@
# Neutralize VPATH when `$srcdir' = `.'.
# Shell code in configure.ac might set extrasub.
# FIXME: do we really want to maintain this feature?
-cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
-ac_sed_extra="$ac_vpsub
+cat >>$CONFIG_STATUS <<_ACEOF
+ sed "$ac_vpsub
$extrasub
_ACEOF
-cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+cat >>$CONFIG_STATUS <<\_ACEOF
:t
/@[a-zA-Z_][a-zA-Z_0-9]*@/!b
-s|@configure_input@|$ac_sed_conf_input|;t t
+s&@configure_input@&$configure_input&;t t
s&@top_builddir@&$ac_top_builddir_sub&;t t
-s&@top_build_prefix@&$ac_top_build_prefix&;t t
s&@srcdir@&$ac_srcdir&;t t
s&@abs_srcdir@&$ac_abs_srcdir&;t t
s&@top_srcdir@&$ac_top_srcdir&;t t
@@ -19568,49 +37339,119 @@
s&@abs_top_builddir@&$ac_abs_top_builddir&;t t
s&@INSTALL@&$ac_INSTALL&;t t
$ac_datarootdir_hack
-"
-eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$ac_tmp/subs.awk" \
- >$ac_tmp/out || as_fn_error $? "could not create $ac_file" "$LINENO" 5
+" $ac_file_inputs | sed -f "$tmp/subs-1.sed" | sed -f "$tmp/subs-2.sed" >$tmp/out
test -z "$ac_datarootdir_hack$ac_datarootdir_seen" &&
- { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } &&
- { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' \
- "$ac_tmp/out"`; test -z "$ac_out"; } &&
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir'
-which seems to be undefined. Please make sure it is defined" >&5
-$as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
-which seems to be undefined. Please make sure it is defined" >&2;}
+ { ac_out=`sed -n '/\${datarootdir}/p' "$tmp/out"`; test -n "$ac_out"; } &&
+ { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' "$tmp/out"`; test -z "$ac_out"; } &&
+ { echo "$as_me:$LINENO: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+which seems to be undefined. Please make sure it is defined." >&5
+echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+which seems to be undefined. Please make sure it is defined." >&2;}
- rm -f "$ac_tmp/stdin"
+ rm -f "$tmp/stdin"
case $ac_file in
- -) cat "$ac_tmp/out" && rm -f "$ac_tmp/out";;
- *) rm -f "$ac_file" && mv "$ac_tmp/out" "$ac_file";;
- esac \
- || as_fn_error $? "could not create $ac_file" "$LINENO" 5
+ -) cat "$tmp/out"; rm -f "$tmp/out";;
+ *) rm -f "$ac_file"; mv "$tmp/out" $ac_file;;
+ esac
;;
:H)
#
# CONFIG_HEADER
#
+_ACEOF
+
+# Transform confdefs.h into a sed script `conftest.defines', that
+# substitutes the proper values into config.h.in to produce config.h.
+rm -f conftest.defines conftest.tail
+# First, append a space to every undef/define line, to ease matching.
+echo 's/$/ /' >conftest.defines
+# Then, protect against being on the right side of a sed subst, or in
+# an unquoted here document, in config.status. If some macros were
+# called several times there might be several #defines for the same
+# symbol, which is useless. But do not sort them, since the last
+# AC_DEFINE must be honored.
+ac_word_re=[_$as_cr_Letters][_$as_cr_alnum]*
+# These sed commands are passed to sed as "A NAME B PARAMS C VALUE D", where
+# NAME is the cpp macro being defined, VALUE is the value it is being given.
+# PARAMS is the parameter list in the macro definition--in most cases, it's
+# just an empty string.
+ac_dA='s,^\\([ #]*\\)[^ ]*\\([ ]*'
+ac_dB='\\)[ (].*,\\1define\\2'
+ac_dC=' '
+ac_dD=' ,'
+
+uniq confdefs.h |
+ sed -n '
+ t rset
+ :rset
+ s/^[ ]*#[ ]*define[ ][ ]*//
+ t ok
+ d
+ :ok
+ s/[\\&,]/\\&/g
+ s/^\('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/ '"$ac_dA"'\1'"$ac_dB"'\2'"${ac_dC}"'\3'"$ac_dD"'/p
+ s/^\('"$ac_word_re"'\)[ ]*\(.*\)/'"$ac_dA"'\1'"$ac_dB$ac_dC"'\2'"$ac_dD"'/p
+ ' >>conftest.defines
+
+# Remove the space that was appended to ease matching.
+# Then replace #undef with comments. This is necessary, for
+# example, in the case of _POSIX_SOURCE, which is predefined and required
+# on some systems where configure will not decide to define it.
+# (The regexp can be short, since the line contains either #define or #undef.)
+echo 's/ $//
+s,^[ #]*u.*,/* & */,' >>conftest.defines
+
+# Break up conftest.defines:
+ac_max_sed_lines=50
+
+# First sed command is: sed -f defines.sed $ac_file_inputs >"$tmp/out1"
+# Second one is: sed -f defines.sed "$tmp/out1" >"$tmp/out2"
+# Third one will be: sed -f defines.sed "$tmp/out2" >"$tmp/out1"
+# et cetera.
+ac_in='$ac_file_inputs'
+ac_out='"$tmp/out1"'
+ac_nxt='"$tmp/out2"'
+
+while :
+do
+ # Write a here document:
+ cat >>$CONFIG_STATUS <<_ACEOF
+ # First, check the format of the line:
+ cat >"\$tmp/defines.sed" <<\\CEOF
+/^[ ]*#[ ]*undef[ ][ ]*$ac_word_re[ ]*\$/b def
+/^[ ]*#[ ]*define[ ][ ]*$ac_word_re[( ]/b def
+b
+:def
+_ACEOF
+ sed ${ac_max_sed_lines}q conftest.defines >>$CONFIG_STATUS
+ echo 'CEOF
+ sed -f "$tmp/defines.sed"' "$ac_in >$ac_out" >>$CONFIG_STATUS
+ ac_in=$ac_out; ac_out=$ac_nxt; ac_nxt=$ac_in
+ sed 1,${ac_max_sed_lines}d conftest.defines >conftest.tail
+ grep . conftest.tail >/dev/null || break
+ rm -f conftest.defines
+ mv conftest.tail conftest.defines
+done
+rm -f conftest.defines conftest.tail
+
+echo "ac_result=$ac_in" >>$CONFIG_STATUS
+cat >>$CONFIG_STATUS <<\_ACEOF
if test x"$ac_file" != x-; then
- {
- $as_echo "/* $configure_input */" \
- && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs"
- } >"$ac_tmp/config.h" \
- || as_fn_error $? "could not create $ac_file" "$LINENO" 5
- if diff "$ac_file" "$ac_tmp/config.h" >/dev/null 2>&1; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5
-$as_echo "$as_me: $ac_file is unchanged" >&6;}
+ echo "/* $configure_input */" >"$tmp/config.h"
+ cat "$ac_result" >>"$tmp/config.h"
+ if diff $ac_file "$tmp/config.h" >/dev/null 2>&1; then
+ { echo "$as_me:$LINENO: $ac_file is unchanged" >&5
+echo "$as_me: $ac_file is unchanged" >&6;}
else
- rm -f "$ac_file"
- mv "$ac_tmp/config.h" "$ac_file" \
- || as_fn_error $? "could not create $ac_file" "$LINENO" 5
+ rm -f $ac_file
+ mv "$tmp/config.h" $ac_file
fi
else
- $as_echo "/* $configure_input */" \
- && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" \
- || as_fn_error $? "could not create -" "$LINENO" 5
+ echo "/* $configure_input */"
+ cat "$ac_result"
fi
+ rm -f "$tmp/out12"
;;
@@ -19619,14 +37460,12 @@
done # for ac_tag
-as_fn_exit 0
+{ (exit 0); exit 0; }
_ACEOF
+chmod +x $CONFIG_STATUS
ac_clean_files=$ac_clean_files_save
-test $ac_write_fail = 0 ||
- as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5
-
# configure is writing to config.log, and then calls config.status.
# config.status does its own redirection, appending to config.log.
# Unfortunately, on DOS this fails, as config.log is still kept open
@@ -19645,12 +37484,8 @@
exec 5>>config.log
# Use ||, not &&, to avoid exiting from the if with $? = 1, which
# would make configure fail if this is the last instruction.
- $ac_cs_success || as_fn_exit 1
+ $ac_cs_success || { (exit 1); exit 1; }
fi
-if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
-$as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
-fi
# Print summary of options
@@ -19696,11 +37531,11 @@
echo " SELinux support: $SELINUX_MSG"
echo " Smartcard support: $SCARD_MSG"
echo " S/KEY support: $SKEY_MSG"
-echo " TCP Wrappers support: $TCPW_MSG"
echo " MD5 password support: $MD5_MSG"
echo " libedit support: $LIBEDIT_MSG"
echo " Solaris process contract support: $SPC_MSG"
echo " Solaris project support: $SP_MSG"
+echo " Solaris privilege support: $SPP_MSG"
echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
echo " BSD Auth support: $BSD_AUTH_MSG"
Modified: trunk/crypto/openssh/configure.ac
===================================================================
--- trunk/crypto/openssh/configure.ac 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/configure.ac 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.571 2014/02/21 17:09:34 tim Exp $
+# $Id: configure.ac,v 1.583 2014/08/26 20:32:01 djm Exp $
#
# Copyright (c) 1999-2004 Damien Miller
#
@@ -15,7 +15,7 @@
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
AC_INIT([OpenSSH], [Portable], [openssh-unix-dev at mindrot.org])
-AC_REVISION($Revision: 1.571 $)
+AC_REVISION($Revision: 1.583 $)
AC_CONFIG_SRCDIR([ssh.c])
AC_LANG([C])
@@ -30,7 +30,7 @@
AC_PROG_RANLIB
AC_PROG_INSTALL
AC_PROG_EGREP
-AC_PATH_PROG([AR], [ar])
+AC_CHECK_TOOLS([AR], [ar])
AC_PATH_PROG([CAT], [cat])
AC_PATH_PROG([KILL], [kill])
AC_PATH_PROGS([PERL], [perl5 perl])
@@ -121,6 +121,47 @@
#include <linux/prctl.h>
])
+openssl=yes
+ssh1=no
+AC_ARG_WITH([openssl],
+ [ --without-openssl Disable use of OpenSSL; use only limited internal crypto **EXPERIMENTAL** ],
+ [ if test "x$withval" = "xno" ; then
+ openssl=no
+ ssh1=no
+ fi
+ ]
+)
+AC_MSG_CHECKING([whether OpenSSL will be used for cryptography])
+if test "x$openssl" = "xyes" ; then
+ AC_MSG_RESULT([yes])
+ AC_DEFINE_UNQUOTED([WITH_OPENSSL], [1], [use libcrypto for cryptography])
+else
+ AC_MSG_RESULT([no])
+fi
+
+AC_ARG_WITH([ssh1],
+ [ --with-ssh1 Enable support for SSH protocol 1],
+ [
+ if test "x$withval" = "xyes" ; then
+ if test "x$openssl" = "xno" ; then
+ AC_MSG_ERROR([Cannot enable SSH protocol 1 with OpenSSL disabled])
+ fi
+ ssh1=yes
+ elif test "x$withval" = "xno" ; then
+ ssh1=no
+ else
+ AC_MSG_ERROR([unknown --with-ssh1 argument])
+ fi
+ ]
+)
+AC_MSG_CHECKING([whether SSH protocol 1 support is enabled])
+if test "x$ssh1" = "xyes" ; then
+ AC_MSG_RESULT([yes])
+ AC_DEFINE_UNQUOTED([WITH_SSH1], [1], [include SSH protocol version 1 support])
+else
+ AC_MSG_RESULT([no])
+fi
+
use_stack_protector=1
use_toolchain_hardening=1
AC_ARG_WITH([stackprotect],
@@ -332,6 +373,7 @@
dirent.h \
endian.h \
elf.h \
+ err.h \
features.h \
fcntl.h \
floatingpoint.h \
@@ -340,6 +382,7 @@
ia.h \
iaf.h \
inttypes.h \
+ langinfo.h \
limits.h \
locale.h \
login.h \
@@ -392,6 +435,7 @@
utmp.h \
utmpx.h \
vis.h \
+ wchar.h \
])
# lastlog.h requires sys/time.h to be included first on Solaris
@@ -428,7 +472,12 @@
SIA_MSG="no"
SPC_MSG="no"
SP_MSG="no"
+SPP_MSG="no"
+# Support for Solaris/Illumos privileges (this test is used by both
+# the --with-solaris-privs option and --with-sandbox=solaris).
+SOLARIS_PRIVS="no"
+
# Check for some target-specific stuff
case "$host" in
*-*-aix*)
@@ -534,13 +583,12 @@
LIBS="$LIBS /usr/lib/textreadmode.o"
AC_DEFINE([HAVE_CYGWIN], [1], [Define if you are on Cygwin])
AC_DEFINE([USE_PIPES], [1], [Use PIPES instead of a socketpair()])
+ AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
+ [Define to disable UID restoration test])
AC_DEFINE([DISABLE_SHADOW], [1],
[Define if you want to disable shadow passwords])
AC_DEFINE([NO_X11_UNIX_SOCKETS], [1],
[Define if X11 doesn't support AF_UNIX sockets on that system])
- AC_DEFINE([NO_IPPORT_RESERVED_CONCEPT], [1],
- [Define if the concept of ports only accessible to
- superusers isn't known])
AC_DEFINE([DISABLE_FD_PASSING], [1],
[Define if your platform needs to skip post auth
file descriptor passing])
@@ -585,7 +633,7 @@
AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
[Prepend the address family to IP tunnel traffic])
m4_pattern_allow([AU_IPv])
- AC_CHECK_DECL([AU_IPv4], [],
+ AC_CHECK_DECL([AU_IPv4], [],
AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
[#include <bsm/audit.h>]
AC_DEFINE([LASTLOG_WRITE_PUTUTXLINE], [1],
@@ -596,17 +644,20 @@
supported by bsd-setproctitle.c])
AC_CHECK_FUNCS([sandbox_init])
AC_CHECK_HEADERS([sandbox.h])
+ AC_CHECK_LIB([sandbox], [sandbox_apply], [
+ SSHDLIBS="$SSHDLIBS -lsandbox"
+ ])
;;
*-*-dragonfly*)
SSHDLIBS="$SSHDLIBS -lcrypt"
TEST_MALLOC_OPTIONS="AFGJPRX"
;;
-*-*-haiku*)
+*-*-haiku*)
LIBS="$LIBS -lbsd "
AC_CHECK_LIB([network], [socket])
AC_DEFINE([HAVE_U_INT64_T])
- MANTYPE=man
- ;;
+ MANTYPE=man
+ ;;
*-*-hpux*)
# first we define all of the options common to all HP-UX releases
CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
@@ -740,14 +791,41 @@
i*86-*)
seccomp_audit_arch=AUDIT_ARCH_I386
;;
- arm*-*)
+ arm*-*)
seccomp_audit_arch=AUDIT_ARCH_ARM
- ;;
+ ;;
+ aarch64*-*)
+ seccomp_audit_arch=AUDIT_ARCH_AARCH64
+ ;;
+ s390x-*)
+ seccomp_audit_arch=AUDIT_ARCH_S390X
+ ;;
+ s390-*)
+ seccomp_audit_arch=AUDIT_ARCH_S390
+ ;;
+ powerpc64-*)
+ seccomp_audit_arch=AUDIT_ARCH_PPC64
+ ;;
+ powerpc64le-*)
+ seccomp_audit_arch=AUDIT_ARCH_PPC64LE
+ ;;
+ mips-*)
+ seccomp_audit_arch=AUDIT_ARCH_MIPS
+ ;;
+ mipsel-*)
+ seccomp_audit_arch=AUDIT_ARCH_MIPSEL
+ ;;
+ mips64-*)
+ seccomp_audit_arch=AUDIT_ARCH_MIPS64
+ ;;
+ mips64el-*)
+ seccomp_audit_arch=AUDIT_ARCH_MIPSEL64
+ ;;
esac
if test "x$seccomp_audit_arch" != "x" ; then
AC_MSG_RESULT(["$seccomp_audit_arch"])
- AC_DEFINE_UNQUOTED([SECCOMP_AUDIT_ARCH], [$seccomp_audit_arch],
- [Specify the system call convention in use])
+ AC_DEFINE_UNQUOTED([SECCOMP_AUDIT_ARCH], [$seccomp_audit_arch],
+ [Specify the system call convention in use])
else
AC_MSG_RESULT([architecture not supported])
fi
@@ -761,6 +839,7 @@
if test "x$withval" != "xno" ; then
need_dash_r=1
fi
+ CPPFLAGS="$CPPFLAGS -D_OPENBSD_SOURCE"
AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
AC_CHECK_HEADER([net/if_tap.h], ,
AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
@@ -845,6 +924,10 @@
else
AC_MSG_RESULT([no])
fi
+ AC_CHECK_FUNCS([setpflags])
+ AC_CHECK_FUNCS([setppriv])
+ AC_CHECK_FUNCS([priv_basicset])
+ AC_CHECK_HEADERS([priv.h])
AC_ARG_WITH([solaris-contracts],
[ --with-solaris-contracts Enable Solaris process contracts (experimental)],
[
@@ -851,7 +934,7 @@
AC_CHECK_LIB([contract], [ct_tmpl_activate],
[ AC_DEFINE([USE_SOLARIS_PROCESS_CONTRACTS], [1],
[Define if you have Solaris process contracts])
- SSHDLIBS="$SSHDLIBS -lcontract"
+ LIBS="$LIBS -lcontract"
SPC_MSG="yes" ], )
],
)
@@ -861,10 +944,29 @@
AC_CHECK_LIB([project], [setproject],
[ AC_DEFINE([USE_SOLARIS_PROJECTS], [1],
[Define if you have Solaris projects])
- SSHDLIBS="$SSHDLIBS -lproject"
+ LIBS="$LIBS -lproject"
SP_MSG="yes" ], )
],
)
+ AC_ARG_WITH([solaris-privs],
+ [ --with-solaris-privs Enable Solaris/Illumos privileges (experimental)],
+ [
+ AC_MSG_CHECKING([for Solaris/Illumos privilege support])
+ if test "x$ac_cv_func_setppriv" = "xyes" -a \
+ "x$ac_cv_header_priv_h" = "xyes" ; then
+ SOLARIS_PRIVS=yes
+ AC_MSG_RESULT([found])
+ AC_DEFINE([NO_UID_RESTORATION_TEST], [1],
+ [Define to disable UID restoration test])
+ AC_DEFINE([USE_SOLARIS_PRIVS], [1],
+ [Define if you have Solaris privileges])
+ SPP_MSG="yes"
+ else
+ AC_MSG_RESULT([not found])
+ AC_MSG_ERROR([*** must have support for Solaris privileges to use --with-solaris-privs])
+ fi
+ ],
+ )
TEST_SHELL=$SHELL # let configure find us a capable shell
;;
*-*-sunos4*)
@@ -1078,7 +1180,6 @@
dnl Checks for header files.
# Checks for libraries.
-AC_CHECK_FUNC([yp_match], , [AC_CHECK_LIB([nsl], [yp_match])])
AC_CHECK_FUNC([setsockopt], , [AC_CHECK_LIB([socket], [setsockopt])])
dnl IRIX and Solaris 2.5.1 have dirname() in libgen
@@ -1242,8 +1343,10 @@
AC_SEARCH_LIBS([updwtmp], [util bsd])
AC_CHECK_FUNCS([fmt_scaled scan_scaled login logout openpty updwtmp logwtmp])
-# On some platforms, inet_ntop may be found in libresolv or libnsl.
+# On some platforms, inet_ntop and gethostbyname may be found in libresolv
+# or libnsl.
AC_SEARCH_LIBS([inet_ntop], [resolv nsl])
+AC_SEARCH_LIBS([gethostbyname], [resolv nsl])
AC_FUNC_STRFTIME
@@ -1296,11 +1399,14 @@
AC_MSG_RESULT([yes])
], [
AC_MSG_RESULT([no])
-
+
])
AC_CHECK_DECLS([GLOB_NOMATCH], , , [#include <glob.h>])
+AC_CHECK_DECL([VIS_ALL], ,
+ AC_DEFINE(BROKEN_STRNVIS, 1, [missing VIS_ALL]), [#include <vis.h>])
+
AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
AC_RUN_IFELSE(
[AC_LANG_PROGRAM([[
@@ -1361,7 +1467,7 @@
AC_MSG_RESULT([no])
AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
])
- AC_MSG_CHECKING([if skeychallenge takes 4 arguments])
+ AC_MSG_CHECKING([if skeychallenge takes 4 arguments])
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
#include <stdio.h>
#include <skey.h>
@@ -1380,62 +1486,6 @@
]
)
-# Check whether user wants TCP wrappers support
-TCPW_MSG="no"
-AC_ARG_WITH([tcp-wrappers],
- [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
- [
- if test "x$withval" != "xno" ; then
- saved_LIBS="$LIBS"
- saved_LDFLAGS="$LDFLAGS"
- saved_CPPFLAGS="$CPPFLAGS"
- if test -n "${withval}" && \
- test "x${withval}" != "xyes"; then
- if test -d "${withval}/lib"; then
- if test -n "${need_dash_r}"; then
- LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
- else
- LDFLAGS="-L${withval}/lib ${LDFLAGS}"
- fi
- else
- if test -n "${need_dash_r}"; then
- LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
- else
- LDFLAGS="-L${withval} ${LDFLAGS}"
- fi
- fi
- if test -d "${withval}/include"; then
- CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
- else
- CPPFLAGS="-I${withval} ${CPPFLAGS}"
- fi
- fi
- LIBS="-lwrap $LIBS"
- AC_MSG_CHECKING([for libwrap])
- AC_LINK_IFELSE([AC_LANG_PROGRAM([[
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <tcpd.h>
-int deny_severity = 0, allow_severity = 0;
- ]], [[
- hosts_access(0);
- ]])], [
- AC_MSG_RESULT([yes])
- AC_DEFINE([LIBWRAP], [1],
- [Define if you want
- TCP Wrappers support])
- SSHDLIBS="$SSHDLIBS -lwrap"
- TCPW_MSG="yes"
- ], [
- AC_MSG_ERROR([*** libwrap missing])
-
- ])
- LIBS="$saved_LIBS"
- fi
- ]
-)
-
# Check whether user wants to use ldns
LDNS_MSG="no"
AC_ARG_WITH(ldns,
@@ -1480,7 +1530,7 @@
AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
if test "x$PKGCONFIG" != "xno"; then
AC_MSG_CHECKING([if $PKGCONFIG knows about libedit])
- if "$PKGCONFIG" libedit; then
+ if "$PKGCONFIG" libedit; then
AC_MSG_RESULT([yes])
use_pkgconfig_for_libedit=yes
else
@@ -1551,9 +1601,9 @@
AC_CHECK_FUNCS([getaudit_addr aug_get_machine])
AC_DEFINE([USE_BSM_AUDIT], [1], [Use BSM audit module])
if test "$sol2ver" -ge 11; then
- SSHDLIBS="$SSHDLIBS -lscf"
- AC_DEFINE([BROKEN_BSM_API], [1],
- [The system has incomplete BSM API])
+ SSHDLIBS="$SSHDLIBS -lscf"
+ AC_DEFINE([BROKEN_BSM_API], [1],
+ [The system has incomplete BSM API])
fi
;;
linux)
@@ -1579,7 +1629,7 @@
)
AC_ARG_WITH([pie],
- [ --with-pie Build Position Independent Executables if possible], [
+ [ --with-pie Build Position Independent Executables if possible], [
if test "x$withval" = "xno"; then
use_pie=no
fi
@@ -1631,10 +1681,6 @@
Blowfish_expandstate \
Blowfish_expand0state \
Blowfish_stream2word \
- arc4random \
- arc4random_buf \
- arc4random_stir \
- arc4random_uniform \
asprintf \
b64_ntop \
__b64_ntop \
@@ -1649,6 +1695,8 @@
closefrom \
dirfd \
endgrent \
+ err \
+ errx \
explicit_bzero \
fchmod \
fchown \
@@ -1675,9 +1723,9 @@
inet_ntop \
innetgr \
login_getcapbool \
- mblen \
md5_crypt \
memmove \
+ memset_s \
mkdtemp \
mmap \
ngetaddrinfo \
@@ -1684,11 +1732,12 @@
nsleep \
ogetaddrinfo \
openlog_r \
+ pledge \
poll \
prctl \
pstat \
readpassphrase \
- realpath \
+ reallocarray \
recvmsg \
rresvport_af \
sendmsg \
@@ -1736,11 +1785,17 @@
user_from_uid \
usleep \
vasprintf \
- vhangup \
vsnprintf \
waitpid \
+ warn \
])
+dnl Wide character support. Linux man page says it needs _XOPEN_SOURCE.
+saved_CFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -D_XOPEN_SOURCE"
+AC_CHECK_FUNCS([mblen mbtowc nl_langinfo wcwidth])
+CFLAGS="$saved_CFLAGS"
+
AC_LINK_IFELSE(
[AC_LANG_PROGRAM(
[[ #include <ctype.h> ]],
@@ -1748,11 +1803,24 @@
[AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])
])
-# PKCS#11 support requires dlopen() and co
-AC_SEARCH_LIBS([dlopen], [dl],
- [AC_DEFINE([ENABLE_PKCS11], [], [Enable for PKCS#11 support])]
+disable_pkcs11=
+AC_ARG_ENABLE([pkcs11],
+ [ --disable-pkcs11 disable PKCS#11 support code [no]],
+ [
+ if test "x$enableval" = "xno" ; then
+ disable_pkcs11=1
+ fi
+ ]
)
+# PKCS11 depends on OpenSSL.
+if test "x$openssl" = "xyes" && test "x$disable_pkcs11" = "x"; then
+ # PKCS#11 support requires dlopen() and co
+ AC_SEARCH_LIBS([dlopen], [dl],
+ [AC_DEFINE([ENABLE_PKCS11], [], [Enable for PKCS#11 support])]
+ )
+fi
+
# IRIX has a const char return value for gai_strerror()
AC_CHECK_FUNCS([gai_strerror], [
AC_DEFINE([HAVE_GAI_STRERROR])
@@ -1903,6 +1971,32 @@
)
])
+AC_CHECK_FUNCS([realpath], [
+ dnl the sftp v3 spec says SSH_FXP_REALPATH will "canonicalize any given
+ dnl path name", however some implementations of realpath (and some
+ dnl versions of the POSIX spec) do not work on non-existent files,
+ dnl so we use the OpenBSD implementation on those platforms.
+ AC_MSG_CHECKING([if realpath works with non-existent files])
+ AC_RUN_IFELSE(
+ [AC_LANG_PROGRAM([[
+#include <limits.h>
+#include <stdlib.h>
+#include <errno.h>
+ ]], [[
+ char buf[PATH_MAX];
+ if (realpath("/opensshnonexistentfilename1234", buf) == NULL)
+ if (errno == ENOENT)
+ exit(1);
+ exit(0);
+ ]])],
+ [AC_MSG_RESULT([yes])],
+ [AC_DEFINE([BROKEN_REALPATH], [1],
+ [realpath does not work with nonexistent files])
+ AC_MSG_RESULT([no])],
+ [AC_MSG_WARN([cross compiling: assuming working])]
+ )
+])
+
dnl Checks for time functions
AC_CHECK_FUNCS([gettimeofday time])
dnl Checks for utmp functions
@@ -1935,7 +2029,7 @@
[[
char b[5];
snprintf(b,5,"123456789");
- exit(b[4]!='\0');
+ exit(b[4]!='\0');
]])],
[AC_MSG_RESULT([yes])],
[
@@ -1948,11 +2042,9 @@
)
fi
-# If we don't have a working asprintf, then we strongly depend on vsnprintf
-# returning the right thing on overflow: the number of characters it tried to
-# create (as per SUSv3)
-if test "x$ac_cv_func_asprintf" != "xyes" && \
- test "x$ac_cv_func_vsnprintf" = "xyes" ; then
+# We depend on vsnprintf returning the right thing on overflow: the
+# number of characters it tried to create (as per SUSv3)
+if test "x$ac_cv_func_vsnprintf" = "xyes" ; then
AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
AC_RUN_IFELSE(
[AC_LANG_PROGRAM([[
@@ -1960,15 +2052,23 @@
#include <stdio.h>
#include <stdarg.h>
-int x_snprintf(char *str,size_t count,const char *fmt,...)
+int x_snprintf(char *str, size_t count, const char *fmt, ...)
{
- size_t ret; va_list ap;
- va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
+ size_t ret;
+ va_list ap;
+
+ va_start(ap, fmt);
+ ret = vsnprintf(str, count, fmt, ap);
+ va_end(ap);
return ret;
}
]], [[
- char x[1];
- exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
+char x[1];
+if (x_snprintf(x, 1, "%s %d", "hello", 12345) != 11)
+ return 1;
+if (x_snprintf(NULL, 0, "%s %d", "hello", 12345) != 11)
+ return 1;
+return 0;
]])],
[AC_MSG_RESULT([yes])],
[
@@ -2211,6 +2311,13 @@
)
fi
+if test "x$ac_cv_func_getaddrinfo" = "xyes"; then
+ AC_CHECK_DECLS(AI_NUMERICSERV, , ,
+ [#include <sys/types.h>
+ #include <sys/socket.h>
+ #include <netdb.h>])
+fi
+
if test "x$check_for_conflicting_getspnam" = "x1"; then
AC_MSG_CHECKING([for conflicting getspnam in shadow.h])
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <shadow.h> ]],
@@ -2234,6 +2341,9 @@
AC_ARG_WITH([ssl-dir],
[ --with-ssl-dir=PATH Specify path to OpenSSL installation ],
[
+ if test "x$openssl" = "xno" ; then
+ AC_MSG_ERROR([cannot use --with-ssl-dir when OpenSSL disabled])
+ fi
if test "x$withval" != "xno" ; then
case "$withval" in
# Relative paths
@@ -2266,185 +2376,211 @@
fi
]
)
-LIBS="-lcrypto $LIBS"
-AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL], [1],
- [Define if your ssl headers are included
- with #include <openssl/header.h>])],
+
+AC_ARG_WITH([openssl-header-check],
+ [ --without-openssl-header-check Disable OpenSSL version consistency check],
[
- dnl Check default openssl install dir
- if test -n "${need_dash_r}"; then
- LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
- else
- LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
+ if test "x$withval" = "xno" ; then
+ openssl_check_nonfatal=1
fi
- CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
- AC_CHECK_HEADER([openssl/opensslv.h], ,
- [AC_MSG_ERROR([*** OpenSSL headers missing - please install first or check config.log ***])])
- AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL])],
- [
- AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
- ]
- )
]
)
-# Determine OpenSSL header version
-AC_MSG_CHECKING([OpenSSL header version])
-AC_RUN_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <stdio.h>
-#include <string.h>
-#include <openssl/opensslv.h>
-#define DATA "conftest.sslincver"
- ]], [[
- FILE *fd;
- int rc;
-
- fd = fopen(DATA,"w");
- if(fd == NULL)
- exit(1);
-
- if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
- exit(1);
-
- exit(0);
- ]])],
+openssl_engine=no
+AC_ARG_WITH([ssl-engine],
+ [ --with-ssl-engine Enable OpenSSL (hardware) ENGINE support ],
[
- ssl_header_ver=`cat conftest.sslincver`
- AC_MSG_RESULT([$ssl_header_ver])
- ],
- [
- AC_MSG_RESULT([not found])
- AC_MSG_ERROR([OpenSSL version header not found.])
- ],
- [
- AC_MSG_WARN([cross compiling: not checking])
+ if test "x$withval" != "xno" ; then
+ if test "x$openssl" = "xno" ; then
+ AC_MSG_ERROR([cannot use --with-ssl-engine when OpenSSL disabled])
+ fi
+ openssl_engine=yes
+ fi
]
)
-# Determine OpenSSL library version
-AC_MSG_CHECKING([OpenSSL library version])
-AC_RUN_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <stdio.h>
-#include <string.h>
-#include <openssl/opensslv.h>
-#include <openssl/crypto.h>
-#define DATA "conftest.ssllibver"
- ]], [[
- FILE *fd;
- int rc;
+if test "x$openssl" = "xyes" ; then
+ LIBS="-lcrypto $LIBS"
+ AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL], [1],
+ [Define if your ssl headers are included
+ with #include <openssl/header.h>])],
+ [
+ dnl Check default openssl install dir
+ if test -n "${need_dash_r}"; then
+ LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
+ else
+ LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
+ fi
+ CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
+ AC_CHECK_HEADER([openssl/opensslv.h], ,
+ [AC_MSG_ERROR([*** OpenSSL headers missing - please install first or check config.log ***])])
+ AC_TRY_LINK_FUNC([RAND_add], [AC_DEFINE([HAVE_OPENSSL])],
+ [
+ AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
+ ]
+ )
+ ]
+ )
- fd = fopen(DATA,"w");
- if(fd == NULL)
- exit(1);
+ # Determine OpenSSL header version
+ AC_MSG_CHECKING([OpenSSL header version])
+ AC_RUN_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <openssl/opensslv.h>
+ #define DATA "conftest.sslincver"
+ ]], [[
+ FILE *fd;
+ int rc;
- if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
- exit(1);
+ fd = fopen(DATA,"w");
+ if(fd == NULL)
+ exit(1);
- exit(0);
- ]])],
- [
- ssl_library_ver=`cat conftest.ssllibver`
- AC_MSG_RESULT([$ssl_library_ver])
- ],
- [
- AC_MSG_RESULT([not found])
- AC_MSG_ERROR([OpenSSL library not found.])
- ],
- [
- AC_MSG_WARN([cross compiling: not checking])
- ]
-)
+ if ((rc = fprintf(fd, "%08lx (%s)\n",
+ (unsigned long)OPENSSL_VERSION_NUMBER,
+ OPENSSL_VERSION_TEXT)) < 0)
+ exit(1);
-AC_ARG_WITH([openssl-header-check],
- [ --without-openssl-header-check Disable OpenSSL version consistency check],
- [ if test "x$withval" = "xno" ; then
- openssl_check_nonfatal=1
- fi
- ]
-)
+ exit(0);
+ ]])],
+ [
+ ssl_header_ver=`cat conftest.sslincver`
+ AC_MSG_RESULT([$ssl_header_ver])
+ ],
+ [
+ AC_MSG_RESULT([not found])
+ AC_MSG_ERROR([OpenSSL version header not found.])
+ ],
+ [
+ AC_MSG_WARN([cross compiling: not checking])
+ ]
+ )
-# Sanity check OpenSSL headers
-AC_MSG_CHECKING([whether OpenSSL's headers match the library])
-AC_RUN_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <string.h>
-#include <openssl/opensslv.h>
- ]], [[
- exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1);
- ]])],
- [
- AC_MSG_RESULT([yes])
- ],
- [
- AC_MSG_RESULT([no])
- if test "x$openssl_check_nonfatal" = "x"; then
- AC_MSG_ERROR([Your OpenSSL headers do not match your
-library. Check config.log for details.
-If you are sure your installation is consistent, you can disable the check
-by running "./configure --without-openssl-header-check".
-Also see contrib/findssl.sh for help identifying header/library mismatches.
-])
- else
- AC_MSG_WARN([Your OpenSSL headers do not match your
-library. Check config.log for details.
-Also see contrib/findssl.sh for help identifying header/library mismatches.])
- fi
- ],
- [
- AC_MSG_WARN([cross compiling: not checking])
- ]
-)
+ # Determine OpenSSL library version
+ AC_MSG_CHECKING([OpenSSL library version])
+ AC_RUN_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <stdio.h>
+ #include <string.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/crypto.h>
+ #define DATA "conftest.ssllibver"
+ ]], [[
+ FILE *fd;
+ int rc;
-AC_MSG_CHECKING([if programs using OpenSSL functions will link])
-AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
- [[ SSLeay_add_all_algorithms(); ]])],
- [
- AC_MSG_RESULT([yes])
- ],
- [
- AC_MSG_RESULT([no])
- saved_LIBS="$LIBS"
- LIBS="$LIBS -ldl"
- AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
- AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
- [[ SSLeay_add_all_algorithms(); ]])],
- [
- AC_MSG_RESULT([yes])
- ],
- [
- AC_MSG_RESULT([no])
- LIBS="$saved_LIBS"
- ]
- )
- ]
-)
+ fd = fopen(DATA,"w");
+ if(fd == NULL)
+ exit(1);
-AC_CHECK_FUNCS([ \
- BN_is_prime_ex \
- DSA_generate_parameters_ex \
- EVP_DigestInit_ex \
- EVP_DigestFinal_ex \
- EVP_MD_CTX_init \
- EVP_MD_CTX_cleanup \
- EVP_MD_CTX_copy_ex \
- HMAC_CTX_init \
- RSA_generate_key_ex \
- RSA_get_default_method \
-])
+ if ((rc = fprintf(fd, "%08lx (%s)\n", (unsigned long)SSLeay(),
+ SSLeay_version(SSLEAY_VERSION))) < 0)
+ exit(1);
-AC_ARG_WITH([ssl-engine],
- [ --with-ssl-engine Enable OpenSSL (hardware) ENGINE support ],
- [ if test "x$withval" != "xno" ; then
+ exit(0);
+ ]])],
+ [
+ ssl_library_ver=`cat conftest.ssllibver`
+ # Check version is supported.
+ case "$ssl_library_ver" in
+ 0090[[0-7]]*|009080[[0-5]]*)
+ AC_MSG_ERROR([OpenSSL >= 0.9.8f required (have "$ssl_library_ver")])
+ ;;
+ *) ;;
+ esac
+ AC_MSG_RESULT([$ssl_library_ver])
+ ],
+ [
+ AC_MSG_RESULT([not found])
+ AC_MSG_ERROR([OpenSSL library not found.])
+ ],
+ [
+ AC_MSG_WARN([cross compiling: not checking])
+ ]
+ )
+
+ # Sanity check OpenSSL headers
+ AC_MSG_CHECKING([whether OpenSSL's headers match the library])
+ AC_RUN_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <string.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/crypto.h>
+ ]], [[
+ exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1);
+ ]])],
+ [
+ AC_MSG_RESULT([yes])
+ ],
+ [
+ AC_MSG_RESULT([no])
+ if test "x$openssl_check_nonfatal" = "x"; then
+ AC_MSG_ERROR([Your OpenSSL headers do not match your
+ library. Check config.log for details.
+ If you are sure your installation is consistent, you can disable the check
+ by running "./configure --without-openssl-header-check".
+ Also see contrib/findssl.sh for help identifying header/library mismatches.
+ ])
+ else
+ AC_MSG_WARN([Your OpenSSL headers do not match your
+ library. Check config.log for details.
+ Also see contrib/findssl.sh for help identifying header/library mismatches.])
+ fi
+ ],
+ [
+ AC_MSG_WARN([cross compiling: not checking])
+ ]
+ )
+
+ AC_MSG_CHECKING([if programs using OpenSSL functions will link])
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
+ [[ SSLeay_add_all_algorithms(); ]])],
+ [
+ AC_MSG_RESULT([yes])
+ ],
+ [
+ AC_MSG_RESULT([no])
+ saved_LIBS="$LIBS"
+ LIBS="$LIBS -ldl"
+ AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([[ #include <openssl/evp.h> ]],
+ [[ SSLeay_add_all_algorithms(); ]])],
+ [
+ AC_MSG_RESULT([yes])
+ ],
+ [
+ AC_MSG_RESULT([no])
+ LIBS="$saved_LIBS"
+ ]
+ )
+ ]
+ )
+
+ AC_CHECK_FUNCS([ \
+ BN_is_prime_ex \
+ DSA_generate_parameters_ex \
+ EVP_DigestInit_ex \
+ EVP_DigestFinal_ex \
+ EVP_MD_CTX_init \
+ EVP_MD_CTX_cleanup \
+ EVP_MD_CTX_copy_ex \
+ HMAC_CTX_init \
+ RSA_generate_key_ex \
+ RSA_get_default_method \
+ ])
+
+ if test "x$openssl_engine" = "xyes" ; then
AC_MSG_CHECKING([for OpenSSL ENGINE support])
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
-#include <openssl/engine.h>
+ #include <openssl/engine.h>
]], [[
- ENGINE_load_builtin_engines();
- ENGINE_register_all_complete();
+ ENGINE_load_builtin_engines();
+ ENGINE_register_all_complete();
]])],
[ AC_MSG_RESULT([yes])
AC_DEFINE([USE_OPENSSL_ENGINE], [1],
@@ -2451,239 +2587,266 @@
[Enable OpenSSL engine support])
], [ AC_MSG_ERROR([OpenSSL ENGINE support not found])
])
- fi ]
-)
+ fi
-# Check for OpenSSL without EVP_aes_{192,256}_cbc
-AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
-AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <string.h>
-#include <openssl/evp.h>
- ]], [[
- exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);
- ]])],
- [
- AC_MSG_RESULT([no])
- ],
- [
- AC_MSG_RESULT([yes])
- AC_DEFINE([OPENSSL_LOBOTOMISED_AES], [1],
- [libcrypto is missing AES 192 and 256 bit functions])
- ]
-)
+ # Check for OpenSSL without EVP_aes_{192,256}_cbc
+ AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <string.h>
+ #include <openssl/evp.h>
+ ]], [[
+ exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);
+ ]])],
+ [
+ AC_MSG_RESULT([no])
+ ],
+ [
+ AC_MSG_RESULT([yes])
+ AC_DEFINE([OPENSSL_LOBOTOMISED_AES], [1],
+ [libcrypto is missing AES 192 and 256 bit functions])
+ ]
+ )
-# Check for OpenSSL with EVP_aes_*ctr
-AC_MSG_CHECKING([whether OpenSSL has AES CTR via EVP])
-AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <string.h>
-#include <openssl/evp.h>
- ]], [[
- exit(EVP_aes_128_ctr() == NULL ||
- EVP_aes_192_cbc() == NULL ||
- EVP_aes_256_cbc() == NULL);
- ]])],
- [
- AC_MSG_RESULT([yes])
- AC_DEFINE([OPENSSL_HAVE_EVPCTR], [1],
- [libcrypto has EVP AES CTR])
- ],
- [
- AC_MSG_RESULT([no])
- ]
-)
+ # Check for OpenSSL with EVP_aes_*ctr
+ AC_MSG_CHECKING([whether OpenSSL has AES CTR via EVP])
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <string.h>
+ #include <openssl/evp.h>
+ ]], [[
+ exit(EVP_aes_128_ctr() == NULL ||
+ EVP_aes_192_cbc() == NULL ||
+ EVP_aes_256_cbc() == NULL);
+ ]])],
+ [
+ AC_MSG_RESULT([yes])
+ AC_DEFINE([OPENSSL_HAVE_EVPCTR], [1],
+ [libcrypto has EVP AES CTR])
+ ],
+ [
+ AC_MSG_RESULT([no])
+ ]
+ )
-# Check for OpenSSL with EVP_aes_*gcm
-AC_MSG_CHECKING([whether OpenSSL has AES GCM via EVP])
-AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <string.h>
-#include <openssl/evp.h>
- ]], [[
- exit(EVP_aes_128_gcm() == NULL ||
- EVP_aes_256_gcm() == NULL ||
- EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
- EVP_CTRL_GCM_IV_GEN == 0 ||
- EVP_CTRL_GCM_SET_TAG == 0 ||
- EVP_CTRL_GCM_GET_TAG == 0 ||
- EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
- ]])],
- [
- AC_MSG_RESULT([yes])
- AC_DEFINE([OPENSSL_HAVE_EVPGCM], [1],
- [libcrypto has EVP AES GCM])
- ],
- [
- AC_MSG_RESULT([no])
- unsupported_algorithms="$unsupported_cipers \
- aes128-gcm at openssh.com aes256-gcm at openssh.com"
- ]
-)
+ # Check for OpenSSL with EVP_aes_*gcm
+ AC_MSG_CHECKING([whether OpenSSL has AES GCM via EVP])
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <string.h>
+ #include <openssl/evp.h>
+ ]], [[
+ exit(EVP_aes_128_gcm() == NULL ||
+ EVP_aes_256_gcm() == NULL ||
+ EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
+ EVP_CTRL_GCM_IV_GEN == 0 ||
+ EVP_CTRL_GCM_SET_TAG == 0 ||
+ EVP_CTRL_GCM_GET_TAG == 0 ||
+ EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
+ ]])],
+ [
+ AC_MSG_RESULT([yes])
+ AC_DEFINE([OPENSSL_HAVE_EVPGCM], [1],
+ [libcrypto has EVP AES GCM])
+ ],
+ [
+ AC_MSG_RESULT([no])
+ unsupported_algorithms="$unsupported_cipers \
+ aes128-gcm at openssh.com \
+ aes256-gcm at openssh.com"
+ ]
+ )
-AC_SEARCH_LIBS([EVP_CIPHER_CTX_ctrl], [crypto],
- [AC_DEFINE([HAVE_EVP_CIPHER_CTX_CTRL], [1],
- [Define if libcrypto has EVP_CIPHER_CTX_ctrl])])
+ AC_SEARCH_LIBS([EVP_CIPHER_CTX_ctrl], [crypto],
+ [AC_DEFINE([HAVE_EVP_CIPHER_CTX_CTRL], [1],
+ [Define if libcrypto has EVP_CIPHER_CTX_ctrl])])
-AC_MSG_CHECKING([if EVP_DigestUpdate returns an int])
-AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <string.h>
-#include <openssl/evp.h>
- ]], [[
- if(EVP_DigestUpdate(NULL, NULL,0))
- exit(0);
- ]])],
- [
- AC_MSG_RESULT([yes])
- ],
- [
- AC_MSG_RESULT([no])
- AC_DEFINE([OPENSSL_EVP_DIGESTUPDATE_VOID], [1],
- [Define if EVP_DigestUpdate returns void])
- ]
-)
+ AC_MSG_CHECKING([if EVP_DigestUpdate returns an int])
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <string.h>
+ #include <openssl/evp.h>
+ ]], [[
+ if(EVP_DigestUpdate(NULL, NULL,0))
+ exit(0);
+ ]])],
+ [
+ AC_MSG_RESULT([yes])
+ ],
+ [
+ AC_MSG_RESULT([no])
+ AC_DEFINE([OPENSSL_EVP_DIGESTUPDATE_VOID], [1],
+ [Define if EVP_DigestUpdate returns void])
+ ]
+ )
-# Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
-# because the system crypt() is more featureful.
-if test "x$check_for_libcrypt_before" = "x1"; then
- AC_CHECK_LIB([crypt], [crypt])
-fi
+ # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
+ # because the system crypt() is more featureful.
+ if test "x$check_for_libcrypt_before" = "x1"; then
+ AC_CHECK_LIB([crypt], [crypt])
+ fi
-# Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
-# version in OpenSSL.
-if test "x$check_for_libcrypt_later" = "x1"; then
- AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
-fi
-AC_CHECK_FUNCS([crypt DES_crypt])
+ # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
+ # version in OpenSSL.
+ if test "x$check_for_libcrypt_later" = "x1"; then
+ AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
+ fi
+ AC_CHECK_FUNCS([crypt DES_crypt])
-# Search for SHA256 support in libc and/or OpenSSL
-AC_CHECK_FUNCS([SHA256_Update EVP_sha256], ,
- [unsupported_algorithms="$unsupported_algorithms \
- hmac-sha2-256 hmac-sha2-512 \
- diffie-hellman-group-exchange-sha256 \
- hmac-sha2-256-etm at openssh.com hmac-sha2-512-etm at openssh.com"
- ]
-)
+ # Search for SHA256 support in libc and/or OpenSSL
+ AC_CHECK_FUNCS([SHA256_Update EVP_sha256], ,
+ [unsupported_algorithms="$unsupported_algorithms \
+ hmac-sha2-256 \
+ hmac-sha2-512 \
+ diffie-hellman-group-exchange-sha256 \
+ hmac-sha2-256-etm at openssh.com \
+ hmac-sha2-512-etm at openssh.com"
+ ]
+ )
+ # Search for RIPE-MD support in OpenSSL
+ AC_CHECK_FUNCS([EVP_ripemd160], ,
+ [unsupported_algorithms="$unsupported_algorithms \
+ hmac-ripemd160 \
+ hmac-ripemd160 at openssh.com \
+ hmac-ripemd160-etm at openssh.com"
+ ]
+ )
-# Check complete ECC support in OpenSSL
-AC_MSG_CHECKING([whether OpenSSL has NID_X9_62_prime256v1])
-AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/ecdsa.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
-# error "OpenSSL < 0.9.8g has unreliable ECC code"
-#endif
- ]], [[
- EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
- const EVP_MD *m = EVP_sha256(); /* We need this too */
- ]])],
- [ AC_MSG_RESULT([yes])
- enable_nistp256=1 ],
- [ AC_MSG_RESULT([no]) ]
-)
+ # Check complete ECC support in OpenSSL
+ AC_MSG_CHECKING([whether OpenSSL has NID_X9_62_prime256v1])
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <openssl/ec.h>
+ #include <openssl/ecdh.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/opensslv.h>
+ #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
+ # error "OpenSSL < 0.9.8g has unreliable ECC code"
+ #endif
+ ]], [[
+ EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+ const EVP_MD *m = EVP_sha256(); /* We need this too */
+ ]])],
+ [ AC_MSG_RESULT([yes])
+ enable_nistp256=1 ],
+ [ AC_MSG_RESULT([no]) ]
+ )
-AC_MSG_CHECKING([whether OpenSSL has NID_secp384r1])
-AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/ecdsa.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
-# error "OpenSSL < 0.9.8g has unreliable ECC code"
-#endif
- ]], [[
- EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
- const EVP_MD *m = EVP_sha384(); /* We need this too */
- ]])],
- [ AC_MSG_RESULT([yes])
- enable_nistp384=1 ],
- [ AC_MSG_RESULT([no]) ]
-)
+ AC_MSG_CHECKING([whether OpenSSL has NID_secp384r1])
+ AC_LINK_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <openssl/ec.h>
+ #include <openssl/ecdh.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/opensslv.h>
+ #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
+ # error "OpenSSL < 0.9.8g has unreliable ECC code"
+ #endif
+ ]], [[
+ EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
+ const EVP_MD *m = EVP_sha384(); /* We need this too */
+ ]])],
+ [ AC_MSG_RESULT([yes])
+ enable_nistp384=1 ],
+ [ AC_MSG_RESULT([no]) ]
+ )
-AC_MSG_CHECKING([whether OpenSSL has NID_secp521r1])
-AC_LINK_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/ecdsa.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
-# error "OpenSSL < 0.9.8g has unreliable ECC code"
-#endif
- ]], [[
- EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
- const EVP_MD *m = EVP_sha512(); /* We need this too */
- ]])],
- [ AC_MSG_RESULT([yes])
- AC_MSG_CHECKING([if OpenSSL's NID_secp521r1 is functional])
- AC_RUN_IFELSE(
+ AC_MSG_CHECKING([whether OpenSSL has NID_secp521r1])
+ AC_LINK_IFELSE(
[AC_LANG_PROGRAM([[
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/ecdsa.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/opensslv.h>
- ]],[[
+ #include <openssl/ec.h>
+ #include <openssl/ecdh.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/opensslv.h>
+ #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
+ # error "OpenSSL < 0.9.8g has unreliable ECC code"
+ #endif
+ ]], [[
EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
const EVP_MD *m = EVP_sha512(); /* We need this too */
- exit(e == NULL || m == NULL);
]])],
[ AC_MSG_RESULT([yes])
- enable_nistp521=1 ],
- [ AC_MSG_RESULT([no]) ],
- [ AC_MSG_WARN([cross-compiling: assuming yes])
- enable_nistp521=1 ]
- )],
- AC_MSG_RESULT([no])
-)
+ AC_MSG_CHECKING([if OpenSSL's NID_secp521r1 is functional])
+ AC_RUN_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <openssl/ec.h>
+ #include <openssl/ecdh.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+ #include <openssl/objects.h>
+ #include <openssl/opensslv.h>
+ ]],[[
+ EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
+ const EVP_MD *m = EVP_sha512(); /* We need this too */
+ exit(e == NULL || m == NULL);
+ ]])],
+ [ AC_MSG_RESULT([yes])
+ enable_nistp521=1 ],
+ [ AC_MSG_RESULT([no]) ],
+ [ AC_MSG_WARN([cross-compiling: assuming yes])
+ enable_nistp521=1 ]
+ )],
+ AC_MSG_RESULT([no])
+ )
-COMMENT_OUT_ECC="#no ecc#"
-TEST_SSH_ECC=no
+ COMMENT_OUT_ECC="#no ecc#"
+ TEST_SSH_ECC=no
-if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
- test x$enable_nistp521 = x1; then
- AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC])
-fi
-if test x$enable_nistp256 = x1; then
- AC_DEFINE([OPENSSL_HAS_NISTP256], [1],
- [libcrypto has NID_X9_62_prime256v1])
- TEST_SSH_ECC=yes
- COMMENT_OUT_ECC=""
+ if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
+ test x$enable_nistp521 = x1; then
+ AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC])
+ fi
+ if test x$enable_nistp256 = x1; then
+ AC_DEFINE([OPENSSL_HAS_NISTP256], [1],
+ [libcrypto has NID_X9_62_prime256v1])
+ TEST_SSH_ECC=yes
+ COMMENT_OUT_ECC=""
+ else
+ unsupported_algorithms="$unsupported_algorithms \
+ ecdsa-sha2-nistp256 \
+ ecdh-sha2-nistp256 \
+ ecdsa-sha2-nistp256-cert-v01 at openssh.com"
+ fi
+ if test x$enable_nistp384 = x1; then
+ AC_DEFINE([OPENSSL_HAS_NISTP384], [1], [libcrypto has NID_secp384r1])
+ TEST_SSH_ECC=yes
+ COMMENT_OUT_ECC=""
+ else
+ unsupported_algorithms="$unsupported_algorithms \
+ ecdsa-sha2-nistp384 \
+ ecdh-sha2-nistp384 \
+ ecdsa-sha2-nistp384-cert-v01 at openssh.com"
+ fi
+ if test x$enable_nistp521 = x1; then
+ AC_DEFINE([OPENSSL_HAS_NISTP521], [1], [libcrypto has NID_secp521r1])
+ TEST_SSH_ECC=yes
+ COMMENT_OUT_ECC=""
+ else
+ unsupported_algorithms="$unsupported_algorithms \
+ ecdh-sha2-nistp521 \
+ ecdsa-sha2-nistp521 \
+ ecdsa-sha2-nistp521-cert-v01 at openssh.com"
+ fi
+
+ AC_SUBST([TEST_SSH_ECC])
+ AC_SUBST([COMMENT_OUT_ECC])
else
- unsupported_algorithms="$unsupported_algorithms ecdsa-sha2-nistp256 \
- ecdh-sha2-nistp256 ecdsa-sha2-nistp256-cert-v01 at openssh.com"
+ AC_CHECK_LIB([crypt], [crypt], [LIBS="$LIBS -lcrypt"])
+ AC_CHECK_FUNCS([crypt])
fi
-if test x$enable_nistp384 = x1; then
- AC_DEFINE([OPENSSL_HAS_NISTP384], [1], [libcrypto has NID_secp384r1])
- TEST_SSH_ECC=yes
- COMMENT_OUT_ECC=""
-else
- unsupported_algorithms="$unsupported_algorithms ecdsa-sha2-nistp384 \
- ecdh-sha2-nistp384 ecdsa-sha2-nistp384-cert-v01 at openssh.com"
-fi
-if test x$enable_nistp521 = x1; then
- AC_DEFINE([OPENSSL_HAS_NISTP521], [1], [libcrypto has NID_secp521r1])
- TEST_SSH_ECC=yes
- COMMENT_OUT_ECC=""
-else
- unsupported_algorithms="$unsupported_algorithms ecdh-sha2-nistp521 \
- ecdsa-sha2-nistp521 ecdsa-sha2-nistp521-cert-v01 at openssh.com"
-fi
-AC_SUBST([TEST_SSH_ECC])
-AC_SUBST([COMMENT_OUT_ECC])
+AC_CHECK_FUNCS([ \
+ arc4random \
+ arc4random_buf \
+ arc4random_stir \
+ arc4random_uniform \
+])
saved_LIBS="$LIBS"
AC_CHECK_LIB([iaf], [ia_openinfo], [
@@ -2690,7 +2853,7 @@
LIBS="$LIBS -liaf"
AC_CHECK_FUNCS([set_id], [SSHDLIBS="$SSHDLIBS -liaf"
AC_DEFINE([HAVE_LIBIAF], [1],
- [Define if system has libiaf that supports set_id])
+ [Define if system has libiaf that supports set_id])
])
])
LIBS="$saved_LIBS"
@@ -2698,28 +2861,30 @@
### Configure cryptographic random number support
# Check wheter OpenSSL seeds itself
-AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
-AC_RUN_IFELSE(
- [AC_LANG_PROGRAM([[
-#include <string.h>
-#include <openssl/rand.h>
- ]], [[
- exit(RAND_status() == 1 ? 0 : 1);
- ]])],
- [
- OPENSSL_SEEDS_ITSELF=yes
- AC_MSG_RESULT([yes])
- ],
- [
- AC_MSG_RESULT([no])
- ],
- [
- AC_MSG_WARN([cross compiling: assuming yes])
- # This is safe, since we will fatal() at runtime if
- # OpenSSL is not seeded correctly.
- OPENSSL_SEEDS_ITSELF=yes
- ]
-)
+if test "x$openssl" = "xyes" ; then
+ AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
+ AC_RUN_IFELSE(
+ [AC_LANG_PROGRAM([[
+ #include <string.h>
+ #include <openssl/rand.h>
+ ]], [[
+ exit(RAND_status() == 1 ? 0 : 1);
+ ]])],
+ [
+ OPENSSL_SEEDS_ITSELF=yes
+ AC_MSG_RESULT([yes])
+ ],
+ [
+ AC_MSG_RESULT([no])
+ ],
+ [
+ AC_MSG_WARN([cross compiling: assuming yes])
+ # This is safe, since we will fatal() at runtime if
+ # OpenSSL is not seeded correctly.
+ OPENSSL_SEEDS_ITSELF=yes
+ ]
+ )
+fi
# PRNGD TCP socket
AC_ARG_WITH([prngd-port],
@@ -2801,8 +2966,10 @@
RAND_MSG="PRNGd socket $PRNGD_SOCKET"
elif test ! -z "$OPENSSL_SEEDS_ITSELF" ; then
AC_DEFINE([OPENSSL_PRNG_ONLY], [1],
- [Define if you want OpenSSL's internally seeded PRNG only])
+ [Define if you want the OpenSSL internally seeded PRNG only])
RAND_MSG="OpenSSL internal ONLY"
+elif test "x$openssl" = "xno" ; then
+ AC_MSG_WARN([OpenSSH will use /dev/urandom as a source of random numbers. It will fail if this device is not supported or accessible])
else
AC_MSG_ERROR([OpenSSH has no source of random numbers. Please configure OpenSSL with an entropy source or re-run configure using one of the --with-prngd-port or --with-prngd-socket options])
fi
@@ -2864,11 +3031,18 @@
which takes only one argument to pam_strerror])
AC_MSG_RESULT([yes])
PAM_MSG="yes (old library)"
-
+
])
fi
-SSH_PRIVSEP_USER=sshd
+case "$host" in
+*-*-cygwin*)
+ SSH_PRIVSEP_USER=CYGWIN_SSH_PRIVSEP_USER
+ ;;
+*)
+ SSH_PRIVSEP_USER=sshd
+ ;;
+esac
AC_ARG_WITH([privsep-user],
[ --with-privsep-user=user Specify non-privileged user for privilege separation],
[
@@ -2878,8 +3052,13 @@
fi
]
)
-AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], ["$SSH_PRIVSEP_USER"],
- [non-privileged user for privilege separation])
+if test "x$SSH_PRIVSEP_USER" = "xCYGWIN_SSH_PRIVSEP_USER" ; then
+ AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], [CYGWIN_SSH_PRIVSEP_USER],
+ [Cygwin function to fetch non-privileged user for privilege separation])
+else
+ AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], ["$SSH_PRIVSEP_USER"],
+ [non-privileged user for privilege separation])
+fi
AC_SUBST([SSH_PRIVSEP_USER])
if test "x$have_linux_no_new_privs" = "x1" ; then
@@ -2913,7 +3092,7 @@
# Decide which sandbox style to use
sandbox_arg=""
AC_ARG_WITH([sandbox],
- [ --with-sandbox=style Specify privilege separation sandbox (no, darwin, rlimit, systrace, seccomp_filter, capsicum)],
+ [ --with-sandbox=style Specify privilege separation sandbox (no, capsicum, darwin, rlimit, seccomp_filter, systrace, pledge)],
[
if test "x$withval" = "xyes" ; then
sandbox_arg=""
@@ -3009,7 +3188,13 @@
[AC_MSG_WARN([cross compiling: assuming yes])]
)
-if test "x$sandbox_arg" = "xsystrace" || \
+if test "x$sandbox_arg" = "xpledge" || \
+ ( test -z "$sandbox_arg" && test "x$ac_cv_func_pledge" = "xyes" ) ; then
+ test "x$ac_cv_func_pledge" != "xyes" && \
+ AC_MSG_ERROR([pledge sandbox requires pledge(2) support])
+ SANDBOX_STYLE="pledge"
+ AC_DEFINE([SANDBOX_PLEDGE], [1], [Sandbox using pledge(2)])
+elif test "x$sandbox_arg" = "xsystrace" || \
( test -z "$sandbox_arg" && test "x$have_systr_policy_kill" = "x1" ) ; then
test "x$have_systr_policy_kill" != "x1" && \
AC_MSG_ERROR([systrace sandbox requires systrace headers and SYSTR_POLICY_KILL support])
@@ -3062,6 +3247,10 @@
AC_MSG_ERROR([rlimit sandbox requires select to work with rlimit])
SANDBOX_STYLE="rlimit"
AC_DEFINE([SANDBOX_RLIMIT], [1], [Sandbox using setrlimit(2)])
+elif test "x$sandbox_arg" = "xsolaris" || \
+ ( test -z "$sandbox_arg" && test "x$SOLARIS_PRIVS" = "xyes" ) ; then
+ SANDBOX_STYLE="solaris"
+ AC_DEFINE([SANDBOX_SOLARIS], [1], [Sandbox using Solaris/Illumos privileges])
elif test -z "$sandbox_arg" || test "x$sandbox_arg" = "xno" || \
test "x$sandbox_arg" = "xnone" || test "x$sandbox_arg" = "xnull" ; then
SANDBOX_STYLE="none"
@@ -3190,7 +3379,7 @@
AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ u_int a; a = 1;]])],
- [ ac_cv_have_u_int="yes" ], [ ac_cv_have_u_int="no"
+ [ ac_cv_have_u_int="yes" ], [ ac_cv_have_u_int="no"
])
])
if test "x$ac_cv_have_u_int" = "xyes" ; then
@@ -3201,7 +3390,7 @@
AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ int8_t a; int16_t b; int32_t c; a = b = c = 1;]])],
- [ ac_cv_have_intxx_t="yes" ], [ ac_cv_have_intxx_t="no"
+ [ ac_cv_have_intxx_t="yes" ], [ ac_cv_have_intxx_t="no"
])
])
if test "x$ac_cv_have_intxx_t" = "xyes" ; then
@@ -3218,7 +3407,7 @@
[
AC_DEFINE([HAVE_INTXX_T])
AC_MSG_RESULT([yes])
- ], [ AC_MSG_RESULT([no])
+ ], [ AC_MSG_RESULT([no])
])
fi
@@ -3235,7 +3424,7 @@
]], [[
int64_t a; a = 1;
]])],
- [ ac_cv_have_int64_t="yes" ], [ ac_cv_have_int64_t="no"
+ [ ac_cv_have_int64_t="yes" ], [ ac_cv_have_int64_t="no"
])
])
if test "x$ac_cv_have_int64_t" = "xyes" ; then
@@ -3245,7 +3434,7 @@
AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;]])],
- [ ac_cv_have_u_intxx_t="yes" ], [ ac_cv_have_u_intxx_t="no"
+ [ ac_cv_have_u_intxx_t="yes" ], [ ac_cv_have_u_intxx_t="no"
])
])
if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
@@ -3260,7 +3449,7 @@
[
AC_DEFINE([HAVE_U_INTXX_T])
AC_MSG_RESULT([yes])
- ], [ AC_MSG_RESULT([no])
+ ], [ AC_MSG_RESULT([no])
])
fi
@@ -3267,7 +3456,7 @@
AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ u_int64_t a; a = 1;]])],
- [ ac_cv_have_u_int64_t="yes" ], [ ac_cv_have_u_int64_t="no"
+ [ ac_cv_have_u_int64_t="yes" ], [ ac_cv_have_u_int64_t="no"
])
])
if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
@@ -3284,7 +3473,7 @@
[
AC_DEFINE([HAVE_U_INT64_T])
AC_MSG_RESULT([yes])
- ], [ AC_MSG_RESULT([no])
+ ], [ AC_MSG_RESULT([no])
])
fi
@@ -3298,7 +3487,7 @@
uint32_t c;
a = b = c = 1;
]])],
- [ ac_cv_have_uintxx_t="yes" ], [ ac_cv_have_uintxx_t="no"
+ [ ac_cv_have_uintxx_t="yes" ], [ ac_cv_have_uintxx_t="no"
])
])
if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
@@ -3316,7 +3505,7 @@
[
AC_DEFINE([HAVE_UINTXX_T])
AC_MSG_RESULT([yes])
- ], [ AC_MSG_RESULT([no])
+ ], [ AC_MSG_RESULT([no])
])
fi
@@ -3329,7 +3518,7 @@
[
AC_DEFINE([HAVE_UINTXX_T])
AC_MSG_RESULT([yes])
- ], [ AC_MSG_RESULT([no])
+ ], [ AC_MSG_RESULT([no])
])
fi
@@ -3356,7 +3545,7 @@
AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ u_char foo; foo = 125; ]])],
- [ ac_cv_have_u_char="yes" ], [ ac_cv_have_u_char="no"
+ [ ac_cv_have_u_char="yes" ], [ ac_cv_have_u_char="no"
])
])
if test "x$ac_cv_have_u_char" = "xyes" ; then
@@ -3391,7 +3580,7 @@
AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ size_t foo; foo = 1235; ]])],
- [ ac_cv_have_size_t="yes" ], [ ac_cv_have_size_t="no"
+ [ ac_cv_have_size_t="yes" ], [ ac_cv_have_size_t="no"
])
])
if test "x$ac_cv_have_size_t" = "xyes" ; then
@@ -3401,7 +3590,7 @@
AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ ssize_t foo; foo = 1235; ]])],
- [ ac_cv_have_ssize_t="yes" ], [ ac_cv_have_ssize_t="no"
+ [ ac_cv_have_ssize_t="yes" ], [ ac_cv_have_ssize_t="no"
])
])
if test "x$ac_cv_have_ssize_t" = "xyes" ; then
@@ -3411,7 +3600,7 @@
AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <time.h> ]],
[[ clock_t foo; foo = 1235; ]])],
- [ ac_cv_have_clock_t="yes" ], [ ac_cv_have_clock_t="no"
+ [ ac_cv_have_clock_t="yes" ], [ ac_cv_have_clock_t="no"
])
])
if test "x$ac_cv_have_clock_t" = "xyes" ; then
@@ -3442,7 +3631,7 @@
AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ pid_t foo; foo = 1235; ]])],
- [ ac_cv_have_pid_t="yes" ], [ ac_cv_have_pid_t="no"
+ [ ac_cv_have_pid_t="yes" ], [ ac_cv_have_pid_t="no"
])
])
if test "x$ac_cv_have_pid_t" = "xyes" ; then
@@ -3452,7 +3641,7 @@
AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/types.h> ]],
[[ mode_t foo; foo = 1235; ]])],
- [ ac_cv_have_mode_t="yes" ], [ ac_cv_have_mode_t="no"
+ [ ac_cv_have_mode_t="yes" ], [ ac_cv_have_mode_t="no"
])
])
if test "x$ac_cv_have_mode_t" = "xyes" ; then
@@ -3466,7 +3655,7 @@
#include <sys/socket.h>
]], [[ struct sockaddr_storage s; ]])],
[ ac_cv_have_struct_sockaddr_storage="yes" ],
- [ ac_cv_have_struct_sockaddr_storage="no"
+ [ ac_cv_have_struct_sockaddr_storage="no"
])
])
if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
@@ -3480,7 +3669,7 @@
#include <netinet/in.h>
]], [[ struct sockaddr_in6 s; s.sin6_family = 0; ]])],
[ ac_cv_have_struct_sockaddr_in6="yes" ],
- [ ac_cv_have_struct_sockaddr_in6="no"
+ [ ac_cv_have_struct_sockaddr_in6="no"
])
])
if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
@@ -3494,7 +3683,7 @@
#include <netinet/in.h>
]], [[ struct in6_addr s; s.s6_addr[0] = 0; ]])],
[ ac_cv_have_struct_in6_addr="yes" ],
- [ ac_cv_have_struct_in6_addr="no"
+ [ ac_cv_have_struct_in6_addr="no"
])
])
if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
@@ -3518,7 +3707,7 @@
#include <netdb.h>
]], [[ struct addrinfo s; s.ai_flags = AI_PASSIVE; ]])],
[ ac_cv_have_struct_addrinfo="yes" ],
- [ ac_cv_have_struct_addrinfo="no"
+ [ ac_cv_have_struct_addrinfo="no"
])
])
if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
@@ -3530,7 +3719,7 @@
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/time.h> ]],
[[ struct timeval tv; tv.tv_sec = 1;]])],
[ ac_cv_have_struct_timeval="yes" ],
- [ ac_cv_have_struct_timeval="no"
+ [ ac_cv_have_struct_timeval="no"
])
])
if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
@@ -3638,7 +3827,7 @@
#include <sys/socket.h>
]], [[ struct sockaddr_storage s; s.__ss_family = 1; ]])],
[ ac_cv_have___ss_family_in_struct_ss="yes" ],
- [ ac_cv_have___ss_family_in_struct_ss="no"
+ [ ac_cv_have___ss_family_in_struct_ss="no"
])
])
if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
@@ -3737,7 +3926,7 @@
AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
[[ extern char *__progname; printf("%s", __progname); ]])],
[ ac_cv_libc_defines___progname="yes" ],
- [ ac_cv_libc_defines___progname="no"
+ [ ac_cv_libc_defines___progname="no"
])
])
if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
@@ -3748,7 +3937,7 @@
AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
[[ printf("%s", __FUNCTION__); ]])],
[ ac_cv_cc_implements___FUNCTION__="yes" ],
- [ ac_cv_cc_implements___FUNCTION__="no"
+ [ ac_cv_cc_implements___FUNCTION__="no"
])
])
if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
@@ -3760,7 +3949,7 @@
AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h> ]],
[[ printf("%s", __func__); ]])],
[ ac_cv_cc_implements___func__="yes" ],
- [ ac_cv_cc_implements___func__="no"
+ [ ac_cv_cc_implements___func__="no"
])
])
if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
@@ -3773,7 +3962,7 @@
va_list x,y;
]], [[ va_copy(x,y); ]])],
[ ac_cv_have_va_copy="yes" ],
- [ ac_cv_have_va_copy="no"
+ [ ac_cv_have_va_copy="no"
])
])
if test "x$ac_cv_have_va_copy" = "xyes" ; then
@@ -3785,7 +3974,7 @@
#include <stdarg.h>
va_list x,y;
]], [[ __va_copy(x,y); ]])],
- [ ac_cv_have___va_copy="yes" ], [ ac_cv_have___va_copy="no"
+ [ ac_cv_have___va_copy="yes" ], [ ac_cv_have___va_copy="no"
])
])
if test "x$ac_cv_have___va_copy" = "xyes" ; then
@@ -3797,7 +3986,7 @@
AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include <getopt.h> ]],
[[ extern int optreset; optreset = 0; ]])],
[ ac_cv_have_getopt_optreset="yes" ],
- [ ac_cv_have_getopt_optreset="no"
+ [ ac_cv_have_getopt_optreset="no"
])
])
if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
@@ -3809,7 +3998,7 @@
AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
[[ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);]])],
[ ac_cv_libc_defines_sys_errlist="yes" ],
- [ ac_cv_libc_defines_sys_errlist="no"
+ [ ac_cv_libc_defines_sys_errlist="no"
])
])
if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
@@ -3822,7 +4011,7 @@
AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],
[[ extern int sys_nerr; printf("%i", sys_nerr);]])],
[ ac_cv_libc_defines_sys_nerr="yes" ],
- [ ac_cv_libc_defines_sys_nerr="no"
+ [ ac_cv_libc_defines_sys_nerr="no"
])
])
if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
@@ -3885,7 +4074,10 @@
#include <arpa/nameser.h>
#include <resolv.h>
extern struct __res_state _res;
- ]], [[ ]])],
+ ]], [[
+struct __res_state *volatile p = &_res; /* force resolution of _res */
+return 0;
+ ]],)],
[AC_MSG_RESULT([yes])
AC_DEFINE([HAVE__RES_EXTERN], [1],
[Define if you have struct __res_state _res as an extern])
@@ -3978,7 +4170,6 @@
[K5LIBS="$K5LIBS -ldes"])
], [ AC_MSG_RESULT([no])
K5LIBS="-lkrb5 -lk5crypto -lcom_err"
-
])
AC_SEARCH_LIBS([dn_expand], [resolv])
@@ -4161,7 +4352,7 @@
exit(0);
]])],
[
- maildir_what=`awk -F: '{print $1}' conftest.maildir`
+ maildir_what=`awk -F: '{print $1}' conftest.maildir`
maildir=`awk -F: '{print $2}' conftest.maildir \
| sed 's|/$||'`
AC_MSG_RESULT([Using: $maildir from $maildir_what])
@@ -4299,7 +4490,7 @@
else
DISPLAY_HACK_MSG="no"
AC_ARG_WITH([ipaddr-display],
- [ --with-ipaddr-display Use ip address instead of hostname in \$DISPLAY],
+ [ --with-ipaddr-display Use ip address instead of hostname in $DISPLAY],
[
if test "x$withval" != "xno" ; then
AC_DEFINE([IPADDR_IN_DISPLAY])
@@ -4345,7 +4536,7 @@
# Whether to mess with the default path
SERVER_PATH_MSG="(default)"
AC_ARG_WITH([default-path],
- [ --with-default-path= Specify default \$PATH environment for server],
+ [ --with-default-path= Specify default $PATH environment for server],
[
if test "x$external_path_file" = "x/etc/login.conf" ; then
AC_MSG_WARN([
@@ -4506,7 +4697,7 @@
]
)
-AC_DEFINE_UNQUOTED([_PATH_SSH_PIDDIR], ["$piddir"],
+AC_DEFINE_UNQUOTED([_PATH_SSH_PIDDIR], ["$piddir"],
[Specify location of ssh.pid])
AC_SUBST([piddir])
@@ -4664,7 +4855,7 @@
]], [[ char *utmp = UTMP_FILE; ]])],
[ AC_MSG_RESULT([yes]) ],
[ AC_MSG_RESULT([no])
- system_utmp_path=no
+ system_utmp_path=no
])
if test -z "$conf_utmp_location"; then
if test x"$system_utmp_path" = x"no" ; then
@@ -4694,7 +4885,7 @@
]], [[ char *wtmp = WTMP_FILE; ]])],
[ AC_MSG_RESULT([yes]) ],
[ AC_MSG_RESULT([no])
- system_wtmp_path=no
+ system_wtmp_path=no
])
if test -z "$conf_wtmp_location"; then
if test x"$system_wtmp_path" = x"no" ; then
@@ -4727,7 +4918,7 @@
]], [[ char *wtmpx = WTMPX_FILE; ]])],
[ AC_MSG_RESULT([yes]) ],
[ AC_MSG_RESULT([no])
- system_wtmpx_path=no
+ system_wtmpx_path=no
])
if test -z "$conf_wtmpx_location"; then
if test x"$system_wtmpx_path" = x"no" ; then
@@ -4844,11 +5035,11 @@
echo " SELinux support: $SELINUX_MSG"
echo " Smartcard support: $SCARD_MSG"
echo " S/KEY support: $SKEY_MSG"
-echo " TCP Wrappers support: $TCPW_MSG"
echo " MD5 password support: $MD5_MSG"
echo " libedit support: $LIBEDIT_MSG"
echo " Solaris process contract support: $SPC_MSG"
echo " Solaris project support: $SP_MSG"
+echo " Solaris privilege support: $SPP_MSG"
echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
echo " BSD Auth support: $BSD_AUTH_MSG"
Modified: trunk/crypto/openssh/contrib/Makefile
===================================================================
--- trunk/crypto/openssh/contrib/Makefile 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/Makefile 2016-11-05 20:36:34 UTC (rev 9223)
@@ -4,12 +4,12 @@
@echo "Valid targets: gnome-ssh-askpass1 gnome-ssh-askpass2"
gnome-ssh-askpass1: gnome-ssh-askpass1.c
- $(CC) `gnome-config --cflags gnome gnomeui` \
+ $(CC) $(CFLAGS) `gnome-config --cflags gnome gnomeui` \
gnome-ssh-askpass1.c -o gnome-ssh-askpass1 \
`gnome-config --libs gnome gnomeui`
gnome-ssh-askpass2: gnome-ssh-askpass2.c
- $(CC) `$(PKG_CONFIG) --cflags gtk+-2.0` \
+ $(CC) $(CFLAGS) `$(PKG_CONFIG) --cflags gtk+-2.0` \
gnome-ssh-askpass2.c -o gnome-ssh-askpass2 \
`$(PKG_CONFIG) --libs gtk+-2.0 x11`
Modified: trunk/crypto/openssh/contrib/README
===================================================================
--- trunk/crypto/openssh/contrib/README 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/README 2016-11-05 20:36:34 UTC (rev 9223)
@@ -11,7 +11,7 @@
https CONNECT style proxy server. His page for connect.c has extensive
documentation on its use as well as compiled versions for Win32.
-http://www.taiyo.co.jp/~gotoh/ssh/connect.html
+https://bitbucket.org/gotoh/connect/wiki/Home
X11 SSH Askpass:
Modified: trunk/crypto/openssh/contrib/cygwin/README
===================================================================
--- trunk/crypto/openssh/contrib/cygwin/README 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/cygwin/README 2016-11-05 20:36:34 UTC (rev 9223)
@@ -25,6 +25,7 @@
--yes -y Answer all questions with "yes" automatically.
--no -n Answer all questions with "no" automatically.
--cygwin -c <options> Use "options" as value for CYGWIN environment var.
+ --name -N <name> sshd windows service name.
--port -p <n> sshd listens on port n.
--user -u <account> privileged user for service, default 'cyg_server'.
--pwd -w <passwd> Use "pwd" as password for privileged user.
@@ -69,7 +70,7 @@
Building from source is easy. Just unpack the source archive, cd to that
directory, and call cygport:
- cygport openssh.cygport almostall
+ cygport openssh.cygport all
You must have installed the following packages to be able to build OpenSSH
with the aforementioned cygport script:
@@ -77,7 +78,6 @@
zlib
crypt
openssl-devel
- libwrap-devel
libedit-devel
libkrb5-devel
Modified: trunk/crypto/openssh/contrib/cygwin/ssh-host-config
===================================================================
--- trunk/crypto/openssh/contrib/cygwin/ssh-host-config 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/cygwin/ssh-host-config 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,6 +1,6 @@
#!/bin/bash
#
-# ssh-host-config, Copyright 2000-2011 Red Hat Inc.
+# ssh-host-config, Copyright 2000-2014 Red Hat Inc.
#
# This file is part of the Cygwin port of OpenSSH.
#
@@ -34,9 +34,9 @@
/usr/bin/mv coreutils
/usr/bin/rm coreutils
/usr/bin/cygpath cygwin
+ /usr/bin/mkpasswd cygwin
/usr/bin/mount cygwin
/usr/bin/ps cygwin
- /usr/bin/setfacl cygwin
/usr/bin/umount cygwin
/usr/bin/cmp diffutils
/usr/bin/grep grep
@@ -59,8 +59,10 @@
SYSCONFDIR=/etc
LOCALSTATEDIR=/var
+sshd_config_configured=no
port_number=22
-privsep_configured=no
+service_name=sshd
+strictmodes=yes
privsep_used=yes
cygwin_value=""
user_account=
@@ -89,28 +91,8 @@
# Depends on the above mount
_wservices=`cygpath -w "${_services}"`
- # Remove sshd 22/port from services
- if [ `/usr/bin/grep -q 'sshd[ \t][ \t]*22' "${_services}"; echo $?` -eq 0 ]
- then
- /usr/bin/grep -v 'sshd[ \t][ \t]*22' "${_services}" > "${_serv_tmp}"
- if [ -f "${_serv_tmp}" ]
- then
- if /usr/bin/mv "${_serv_tmp}" "${_services}"
- then
- csih_inform "Removing sshd from ${_wservices}"
- else
- csih_warning "Removing sshd from ${_wservices} failed!"
- let ++ret
- fi
- /usr/bin/rm -f "${_serv_tmp}"
- else
- csih_warning "Removing sshd from ${_wservices} failed!"
- let ++ret
- fi
- fi
-
# Add ssh 22/tcp and ssh 22/udp to services
- if [ `/usr/bin/grep -q 'ssh[ \t][ \t]*22' "${_services}"; echo $?` -ne 0 ]
+ if [ `/usr/bin/grep -q 'ssh[[:space:]][[:space:]]*22' "${_services}"; echo $?` -ne 0 ]
then
if /usr/bin/awk '{ if ( $2 ~ /^23\/tcp/ ) print "ssh 22/tcp'"${_spaces}"'SSH Remote Login Protocol\nssh 22/udp'"${_spaces}"'SSH Remote Login Protocol"; print $0; }' < "${_services}" > "${_serv_tmp}"
then
@@ -132,17 +114,45 @@
} # --- End of update_services_file --- #
# ======================================================================
+# Routine: sshd_strictmodes
+# MODIFIES: strictmodes
+# ======================================================================
+sshd_strictmodes() {
+ if [ "${sshd_config_configured}" != "yes" ]
+ then
+ echo
+ csih_inform "StrictModes is set to 'yes' by default."
+ csih_inform "This is the recommended setting, but it requires that the POSIX"
+ csih_inform "permissions of the user's home directory, the user's .ssh"
+ csih_inform "directory, and the user's ssh key files are tight so that"
+ csih_inform "only the user has write permissions."
+ csih_inform "On the other hand, StrictModes don't work well with default"
+ csih_inform "Windows permissions of a home directory mounted with the"
+ csih_inform "'noacl' option, and they don't work at all if the home"
+ csih_inform "directory is on a FAT or FAT32 partition."
+ if ! csih_request "Should StrictModes be used?"
+ then
+ strictmodes=no
+ fi
+ fi
+ return 0
+}
+
+# ======================================================================
# Routine: sshd_privsep
-# MODIFIES: privsep_configured privsep_used
+# MODIFIES: privsep_used
# ======================================================================
sshd_privsep() {
- local sshdconfig_tmp
local ret=0
- if [ "${privsep_configured}" != "yes" ]
+ if [ "${sshd_config_configured}" != "yes" ]
then
- csih_inform "Privilege separation is set to yes by default since OpenSSH 3.3."
- csih_inform "However, this requires a non-privileged account called 'sshd'."
+ echo
+ csih_inform "Privilege separation is set to 'sandbox' by default since"
+ csih_inform "OpenSSH 6.1. This is unsupported by Cygwin and has to be set"
+ csih_inform "to 'yes' or 'no'."
+ csih_inform "However, using privilege separation requires a non-privileged account"
+ csih_inform "called 'sshd'."
csih_inform "For more info on privilege separation read /usr/share/doc/openssh/README.privsep."
if csih_request "Should privilege separation be used?"
then
@@ -159,36 +169,53 @@
privsep_used=no
fi
fi
+ return $ret
+} # --- End of sshd_privsep --- #
- # Create default sshd_config from skeleton files in /etc/defaults/etc or
- # modify to add the missing privsep configuration option
- if /usr/bin/cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1
+# ======================================================================
+# Routine: sshd_config_tweak
+# ======================================================================
+sshd_config_tweak() {
+ local ret=0
+
+ # Modify sshd_config
+ csih_inform "Updating ${SYSCONFDIR}/sshd_config file"
+ if [ "${port_number}" -ne 22 ]
then
- csih_inform "Updating ${SYSCONFDIR}/sshd_config file"
- sshdconfig_tmp=${SYSCONFDIR}/sshd_config.$$
- /usr/bin/sed -e "s/^#UsePrivilegeSeparation yes/UsePrivilegeSeparation ${privsep_used}/
- s/^#Port 22/Port ${port_number}/
- s/^#StrictModes yes/StrictModes no/" \
- < ${SYSCONFDIR}/sshd_config \
- > "${sshdconfig_tmp}"
- if ! /usr/bin/mv "${sshdconfig_tmp}" ${SYSCONFDIR}/sshd_config
+ /usr/bin/sed -i -e "s/^#\?[[:space:]]*Port[[:space:]].*/Port ${port_number}/" \
+ ${SYSCONFDIR}/sshd_config
+ if [ $? -ne 0 ]
then
- csih_warning "Setting privilege separation to 'yes' failed!"
- csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
- let ++ret
+ csih_warning "Setting listening port to ${port_number} failed!"
+ csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
+ let ++ret
fi
- elif [ "${privsep_configured}" != "yes" ]
+ fi
+ if [ "${strictmodes}" = "no" ]
then
- echo >> ${SYSCONFDIR}/sshd_config
- if ! echo "UsePrivilegeSeparation ${privsep_used}" >> ${SYSCONFDIR}/sshd_config
+ /usr/bin/sed -i -e "s/^#\?[[:space:]]*StrictModes[[:space:]].*/StrictModes no/" \
+ ${SYSCONFDIR}/sshd_config
+ if [ $? -ne 0 ]
then
- csih_warning "Setting privilege separation to 'yes' failed!"
- csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
- let ++ret
+ csih_warning "Setting StrictModes to 'no' failed!"
+ csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
+ let ++ret
fi
fi
+ if [ "${sshd_config_configured}" != "yes" ]
+ then
+ /usr/bin/sed -i -e "
+ s/^#\?UsePrivilegeSeparation .*/UsePrivilegeSeparation ${privsep_used}/" \
+ ${SYSCONFDIR}/sshd_config
+ if [ $? -ne 0 ]
+ then
+ csih_warning "Setting privilege separation failed!"
+ csih_warning "Check your ${SYSCONFDIR}/sshd_config file!"
+ let ++ret
+ fi
+ fi
return $ret
-} # --- End of sshd_privsep --- #
+} # --- End of sshd_config_tweak --- #
# ======================================================================
# Routine: update_inetd_conf
@@ -207,11 +234,11 @@
# we have inetutils-1.5 inetd.d support
if [ -f "${_inetcnf}" ]
then
- /usr/bin/grep -q '^[ \t]*ssh' "${_inetcnf}" && _with_comment=0
+ /usr/bin/grep -q '^[[:space:]]*ssh' "${_inetcnf}" && _with_comment=0
# check for sshd OR ssh in top-level inetd.conf file, and remove
# will be replaced by a file in inetd.d/
- if [ `/usr/bin/grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -eq 0 ]
+ if [ $(/usr/bin/grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?) -eq 0 ]
then
/usr/bin/grep -v '^[# \t]*ssh' "${_inetcnf}" >> "${_inetcnf_tmp}"
if [ -f "${_inetcnf_tmp}" ]
@@ -236,9 +263,9 @@
then
if [ "${_with_comment}" -eq 0 ]
then
- /usr/bin/sed -e 's/@COMMENT@[ \t]*//' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}"
+ /usr/bin/sed -e 's/@COMMENT@[[:space:]]*//' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}"
else
- /usr/bin/sed -e 's/@COMMENT@[ \t]*/# /' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}"
+ /usr/bin/sed -e 's/@COMMENT@[[:space:]]*/# /' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}"
fi
if /usr/bin/mv "${_sshd_inetd_conf_tmp}" "${_sshd_inetd_conf}"
then
@@ -251,13 +278,13 @@
elif [ -f "${_inetcnf}" ]
then
- /usr/bin/grep -q '^[ \t]*sshd' "${_inetcnf}" && _with_comment=0
+ /usr/bin/grep -q '^[[:space:]]*sshd' "${_inetcnf}" && _with_comment=0
# check for sshd in top-level inetd.conf file, and remove
# will be replaced by a file in inetd.d/
- if [ `/usr/bin/grep -q '^[# \t]*sshd' "${_inetcnf}"; echo $?` -eq 0 ]
+ if [ `/usr/bin/grep -q '^#\?[[:space:]]*sshd' "${_inetcnf}"; echo $?` -eq 0 ]
then
- /usr/bin/grep -v '^[# \t]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}"
+ /usr/bin/grep -v '^#\?[[:space:]]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}"
if [ -f "${_inetcnf_tmp}" ]
then
if /usr/bin/mv "${_inetcnf_tmp}" "${_inetcnf}"
@@ -305,24 +332,31 @@
if [ -z "${run_service_as}" ]
then
- accnt_name=$(/usr/bin/cygrunsrv -VQ sshd | /usr/bin/sed -ne 's/^Account *: *//gp')
+ accnt_name=$(/usr/bin/cygrunsrv -VQ sshd |
+ /usr/bin/sed -ne 's/^Account *: *//gp')
if [ "${accnt_name}" = "LocalSystem" ]
then
# Convert "LocalSystem" to "SYSTEM" as is the correct account name
- accnt_name="SYSTEM:"
- elif [[ "${accnt_name}" =~ ^\.\\ ]]
- then
- # Convert "." domain to local machine name
- accnt_name="U-${COMPUTERNAME}${accnt_name#.},"
+ run_service_as="SYSTEM"
+ else
+ dom="${accnt_name%%\\*}"
+ accnt_name="${accnt_name#*\\}"
+ if [ "${dom}" = '.' ]
+ then
+ # Check local account
+ run_service_as=$(/usr/bin/mkpasswd -l -u "${accnt_name}" |
+ /usr/bin/awk -F: '{print $1;}')
+ else
+ # Check domain
+ run_service_as=$(/usr/bin/mkpasswd -d "${dom}" -u "${accnt_name}" |
+ /usr/bin/awk -F: '{print $1;}')
+ fi
fi
- run_service_as=$(/usr/bin/grep -Fi "${accnt_name}" /etc/passwd | /usr/bin/awk -F: '{print $1;}')
if [ -z "${run_service_as}" ]
then
- csih_warning "Couldn't determine name of user running sshd service from /etc/passwd!"
+ csih_warning "Couldn't determine name of user running sshd service from account database!"
csih_warning "As a result, this script cannot make sure that the files used"
csih_warning "by the sshd service belong to the user running the service."
- csih_warning "Please re-run the mkpasswd tool to make sure the /etc/passwd"
- csih_warning "file is in a good shape."
return 1
fi
fi
@@ -375,7 +409,7 @@
local ret=0
echo
- if /usr/bin/cygrunsrv -Q sshd >/dev/null 2>&1
+ if /usr/bin/cygrunsrv -Q ${service_name} >/dev/null 2>&1
then
csih_inform "Sshd service is already installed."
check_service_files_ownership "" || let ret+=$?
@@ -431,7 +465,7 @@
fi
if [ -z "${password}" ]
then
- if /usr/bin/cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
+ if /usr/bin/cygrunsrv -I ${service_name} -d "CYGWIN ${service_name}" -p /usr/sbin/sshd \
-a "-D" -y tcpip "${cygwin_env[@]}"
then
echo
@@ -441,7 +475,7 @@
csih_inform "will start automatically after the next reboot."
fi
else
- if /usr/bin/cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
+ if /usr/bin/cygrunsrv -I ${service_name} -d "CYGWIN ${service_name}" -p /usr/sbin/sshd \
-a "-D" -y tcpip "${cygwin_env[@]}" \
-u "${run_service_as}" -w "${password}"
then
@@ -448,13 +482,13 @@
/usr/bin/editrights -u "${run_service_as}" -a SeServiceLogonRight
echo
csih_inform "The sshd service has been installed under the '${run_service_as}'"
- csih_inform "account. To start the service now, call \`net start sshd' or"
- csih_inform "\`cygrunsrv -S sshd'. Otherwise, it will start automatically"
+ csih_inform "account. To start the service now, call \`net start ${service_name}' or"
+ csih_inform "\`cygrunsrv -S ${service_name}'. Otherwise, it will start automatically"
csih_inform "after the next reboot."
fi
fi
- if /usr/bin/cygrunsrv -Q sshd >/dev/null 2>&1
+ if /usr/bin/cygrunsrv -Q ${service_name} >/dev/null 2>&1
then
check_service_files_ownership "${run_service_as}" || let ret+=$?
else
@@ -528,6 +562,11 @@
shift
;;
+ -N | --name )
+ service_name=$1
+ shift
+ ;;
+
-p | --port )
port_number=$1
shift
@@ -557,6 +596,7 @@
echo " --yes -y Answer all questions with \"yes\" automatically."
echo " --no -n Answer all questions with \"no\" automatically."
echo " --cygwin -c <options> Use \"options\" as value for CYGWIN environment var."
+ echo " --name -N <name> sshd windows service name."
echo " --port -p <n> sshd listens on port n."
echo " --user -u <account> privileged user for service, default 'cyg_server'."
echo " --pwd -w <passwd> Use \"pwd\" as password for privileged user."
@@ -590,10 +630,7 @@
csih_warning "However, it seems your account does not have these privileges."
csih_warning "Here's the list of groups in your user token:"
echo
- for i in $(/usr/bin/id -G)
- do
- /usr/bin/awk -F: "/[^:]*:[^:]*:$i:/{ print \" \" \$1; }" /etc/group
- done
+ /usr/bin/id -Gnz | xargs -0n1 echo " "
echo
csih_warning "This usually means you're running this script from a non-admin"
csih_warning "desktop session, or in a non-elevated shell under UAC control."
@@ -615,32 +652,6 @@
warning_cnt=0
-# Check for ${SYSCONFDIR} directory
-csih_make_dir "${SYSCONFDIR}" "Cannot create global configuration files."
-if ! /usr/bin/chmod 775 "${SYSCONFDIR}" >/dev/null 2>&1
-then
- csih_warning "Can't set permissions on ${SYSCONFDIR}!"
- let ++warning_cnt
-fi
-if ! /usr/bin/setfacl -m u:system:rwx "${SYSCONFDIR}" >/dev/null 2>&1
-then
- csih_warning "Can't set extended permissions on ${SYSCONFDIR}!"
- let ++warning_cnt
-fi
-
-# Check for /var/log directory
-csih_make_dir "${LOCALSTATEDIR}/log" "Cannot create log directory."
-if ! /usr/bin/chmod 775 "${LOCALSTATEDIR}/log" >/dev/null 2>&1
-then
- csih_warning "Can't set permissions on ${LOCALSTATEDIR}/log!"
- let ++warning_cnt
-fi
-if ! /usr/bin/setfacl -m u:system:rwx "${LOCALSTATEDIR}/log" >/dev/null 2>&1
-then
- csih_warning "Can't set extended permissions on ${LOCALSTATEDIR}/log!"
- let ++warning_cnt
-fi
-
# Create /var/log/lastlog if not already exists
if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ]
then
@@ -665,13 +676,9 @@
csih_warning "Can't set permissions on ${LOCALSTATEDIR}/empty!"
let ++warning_cnt
fi
-if ! /usr/bin/setfacl -m u:system:rwx "${LOCALSTATEDIR}/empty" >/dev/null 2>&1
-then
- csih_warning "Can't set extended permissions on ${LOCALSTATEDIR}/empty!"
- let ++warning_cnt
-fi
# generate missing host keys
+csih_inform "Generating missing SSH host keys"
/usr/bin/ssh-keygen -A || let warning_cnt+=$?
# handle ssh_config
@@ -690,10 +697,11 @@
csih_install_config "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults" || let ++warning_cnt
if ! /usr/bin/cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1
then
- /usr/bin/grep -q UsePrivilegeSeparation ${SYSCONFDIR}/sshd_config && privsep_configured=yes
+ sshd_config_configured=yes
fi
+sshd_strictmodes || let warning_cnt+=$?
sshd_privsep || let warning_cnt+=$?
-
+sshd_config_tweak || let warning_cnt+=$?
update_services_file || let warning_cnt+=$?
update_inetd_conf || let warning_cnt+=$?
install_service || let warning_cnt+=$?
Modified: trunk/crypto/openssh/contrib/cygwin/ssh-user-config
===================================================================
--- trunk/crypto/openssh/contrib/cygwin/ssh-user-config 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/cygwin/ssh-user-config 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,6 +1,6 @@
#!/bin/bash
#
-# ssh-user-config, Copyright 2000-2008 Red Hat Inc.
+# ssh-user-config, Copyright 2000-2014 Red Hat Inc.
#
# This file is part of the Cygwin port of OpenSSH.
#
@@ -75,12 +75,11 @@
# pwdhome
# ======================================================================
check_user_homedir() {
- local uid=$(id -u)
- pwdhome=$(awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < ${SYSCONFDIR}/passwd)
+ pwdhome=$(getent passwd $UID | awk -F: '{ print $6; }')
if [ "X${pwdhome}" = "X" ]
then
csih_error_multi \
- "There is no home directory set for you in ${SYSCONFDIR}/passwd." \
+ "There is no home directory set for you in the account database." \
'Setting $HOME is not sufficient!'
fi
@@ -87,7 +86,7 @@
if [ ! -d "${pwdhome}" ]
then
csih_error_multi \
- "${pwdhome} is set in ${SYSCONFDIR}/passwd as your home directory" \
+ "${pwdhome} is set in the account database as your home directory" \
'but it is not a valid directory. Cannot create user identity files.'
fi
@@ -96,7 +95,7 @@
if [ "X${pwdhome}" = "X/" ]
then
# But first raise a warning!
- csih_warning "Your home directory in ${SYSCONFDIR}/passwd is set to root (/). This is not recommended!"
+ csih_warning "Your home directory in the account database is set to root (/). This is not recommended!"
if csih_request "Would you like to proceed anyway?"
then
pwdhome=''
@@ -106,7 +105,7 @@
fi
fi
- if [ -d "${pwdhome}" -a csih_is_nt -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ]
+ if [ -d "${pwdhome}" -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ]
then
echo
csih_warning 'group and other have been revoked write permission to your home'
@@ -149,9 +148,10 @@
# pwdhome -- check_user_homedir()
# ======================================================================
fix_authorized_keys_perms() {
- if [ csih_is_nt -a -e "${pwdhome}/.ssh/authorized_keys" ]
+ if [ -e "${pwdhome}/.ssh/authorized_keys" ]
then
- if ! setfacl -m "u::rw-,g::---,o::---" "${pwdhome}/.ssh/authorized_keys"
+ setfacl -b "${pwdhome}/.ssh/authorized_keys" 2>/dev/null || echo -n
+ if ! chmod u-x,g-wx,o-wx "${pwdhome}/.ssh/authorized_keys"
then
csih_warning "Setting correct permissions to ${pwdhome}/.ssh/authorized_keys"
csih_warning "failed. Please care for the correct permissions. The minimum requirement"
@@ -243,15 +243,6 @@
# Action!
# ======================================================================
-# Check passwd file
-if [ ! -f ${SYSCONFDIR}/passwd ]
-then
- csih_error_multi \
- "${SYSCONFDIR}/passwd is nonexistant. Please generate an ${SYSCONFDIR}/passwd file" \
- 'first using mkpasswd. Check if it contains an entry for you and' \
- 'please care for the home directory in your entry as well.'
-fi
-
check_user_homedir
check_user_dot_ssh_dir
create_identity id_rsa rsa "SSH2 RSA"
Modified: trunk/crypto/openssh/contrib/redhat/openssh.spec
===================================================================
--- trunk/crypto/openssh/contrib/redhat/openssh.spec 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/redhat/openssh.spec 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-%define ver 6.6p1
+%define ver 7.3p1
%define rel 1
# OpenSSH privilege separation requires a user & group ID
@@ -86,10 +86,10 @@
%else
Requires: initscripts >= 5.20
%endif
-BuildRequires: perl, openssl-devel, tcp_wrappers
+BuildRequires: perl, openssl-devel
BuildRequires: /bin/login
%if ! %{build6x}
-BuildPreReq: glibc-devel, pam
+BuildRequires: glibc-devel, pam
%else
BuildRequires: /usr/include/security/pam_appl.h
%endif
@@ -184,7 +184,7 @@
%endif
%if %{kerberos5}
-K5DIR=`rpm -ql krb5-devel | grep include/krb5.h | sed 's,\/include\/krb5.h,,'`
+K5DIR=`rpm -ql krb5-devel | grep 'include/krb5\.h' | sed 's,\/include\/krb5.h,,'`
echo K5DIR=$K5DIR
%endif
@@ -192,8 +192,6 @@
--sysconfdir=%{_sysconfdir}/ssh \
--libexecdir=%{_libexecdir}/openssh \
--datadir=%{_datadir}/openssh \
- --with-tcp-wrappers \
- --with-rsh=%{_bindir}/rsh \
--with-default-path=/usr/local/bin:/bin:/usr/bin \
--with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
--with-privsep-path=%{_var}/empty/sshd \
@@ -360,8 +358,6 @@
%attr(0644,root,root) %{_mandir}/man1/ssh.1*
%attr(0644,root,root) %{_mandir}/man5/ssh_config.5*
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
-%attr(-,root,root) %{_bindir}/slogin
-%attr(-,root,root) %{_mandir}/man1/slogin.1*
%if ! %{rescue}
%attr(2755,root,nobody) %{_bindir}/ssh-agent
%attr(0755,root,root) %{_bindir}/ssh-add
Modified: trunk/crypto/openssh/contrib/ssh-copy-id
===================================================================
--- trunk/crypto/openssh/contrib/ssh-copy-id 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/ssh-copy-id 2016-11-05 20:36:34 UTC (rev 9223)
@@ -56,10 +56,13 @@
fi
fi
-DEFAULT_PUB_ID_FILE=$(ls -t ${HOME}/.ssh/id*.pub 2>/dev/null | grep -v -- '-cert.pub$' | head -n 1)
+DEFAULT_PUB_ID_FILE="$HOME/$(cd "$HOME" ; ls -t .ssh/id*.pub 2>/dev/null | grep -v -- '-cert.pub$' | head -n 1)"
usage () {
- printf 'Usage: %s [-h|-?|-n] [-i [identity_file]] [-p port] [[-o <ssh -o options>] ...] [user@]hostname\n' "$0" >&2
+ printf 'Usage: %s [-h|-?|-f|-n] [-i [identity_file]] [-p port] [[-o <ssh -o options>] ...] [user@]hostname\n' "$0" >&2
+ printf '\t-f: force mode -- copy keys without trying to check if they are already installed\n' >&2
+ printf '\t-n: dry run -- no keys are actually copied\n' >&2
+ printf '\t-h|-?: print this help\n' >&2
exit 1
}
@@ -77,15 +80,18 @@
PUB_ID_FILE="$L_ID_FILE.pub"
fi
- PRIV_ID_FILE=$(dirname "$PUB_ID_FILE")/$(basename "$PUB_ID_FILE" .pub)
+ [ "$FORCED" ] || PRIV_ID_FILE=$(dirname "$PUB_ID_FILE")/$(basename "$PUB_ID_FILE" .pub)
# check that the files are readable
- for f in $PUB_ID_FILE $PRIV_ID_FILE ; do
- ErrMSG=$( { : < $f ; } 2>&1 ) || {
- printf "\n%s: ERROR: failed to open ID file '%s': %s\n\n" "$0" "$f" "$(printf "%s\n" "$ErrMSG" | sed -e 's/.*: *//')"
+ for f in "$PUB_ID_FILE" ${PRIV_ID_FILE:+"$PRIV_ID_FILE"} ; do
+ ErrMSG=$( { : < "$f" ; } 2>&1 ) || {
+ local L_PRIVMSG=""
+ [ "$f" = "$PRIV_ID_FILE" ] && L_PRIVMSG=" (to install the contents of '$PUB_ID_FILE' anyway, look at the -f option)"
+ printf "\n%s: ERROR: failed to open ID file '%s': %s\n" "$0" "$f" "$(printf "%s\n%s\n" "$ErrMSG" "$L_PRIVMSG" | sed -e 's/.*: *//')"
exit 1
}
done
+ printf '%s: INFO: Source of key(s) to be installed: "%s"\n' "$0" "$PUB_ID_FILE" >&2
GET_ID="cat \"$PUB_ID_FILE\""
}
@@ -121,7 +127,7 @@
}
shift
;;
- -n|-h|-\?)
+ -f|-n|-h|-\?)
OPT="$1"
OPTARG=
shift
@@ -154,6 +160,9 @@
-o|-p)
SSH_OPTS="${SSH_OPTS:+$SSH_OPTS }$OPT '$(quote "$OPTARG")'"
;;
+ -f)
+ FORCED=1
+ ;;
-n)
DRY_RUN=1
;;
@@ -194,6 +203,11 @@
populate_new_ids() {
local L_SUCCESS="$1"
+ if [ "$FORCED" ] ; then
+ NEW_IDS=$(eval $GET_ID)
+ return
+ fi
+
# repopulate "$@" inside this function
eval set -- "$SSH_OPTS"
@@ -200,15 +214,16 @@
umask 0177
local L_TMP_ID_FILE=$(mktemp ~/.ssh/ssh-copy-id_id.XXXXXXXXXX)
if test $? -ne 0 || test "x$L_TMP_ID_FILE" = "x" ; then
- echo "mktemp failed" 1>&2
+ printf '%s: ERROR: mktemp failed\n' "$0" >&2
exit 1
fi
- trap "rm -f $L_TMP_ID_FILE ${L_TMP_ID_FILE}.pub" EXIT TERM INT QUIT
+ local L_CLEANUP="rm -f \"$L_TMP_ID_FILE\" \"${L_TMP_ID_FILE}.stderr\""
+ trap "$L_CLEANUP" EXIT TERM INT QUIT
printf '%s: INFO: attempting to log in with the new key(s), to filter out any that are already installed\n' "$0" >&2
NEW_IDS=$(
eval $GET_ID | {
- while read ID ; do
- printf '%s\n' "$ID" > $L_TMP_ID_FILE
+ while read ID || [ "$ID" ] ; do
+ printf '%s\n' "$ID" > "$L_TMP_ID_FILE"
# the next line assumes $PRIV_ID_FILE only set if using a single id file - this
# assumption will break if we implement the possibility of multiple -i options.
@@ -215,22 +230,24 @@
# The point being that if file based, ssh needs the private key, which it cannot
# find if only given the contents of the .pub file in an unrelated tmpfile
ssh -i "${PRIV_ID_FILE:-$L_TMP_ID_FILE}" \
+ -o ControlPath=none \
+ -o LogLevel=INFO \
-o PreferredAuthentications=publickey \
- -o IdentitiesOnly=yes "$@" exit 2>$L_TMP_ID_FILE.stderr </dev/null
+ -o IdentitiesOnly=yes "$@" exit 2>"$L_TMP_ID_FILE.stderr" </dev/null
if [ "$?" = "$L_SUCCESS" ] ; then
- : > $L_TMP_ID_FILE
+ : > "$L_TMP_ID_FILE"
else
- grep 'Permission denied' $L_TMP_ID_FILE.stderr >/dev/null || {
- sed -e 's/^/ERROR: /' <$L_TMP_ID_FILE.stderr >$L_TMP_ID_FILE
+ grep 'Permission denied' "$L_TMP_ID_FILE.stderr" >/dev/null || {
+ sed -e 's/^/ERROR: /' <"$L_TMP_ID_FILE.stderr" >"$L_TMP_ID_FILE"
cat >/dev/null #consume the other keys, causing loop to end
}
fi
- cat $L_TMP_ID_FILE
+ cat "$L_TMP_ID_FILE"
done
}
)
- rm -f $L_TMP_ID_FILE* && trap - EXIT TERM INT QUIT
+ eval "$L_CLEANUP" && trap - EXIT TERM INT QUIT
if expr "$NEW_IDS" : "^ERROR: " >/dev/null ; then
printf '\n%s: %s\n\n' "$0" "$NEW_IDS" >&2
@@ -237,13 +254,14 @@
exit 1
fi
if [ -z "$NEW_IDS" ] ; then
- printf '\n%s: WARNING: All keys were skipped because they already exist on the remote system.\n\n' "$0" >&2
+ printf '\n%s: WARNING: All keys were skipped because they already exist on the remote system.\n' "$0" >&2
+ printf '\t\t(if you think this is a mistake, you may want to use -f option)\n\n' "$0" >&2
exit 0
fi
printf '%s: INFO: %d key(s) remain to be installed -- if you are prompted now it is to install the new keys\n' "$0" "$(printf '%s\n' "$NEW_IDS" | wc -l)" >&2
}
-REMOTE_VERSION=$(ssh -v -o PreferredAuthentications=',' "$@" 2>&1 |
+REMOTE_VERSION=$(ssh -v -o PreferredAuthentications=',' -o ControlPath=none "$@" 2>&1 |
sed -ne 's/.*remote software version //p')
case "$REMOTE_VERSION" in
@@ -269,10 +287,9 @@
*)
# Assuming that the remote host treats ~/.ssh/authorized_keys as one might expect
populate_new_ids 0
- [ "$DRY_RUN" ] || printf '%s\n' "$NEW_IDS" | ssh "$@" "
- umask 077 ;
- mkdir -p .ssh && cat >> .ssh/authorized_keys || exit 1 ;
- if type restorecon >/dev/null 2>&1 ; then restorecon -F .ssh .ssh/authorized_keys ; fi" \
+ # in ssh below - to defend against quirky remote shells: use 'exec sh -c' to get POSIX; 'cd' to be at $HOME; and all on one line, because tcsh.
+ [ "$DRY_RUN" ] || printf '%s\n' "$NEW_IDS" | \
+ ssh "$@" "exec sh -c 'cd ; umask 077 ; mkdir -p .ssh && cat >> .ssh/authorized_keys || exit 1 ; if type restorecon >/dev/null 2>&1 ; then restorecon -F .ssh .ssh/authorized_keys ; fi'" \
|| exit 1
ADDED=$(printf '%s\n' "$NEW_IDS" | wc -l)
;;
Modified: trunk/crypto/openssh/contrib/ssh-copy-id.1
===================================================================
--- trunk/crypto/openssh/contrib/ssh-copy-id.1 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/ssh-copy-id.1 2016-11-05 20:36:34 UTC (rev 9223)
@@ -29,6 +29,7 @@
.Nd use locally available keys to authorise logins on a remote machine
.Sh SYNOPSIS
.Nm
+.Op Fl f
.Op Fl n
.Op Fl i Op Ar identity_file
.Op Fl p Ar port
@@ -76,6 +77,10 @@
Note that this can be used to ensure that the keys copied have the
comment one prefers and/or extra options applied, by ensuring that the
key file has these set as preferred before the copy is attempted.
+.It Fl f
+Forced mode: doesn't check if the keys are present on the remote server.
+This means that it does not need the private key. Of course, this can result
+in more than one copy of the key being installed on the remote system.
.It Fl n
do a dry-run. Instead of installing keys on the remote system simply
prints the key(s) that would have been installed.
Modified: trunk/crypto/openssh/contrib/suse/openssh.spec
===================================================================
--- trunk/crypto/openssh/contrib/suse/openssh.spec 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/contrib/suse/openssh.spec 2016-11-05 20:36:34 UTC (rev 9223)
@@ -13,7 +13,7 @@
Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation
Name: openssh
-Version: 6.6p1
+Version: 7.3p1
URL: http://www.openssh.com/
Release: 1
Source0: openssh-%{version}.tar.gz
@@ -28,11 +28,9 @@
# (Build[ing] Prereq[uisites] only work for RPM 2.95 and newer.)
# building prerequisites -- stuff for
# OpenSSL (openssl-devel),
-# TCP Wrappers (tcpd-devel),
# and Gnome (glibdev, gtkdev, and gnlibsd)
#
BuildPrereq: openssl
-BuildPrereq: tcpd-devel
BuildPrereq: zlib-devel
#BuildPrereq: glibdev
#BuildPrereq: gtkdev
@@ -140,7 +138,6 @@
--mandir=%{_mandir} \
--with-privsep-path=/var/lib/empty \
--with-pam \
- --with-tcp-wrappers \
--libexecdir=%{_libdir}/ssh
make
@@ -205,7 +202,6 @@
%attr(0755,root,root) %{_bindir}/ssh-keygen
%attr(0755,root,root) %{_bindir}/scp
%attr(0755,root,root) %{_bindir}/ssh
-%attr(-,root,root) %{_bindir}/slogin
%attr(0755,root,root) %{_bindir}/ssh-agent
%attr(0755,root,root) %{_bindir}/ssh-add
%attr(0755,root,root) %{_bindir}/ssh-keyscan
@@ -217,7 +213,6 @@
%attr(0755,root,root) %{_libdir}/ssh/ssh-pkcs11-helper
%attr(0644,root,root) %doc %{_mandir}/man1/scp.1*
%attr(0644,root,root) %doc %{_mandir}/man1/sftp.1*
-%attr(-,root,root) %doc %{_mandir}/man1/slogin.1*
%attr(0644,root,root) %doc %{_mandir}/man1/ssh.1*
%attr(0644,root,root) %doc %{_mandir}/man1/ssh-add.1*
%attr(0644,root,root) %doc %{_mandir}/man1/ssh-agent.1*
Modified: trunk/crypto/openssh/deattack.c
===================================================================
--- trunk/crypto/openssh/deattack.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/deattack.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: deattack.c,v 1.30 2006/09/16 19:53:37 djm Exp $ */
+/* $OpenBSD: deattack.c,v 1.32 2015/01/20 23:14:00 deraadt Exp $ */
/*
* Cryptographic attack detector for ssh - source code
*
@@ -20,16 +20,13 @@
#include "includes.h"
-#include <sys/types.h>
-
#include <string.h>
#include <stdio.h>
-#include <stdarg.h>
+#include <stdlib.h>
-#include "xmalloc.h"
#include "deattack.h"
-#include "log.h"
#include "crc32.h"
+#include "sshbuf.h"
#include "misc.h"
/*
@@ -66,7 +63,7 @@
/* Hash function (Input keys are cipher results) */
-#define HASH(x) get_u32(x)
+#define HASH(x) PEEK_U32(x)
#define CMP(a, b) (memcmp(a, b, SSH_BLOCKSIZE))
@@ -79,10 +76,10 @@
/* detect if a block is used in a particular pattern */
static int
-check_crc(u_char *S, u_char *buf, u_int32_t len)
+check_crc(const u_char *S, const u_char *buf, u_int32_t len)
{
u_int32_t crc;
- u_char *c;
+ const u_char *c;
crc = 0;
for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
@@ -94,36 +91,44 @@
crc_update(&crc, 0);
}
}
- return (crc == 0);
+ return crc == 0;
}
+void
+deattack_init(struct deattack_ctx *dctx)
+{
+ bzero(dctx, sizeof(*dctx));
+ dctx->n = HASH_MINSIZE / HASH_ENTRYSIZE;
+}
/* Detect a crc32 compensation attack on a packet */
int
-detect_attack(u_char *buf, u_int32_t len)
+detect_attack(struct deattack_ctx *dctx, const u_char *buf, u_int32_t len)
{
- static u_int16_t *h = (u_int16_t *) NULL;
- static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
- u_int32_t i, j;
- u_int32_t l, same;
- u_char *c;
- u_char *d;
+ u_int32_t i, j, l, same;
+ u_int16_t *tmp;
+ const u_char *c, *d;
if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||
- len % SSH_BLOCKSIZE != 0) {
- fatal("detect_attack: bad length %d", len);
- }
- for (l = n; l < HASH_FACTOR(len / SSH_BLOCKSIZE); l = l << 2)
+ len % SSH_BLOCKSIZE != 0)
+ return DEATTACK_ERROR;
+ for (l = dctx->n; l < HASH_FACTOR(len / SSH_BLOCKSIZE); l = l << 2)
;
- if (h == NULL) {
- debug("Installing crc compensation attack detector.");
- h = (u_int16_t *) xcalloc(l, HASH_ENTRYSIZE);
- n = l;
+ if (dctx->h == NULL) {
+ if ((dctx->h = calloc(l, HASH_ENTRYSIZE)) == NULL)
+ return DEATTACK_ERROR;
+ dctx->n = l;
} else {
- if (l > n) {
- h = (u_int16_t *)xrealloc(h, l, HASH_ENTRYSIZE);
- n = l;
+ if (l > dctx->n) {
+ if ((tmp = reallocarray(dctx->h, l, HASH_ENTRYSIZE))
+ == NULL) {
+ free(dctx->h);
+ dctx->h = NULL;
+ return DEATTACK_ERROR;
+ }
+ dctx->h = tmp;
+ dctx->n = l;
}
}
@@ -132,29 +137,29 @@
for (d = buf; d < c; d += SSH_BLOCKSIZE) {
if (!CMP(c, d)) {
if ((check_crc(c, buf, len)))
- return (DEATTACK_DETECTED);
+ return DEATTACK_DETECTED;
else
break;
}
}
}
- return (DEATTACK_OK);
+ return DEATTACK_OK;
}
- memset(h, HASH_UNUSEDCHAR, n * HASH_ENTRYSIZE);
+ memset(dctx->h, HASH_UNUSEDCHAR, dctx->n * HASH_ENTRYSIZE);
for (c = buf, same = j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
- for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
- i = (i + 1) & (n - 1)) {
- if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
+ for (i = HASH(c) & (dctx->n - 1); dctx->h[i] != HASH_UNUSED;
+ i = (i + 1) & (dctx->n - 1)) {
+ if (!CMP(c, buf + dctx->h[i] * SSH_BLOCKSIZE)) {
if (++same > MAX_IDENTICAL)
- return (DEATTACK_DOS_DETECTED);
+ return DEATTACK_DOS_DETECTED;
if (check_crc(c, buf, len))
- return (DEATTACK_DETECTED);
+ return DEATTACK_DETECTED;
else
break;
}
}
- h[i] = j;
+ dctx->h[i] = j;
}
- return (DEATTACK_OK);
+ return DEATTACK_OK;
}
Modified: trunk/crypto/openssh/deattack.h
===================================================================
--- trunk/crypto/openssh/deattack.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/deattack.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: deattack.h,v 1.10 2006/09/16 19:53:37 djm Exp $ */
+/* $OpenBSD: deattack.h,v 1.11 2015/01/19 19:52:16 markus Exp $ */
/*
* Cryptographic attack detector for ssh - Header file
@@ -26,6 +26,13 @@
#define DEATTACK_OK 0
#define DEATTACK_DETECTED 1
#define DEATTACK_DOS_DETECTED 2
+#define DEATTACK_ERROR 3
-int detect_attack(u_char *, u_int32_t);
+struct deattack_ctx {
+ u_int16_t *h;
+ u_int32_t n;
+};
+
+void deattack_init(struct deattack_ctx *);
+int detect_attack(struct deattack_ctx *, const u_char *, u_int32_t);
#endif
Modified: trunk/crypto/openssh/defines.h
===================================================================
--- trunk/crypto/openssh/defines.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/defines.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -25,7 +25,7 @@
#ifndef _DEFINES_H
#define _DEFINES_H
-/* $Id: defines.h,v 1.176 2014/01/17 13:12:38 dtucker Exp $ */
+/* $Id: defines.h,v 1.183 2014/09/02 19:33:26 djm Exp $ */
/* Constants */
@@ -43,6 +43,19 @@
#endif
/*
+ * Cygwin doesn't really have a notion of reserved ports. It is still
+ * is useful on the client side so for compatibility it defines as 1024 via
+ * netinet/in.h inside an enum. We * don't actually want that restriction
+ * so we want to set that to zero, but we can't do it direct in config.h
+ * because it'll cause a conflicting definition the first time we include
+ * netinet/in.h.
+ */
+
+#ifdef HAVE_CYGWIN
+#define IPPORT_RESERVED 0
+#endif
+
+/*
* Definitions for IP type of service (ip_tos)
*/
#include <netinet/in_systm.h>
@@ -105,6 +118,17 @@
# endif /* PATH_MAX */
#endif /* MAXPATHLEN */
+#ifndef HOST_NAME_MAX
+# include "netdb.h" /* for MAXHOSTNAMELEN */
+# if defined(_POSIX_HOST_NAME_MAX)
+# define HOST_NAME_MAX _POSIX_HOST_NAME_MAX
+# elif defined(MAXHOSTNAMELEN)
+# define HOST_NAME_MAX MAXHOSTNAMELEN
+# else
+# define HOST_NAME_MAX 255
+# endif
+#endif /* HOST_NAME_MAX */
+
#if defined(HAVE_DECL_MAXSYMLINKS) && HAVE_DECL_MAXSYMLINKS == 0
# define MAXSYMLINKS 5
#endif
@@ -405,7 +429,7 @@
/* user may have set a different path */
#if defined(_PATH_MAILDIR) && defined(MAIL_DIRECTORY)
-# undef _PATH_MAILDIR MAILDIR
+# undef _PATH_MAILDIR
#endif /* defined(_PATH_MAILDIR) && defined(MAIL_DIRECTORY) */
#ifdef MAIL_DIRECTORY
@@ -586,6 +610,12 @@
# undef HAVE_GAI_STRERROR
#endif
+#if defined(HAVE_GETADDRINFO)
+# if defined(HAVE_DECL_AI_NUMERICSERV) && HAVE_DECL_AI_NUMERICSERV == 0
+# define AI_NUMERICSERV 0
+# endif
+#endif
+
#if defined(BROKEN_UPDWTMPX) && defined(HAVE_UPDWTMPX)
# undef HAVE_UPDWTMPX
#endif
@@ -603,10 +633,6 @@
# define memmove(s1, s2, n) bcopy((s2), (s1), (n))
#endif /* !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY) */
-#if defined(HAVE_VHANGUP) && !defined(HAVE_DEV_PTMX)
-# define USE_VHANGUP
-#endif /* defined(HAVE_VHANGUP) && !defined(HAVE_DEV_PTMX) */
-
#ifndef GETPGRP_VOID
# include <unistd.h>
# define getpgrp() getpgrp(0)
@@ -809,14 +835,6 @@
# define SSH_IOBUFSZ 8192
#endif
-#ifndef _NSIG
-# ifdef NSIG
-# define _NSIG NSIG
-# else
-# define _NSIG 128
-# endif
-#endif
-
/*
* Platforms that have arc4random_uniform() and not arc4random_stir()
* shouldn't need the latter.
@@ -826,4 +844,30 @@
# define arc4random_stir()
#endif
+#ifndef HAVE_VA_COPY
+# ifdef HAVE___VA_COPY
+# define va_copy(dest, src) __va_copy(dest, src)
+# else
+# define va_copy(dest, src) (dest) = (src)
+# endif
+#endif
+
+#ifndef __predict_true
+# if defined(__GNUC__) && \
+ ((__GNUC__ > (2)) || (__GNUC__ == (2) && __GNUC_MINOR__ >= (96)))
+# define __predict_true(exp) __builtin_expect(((exp) != 0), 1)
+# define __predict_false(exp) __builtin_expect(((exp) != 0), 0)
+# else
+# define __predict_true(exp) ((exp) != 0)
+# define __predict_false(exp) ((exp) != 0)
+# endif /* gcc version */
+#endif /* __predict_true */
+
+#if defined(HAVE_GLOB_H) && defined(GLOB_HAS_ALTDIRFUNC) && \
+ defined(GLOB_HAS_GL_MATCHC) && defined(GLOB_HAS_GL_STATV) && \
+ defined(HAVE_DECL_GLOB_NOMATCH) && HAVE_DECL_GLOB_NOMATCH != 0 && \
+ !defined(BROKEN_GLOB)
+# define USE_SYSTEM_GLOB
+#endif
+
#endif /* _DEFINES_H */
Modified: trunk/crypto/openssh/dh.c
===================================================================
--- trunk/crypto/openssh/dh.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/dh.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh.c,v 1.53 2013/11/21 00:45:44 djm Exp $ */
+/* $OpenBSD: dh.c,v 1.60 2016/05/02 10:26:04 djm Exp $ */
/*
* Copyright (c) 2000 Niels Provos. All rights reserved.
*
@@ -25,20 +25,23 @@
#include "includes.h"
-#include <sys/param.h>
+#include <sys/param.h> /* MIN */
#include <openssl/bn.h>
#include <openssl/dh.h>
+#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <limits.h>
#include "dh.h"
#include "pathnames.h"
#include "log.h"
#include "misc.h"
+#include "ssherr.h"
static int
parse_prime(int linenum, char *line, struct dhgroup *dhg)
@@ -107,10 +110,11 @@
goto fail;
}
- if ((dhg->g = BN_new()) == NULL)
- fatal("parse_prime: BN_new failed");
- if ((dhg->p = BN_new()) == NULL)
- fatal("parse_prime: BN_new failed");
+ if ((dhg->g = BN_new()) == NULL ||
+ (dhg->p = BN_new()) == NULL) {
+ error("parse_prime: BN_new failed");
+ goto fail;
+ }
if (BN_hex2bn(&dhg->g, gen) == 0) {
error("moduli:%d: could not parse generator value", linenum);
goto fail;
@@ -128,7 +132,6 @@
error("moduli:%d: generator is invalid", linenum);
goto fail;
}
-
return 1;
fail:
@@ -137,7 +140,6 @@
if (dhg->p != NULL)
BN_clear_free(dhg->p);
dhg->g = dhg->p = NULL;
- error("Bad prime description in line %d", linenum);
return 0;
}
@@ -150,11 +152,10 @@
int linenum;
struct dhgroup dhg;
- if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL &&
- (f = fopen(_PATH_DH_PRIMES, "r")) == NULL) {
- logit("WARNING: %s does not exist, using fixed modulus",
- _PATH_DH_MODULI);
- return (dh_new_group14());
+ if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL) {
+ logit("WARNING: could open open %s (%s), using fixed modulus",
+ _PATH_DH_MODULI, strerror(errno));
+ return (dh_new_group_fallback(max));
}
linenum = 0;
@@ -181,8 +182,8 @@
if (bestcount == 0) {
fclose(f);
- logit("WARNING: no suitable primes in %s", _PATH_DH_PRIMES);
- return (dh_new_group14());
+ logit("WARNING: no suitable primes in %s", _PATH_DH_MODULI);
+ return (dh_new_group_fallback(max));
}
linenum = 0;
@@ -200,9 +201,11 @@
break;
}
fclose(f);
- if (linenum != which+1)
- fatal("WARNING: line %d disappeared in %s, giving up",
- which, _PATH_DH_PRIMES);
+ if (linenum != which+1) {
+ logit("WARNING: line %d disappeared in %s, giving up",
+ which, _PATH_DH_MODULI);
+ return (dh_new_group_fallback(max));
+ }
return (dh_new_group(dhg.g, dhg.p));
}
@@ -243,30 +246,39 @@
bits_set++;
debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));
- /* if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial */
- if (bits_set > 1)
- return 1;
-
- logit("invalid public DH value (%d/%d)", bits_set, BN_num_bits(dh->p));
- return 0;
+ /*
+ * if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial
+ */
+ if (bits_set < 4) {
+ logit("invalid public DH value (%d/%d)",
+ bits_set, BN_num_bits(dh->p));
+ return 0;
+ }
+ return 1;
}
-void
+int
dh_gen_key(DH *dh, int need)
{
int pbits;
- if (need <= 0)
- fatal("%s: need <= 0", __func__);
- if (dh->p == NULL)
- fatal("%s: dh->p == NULL", __func__);
- if ((pbits = BN_num_bits(dh->p)) <= 0)
- fatal("%s: bits(p) <= 0", __func__);
+ if (need < 0 || dh->p == NULL ||
+ (pbits = BN_num_bits(dh->p)) <= 0 ||
+ need > INT_MAX / 2 || 2 * need > pbits)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (need < 256)
+ need = 256;
+ /*
+ * Pollard Rho, Big step/Little Step attacks are O(sqrt(n)),
+ * so double requested need here.
+ */
dh->length = MIN(need * 2, pbits - 1);
- if (DH_generate_key(dh) == 0)
- fatal("%s: key generation failed", __func__);
- if (!dh_pub_is_valid(dh, dh->pub_key))
- fatal("%s: generated invalid key", __func__);
+ if (DH_generate_key(dh) == 0 ||
+ !dh_pub_is_valid(dh, dh->pub_key)) {
+ BN_clear_free(dh->priv_key);
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ }
+ return 0;
}
DH *
@@ -275,13 +287,12 @@
DH *dh;
if ((dh = DH_new()) == NULL)
- fatal("dh_new_group_asc: DH_new");
-
- if (BN_hex2bn(&dh->p, modulus) == 0)
- fatal("BN_hex2bn p");
- if (BN_hex2bn(&dh->g, gen) == 0)
- fatal("BN_hex2bn g");
-
+ return NULL;
+ if (BN_hex2bn(&dh->p, modulus) == 0 ||
+ BN_hex2bn(&dh->g, gen) == 0) {
+ DH_free(dh);
+ return NULL;
+ }
return (dh);
}
@@ -296,7 +307,7 @@
DH *dh;
if ((dh = DH_new()) == NULL)
- fatal("dh_new_group: DH_new");
+ return NULL;
dh->p = modulus;
dh->g = gen;
@@ -303,6 +314,7 @@
return (dh);
}
+/* rfc2409 "Second Oakley Group" (1024 bits) */
DH *
dh_new_group1(void)
{
@@ -317,6 +329,7 @@
return (dh_new_group_asc(gen, group1));
}
+/* rfc3526 group 14 "2048-bit MODP Group" */
DH *
dh_new_group14(void)
{
@@ -336,6 +349,105 @@
return (dh_new_group_asc(gen, group14));
}
+/* rfc3526 group 16 "4096-bit MODP Group" */
+DH *
+dh_new_group16(void)
+{
+ static char *gen = "2", *group16 =
+ "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
+ "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
+ "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
+ "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
+ "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE45B3D"
+ "C2007CB8" "A163BF05" "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F"
+ "83655D23" "DCA3AD96" "1C62F356" "208552BB" "9ED52907" "7096966D"
+ "670C354E" "4ABC9804" "F1746C08" "CA18217C" "32905E46" "2E36CE3B"
+ "E39E772C" "180E8603" "9B2783A2" "EC07A28F" "B5C55DF0" "6F4C52C9"
+ "DE2BCBF6" "95581718" "3995497C" "EA956AE5" "15D22618" "98FA0510"
+ "15728E5A" "8AAAC42D" "AD33170D" "04507A33" "A85521AB" "DF1CBA64"
+ "ECFB8504" "58DBEF0A" "8AEA7157" "5D060C7D" "B3970F85" "A6E1E4C7"
+ "ABF5AE8C" "DB0933D7" "1E8C94E0" "4A25619D" "CEE3D226" "1AD2EE6B"
+ "F12FFA06" "D98A0864" "D8760273" "3EC86A64" "521F2B18" "177B200C"
+ "BBE11757" "7A615D6C" "770988C0" "BAD946E2" "08E24FA0" "74E5AB31"
+ "43DB5BFC" "E0FD108E" "4B82D120" "A9210801" "1A723C12" "A787E6D7"
+ "88719A10" "BDBA5B26" "99C32718" "6AF4E23C" "1A946834" "B6150BDA"
+ "2583E9CA" "2AD44CE8" "DBBBC2DB" "04DE8EF9" "2E8EFC14" "1FBECAA6"
+ "287C5947" "4E6BC05D" "99B2964F" "A090C3A2" "233BA186" "515BE7ED"
+ "1F612970" "CEE2D7AF" "B81BDD76" "2170481C" "D0069127" "D5B05AA9"
+ "93B4EA98" "8D8FDDC1" "86FFB7DC" "90A6C08F" "4DF435C9" "34063199"
+ "FFFFFFFF" "FFFFFFFF";
+
+ return (dh_new_group_asc(gen, group16));
+}
+
+/* rfc3526 group 18 "8192-bit MODP Group" */
+DH *
+dh_new_group18(void)
+{
+ static char *gen = "2", *group16 =
+ "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
+ "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
+ "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
+ "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
+ "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE45B3D"
+ "C2007CB8" "A163BF05" "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F"
+ "83655D23" "DCA3AD96" "1C62F356" "208552BB" "9ED52907" "7096966D"
+ "670C354E" "4ABC9804" "F1746C08" "CA18217C" "32905E46" "2E36CE3B"
+ "E39E772C" "180E8603" "9B2783A2" "EC07A28F" "B5C55DF0" "6F4C52C9"
+ "DE2BCBF6" "95581718" "3995497C" "EA956AE5" "15D22618" "98FA0510"
+ "15728E5A" "8AAAC42D" "AD33170D" "04507A33" "A85521AB" "DF1CBA64"
+ "ECFB8504" "58DBEF0A" "8AEA7157" "5D060C7D" "B3970F85" "A6E1E4C7"
+ "ABF5AE8C" "DB0933D7" "1E8C94E0" "4A25619D" "CEE3D226" "1AD2EE6B"
+ "F12FFA06" "D98A0864" "D8760273" "3EC86A64" "521F2B18" "177B200C"
+ "BBE11757" "7A615D6C" "770988C0" "BAD946E2" "08E24FA0" "74E5AB31"
+ "43DB5BFC" "E0FD108E" "4B82D120" "A9210801" "1A723C12" "A787E6D7"
+ "88719A10" "BDBA5B26" "99C32718" "6AF4E23C" "1A946834" "B6150BDA"
+ "2583E9CA" "2AD44CE8" "DBBBC2DB" "04DE8EF9" "2E8EFC14" "1FBECAA6"
+ "287C5947" "4E6BC05D" "99B2964F" "A090C3A2" "233BA186" "515BE7ED"
+ "1F612970" "CEE2D7AF" "B81BDD76" "2170481C" "D0069127" "D5B05AA9"
+ "93B4EA98" "8D8FDDC1" "86FFB7DC" "90A6C08F" "4DF435C9" "34028492"
+ "36C3FAB4" "D27C7026" "C1D4DCB2" "602646DE" "C9751E76" "3DBA37BD"
+ "F8FF9406" "AD9E530E" "E5DB382F" "413001AE" "B06A53ED" "9027D831"
+ "179727B0" "865A8918" "DA3EDBEB" "CF9B14ED" "44CE6CBA" "CED4BB1B"
+ "DB7F1447" "E6CC254B" "33205151" "2BD7AF42" "6FB8F401" "378CD2BF"
+ "5983CA01" "C64B92EC" "F032EA15" "D1721D03" "F482D7CE" "6E74FEF6"
+ "D55E702F" "46980C82" "B5A84031" "900B1C9E" "59E7C97F" "BEC7E8F3"
+ "23A97A7E" "36CC88BE" "0F1D45B7" "FF585AC5" "4BD407B2" "2B4154AA"
+ "CC8F6D7E" "BF48E1D8" "14CC5ED2" "0F8037E0" "A79715EE" "F29BE328"
+ "06A1D58B" "B7C5DA76" "F550AA3D" "8A1FBFF0" "EB19CCB1" "A313D55C"
+ "DA56C9EC" "2EF29632" "387FE8D7" "6E3C0468" "043E8F66" "3F4860EE"
+ "12BF2D5B" "0B7474D6" "E694F91E" "6DBE1159" "74A3926F" "12FEE5E4"
+ "38777CB6" "A932DF8C" "D8BEC4D0" "73B931BA" "3BC832B6" "8D9DD300"
+ "741FA7BF" "8AFC47ED" "2576F693" "6BA42466" "3AAB639C" "5AE4F568"
+ "3423B474" "2BF1C978" "238F16CB" "E39D652D" "E3FDB8BE" "FC848AD9"
+ "22222E04" "A4037C07" "13EB57A8" "1A23F0C7" "3473FC64" "6CEA306B"
+ "4BCBC886" "2F8385DD" "FA9D4B7F" "A2C087E8" "79683303" "ED5BDD3A"
+ "062B3CF5" "B3A278A6" "6D2A13F8" "3F44F82D" "DF310EE0" "74AB6A36"
+ "4597E899" "A0255DC1" "64F31CC5" "0846851D" "F9AB4819" "5DED7EA1"
+ "B1D510BD" "7EE74D73" "FAF36BC3" "1ECFA268" "359046F4" "EB879F92"
+ "4009438B" "481C6CD7" "889A002E" "D5EE382B" "C9190DA6" "FC026E47"
+ "9558E447" "5677E9AA" "9E3050E2" "765694DF" "C81F56E8" "80B96E71"
+ "60C980DD" "98EDD3DF" "FFFFFFFF" "FFFFFFFF";
+
+ return (dh_new_group_asc(gen, group16));
+}
+
+/* Select fallback group used by DH-GEX if moduli file cannot be read. */
+DH *
+dh_new_group_fallback(int max)
+{
+ debug3("%s: requested max size %d", __func__, max);
+ if (max < 3072) {
+ debug3("using 2k bit group 14");
+ return dh_new_group14();
+ } else if (max < 6144) {
+ debug3("using 4k bit group 16");
+ return dh_new_group16();
+ }
+ debug3("using 8k bit group 18");
+ return dh_new_group18();
+}
+
/*
* Estimates the group order for a Diffie-Hellman group that has an
* attack complexity approximately the same as O(2**bits).
@@ -343,8 +455,7 @@
* Management Part 1 (rev 3) limited by the recommended maximum value
* from RFC4419 section 3.
*/
-
-int
+u_int
dh_estimate(int bits)
{
if (bits <= 112)
Modified: trunk/crypto/openssh/dh.h
===================================================================
--- trunk/crypto/openssh/dh.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/dh.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh.h,v 1.11 2013/10/08 11:42:13 dtucker Exp $ */
+/* $OpenBSD: dh.h,v 1.15 2016/05/02 10:26:04 djm Exp $ */
/*
* Copyright (c) 2000 Niels Provos. All rights reserved.
@@ -37,14 +37,20 @@
DH *dh_new_group(BIGNUM *, BIGNUM *);
DH *dh_new_group1(void);
DH *dh_new_group14(void);
+DH *dh_new_group16(void);
+DH *dh_new_group18(void);
+DH *dh_new_group_fallback(int);
-void dh_gen_key(DH *, int);
+int dh_gen_key(DH *, int);
int dh_pub_is_valid(DH *, BIGNUM *);
-int dh_estimate(int);
+u_int dh_estimate(int);
-/* Min and max values from RFC4419. */
-#define DH_GRP_MIN 1024
+/*
+ * Max value from RFC4419.
+ * Miniumum increased in light of DH precomputation attacks.
+ */
+#define DH_GRP_MIN 2048
#define DH_GRP_MAX 8192
/*
Modified: trunk/crypto/openssh/digest-libc.c
===================================================================
--- trunk/crypto/openssh/digest-libc.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/digest-libc.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: digest-libc.c,v 1.2 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: digest-libc.c,v 1.5 2015/05/05 02:48:17 jsg Exp $ */
/*
* Copyright (c) 2013 Damien Miller <djm at mindrot.org>
* Copyright (c) 2014 Markus Friedl. All rights reserved.
@@ -18,17 +18,22 @@
#include "includes.h"
+#ifndef WITH_OPENSSL
+
#include <sys/types.h>
#include <limits.h>
#include <stdlib.h>
#include <string.h>
+#if 0
#include <md5.h>
#include <rmd160.h>
#include <sha1.h>
#include <sha2.h>
+#endif
-#include "buffer.h"
+#include "ssherr.h"
+#include "sshbuf.h"
#include "digest.h"
typedef void md_init_fn(void *mdctx);
@@ -88,10 +93,10 @@
"SHA256",
SHA256_BLOCK_LENGTH,
SHA256_DIGEST_LENGTH,
- sizeof(SHA2_CTX),
- (md_init_fn *) SHA256Init,
- (md_update_fn *) SHA256Update,
- (md_final_fn *) SHA256Final
+ sizeof(SHA256_CTX),
+ (md_init_fn *) SHA256_Init,
+ (md_update_fn *) SHA256_Update,
+ (md_final_fn *) SHA256_Final
},
{
SSH_DIGEST_SHA384,
@@ -98,10 +103,10 @@
"SHA384",
SHA384_BLOCK_LENGTH,
SHA384_DIGEST_LENGTH,
- sizeof(SHA2_CTX),
- (md_init_fn *) SHA384Init,
- (md_update_fn *) SHA384Update,
- (md_final_fn *) SHA384Final
+ sizeof(SHA384_CTX),
+ (md_init_fn *) SHA384_Init,
+ (md_update_fn *) SHA384_Update,
+ (md_final_fn *) SHA384_Final
},
{
SSH_DIGEST_SHA512,
@@ -108,10 +113,10 @@
"SHA512",
SHA512_BLOCK_LENGTH,
SHA512_DIGEST_LENGTH,
- sizeof(SHA2_CTX),
- (md_init_fn *) SHA512Init,
- (md_update_fn *) SHA512Update,
- (md_final_fn *) SHA512Final
+ sizeof(SHA512_CTX),
+ (md_init_fn *) SHA512_Init,
+ (md_update_fn *) SHA512_Update,
+ (md_final_fn *) SHA512_Final
}
};
@@ -125,6 +130,26 @@
return &(digests[alg]);
}
+int
+ssh_digest_alg_by_name(const char *name)
+{
+ int alg;
+
+ for (alg = 0; alg < SSH_DIGEST_MAX; alg++) {
+ if (strcasecmp(name, digests[alg].name) == 0)
+ return digests[alg].id;
+ }
+ return -1;
+}
+
+const char *
+ssh_digest_alg_name(int alg)
+{
+ const struct ssh_digest *digest = ssh_digest_by_alg(alg);
+
+ return digest == NULL ? NULL : digest->name;
+}
+
size_t
ssh_digest_bytes(int alg)
{
@@ -147,7 +172,7 @@
const struct ssh_digest *digest = ssh_digest_by_alg(alg);
struct ssh_digest_ctx *ret;
- if (digest == NULL || (ret = calloc(1, sizeof(ret))) == NULL)
+ if (digest == NULL || (ret = calloc(1, sizeof(*ret))) == NULL)
return NULL;
if ((ret->mdctx = calloc(1, digest->ctx_len)) == NULL) {
free(ret);
@@ -164,7 +189,7 @@
const struct ssh_digest *digest = ssh_digest_by_alg(from->alg);
if (digest == NULL || from->alg != to->alg)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
memcpy(to->mdctx, from->mdctx, digest->ctx_len);
return 0;
}
@@ -175,15 +200,15 @@
const struct ssh_digest *digest = ssh_digest_by_alg(ctx->alg);
if (digest == NULL)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
digest->md_update(ctx->mdctx, m, mlen);
return 0;
}
int
-ssh_digest_update_buffer(struct ssh_digest_ctx *ctx, const Buffer *b)
+ssh_digest_update_buffer(struct ssh_digest_ctx *ctx, const struct sshbuf *b)
{
- return ssh_digest_update(ctx, buffer_ptr(b), buffer_len(b));
+ return ssh_digest_update(ctx, sshbuf_ptr(b), sshbuf_len(b));
}
int
@@ -192,11 +217,11 @@
const struct ssh_digest *digest = ssh_digest_by_alg(ctx->alg);
if (digest == NULL)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
if (dlen > UINT_MAX)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
if (dlen < digest->digest_len) /* No truncation allowed */
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
digest->md_final(d, ctx->mdctx);
return 0;
}
@@ -223,16 +248,17 @@
struct ssh_digest_ctx *ctx = ssh_digest_start(alg);
if (ctx == NULL)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
if (ssh_digest_update(ctx, m, mlen) != 0 ||
ssh_digest_final(ctx, d, dlen) != 0)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
ssh_digest_free(ctx);
return 0;
}
int
-ssh_digest_buffer(int alg, const Buffer *b, u_char *d, size_t dlen)
+ssh_digest_buffer(int alg, const struct sshbuf *b, u_char *d, size_t dlen)
{
- return ssh_digest_memory(alg, buffer_ptr(b), buffer_len(b), d, dlen);
+ return ssh_digest_memory(alg, sshbuf_ptr(b), sshbuf_len(b), d, dlen);
}
+#endif /* !WITH_OPENSSL */
Modified: trunk/crypto/openssh/digest-openssl.c
===================================================================
--- trunk/crypto/openssh/digest-openssl.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/digest-openssl.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: digest-openssl.c,v 1.2 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: digest-openssl.c,v 1.5 2014/12/21 22:27:56 djm Exp $ */
/*
* Copyright (c) 2013 Damien Miller <djm at mindrot.org>
*
@@ -17,6 +17,8 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
#include <limits.h>
#include <stdlib.h>
@@ -26,9 +28,19 @@
#include "openbsd-compat/openssl-compat.h"
-#include "buffer.h"
+#include "sshbuf.h"
#include "digest.h"
+#include "ssherr.h"
+#ifndef HAVE_EVP_RIPEMD160
+# define EVP_ripemd160 NULL
+#endif /* HAVE_EVP_RIPEMD160 */
+#ifndef HAVE_EVP_SHA256
+# define EVP_sha256 NULL
+# define EVP_sha384 NULL
+# define EVP_sha512 NULL
+#endif /* HAVE_EVP_SHA256 */
+
struct ssh_digest_ctx {
int alg;
EVP_MD_CTX mdctx;
@@ -46,11 +58,9 @@
{ SSH_DIGEST_MD5, "MD5", 16, EVP_md5 },
{ SSH_DIGEST_RIPEMD160, "RIPEMD160", 20, EVP_ripemd160 },
{ SSH_DIGEST_SHA1, "SHA1", 20, EVP_sha1 },
-#ifdef HAVE_EVP_SHA256 /* XXX replace with local if missing */
{ SSH_DIGEST_SHA256, "SHA256", 32, EVP_sha256 },
{ SSH_DIGEST_SHA384, "SHA384", 48, EVP_sha384 },
{ SSH_DIGEST_SHA512, "SHA512", 64, EVP_sha512 },
-#endif
{ -1, NULL, 0, NULL },
};
@@ -61,9 +71,31 @@
return NULL;
if (digests[alg].id != alg) /* sanity */
return NULL;
+ if (digests[alg].mdfunc == NULL)
+ return NULL;
return &(digests[alg]);
}
+int
+ssh_digest_alg_by_name(const char *name)
+{
+ int alg;
+
+ for (alg = 0; digests[alg].id != -1; alg++) {
+ if (strcasecmp(name, digests[alg].name) == 0)
+ return digests[alg].id;
+ }
+ return -1;
+}
+
+const char *
+ssh_digest_alg_name(int alg)
+{
+ const struct ssh_digest *digest = ssh_digest_by_alg(alg);
+
+ return digest == NULL ? NULL : digest->name;
+}
+
size_t
ssh_digest_bytes(int alg)
{
@@ -98,9 +130,11 @@
int
ssh_digest_copy_state(struct ssh_digest_ctx *from, struct ssh_digest_ctx *to)
{
+ if (from->alg != to->alg)
+ return SSH_ERR_INVALID_ARGUMENT;
/* we have bcopy-style order while openssl has memcpy-style */
if (!EVP_MD_CTX_copy_ex(&to->mdctx, &from->mdctx))
- return -1;
+ return SSH_ERR_LIBCRYPTO_ERROR;
return 0;
}
@@ -108,14 +142,14 @@
ssh_digest_update(struct ssh_digest_ctx *ctx, const void *m, size_t mlen)
{
if (EVP_DigestUpdate(&ctx->mdctx, m, mlen) != 1)
- return -1;
+ return SSH_ERR_LIBCRYPTO_ERROR;
return 0;
}
int
-ssh_digest_update_buffer(struct ssh_digest_ctx *ctx, const Buffer *b)
+ssh_digest_update_buffer(struct ssh_digest_ctx *ctx, const struct sshbuf *b)
{
- return ssh_digest_update(ctx, buffer_ptr(b), buffer_len(b));
+ return ssh_digest_update(ctx, sshbuf_ptr(b), sshbuf_len(b));
}
int
@@ -125,13 +159,13 @@
u_int l = dlen;
if (dlen > UINT_MAX)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
if (dlen < digest->digest_len) /* No truncation allowed */
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
if (EVP_DigestFinal_ex(&ctx->mdctx, d, &l) != 1)
- return -1;
+ return SSH_ERR_LIBCRYPTO_ERROR;
if (l != digest->digest_len) /* sanity */
- return -1;
+ return SSH_ERR_INTERNAL_ERROR;
return 0;
}
@@ -148,19 +182,24 @@
int
ssh_digest_memory(int alg, const void *m, size_t mlen, u_char *d, size_t dlen)
{
- struct ssh_digest_ctx *ctx = ssh_digest_start(alg);
+ const struct ssh_digest *digest = ssh_digest_by_alg(alg);
+ u_int mdlen;
- if (ctx == NULL)
- return -1;
- if (ssh_digest_update(ctx, m, mlen) != 0 ||
- ssh_digest_final(ctx, d, dlen) != 0)
- return -1;
- ssh_digest_free(ctx);
+ if (digest == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (dlen > UINT_MAX)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (dlen < digest->digest_len)
+ return SSH_ERR_INVALID_ARGUMENT;
+ mdlen = dlen;
+ if (!EVP_Digest(m, mlen, d, &mdlen, digest->mdfunc(), NULL))
+ return SSH_ERR_LIBCRYPTO_ERROR;
return 0;
}
int
-ssh_digest_buffer(int alg, const Buffer *b, u_char *d, size_t dlen)
+ssh_digest_buffer(int alg, const struct sshbuf *b, u_char *d, size_t dlen)
{
- return ssh_digest_memory(alg, buffer_ptr(b), buffer_len(b), d, dlen);
+ return ssh_digest_memory(alg, sshbuf_ptr(b), sshbuf_len(b), d, dlen);
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/digest.h
===================================================================
--- trunk/crypto/openssh/digest.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/digest.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: digest.h,v 1.2 2014/01/27 18:58:14 markus Exp $ */
+/* $OpenBSD: digest.h,v 1.7 2014/12/21 22:27:56 djm Exp $ */
/*
* Copyright (c) 2013 Damien Miller <djm at mindrot.org>
*
@@ -30,8 +30,15 @@
#define SSH_DIGEST_SHA512 5
#define SSH_DIGEST_MAX 6
+struct sshbuf;
struct ssh_digest_ctx;
+/* Looks up a digest algorithm by name */
+int ssh_digest_alg_by_name(const char *name);
+
+/* Returns the algorithm name for a digest identifier */
+const char *ssh_digest_alg_name(int alg);
+
/* Returns the algorithm's digest length in bytes or 0 for invalid algorithm */
size_t ssh_digest_bytes(int alg);
@@ -47,7 +54,7 @@
u_char *d, size_t dlen)
__attribute__((__bounded__(__buffer__, 2, 3)))
__attribute__((__bounded__(__buffer__, 4, 5)));
-int ssh_digest_buffer(int alg, const Buffer *b, u_char *d, size_t dlen)
+int ssh_digest_buffer(int alg, const struct sshbuf *b, u_char *d, size_t dlen)
__attribute__((__bounded__(__buffer__, 3, 4)));
/* Update API */
@@ -54,7 +61,8 @@
struct ssh_digest_ctx *ssh_digest_start(int alg);
int ssh_digest_update(struct ssh_digest_ctx *ctx, const void *m, size_t mlen)
__attribute__((__bounded__(__buffer__, 2, 3)));
-int ssh_digest_update_buffer(struct ssh_digest_ctx *ctx, const Buffer *b);
+int ssh_digest_update_buffer(struct ssh_digest_ctx *ctx,
+ const struct sshbuf *b);
int ssh_digest_final(struct ssh_digest_ctx *ctx, u_char *d, size_t dlen)
__attribute__((__bounded__(__buffer__, 2, 3)));
void ssh_digest_free(struct ssh_digest_ctx *ctx);
Modified: trunk/crypto/openssh/dispatch.c
===================================================================
--- trunk/crypto/openssh/dispatch.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/dispatch.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: dispatch.c,v 1.22 2008/10/31 15:05:34 stevesk Exp $ */
+/* $OpenBSD: dispatch.c,v 1.27 2015/05/01 07:10:01 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -36,36 +36,42 @@
#include "dispatch.h"
#include "packet.h"
#include "compat.h"
+#include "ssherr.h"
-#define DISPATCH_MAX 255
+int
+dispatch_protocol_error(int type, u_int32_t seq, void *ctx)
+{
+ struct ssh *ssh = active_state; /* XXX */
+ int r;
-dispatch_fn *dispatch[DISPATCH_MAX];
-
-void
-dispatch_protocol_error(int type, u_int32_t seq, void *ctxt)
-{
logit("dispatch_protocol_error: type %d seq %u", type, seq);
if (!compat20)
fatal("protocol error");
- packet_start(SSH2_MSG_UNIMPLEMENTED);
- packet_put_int(seq);
- packet_send();
- packet_write_wait();
+ if ((r = sshpkt_start(ssh, SSH2_MSG_UNIMPLEMENTED)) != 0 ||
+ (r = sshpkt_put_u32(ssh, seq)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0 ||
+ (r = ssh_packet_write_wait(ssh)) != 0)
+ sshpkt_fatal(ssh, __func__, r);
+ return 0;
}
-void
-dispatch_protocol_ignore(int type, u_int32_t seq, void *ctxt)
+
+int
+dispatch_protocol_ignore(int type, u_int32_t seq, void *ssh)
{
logit("dispatch_protocol_ignore: type %d seq %u", type, seq);
+ return 0;
}
+
void
-dispatch_init(dispatch_fn *dflt)
+ssh_dispatch_init(struct ssh *ssh, dispatch_fn *dflt)
{
u_int i;
for (i = 0; i < DISPATCH_MAX; i++)
- dispatch[i] = dflt;
+ ssh->dispatch[i] = dflt;
}
+
void
-dispatch_range(u_int from, u_int to, dispatch_fn *fn)
+ssh_dispatch_range(struct ssh *ssh, u_int from, u_int to, dispatch_fn *fn)
{
u_int i;
@@ -72,33 +78,65 @@
for (i = from; i <= to; i++) {
if (i >= DISPATCH_MAX)
break;
- dispatch[i] = fn;
+ ssh->dispatch[i] = fn;
}
}
+
void
-dispatch_set(int type, dispatch_fn *fn)
+ssh_dispatch_set(struct ssh *ssh, int type, dispatch_fn *fn)
{
- dispatch[type] = fn;
+ ssh->dispatch[type] = fn;
}
-void
-dispatch_run(int mode, volatile sig_atomic_t *done, void *ctxt)
+
+int
+ssh_dispatch_run(struct ssh *ssh, int mode, volatile sig_atomic_t *done,
+ void *ctxt)
{
+ int r;
+ u_char type;
+ u_int32_t seqnr;
+
for (;;) {
- int type;
- u_int32_t seqnr;
-
if (mode == DISPATCH_BLOCK) {
- type = packet_read_seqnr(&seqnr);
+ r = ssh_packet_read_seqnr(ssh, &type, &seqnr);
+ if (r != 0)
+ return r;
} else {
- type = packet_read_poll_seqnr(&seqnr);
+ r = ssh_packet_read_poll_seqnr(ssh, &type, &seqnr);
+ if (r != 0)
+ return r;
if (type == SSH_MSG_NONE)
- return;
+ return 0;
}
- if (type > 0 && type < DISPATCH_MAX && dispatch[type] != NULL)
- (*dispatch[type])(type, seqnr, ctxt);
- else
- packet_disconnect("protocol error: rcvd type %d", type);
+ if (type > 0 && type < DISPATCH_MAX &&
+ ssh->dispatch[type] != NULL) {
+ if (ssh->dispatch_skip_packets) {
+ debug2("skipped packet (type %u)", type);
+ ssh->dispatch_skip_packets--;
+ continue;
+ }
+ /* XXX 'ssh' will replace 'ctxt' later */
+ r = (*ssh->dispatch[type])(type, seqnr, ctxt);
+ if (r != 0)
+ return r;
+ } else {
+ r = sshpkt_disconnect(ssh,
+ "protocol error: rcvd type %d", type);
+ if (r != 0)
+ return r;
+ return SSH_ERR_DISCONNECTED;
+ }
if (done != NULL && *done)
- return;
+ return 0;
}
}
+
+void
+ssh_dispatch_run_fatal(struct ssh *ssh, int mode, volatile sig_atomic_t *done,
+ void *ctxt)
+{
+ int r;
+
+ if ((r = ssh_dispatch_run(ssh, mode, done, ctxt)) != 0)
+ sshpkt_fatal(ssh, __func__, r);
+}
Modified: trunk/crypto/openssh/dispatch.h
===================================================================
--- trunk/crypto/openssh/dispatch.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/dispatch.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: dispatch.h,v 1.11 2006/04/20 09:27:09 djm Exp $ */
+/* $OpenBSD: dispatch.h,v 1.12 2015/01/19 20:07:45 markus Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -24,18 +24,35 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
-#include <signal.h>
+#ifndef DISPATCH_H
+#define DISPATCH_H
+#define DISPATCH_MAX 255
+
enum {
DISPATCH_BLOCK,
DISPATCH_NONBLOCK
};
-typedef void dispatch_fn(int, u_int32_t, void *);
+struct ssh;
-void dispatch_init(dispatch_fn *);
-void dispatch_set(int, dispatch_fn *);
-void dispatch_range(u_int, u_int, dispatch_fn *);
-void dispatch_run(int, volatile sig_atomic_t *, void *);
-void dispatch_protocol_error(int, u_int32_t, void *);
-void dispatch_protocol_ignore(int, u_int32_t, void *);
+typedef int dispatch_fn(int, u_int32_t, void *);
+
+int dispatch_protocol_error(int, u_int32_t, void *);
+int dispatch_protocol_ignore(int, u_int32_t, void *);
+void ssh_dispatch_init(struct ssh *, dispatch_fn *);
+void ssh_dispatch_set(struct ssh *, int, dispatch_fn *);
+void ssh_dispatch_range(struct ssh *, u_int, u_int, dispatch_fn *);
+int ssh_dispatch_run(struct ssh *, int, volatile sig_atomic_t *, void *);
+void ssh_dispatch_run_fatal(struct ssh *, int, volatile sig_atomic_t *, void *);
+
+#define dispatch_init(dflt) \
+ ssh_dispatch_init(active_state, (dflt))
+#define dispatch_range(from, to, fn) \
+ ssh_dispatch_range(active_state, (from), (to), (fn))
+#define dispatch_set(type, fn) \
+ ssh_dispatch_set(active_state, (type), (fn))
+#define dispatch_run(mode, done, ctxt) \
+ ssh_dispatch_run_fatal(active_state, (mode), (done), (ctxt))
+
+#endif
Modified: trunk/crypto/openssh/dns.c
===================================================================
--- trunk/crypto/openssh/dns.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/dns.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: dns.c,v 1.29 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: dns.c,v 1.35 2015/08/20 22:32:42 deraadt Exp $ */
/*
* Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -34,11 +34,15 @@
#include <stdarg.h>
#include <stdio.h>
#include <string.h>
+#include <stdarg.h>
+#include <stdlib.h>
#include "xmalloc.h"
-#include "key.h"
+#include "sshkey.h"
+#include "ssherr.h"
#include "dns.h"
#include "log.h"
+#include "digest.h"
static const char *errset_text[] = {
"success", /* 0 ERRSET_SUCCESS */
@@ -75,10 +79,10 @@
*/
static int
dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,
- u_char **digest, u_int *digest_len, Key *key)
+ u_char **digest, size_t *digest_len, struct sshkey *key)
{
- int success = 0;
- enum fp_type fp_type = 0;
+ int r, success = 0;
+ int fp_alg = -1;
switch (key->type) {
case KEY_RSA:
@@ -96,6 +100,11 @@
if (!*digest_type)
*digest_type = SSHFP_HASH_SHA256;
break;
+ case KEY_ED25519:
+ *algorithm = SSHFP_KEY_ED25519;
+ if (!*digest_type)
+ *digest_type = SSHFP_HASH_SHA256;
+ break;
default:
*algorithm = SSHFP_KEY_RESERVED; /* 0 */
*digest_type = SSHFP_HASH_RESERVED; /* 0 */
@@ -103,10 +112,10 @@
switch (*digest_type) {
case SSHFP_HASH_SHA1:
- fp_type = SSH_FP_SHA1;
+ fp_alg = SSH_DIGEST_SHA1;
break;
case SSHFP_HASH_SHA256:
- fp_type = SSH_FP_SHA256;
+ fp_alg = SSH_DIGEST_SHA256;
break;
default:
*digest_type = SSHFP_HASH_RESERVED; /* 0 */
@@ -113,9 +122,10 @@
}
if (*algorithm && *digest_type) {
- *digest = key_fingerprint_raw(key, fp_type, digest_len);
- if (*digest == NULL)
- fatal("dns_read_key: null from key_fingerprint_raw()");
+ if ((r = sshkey_fingerprint_raw(key, fp_alg, digest,
+ digest_len)) != 0)
+ fatal("%s: sshkey_fingerprint_raw: %s", __func__,
+ ssh_err(r));
success = 1;
} else {
*digest = NULL;
@@ -131,7 +141,7 @@
*/
static int
dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
- u_char **digest, u_int *digest_len, u_char *rdata, int rdata_len)
+ u_char **digest, size_t *digest_len, u_char *rdata, int rdata_len)
{
int success = 0;
@@ -144,7 +154,7 @@
*digest_len = rdata_len - 2;
if (*digest_len > 0) {
- *digest = (u_char *) xmalloc(*digest_len);
+ *digest = xmalloc(*digest_len);
memcpy(*digest, rdata + 2, *digest_len);
} else {
*digest = (u_char *)xstrdup("");
@@ -192,7 +202,7 @@
*/
int
verify_host_key_dns(const char *hostname, struct sockaddr *address,
- Key *hostkey, int *flags)
+ struct sshkey *hostkey, int *flags)
{
u_int counter;
int result;
@@ -201,12 +211,12 @@
u_int8_t hostkey_algorithm;
u_int8_t hostkey_digest_type = SSHFP_HASH_RESERVED;
u_char *hostkey_digest;
- u_int hostkey_digest_len;
+ size_t hostkey_digest_len;
u_int8_t dnskey_algorithm;
u_int8_t dnskey_digest_type;
u_char *dnskey_digest;
- u_int dnskey_digest_len;
+ size_t dnskey_digest_len;
*flags = 0;
@@ -284,7 +294,7 @@
free(dnskey_digest);
}
- free(hostkey_digest); /* from key_fingerprint_raw() */
+ free(hostkey_digest); /* from sshkey_fingerprint_raw() */
freerrset(fingerprints);
if (*flags & DNS_VERIFY_FOUND)
@@ -302,13 +312,13 @@
* Export the fingerprint of a key as a DNS resource record
*/
int
-export_dns_rr(const char *hostname, Key *key, FILE *f, int generic)
+export_dns_rr(const char *hostname, struct sshkey *key, FILE *f, int generic)
{
u_int8_t rdata_pubkey_algorithm = 0;
u_int8_t rdata_digest_type = SSHFP_HASH_RESERVED;
u_int8_t dtype;
u_char *rdata_digest;
- u_int i, rdata_digest_len;
+ size_t i, rdata_digest_len;
int success = 0;
for (dtype = SSHFP_HASH_SHA1; dtype < SSHFP_HASH_MAX; dtype++) {
@@ -316,7 +326,7 @@
if (dns_read_key(&rdata_pubkey_algorithm, &rdata_digest_type,
&rdata_digest, &rdata_digest_len, key)) {
if (generic) {
- fprintf(f, "%s IN TYPE%d \\# %d %02x %02x ",
+ fprintf(f, "%s IN TYPE%d \\# %zu %02x %02x ",
hostname, DNS_RDATATYPE_SSHFP,
2 + rdata_digest_len,
rdata_pubkey_algorithm, rdata_digest_type);
@@ -327,7 +337,7 @@
for (i = 0; i < rdata_digest_len; i++)
fprintf(f, "%02x", rdata_digest[i]);
fprintf(f, "\n");
- free(rdata_digest); /* from key_fingerprint_raw() */
+ free(rdata_digest); /* from sshkey_fingerprint_raw() */
success = 1;
}
}
Modified: trunk/crypto/openssh/dns.h
===================================================================
--- trunk/crypto/openssh/dns.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/dns.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: dns.h,v 1.12 2012/05/23 03:28:28 djm Exp $ */
+/* $OpenBSD: dns.h,v 1.15 2015/05/08 06:45:13 djm Exp $ */
/*
* Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -32,7 +32,8 @@
SSHFP_KEY_RESERVED = 0,
SSHFP_KEY_RSA = 1,
SSHFP_KEY_DSA = 2,
- SSHFP_KEY_ECDSA = 3
+ SSHFP_KEY_ECDSA = 3,
+ SSHFP_KEY_ED25519 = 4
};
enum sshfp_hashes {
@@ -49,7 +50,8 @@
#define DNS_VERIFY_MATCH 0x00000002
#define DNS_VERIFY_SECURE 0x00000004
-int verify_host_key_dns(const char *, struct sockaddr *, Key *, int *);
-int export_dns_rr(const char *, Key *, FILE *, int);
+int verify_host_key_dns(const char *, struct sockaddr *,
+ struct sshkey *, int *);
+int export_dns_rr(const char *, struct sshkey *, FILE *, int);
#endif /* DNS_H */
Modified: trunk/crypto/openssh/entropy.c
===================================================================
--- trunk/crypto/openssh/entropy.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/entropy.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -24,6 +24,8 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
#include <sys/socket.h>
#ifdef HAVE_SYS_UN_H
@@ -43,6 +45,8 @@
#include <openssl/crypto.h>
#include <openssl/err.h>
+#include "openbsd-compat/openssl-compat.h"
+
#include "ssh.h"
#include "misc.h"
#include "xmalloc.h"
@@ -209,16 +213,7 @@
#ifndef OPENSSL_PRNG_ONLY
unsigned char buf[RANDOM_SEED_SIZE];
#endif
- /*
- * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
- * We match major, minor, fix and status (not patch) for <1.0.0.
- * After that, we acceptable compatible fix versions (so we
- * allow 1.0.1 to work with 1.0.0). Going backwards is only allowed
- * within a patch series.
- */
- u_long version_mask = SSLeay() >= 0x1000000f ? ~0xffff0L : ~0xff0L;
- if (((SSLeay() ^ OPENSSL_VERSION_NUMBER) & version_mask) ||
- (SSLeay() >> 12) < (OPENSSL_VERSION_NUMBER >> 12))
+ if (!ssh_compatible_openssl(OPENSSL_VERSION_NUMBER, SSLeay()))
fatal("OpenSSL version mismatch. Built against %lx, you "
"have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
@@ -237,3 +232,13 @@
if (RAND_status() != 1)
fatal("PRNG is not seeded");
}
+
+#else /* WITH_OPENSSL */
+
+/* Handled in arc4random() */
+void
+seed_rng(void)
+{
+}
+
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/ge25519.h
===================================================================
--- trunk/crypto/openssh/ge25519.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ge25519.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ge25519.h,v 1.3 2013/12/09 11:03:45 markus Exp $ */
+/* $OpenBSD: ge25519.h,v 1.4 2015/02/16 18:26:26 miod Exp $ */
/*
* Public Domain, Authors: Daniel J. Bernstein, Niels Duif, Tanja Lange,
@@ -28,7 +28,7 @@
fe25519 t;
} ge25519;
-const ge25519 ge25519_base;
+extern const ge25519 ge25519_base;
int ge25519_unpackneg_vartime(ge25519 *r, const unsigned char p[32]);
Modified: trunk/crypto/openssh/groupaccess.c
===================================================================
--- trunk/crypto/openssh/groupaccess.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/groupaccess.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: groupaccess.c,v 1.14 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: groupaccess.c,v 1.16 2015/05/04 06:10:48 djm Exp $ */
/*
* Copyright (c) 2001 Kevin Steves. All rights reserved.
*
@@ -26,7 +26,6 @@
#include "includes.h"
#include <sys/types.h>
-#include <sys/param.h>
#include <grp.h>
#include <unistd.h>
@@ -33,6 +32,7 @@
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
+#include <limits.h>
#include "xmalloc.h"
#include "groupaccess.h"
@@ -97,11 +97,9 @@
ga_match_pattern_list(const char *group_pattern)
{
int i, found = 0;
- size_t len = strlen(group_pattern);
for (i = 0; i < ngroups; i++) {
- switch (match_pattern_list(groups_byname[i],
- group_pattern, len, 0)) {
+ switch (match_pattern_list(groups_byname[i], group_pattern, 0)) {
case -1:
return 0; /* Negated match wins */
case 0:
Modified: trunk/crypto/openssh/gss-genr.c
===================================================================
--- trunk/crypto/openssh/gss-genr.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/gss-genr.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: gss-genr.c,v 1.22 2013/11/08 00:39:15 djm Exp $ */
+/* $OpenBSD: gss-genr.c,v 1.23 2015/01/20 23:14:00 deraadt Exp $ */
/*
* Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
@@ -31,8 +31,10 @@
#include <sys/types.h>
#include <sys/param.h>
+#include <limits.h>
#include <stdarg.h>
#include <string.h>
+#include <signal.h>
#include <unistd.h>
#include "xmalloc.h"
Modified: trunk/crypto/openssh/gss-serv-krb5.c
===================================================================
--- trunk/crypto/openssh/gss-serv-krb5.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/gss-serv-krb5.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -39,6 +39,7 @@
#include "hostfile.h"
#include "auth.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "buffer.h"
Modified: trunk/crypto/openssh/gss-serv.c
===================================================================
--- trunk/crypto/openssh/gss-serv.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/gss-serv.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: gss-serv.c,v 1.26 2014/02/26 20:28:44 djm Exp $ */
+/* $OpenBSD: gss-serv.c,v 1.29 2015/05/22 03:50:02 djm Exp $ */
/*
* Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -29,7 +29,6 @@
#ifdef GSSAPI
#include <sys/types.h>
-#include <sys/param.h>
#include <stdarg.h>
#include <string.h>
@@ -45,9 +44,12 @@
#include "channels.h"
#include "session.h"
#include "misc.h"
+#include "servconf.h"
#include "ssh-gss.h"
+extern ServerOptions options;
+
static ssh_gssapi_client gssapi_client =
{ GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};
@@ -97,28 +99,35 @@
ssh_gssapi_acquire_cred(Gssctxt *ctx)
{
OM_uint32 status;
- char lname[MAXHOSTNAMELEN];
+ char lname[NI_MAXHOST];
gss_OID_set oidset;
- gss_create_empty_oid_set(&status, &oidset);
- gss_add_oid_set_member(&status, ctx->oid, &oidset);
+ if (options.gss_strict_acceptor) {
+ gss_create_empty_oid_set(&status, &oidset);
+ gss_add_oid_set_member(&status, ctx->oid, &oidset);
- if (gethostname(lname, MAXHOSTNAMELEN)) {
- gss_release_oid_set(&status, &oidset);
- return (-1);
- }
+ if (gethostname(lname, MAXHOSTNAMELEN)) {
+ gss_release_oid_set(&status, &oidset);
+ return (-1);
+ }
- if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
+ if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
+ gss_release_oid_set(&status, &oidset);
+ return (ctx->major);
+ }
+
+ if ((ctx->major = gss_acquire_cred(&ctx->minor,
+ ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds,
+ NULL, NULL)))
+ ssh_gssapi_error(ctx);
+
gss_release_oid_set(&status, &oidset);
return (ctx->major);
+ } else {
+ ctx->name = GSS_C_NO_NAME;
+ ctx->creds = GSS_C_NO_CREDENTIAL;
}
-
- if ((ctx->major = gss_acquire_cred(&ctx->minor,
- ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
- ssh_gssapi_error(ctx);
-
- gss_release_oid_set(&status, &oidset);
- return (ctx->major);
+ return GSS_S_COMPLETE;
}
/* Privileged */
Modified: trunk/crypto/openssh/hmac.c
===================================================================
--- trunk/crypto/openssh/hmac.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/hmac.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: hmac.c,v 1.10 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: hmac.c,v 1.12 2015/03/24 20:03:44 markus Exp $ */
/*
* Copyright (c) 2014 Markus Friedl. All rights reserved.
*
@@ -20,7 +20,7 @@
#include <sys/types.h>
#include <string.h>
-#include "buffer.h"
+#include "sshbuf.h"
#include "digest.h"
#include "hmac.h"
@@ -96,7 +96,7 @@
}
int
-ssh_hmac_update_buffer(struct ssh_hmac_ctx *ctx, const Buffer *b)
+ssh_hmac_update_buffer(struct ssh_hmac_ctx *ctx, const struct sshbuf *b)
{
return ssh_digest_update_buffer(ctx->digest, b);
}
@@ -154,7 +154,7 @@
if (memcmp(e, digest, elen)) {
for (i = 0; i < elen; i++)
- printf("[%zd] %2.2x %2.2x\n", i, e[i], digest[i]);
+ printf("[%zu] %2.2x %2.2x\n", i, e[i], digest[i]);
printf("mismatch\n");
} else
printf("ok\n");
Modified: trunk/crypto/openssh/hmac.h
===================================================================
--- trunk/crypto/openssh/hmac.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/hmac.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: hmac.h,v 1.6 2014/01/27 18:58:14 markus Exp $ */
+/* $OpenBSD: hmac.h,v 1.9 2014/06/24 01:13:21 djm Exp $ */
/*
* Copyright (c) 2014 Markus Friedl. All rights reserved.
*
@@ -21,6 +21,7 @@
/* Returns the algorithm's digest length in bytes or 0 for invalid algorithm */
size_t ssh_hmac_bytes(int alg);
+struct sshbuf;
struct ssh_hmac_ctx;
struct ssh_hmac_ctx *ssh_hmac_start(int alg);
@@ -29,7 +30,7 @@
__attribute__((__bounded__(__buffer__, 2, 3)));
int ssh_hmac_update(struct ssh_hmac_ctx *ctx, const void *m, size_t mlen)
__attribute__((__bounded__(__buffer__, 2, 3)));
-int ssh_hmac_update_buffer(struct ssh_hmac_ctx *ctx, const Buffer *b);
+int ssh_hmac_update_buffer(struct ssh_hmac_ctx *ctx, const struct sshbuf *b);
int ssh_hmac_final(struct ssh_hmac_ctx *ctx, u_char *d, size_t dlen)
__attribute__((__bounded__(__buffer__, 2, 3)));
void ssh_hmac_free(struct ssh_hmac_ctx *ctx);
Modified: trunk/crypto/openssh/hostfile.c
===================================================================
--- trunk/crypto/openssh/hostfile.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/hostfile.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: hostfile.c,v 1.55 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: hostfile.c,v 1.66 2015/05/04 06:10:48 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -39,21 +39,26 @@
#include "includes.h"
#include <sys/types.h>
+#include <sys/stat.h>
#include <netinet/in.h>
+#include <errno.h>
#include <resolv.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <stdarg.h>
+#include <unistd.h>
#include "xmalloc.h"
#include "match.h"
-#include "key.h"
+#include "sshkey.h"
#include "hostfile.h"
#include "log.h"
#include "misc.h"
+#include "ssherr.h"
#include "digest.h"
#include "hmac.h"
@@ -62,6 +67,8 @@
u_int num_entries;
};
+/* XXX hmac is too easy to dictionary attack; use bcrypt? */
+
static int
extract_salt(const char *s, u_int l, u_char *salt, size_t salt_len)
{
@@ -154,15 +161,16 @@
*/
int
-hostfile_read_key(char **cpp, int *bitsp, Key *ret)
+hostfile_read_key(char **cpp, u_int *bitsp, struct sshkey *ret)
{
char *cp;
+ int r;
/* Skip leading whitespace. */
for (cp = *cpp; *cp == ' ' || *cp == '\t'; cp++)
;
- if (key_read(ret, &cp) != 1)
+ if ((r = sshkey_read(ret, &cp)) != 0)
return 0;
/* Skip trailing whitespace. */
@@ -171,29 +179,11 @@
/* Return results. */
*cpp = cp;
- if (bitsp != NULL) {
- if ((*bitsp = key_size(ret)) <= 0)
- return 0;
- }
+ if (bitsp != NULL)
+ *bitsp = sshkey_size(ret);
return 1;
}
-static int
-hostfile_check_key(int bits, const Key *key, const char *host,
- const char *filename, u_long linenum)
-{
- if (key == NULL || key->type != KEY_RSA1 || key->rsa == NULL)
- return 1;
- if (bits != BN_num_bits(key->rsa->n)) {
- logit("Warning: %s, line %lu: keysize mismatch for host %s: "
- "actual %d vs. announced %d.",
- filename, linenum, host, BN_num_bits(key->rsa->n), bits);
- logit("Warning: replace %d with %d in %s, line %lu.",
- bits, BN_num_bits(key->rsa->n), filename, linenum);
- }
- return 1;
-}
-
static HostkeyMarker
check_markers(char **cpp)
{
@@ -238,91 +228,66 @@
return ret;
}
-void
-load_hostkeys(struct hostkeys *hostkeys, const char *host, const char *path)
+struct load_callback_ctx {
+ const char *host;
+ u_long num_loaded;
+ struct hostkeys *hostkeys;
+};
+
+static int
+record_hostkey(struct hostkey_foreach_line *l, void *_ctx)
{
- FILE *f;
- char line[8192];
- u_long linenum = 0, num_loaded = 0;
- char *cp, *cp2, *hashed_host;
- HostkeyMarker marker;
- Key *key;
- int kbits;
+ struct load_callback_ctx *ctx = (struct load_callback_ctx *)_ctx;
+ struct hostkeys *hostkeys = ctx->hostkeys;
+ struct hostkey_entry *tmp;
- if ((f = fopen(path, "r")) == NULL)
- return;
- debug3("%s: loading entries for host \"%.100s\" from file \"%s\"",
- __func__, host, path);
- while (read_keyfile_line(f, path, line, sizeof(line), &linenum) == 0) {
- cp = line;
+ if (l->status == HKF_STATUS_INVALID) {
+ /* XXX make this verbose() in the future */
+ debug("%s:%ld: parse error in hostkeys file",
+ l->path, l->linenum);
+ return 0;
+ }
- /* Skip any leading whitespace, comments and empty lines. */
- for (; *cp == ' ' || *cp == '\t'; cp++)
- ;
- if (!*cp || *cp == '#' || *cp == '\n')
- continue;
+ debug3("%s: found %skey type %s in file %s:%lu", __func__,
+ l->marker == MRK_NONE ? "" :
+ (l->marker == MRK_CA ? "ca " : "revoked "),
+ sshkey_type(l->key), l->path, l->linenum);
+ if ((tmp = reallocarray(hostkeys->entries,
+ hostkeys->num_entries + 1, sizeof(*hostkeys->entries))) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ hostkeys->entries = tmp;
+ hostkeys->entries[hostkeys->num_entries].host = xstrdup(ctx->host);
+ hostkeys->entries[hostkeys->num_entries].file = xstrdup(l->path);
+ hostkeys->entries[hostkeys->num_entries].line = l->linenum;
+ hostkeys->entries[hostkeys->num_entries].key = l->key;
+ l->key = NULL; /* steal it */
+ hostkeys->entries[hostkeys->num_entries].marker = l->marker;
+ hostkeys->num_entries++;
+ ctx->num_loaded++;
- if ((marker = check_markers(&cp)) == MRK_ERROR) {
- verbose("%s: invalid marker at %s:%lu",
- __func__, path, linenum);
- continue;
- }
+ return 0;
+}
- /* Find the end of the host name portion. */
- for (cp2 = cp; *cp2 && *cp2 != ' ' && *cp2 != '\t'; cp2++)
- ;
+void
+load_hostkeys(struct hostkeys *hostkeys, const char *host, const char *path)
+{
+ int r;
+ struct load_callback_ctx ctx;
- /* Check if the host name matches. */
- if (match_hostname(host, cp, (u_int) (cp2 - cp)) != 1) {
- if (*cp != HASH_DELIM)
- continue;
- hashed_host = host_hash(host, cp, (u_int) (cp2 - cp));
- if (hashed_host == NULL) {
- debug("Invalid hashed host line %lu of %s",
- linenum, path);
- continue;
- }
- if (strncmp(hashed_host, cp, (u_int) (cp2 - cp)) != 0)
- continue;
- }
+ ctx.host = host;
+ ctx.num_loaded = 0;
+ ctx.hostkeys = hostkeys;
- /* Got a match. Skip host name. */
- cp = cp2;
-
- /*
- * Extract the key from the line. This will skip any leading
- * whitespace. Ignore badly formatted lines.
- */
- key = key_new(KEY_UNSPEC);
- if (!hostfile_read_key(&cp, &kbits, key)) {
- key_free(key);
- key = key_new(KEY_RSA1);
- if (!hostfile_read_key(&cp, &kbits, key)) {
- key_free(key);
- continue;
- }
- }
- if (!hostfile_check_key(kbits, key, host, path, linenum))
- continue;
-
- debug3("%s: found %skey type %s in file %s:%lu", __func__,
- marker == MRK_NONE ? "" :
- (marker == MRK_CA ? "ca " : "revoked "),
- key_type(key), path, linenum);
- hostkeys->entries = xrealloc(hostkeys->entries,
- hostkeys->num_entries + 1, sizeof(*hostkeys->entries));
- hostkeys->entries[hostkeys->num_entries].host = xstrdup(host);
- hostkeys->entries[hostkeys->num_entries].file = xstrdup(path);
- hostkeys->entries[hostkeys->num_entries].line = linenum;
- hostkeys->entries[hostkeys->num_entries].key = key;
- hostkeys->entries[hostkeys->num_entries].marker = marker;
- hostkeys->num_entries++;
- num_loaded++;
+ if ((r = hostkeys_foreach(path, record_hostkey, &ctx, host, NULL,
+ HKF_WANT_MATCH|HKF_WANT_PARSE_KEY)) != 0) {
+ if (r != SSH_ERR_SYSTEM_ERROR && errno != ENOENT)
+ debug("%s: hostkeys_foreach failed for %s: %s",
+ __func__, path, ssh_err(r));
}
- debug3("%s: loaded %lu keys", __func__, num_loaded);
- fclose(f);
- return;
-}
+ if (ctx.num_loaded != 0)
+ debug3("%s: loaded %lu keys from %s", __func__,
+ ctx.num_loaded, host);
+}
void
free_hostkeys(struct hostkeys *hostkeys)
@@ -332,7 +297,7 @@
for (i = 0; i < hostkeys->num_entries; i++) {
free(hostkeys->entries[i].host);
free(hostkeys->entries[i].file);
- key_free(hostkeys->entries[i].key);
+ sshkey_free(hostkeys->entries[i].key);
explicit_bzero(hostkeys->entries + i, sizeof(*hostkeys->entries));
}
free(hostkeys->entries);
@@ -341,18 +306,18 @@
}
static int
-check_key_not_revoked(struct hostkeys *hostkeys, Key *k)
+check_key_not_revoked(struct hostkeys *hostkeys, struct sshkey *k)
{
- int is_cert = key_is_cert(k);
+ int is_cert = sshkey_is_cert(k);
u_int i;
for (i = 0; i < hostkeys->num_entries; i++) {
if (hostkeys->entries[i].marker != MRK_REVOKE)
continue;
- if (key_equal_public(k, hostkeys->entries[i].key))
+ if (sshkey_equal_public(k, hostkeys->entries[i].key))
return -1;
if (is_cert &&
- key_equal_public(k->cert->signature_key,
+ sshkey_equal_public(k->cert->signature_key,
hostkeys->entries[i].key))
return -1;
}
@@ -376,11 +341,11 @@
*/
static HostStatus
check_hostkeys_by_key_or_type(struct hostkeys *hostkeys,
- Key *k, int keytype, const struct hostkey_entry **found)
+ struct sshkey *k, int keytype, const struct hostkey_entry **found)
{
u_int i;
HostStatus end_return = HOST_NEW;
- int want_cert = key_is_cert(k);
+ int want_cert = sshkey_is_cert(k);
HostkeyMarker want_marker = want_cert ? MRK_CA : MRK_NONE;
int proto = (k ? k->type : keytype) == KEY_RSA1 ? 1 : 2;
@@ -404,7 +369,7 @@
break;
}
if (want_cert) {
- if (key_equal_public(k->cert->signature_key,
+ if (sshkey_equal_public(k->cert->signature_key,
hostkeys->entries[i].key)) {
/* A matching CA exists */
end_return = HOST_OK;
@@ -413,7 +378,7 @@
break;
}
} else {
- if (key_equal(k, hostkeys->entries[i].key)) {
+ if (sshkey_equal(k, hostkeys->entries[i].key)) {
end_return = HOST_OK;
if (found != NULL)
*found = hostkeys->entries + i;
@@ -432,9 +397,9 @@
}
return end_return;
}
-
+
HostStatus
-check_key_in_hostkeys(struct hostkeys *hostkeys, Key *key,
+check_key_in_hostkeys(struct hostkeys *hostkeys, struct sshkey *key,
const struct hostkey_entry **found)
{
if (key == NULL)
@@ -450,18 +415,42 @@
found) == HOST_FOUND);
}
+static int
+write_host_entry(FILE *f, const char *host, const char *ip,
+ const struct sshkey *key, int store_hash)
+{
+ int r, success = 0;
+ char *hashed_host = NULL;
+
+ if (store_hash) {
+ if ((hashed_host = host_hash(host, NULL, 0)) == NULL) {
+ error("%s: host_hash failed", __func__);
+ return 0;
+ }
+ fprintf(f, "%s ", hashed_host);
+ } else if (ip != NULL)
+ fprintf(f, "%s,%s ", host, ip);
+ else
+ fprintf(f, "%s ", host);
+
+ if ((r = sshkey_write(key, f)) == 0)
+ success = 1;
+ else
+ error("%s: sshkey_write failed: %s", __func__, ssh_err(r));
+ fputc('\n', f);
+ return success;
+}
+
/*
* Appends an entry to the host file. Returns false if the entry could not
* be appended.
*/
-
int
-add_host_to_hostfile(const char *filename, const char *host, const Key *key,
- int store_hash)
+add_host_to_hostfile(const char *filename, const char *host,
+ const struct sshkey *key, int store_hash)
{
FILE *f;
- int success = 0;
- char *hashed_host = NULL;
+ int success;
if (key == NULL)
return 1; /* XXX ? */
@@ -468,22 +457,396 @@
f = fopen(filename, "a");
if (!f)
return 0;
+ success = write_host_entry(f, host, NULL, key, store_hash);
+ fclose(f);
+ return success;
+}
- if (store_hash) {
- if ((hashed_host = host_hash(host, NULL, 0)) == NULL) {
- error("add_host_to_hostfile: host_hash failed");
- fclose(f);
+struct host_delete_ctx {
+ FILE *out;
+ int quiet;
+ const char *host;
+ int *skip_keys; /* XXX split for host/ip? might want to ensure both */
+ struct sshkey * const *keys;
+ size_t nkeys;
+ int modified;
+};
+
+static int
+host_delete(struct hostkey_foreach_line *l, void *_ctx)
+{
+ struct host_delete_ctx *ctx = (struct host_delete_ctx *)_ctx;
+ int loglevel = ctx->quiet ? SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_VERBOSE;
+ size_t i;
+
+ if (l->status == HKF_STATUS_MATCHED) {
+ if (l->marker != MRK_NONE) {
+ /* Don't remove CA and revocation lines */
+ fprintf(ctx->out, "%s\n", l->line);
return 0;
}
+
+ /* XXX might need a knob for this later */
+ /* Don't remove RSA1 keys */
+ if (l->key->type == KEY_RSA1) {
+ fprintf(ctx->out, "%s\n", l->line);
+ return 0;
+ }
+
+ /*
+ * If this line contains one of the keys that we will be
+ * adding later, then don't change it and mark the key for
+ * skipping.
+ */
+ for (i = 0; i < ctx->nkeys; i++) {
+ if (sshkey_equal(ctx->keys[i], l->key)) {
+ ctx->skip_keys[i] = 1;
+ fprintf(ctx->out, "%s\n", l->line);
+ debug3("%s: %s key already at %s:%ld", __func__,
+ sshkey_type(l->key), l->path, l->linenum);
+ return 0;
+ }
+ }
+
+ /*
+ * Hostname matches and has no CA/revoke marker, delete it
+ * by *not* writing the line to ctx->out.
+ */
+ do_log2(loglevel, "%s%s%s:%ld: Removed %s key for host %s",
+ ctx->quiet ? __func__ : "", ctx->quiet ? ": " : "",
+ l->path, l->linenum, sshkey_type(l->key), ctx->host);
+ ctx->modified = 1;
+ return 0;
}
- fprintf(f, "%s ", store_hash ? hashed_host : host);
+ /* Retain non-matching hosts and invalid lines when deleting */
+ if (l->status == HKF_STATUS_INVALID) {
+ do_log2(loglevel, "%s%s%s:%ld: invalid known_hosts entry",
+ ctx->quiet ? __func__ : "", ctx->quiet ? ": " : "",
+ l->path, l->linenum);
+ }
+ fprintf(ctx->out, "%s\n", l->line);
+ return 0;
+}
- if (key_write(key, f)) {
- success = 1;
+int
+hostfile_replace_entries(const char *filename, const char *host, const char *ip,
+ struct sshkey **keys, size_t nkeys, int store_hash, int quiet, int hash_alg)
+{
+ int r, fd, oerrno = 0;
+ int loglevel = quiet ? SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_VERBOSE;
+ struct host_delete_ctx ctx;
+ char *fp, *temp = NULL, *back = NULL;
+ mode_t omask;
+ size_t i;
+
+ omask = umask(077);
+
+ memset(&ctx, 0, sizeof(ctx));
+ ctx.host = host;
+ ctx.quiet = quiet;
+ if ((ctx.skip_keys = calloc(nkeys, sizeof(*ctx.skip_keys))) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ ctx.keys = keys;
+ ctx.nkeys = nkeys;
+ ctx.modified = 0;
+
+ /*
+ * Prepare temporary file for in-place deletion.
+ */
+ if ((r = asprintf(&temp, "%s.XXXXXXXXXXX", filename)) < 0 ||
+ (r = asprintf(&back, "%s.old", filename)) < 0) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto fail;
+ }
+
+ if ((fd = mkstemp(temp)) == -1) {
+ oerrno = errno;
+ error("%s: mkstemp: %s", __func__, strerror(oerrno));
+ r = SSH_ERR_SYSTEM_ERROR;
+ goto fail;
+ }
+ if ((ctx.out = fdopen(fd, "w")) == NULL) {
+ oerrno = errno;
+ close(fd);
+ error("%s: fdopen: %s", __func__, strerror(oerrno));
+ r = SSH_ERR_SYSTEM_ERROR;
+ goto fail;
+ }
+
+ /* Remove all entries for the specified host from the file */
+ if ((r = hostkeys_foreach(filename, host_delete, &ctx, host, ip,
+ HKF_WANT_PARSE_KEY)) != 0) {
+ error("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
+ goto fail;
+ }
+
+ /* Add the requested keys */
+ for (i = 0; i < nkeys; i++) {
+ if (ctx.skip_keys[i])
+ continue;
+ if ((fp = sshkey_fingerprint(keys[i], hash_alg,
+ SSH_FP_DEFAULT)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto fail;
+ }
+ do_log2(loglevel, "%s%sAdding new key for %s to %s: %s %s",
+ quiet ? __func__ : "", quiet ? ": " : "", host, filename,
+ sshkey_ssh_name(keys[i]), fp);
+ free(fp);
+ if (!write_host_entry(ctx.out, host, ip, keys[i], store_hash)) {
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto fail;
+ }
+ ctx.modified = 1;
+ }
+ fclose(ctx.out);
+ ctx.out = NULL;
+
+ if (ctx.modified) {
+ /* Backup the original file and replace it with the temporary */
+ if (unlink(back) == -1 && errno != ENOENT) {
+ oerrno = errno;
+ error("%s: unlink %.100s: %s", __func__,
+ back, strerror(errno));
+ r = SSH_ERR_SYSTEM_ERROR;
+ goto fail;
+ }
+ if (link(filename, back) == -1) {
+ oerrno = errno;
+ error("%s: link %.100s to %.100s: %s", __func__,
+ filename, back, strerror(errno));
+ r = SSH_ERR_SYSTEM_ERROR;
+ goto fail;
+ }
+ if (rename(temp, filename) == -1) {
+ oerrno = errno;
+ error("%s: rename \"%s\" to \"%s\": %s", __func__,
+ temp, filename, strerror(errno));
+ r = SSH_ERR_SYSTEM_ERROR;
+ goto fail;
+ }
} else {
- error("add_host_to_hostfile: saving key in %s failed", filename);
+ /* No changes made; just delete the temporary file */
+ if (unlink(temp) != 0)
+ error("%s: unlink \"%s\": %s", __func__,
+ temp, strerror(errno));
}
- fprintf(f, "\n");
+
+ /* success */
+ r = 0;
+ fail:
+ if (temp != NULL && r != 0)
+ unlink(temp);
+ free(temp);
+ free(back);
+ if (ctx.out != NULL)
+ fclose(ctx.out);
+ free(ctx.skip_keys);
+ umask(omask);
+ if (r == SSH_ERR_SYSTEM_ERROR)
+ errno = oerrno;
+ return r;
+}
+
+static int
+match_maybe_hashed(const char *host, const char *names, int *was_hashed)
+{
+ int hashed = *names == HASH_DELIM;
+ const char *hashed_host;
+ size_t nlen = strlen(names);
+
+ if (was_hashed != NULL)
+ *was_hashed = hashed;
+ if (hashed) {
+ if ((hashed_host = host_hash(host, names, nlen)) == NULL)
+ return -1;
+ return nlen == strlen(hashed_host) &&
+ strncmp(hashed_host, names, nlen) == 0;
+ }
+ return match_hostname(host, names) == 1;
+}
+
+int
+hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
+ const char *host, const char *ip, u_int options)
+{
+ FILE *f;
+ char line[8192], oline[8192], ktype[128];
+ u_long linenum = 0;
+ char *cp, *cp2;
+ u_int kbits;
+ int hashed;
+ int s, r = 0;
+ struct hostkey_foreach_line lineinfo;
+ size_t l;
+
+ memset(&lineinfo, 0, sizeof(lineinfo));
+ if (host == NULL && (options & HKF_WANT_MATCH) != 0)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((f = fopen(path, "r")) == NULL)
+ return SSH_ERR_SYSTEM_ERROR;
+
+ debug3("%s: reading file \"%s\"", __func__, path);
+ while (read_keyfile_line(f, path, line, sizeof(line), &linenum) == 0) {
+ line[strcspn(line, "\n")] = '\0';
+ strlcpy(oline, line, sizeof(oline));
+
+ sshkey_free(lineinfo.key);
+ memset(&lineinfo, 0, sizeof(lineinfo));
+ lineinfo.path = path;
+ lineinfo.linenum = linenum;
+ lineinfo.line = oline;
+ lineinfo.marker = MRK_NONE;
+ lineinfo.status = HKF_STATUS_OK;
+ lineinfo.keytype = KEY_UNSPEC;
+
+ /* Skip any leading whitespace, comments and empty lines. */
+ for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
+ ;
+ if (!*cp || *cp == '#' || *cp == '\n') {
+ if ((options & HKF_WANT_MATCH) == 0) {
+ lineinfo.status = HKF_STATUS_COMMENT;
+ if ((r = callback(&lineinfo, ctx)) != 0)
+ break;
+ }
+ continue;
+ }
+
+ if ((lineinfo.marker = check_markers(&cp)) == MRK_ERROR) {
+ verbose("%s: invalid marker at %s:%lu",
+ __func__, path, linenum);
+ if ((options & HKF_WANT_MATCH) == 0)
+ goto bad;
+ continue;
+ }
+
+ /* Find the end of the host name portion. */
+ for (cp2 = cp; *cp2 && *cp2 != ' ' && *cp2 != '\t'; cp2++)
+ ;
+ lineinfo.hosts = cp;
+ *cp2++ = '\0';
+
+ /* Check if the host name matches. */
+ if (host != NULL) {
+ if ((s = match_maybe_hashed(host, lineinfo.hosts,
+ &hashed)) == -1) {
+ debug2("%s: %s:%ld: bad host hash \"%.32s\"",
+ __func__, path, linenum, lineinfo.hosts);
+ goto bad;
+ }
+ if (s == 1) {
+ lineinfo.status = HKF_STATUS_MATCHED;
+ lineinfo.match |= HKF_MATCH_HOST |
+ (hashed ? HKF_MATCH_HOST_HASHED : 0);
+ }
+ /* Try matching IP address if supplied */
+ if (ip != NULL) {
+ if ((s = match_maybe_hashed(ip, lineinfo.hosts,
+ &hashed)) == -1) {
+ debug2("%s: %s:%ld: bad ip hash "
+ "\"%.32s\"", __func__, path,
+ linenum, lineinfo.hosts);
+ goto bad;
+ }
+ if (s == 1) {
+ lineinfo.status = HKF_STATUS_MATCHED;
+ lineinfo.match |= HKF_MATCH_IP |
+ (hashed ? HKF_MATCH_IP_HASHED : 0);
+ }
+ }
+ /*
+ * Skip this line if host matching requested and
+ * neither host nor address matched.
+ */
+ if ((options & HKF_WANT_MATCH) != 0 &&
+ lineinfo.status != HKF_STATUS_MATCHED)
+ continue;
+ }
+
+ /* Got a match. Skip host name and any following whitespace */
+ for (; *cp2 == ' ' || *cp2 == '\t'; cp2++)
+ ;
+ if (*cp2 == '\0' || *cp2 == '#') {
+ debug2("%s:%ld: truncated before key type",
+ path, linenum);
+ goto bad;
+ }
+ lineinfo.rawkey = cp = cp2;
+
+ if ((options & HKF_WANT_PARSE_KEY) != 0) {
+ /*
+ * Extract the key from the line. This will skip
+ * any leading whitespace. Ignore badly formatted
+ * lines.
+ */
+ if ((lineinfo.key = sshkey_new(KEY_UNSPEC)) == NULL) {
+ error("%s: sshkey_new failed", __func__);
+ r = SSH_ERR_ALLOC_FAIL;
+ break;
+ }
+ if (!hostfile_read_key(&cp, &kbits, lineinfo.key)) {
+#ifdef WITH_SSH1
+ sshkey_free(lineinfo.key);
+ lineinfo.key = sshkey_new(KEY_RSA1);
+ if (lineinfo.key == NULL) {
+ error("%s: sshkey_new fail", __func__);
+ r = SSH_ERR_ALLOC_FAIL;
+ break;
+ }
+ if (!hostfile_read_key(&cp, &kbits,
+ lineinfo.key))
+ goto bad;
+#else
+ goto bad;
+#endif
+ }
+ lineinfo.keytype = lineinfo.key->type;
+ lineinfo.comment = cp;
+ } else {
+ /* Extract and parse key type */
+ l = strcspn(lineinfo.rawkey, " \t");
+ if (l <= 1 || l >= sizeof(ktype) ||
+ lineinfo.rawkey[l] == '\0')
+ goto bad;
+ memcpy(ktype, lineinfo.rawkey, l);
+ ktype[l] = '\0';
+ lineinfo.keytype = sshkey_type_from_name(ktype);
+
+ /*
+ * Assume RSA1 if the first component is a short
+ * decimal number.
+ */
+ if (lineinfo.keytype == KEY_UNSPEC && l < 8 &&
+ strspn(ktype, "0123456789") == l)
+ lineinfo.keytype = KEY_RSA1;
+
+ /*
+ * Check that something other than whitespace follows
+ * the key type. This won't catch all corruption, but
+ * it does catch trivial truncation.
+ */
+ cp2 += l; /* Skip past key type */
+ for (; *cp2 == ' ' || *cp2 == '\t'; cp2++)
+ ;
+ if (*cp2 == '\0' || *cp2 == '#') {
+ debug2("%s:%ld: truncated after key type",
+ path, linenum);
+ lineinfo.keytype = KEY_UNSPEC;
+ }
+ if (lineinfo.keytype == KEY_UNSPEC) {
+ bad:
+ sshkey_free(lineinfo.key);
+ lineinfo.key = NULL;
+ lineinfo.status = HKF_STATUS_INVALID;
+ if ((r = callback(&lineinfo, ctx)) != 0)
+ break;
+ continue;
+ }
+ }
+ if ((r = callback(&lineinfo, ctx)) != 0)
+ break;
+ }
+ sshkey_free(lineinfo.key);
fclose(f);
- return success;
+ return r;
}
Modified: trunk/crypto/openssh/hostfile.h
===================================================================
--- trunk/crypto/openssh/hostfile.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/hostfile.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: hostfile.h,v 1.20 2013/07/12 00:19:58 djm Exp $ */
+/* $OpenBSD: hostfile.h,v 1.24 2015/02/16 22:08:57 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -26,7 +26,7 @@
char *host;
char *file;
u_long line;
- Key *key;
+ struct sshkey *key;
HostkeyMarker marker;
};
struct hostkeys;
@@ -35,14 +35,19 @@
void load_hostkeys(struct hostkeys *, const char *, const char *);
void free_hostkeys(struct hostkeys *);
-HostStatus check_key_in_hostkeys(struct hostkeys *, Key *,
+HostStatus check_key_in_hostkeys(struct hostkeys *, struct sshkey *,
const struct hostkey_entry **);
int lookup_key_in_hostkeys_by_type(struct hostkeys *, int,
const struct hostkey_entry **);
-int hostfile_read_key(char **, int *, Key *);
-int add_host_to_hostfile(const char *, const char *, const Key *, int);
+int hostfile_read_key(char **, u_int *, struct sshkey *);
+int add_host_to_hostfile(const char *, const char *,
+ const struct sshkey *, int);
+int hostfile_replace_entries(const char *filename,
+ const char *host, const char *ip, struct sshkey **keys, size_t nkeys,
+ int store_hash, int quiet, int hash_alg);
+
#define HASH_MAGIC "|1|"
#define HASH_DELIM '|'
@@ -51,4 +56,53 @@
char *host_hash(const char *, const char *, u_int);
+/*
+ * Iterate through a hostkeys file, optionally parsing keys and matching
+ * hostnames. Allows access to the raw keyfile lines to allow
+ * streaming edits to the file to take place.
+ */
+#define HKF_WANT_MATCH (1) /* return only matching hosts/addrs */
+#define HKF_WANT_PARSE_KEY (1<<1) /* need key parsed */
+
+#define HKF_STATUS_OK 0 /* Line parsed, didn't match host */
+#define HKF_STATUS_INVALID 1 /* line had parse error */
+#define HKF_STATUS_COMMENT 2 /* valid line contained no key */
+#define HKF_STATUS_MATCHED 3 /* hostname or IP matched */
+
+#define HKF_MATCH_HOST (1) /* hostname matched */
+#define HKF_MATCH_IP (1<<1) /* address matched */
+#define HKF_MATCH_HOST_HASHED (1<<2) /* hostname was hashed */
+#define HKF_MATCH_IP_HASHED (1<<3) /* address was hashed */
+/* XXX HKF_MATCH_KEY_TYPE? */
+
+/*
+ * The callback function receives this as an argument for each matching
+ * hostkey line. The callback may "steal" the 'key' field by setting it to NULL.
+ * If a parse error occurred, then "hosts" and subsequent options may be NULL.
+ */
+struct hostkey_foreach_line {
+ const char *path; /* Path of file */
+ u_long linenum; /* Line number */
+ u_int status; /* One of HKF_STATUS_* */
+ u_int match; /* Zero or more of HKF_MATCH_* OR'd together */
+ char *line; /* Entire key line; mutable by callback */
+ int marker; /* CA/revocation markers; indicated by MRK_* value */
+ const char *hosts; /* Raw hosts text, may be hashed or list multiple */
+ const char *rawkey; /* Text of key and any comment following it */
+ int keytype; /* Type of key; KEY_UNSPEC for invalid/comment lines */
+ struct sshkey *key; /* Key, if parsed ok and HKF_WANT_MATCH_HOST set */
+ const char *comment; /* Any comment following the key */
+};
+
+/*
+ * Callback fires for each line (or matching line if a HKF_WANT_* option
+ * is set). The foreach loop will terminate if the callback returns a non-
+ * zero exit status.
+ */
+typedef int hostkeys_foreach_fn(struct hostkey_foreach_line *l, void *ctx);
+
+/* Iterate over a hostkeys file */
+int hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
+ const char *host, const char *ip, u_int options);
+
#endif
Modified: trunk/crypto/openssh/includes.h
===================================================================
--- trunk/crypto/openssh/includes.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/includes.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -23,20 +23,15 @@
#endif
#include <sys/types.h>
+#include <sys/param.h>
#include <sys/socket.h> /* For CMSG_* */
#ifdef HAVE_LIMITS_H
-# include <limits.h> /* For PATH_MAX */
+# include <limits.h> /* For PATH_MAX, _POSIX_HOST_NAME_MAX */
#endif
#ifdef HAVE_BSTRING_H
# include <bstring.h>
#endif
-#if defined(HAVE_GLOB_H) && defined(GLOB_HAS_ALTDIRFUNC) && \
- defined(GLOB_HAS_GL_MATCHC) && defined(GLOB_HAS_GL_STATV) && \
- defined(HAVE_DECL_GLOB_NOMATCH) && HAVE_DECL_GLOB_NOMATCH != 0 && \
- !defined(BROKEN_GLOB)
-# include <glob.h>
-#endif
#ifdef HAVE_ENDIAN_H
# include <endian.h>
#endif
@@ -166,7 +161,9 @@
# endif
#endif
+#ifdef WITH_OPENSSL
#include <openssl/opensslv.h> /* For OPENSSL_VERSION_NUMBER */
+#endif
#include "defines.h"
Modified: trunk/crypto/openssh/kex.c
===================================================================
--- trunk/crypto/openssh/kex.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kex.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.98 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.118 2016/05/02 10:26:04 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
*
@@ -25,7 +25,7 @@
#include "includes.h"
-#include <sys/param.h>
+#include <sys/param.h> /* MAX roundup */
#include <signal.h>
#include <stdarg.h>
@@ -33,22 +33,26 @@
#include <stdlib.h>
#include <string.h>
+#ifdef WITH_OPENSSL
#include <openssl/crypto.h>
+#include <openssl/dh.h>
+#endif
-#include "xmalloc.h"
#include "ssh2.h"
-#include "buffer.h"
#include "packet.h"
#include "compat.h"
#include "cipher.h"
-#include "key.h"
+#include "sshkey.h"
#include "kex.h"
#include "log.h"
#include "mac.h"
#include "match.h"
+#include "misc.h"
#include "dispatch.h"
#include "monitor.h"
-#include "roaming.h"
+
+#include "ssherr.h"
+#include "sshbuf.h"
#include "digest.h"
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
@@ -60,22 +64,39 @@
#endif
/* prototype */
-static void kex_kexinit_finish(Kex *);
-static void kex_choose_conf(Kex *);
+static int kex_choose_conf(struct ssh *);
+static int kex_input_newkeys(int, u_int32_t, void *);
+static const char *proposal_names[PROPOSAL_MAX] = {
+ "KEX algorithms",
+ "host key algorithms",
+ "ciphers ctos",
+ "ciphers stoc",
+ "MACs ctos",
+ "MACs stoc",
+ "compression ctos",
+ "compression stoc",
+ "languages ctos",
+ "languages stoc",
+};
+
struct kexalg {
char *name;
- int type;
+ u_int type;
int ec_nid;
int hash_alg;
};
static const struct kexalg kexalgs[] = {
+#ifdef WITH_OPENSSL
{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
- { KEX_DH14, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
+ { KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
+ { KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
+ { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
+ { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512 },
{ KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
#ifdef HAVE_EVP_SHA256
{ KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
-#endif
+#endif /* HAVE_EVP_SHA256 */
#ifdef OPENSSL_HAS_ECC
{ KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,
NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
@@ -84,12 +105,12 @@
# ifdef OPENSSL_HAS_NISTP521
{ KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
SSH_DIGEST_SHA512 },
-# endif
-#endif
- { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
-#ifdef HAVE_EVP_SHA256
+# endif /* OPENSSL_HAS_NISTP521 */
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+#if defined(HAVE_EVP_SHA256) || !defined(WITH_OPENSSL)
{ KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
-#endif
+#endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
{ NULL, -1, -1, -1},
};
@@ -96,7 +117,7 @@
char *
kex_alg_list(char sep)
{
- char *ret = NULL;
+ char *ret = NULL, *tmp;
size_t nlen, rlen = 0;
const struct kexalg *k;
@@ -104,7 +125,11 @@
if (ret != NULL)
ret[rlen++] = sep;
nlen = strlen(k->name);
- ret = xrealloc(ret, 1, rlen + nlen + 2);
+ if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) {
+ free(ret);
+ return NULL;
+ }
+ ret = tmp;
memcpy(ret + rlen, k->name, nlen + 1);
rlen += nlen;
}
@@ -131,7 +156,8 @@
if (names == NULL || strcmp(names, "") == 0)
return 0;
- s = cp = xstrdup(names);
+ if ((s = cp = strdup(names)) == NULL)
+ return 0;
for ((p = strsep(&cp, ",")); p && *p != '\0';
(p = strsep(&cp, ","))) {
if (kex_alg_by_name(p) == NULL) {
@@ -145,61 +171,144 @@
return 1;
}
+/*
+ * Concatenate algorithm names, avoiding duplicates in the process.
+ * Caller must free returned string.
+ */
+char *
+kex_names_cat(const char *a, const char *b)
+{
+ char *ret = NULL, *tmp = NULL, *cp, *p;
+ size_t len;
+
+ if (a == NULL || *a == '\0')
+ return NULL;
+ if (b == NULL || *b == '\0')
+ return strdup(a);
+ if (strlen(b) > 1024*1024)
+ return NULL;
+ len = strlen(a) + strlen(b) + 2;
+ if ((tmp = cp = strdup(b)) == NULL ||
+ (ret = calloc(1, len)) == NULL) {
+ free(tmp);
+ return NULL;
+ }
+ strlcpy(ret, a, len);
+ for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) {
+ if (match_list(ret, p, NULL) != NULL)
+ continue; /* Algorithm already present */
+ if (strlcat(ret, ",", len) >= len ||
+ strlcat(ret, p, len) >= len) {
+ free(tmp);
+ free(ret);
+ return NULL; /* Shouldn't happen */
+ }
+ }
+ free(tmp);
+ return ret;
+}
+
+/*
+ * Assemble a list of algorithms from a default list and a string from a
+ * configuration file. The user-provided string may begin with '+' to
+ * indicate that it should be appended to the default.
+ */
+int
+kex_assemble_names(const char *def, char **list)
+{
+ char *ret;
+
+ if (list == NULL || *list == NULL || **list == '\0') {
+ *list = strdup(def);
+ return 0;
+ }
+ if (**list != '+') {
+ return 0;
+ }
+
+ if ((ret = kex_names_cat(def, *list + 1)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ free(*list);
+ *list = ret;
+ return 0;
+}
+
/* put algorithm proposal into buffer */
-static void
-kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
+int
+kex_prop2buf(struct sshbuf *b, char *proposal[PROPOSAL_MAX])
{
u_int i;
+ int r;
- buffer_clear(b);
+ sshbuf_reset(b);
+
/*
* add a dummy cookie, the cookie will be overwritten by
* kex_send_kexinit(), each time a kexinit is set
*/
- for (i = 0; i < KEX_COOKIE_LEN; i++)
- buffer_put_char(b, 0);
- for (i = 0; i < PROPOSAL_MAX; i++)
- buffer_put_cstring(b, proposal[i]);
- buffer_put_char(b, 0); /* first_kex_packet_follows */
- buffer_put_int(b, 0); /* uint32 reserved */
+ for (i = 0; i < KEX_COOKIE_LEN; i++) {
+ if ((r = sshbuf_put_u8(b, 0)) != 0)
+ return r;
+ }
+ for (i = 0; i < PROPOSAL_MAX; i++) {
+ if ((r = sshbuf_put_cstring(b, proposal[i])) != 0)
+ return r;
+ }
+ if ((r = sshbuf_put_u8(b, 0)) != 0 || /* first_kex_packet_follows */
+ (r = sshbuf_put_u32(b, 0)) != 0) /* uint32 reserved */
+ return r;
+ return 0;
}
/* parse buffer and return algorithm proposal */
-static char **
-kex_buf2prop(Buffer *raw, int *first_kex_follows)
+int
+kex_buf2prop(struct sshbuf *raw, int *first_kex_follows, char ***propp)
{
- Buffer b;
+ struct sshbuf *b = NULL;
+ u_char v;
u_int i;
- char **proposal;
+ char **proposal = NULL;
+ int r;
- proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
-
- buffer_init(&b);
- buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
- /* skip cookie */
- for (i = 0; i < KEX_COOKIE_LEN; i++)
- buffer_get_char(&b);
+ *propp = NULL;
+ if ((proposal = calloc(PROPOSAL_MAX, sizeof(char *))) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((b = sshbuf_fromb(raw)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_consume(b, KEX_COOKIE_LEN)) != 0) /* skip cookie */
+ goto out;
/* extract kex init proposal strings */
for (i = 0; i < PROPOSAL_MAX; i++) {
- proposal[i] = buffer_get_cstring(&b,NULL);
- debug2("kex_parse_kexinit: %s", proposal[i]);
+ if ((r = sshbuf_get_cstring(b, &(proposal[i]), NULL)) != 0)
+ goto out;
+ debug2("%s: %s", proposal_names[i], proposal[i]);
}
/* first kex follows / reserved */
- i = buffer_get_char(&b);
+ if ((r = sshbuf_get_u8(b, &v)) != 0 || /* first_kex_follows */
+ (r = sshbuf_get_u32(b, &i)) != 0) /* reserved */
+ goto out;
if (first_kex_follows != NULL)
- *first_kex_follows = i;
- debug2("kex_parse_kexinit: first_kex_follows %d ", i);
- i = buffer_get_int(&b);
- debug2("kex_parse_kexinit: reserved %u ", i);
- buffer_free(&b);
- return proposal;
+ *first_kex_follows = v;
+ debug2("first_kex_follows %d ", v);
+ debug2("reserved %u ", i);
+ r = 0;
+ *propp = proposal;
+ out:
+ if (r != 0 && proposal != NULL)
+ kex_prop_free(proposal);
+ sshbuf_free(b);
+ return r;
}
-static void
+void
kex_prop_free(char **proposal)
{
u_int i;
+ if (proposal == NULL)
+ return;
for (i = 0; i < PROPOSAL_MAX; i++)
free(proposal[i]);
free(proposal);
@@ -206,97 +315,174 @@
}
/* ARGSUSED */
-static void
+static int
kex_protocol_error(int type, u_int32_t seq, void *ctxt)
{
- error("Hm, kex protocol error: type %d seq %u", type, seq);
+ struct ssh *ssh = active_state; /* XXX */
+ int r;
+
+ error("kex protocol error: type %d seq %u", type, seq);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_UNIMPLEMENTED)) != 0 ||
+ (r = sshpkt_put_u32(ssh, seq)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
+ return 0;
}
static void
-kex_reset_dispatch(void)
+kex_reset_dispatch(struct ssh *ssh)
{
- dispatch_range(SSH2_MSG_TRANSPORT_MIN,
+ ssh_dispatch_range(ssh, SSH2_MSG_TRANSPORT_MIN,
SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
- dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
+ ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit);
}
-void
-kex_finish(Kex *kex)
+static int
+kex_send_ext_info(struct ssh *ssh)
{
- kex_reset_dispatch();
+ int r;
- packet_start(SSH2_MSG_NEWKEYS);
- packet_send();
- /* packet_write_wait(); */
+ if ((r = sshpkt_start(ssh, SSH2_MSG_EXT_INFO)) != 0 ||
+ (r = sshpkt_put_u32(ssh, 1)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, "server-sig-algs")) != 0 ||
+ (r = sshpkt_put_cstring(ssh, "rsa-sha2-256,rsa-sha2-512")) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
+ return 0;
+}
+
+int
+kex_send_newkeys(struct ssh *ssh)
+{
+ int r;
+
+ kex_reset_dispatch(ssh);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_NEWKEYS)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
debug("SSH2_MSG_NEWKEYS sent");
+ debug("expecting SSH2_MSG_NEWKEYS");
+ ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_input_newkeys);
+ if (ssh->kex->ext_info_c)
+ if ((r = kex_send_ext_info(ssh)) != 0)
+ return r;
+ return 0;
+}
- debug("expecting SSH2_MSG_NEWKEYS");
- packet_read_expect(SSH2_MSG_NEWKEYS);
- packet_check_eom();
+int
+kex_input_ext_info(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ u_int32_t i, ninfo;
+ char *name, *val, *found;
+ int r;
+
+ debug("SSH2_MSG_EXT_INFO received");
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &kex_protocol_error);
+ if ((r = sshpkt_get_u32(ssh, &ninfo)) != 0)
+ return r;
+ for (i = 0; i < ninfo; i++) {
+ if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0)
+ return r;
+ if ((r = sshpkt_get_cstring(ssh, &val, NULL)) != 0) {
+ free(name);
+ return r;
+ }
+ debug("%s: %s=<%s>", __func__, name, val);
+ if (strcmp(name, "server-sig-algs") == 0) {
+ found = match_list("rsa-sha2-256", val, NULL);
+ if (found) {
+ kex->rsa_sha2 = 256;
+ free(found);
+ }
+ found = match_list("rsa-sha2-512", val, NULL);
+ if (found) {
+ kex->rsa_sha2 = 512;
+ free(found);
+ }
+ }
+ free(name);
+ free(val);
+ }
+ return sshpkt_get_end(ssh);
+}
+
+static int
+kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ int r;
+
debug("SSH2_MSG_NEWKEYS received");
-
+ ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
+ if ((r = sshpkt_get_end(ssh)) != 0)
+ return r;
kex->done = 1;
- buffer_clear(&kex->peer);
- /* buffer_clear(&kex->my); */
+ sshbuf_reset(kex->peer);
+ /* sshbuf_reset(kex->my); */
kex->flags &= ~KEX_INIT_SENT;
free(kex->name);
kex->name = NULL;
+ return 0;
}
-void
-kex_send_kexinit(Kex *kex)
+int
+kex_send_kexinit(struct ssh *ssh)
{
- u_int32_t rnd = 0;
u_char *cookie;
- u_int i;
+ struct kex *kex = ssh->kex;
+ int r;
- if (kex == NULL) {
- error("kex_send_kexinit: no kex, cannot rekey");
- return;
- }
- if (kex->flags & KEX_INIT_SENT) {
- debug("KEX_INIT_SENT");
- return;
- }
+ if (kex == NULL)
+ return SSH_ERR_INTERNAL_ERROR;
+ if (kex->flags & KEX_INIT_SENT)
+ return 0;
kex->done = 0;
/* generate a random cookie */
- if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
- fatal("kex_send_kexinit: kex proposal too short");
- cookie = buffer_ptr(&kex->my);
- for (i = 0; i < KEX_COOKIE_LEN; i++) {
- if (i % 4 == 0)
- rnd = arc4random();
- cookie[i] = rnd;
- rnd >>= 8;
- }
- packet_start(SSH2_MSG_KEXINIT);
- packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
- packet_send();
+ if (sshbuf_len(kex->my) < KEX_COOKIE_LEN)
+ return SSH_ERR_INVALID_FORMAT;
+ if ((cookie = sshbuf_mutable_ptr(kex->my)) == NULL)
+ return SSH_ERR_INTERNAL_ERROR;
+ arc4random_buf(cookie, KEX_COOKIE_LEN);
+
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEXINIT)) != 0 ||
+ (r = sshpkt_putb(ssh, kex->my)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
debug("SSH2_MSG_KEXINIT sent");
kex->flags |= KEX_INIT_SENT;
+ return 0;
}
/* ARGSUSED */
-void
+int
kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
{
- char *ptr;
- u_int i, dlen;
- Kex *kex = (Kex *)ctxt;
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ const u_char *ptr;
+ u_int i;
+ size_t dlen;
+ int r;
debug("SSH2_MSG_KEXINIT received");
if (kex == NULL)
- fatal("kex_input_kexinit: no kex, cannot rekey");
+ return SSH_ERR_INVALID_ARGUMENT;
- ptr = packet_get_raw(&dlen);
- buffer_append(&kex->peer, ptr, dlen);
+ ptr = sshpkt_ptr(ssh, &dlen);
+ if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
+ return r;
/* discard packet */
for (i = 0; i < KEX_COOKIE_LEN; i++)
- packet_get_char();
+ if ((r = sshpkt_get_u8(ssh, NULL)) != 0)
+ return r;
for (i = 0; i < PROPOSAL_MAX; i++)
- free(packet_get_string(NULL));
+ if ((r = sshpkt_get_string(ssh, NULL, NULL)) != 0)
+ return r;
/*
* XXX RFC4253 sec 7: "each side MAY guess" - currently no supported
* KEX method has the server move first, but a server might be using
@@ -307,55 +493,151 @@
* for cases where the server *doesn't* go first. I guess we should
* ignore it when it is set for these cases, which is what we do now.
*/
- (void) packet_get_char(); /* first_kex_follows */
- (void) packet_get_int(); /* reserved */
- packet_check_eom();
+ if ((r = sshpkt_get_u8(ssh, NULL)) != 0 || /* first_kex_follows */
+ (r = sshpkt_get_u32(ssh, NULL)) != 0 || /* reserved */
+ (r = sshpkt_get_end(ssh)) != 0)
+ return r;
- kex_kexinit_finish(kex);
+ if (!(kex->flags & KEX_INIT_SENT))
+ if ((r = kex_send_kexinit(ssh)) != 0)
+ return r;
+ if ((r = kex_choose_conf(ssh)) != 0)
+ return r;
+
+ if (kex->kex_type < KEX_MAX && kex->kex[kex->kex_type] != NULL)
+ return (kex->kex[kex->kex_type])(ssh);
+
+ return SSH_ERR_INTERNAL_ERROR;
}
-Kex *
-kex_setup(char *proposal[PROPOSAL_MAX])
+int
+kex_new(struct ssh *ssh, char *proposal[PROPOSAL_MAX], struct kex **kexp)
{
- Kex *kex;
+ struct kex *kex;
+ int r;
- kex = xcalloc(1, sizeof(*kex));
- buffer_init(&kex->peer);
- buffer_init(&kex->my);
- kex_prop2buf(&kex->my, proposal);
+ *kexp = NULL;
+ if ((kex = calloc(1, sizeof(*kex))) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((kex->peer = sshbuf_new()) == NULL ||
+ (kex->my = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = kex_prop2buf(kex->my, proposal)) != 0)
+ goto out;
kex->done = 0;
+ kex_reset_dispatch(ssh);
+ r = 0;
+ *kexp = kex;
+ out:
+ if (r != 0)
+ kex_free(kex);
+ return r;
+}
- kex_send_kexinit(kex); /* we start */
- kex_reset_dispatch();
+void
+kex_free_newkeys(struct newkeys *newkeys)
+{
+ if (newkeys == NULL)
+ return;
+ if (newkeys->enc.key) {
+ explicit_bzero(newkeys->enc.key, newkeys->enc.key_len);
+ free(newkeys->enc.key);
+ newkeys->enc.key = NULL;
+ }
+ if (newkeys->enc.iv) {
+ explicit_bzero(newkeys->enc.iv, newkeys->enc.iv_len);
+ free(newkeys->enc.iv);
+ newkeys->enc.iv = NULL;
+ }
+ free(newkeys->enc.name);
+ explicit_bzero(&newkeys->enc, sizeof(newkeys->enc));
+ free(newkeys->comp.name);
+ explicit_bzero(&newkeys->comp, sizeof(newkeys->comp));
+ mac_clear(&newkeys->mac);
+ if (newkeys->mac.key) {
+ explicit_bzero(newkeys->mac.key, newkeys->mac.key_len);
+ free(newkeys->mac.key);
+ newkeys->mac.key = NULL;
+ }
+ free(newkeys->mac.name);
+ explicit_bzero(&newkeys->mac, sizeof(newkeys->mac));
+ explicit_bzero(newkeys, sizeof(*newkeys));
+ free(newkeys);
+}
- return kex;
+void
+kex_free(struct kex *kex)
+{
+ u_int mode;
+
+#ifdef WITH_OPENSSL
+ if (kex->dh)
+ DH_free(kex->dh);
+#ifdef OPENSSL_HAS_ECC
+ if (kex->ec_client_key)
+ EC_KEY_free(kex->ec_client_key);
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ for (mode = 0; mode < MODE_MAX; mode++) {
+ kex_free_newkeys(kex->newkeys[mode]);
+ kex->newkeys[mode] = NULL;
+ }
+ sshbuf_free(kex->peer);
+ sshbuf_free(kex->my);
+ free(kex->session_id);
+ free(kex->client_version_string);
+ free(kex->server_version_string);
+ free(kex->failed_choice);
+ free(kex->hostkey_alg);
+ free(kex->name);
+ free(kex);
}
-static void
-kex_kexinit_finish(Kex *kex)
+int
+kex_setup(struct ssh *ssh, char *proposal[PROPOSAL_MAX])
{
- if (!(kex->flags & KEX_INIT_SENT))
- kex_send_kexinit(kex);
+ int r;
- kex_choose_conf(kex);
+ if ((r = kex_new(ssh, proposal, &ssh->kex)) != 0)
+ return r;
+ if ((r = kex_send_kexinit(ssh)) != 0) { /* we start */
+ kex_free(ssh->kex);
+ ssh->kex = NULL;
+ return r;
+ }
+ return 0;
+}
- if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
- kex->kex[kex->kex_type] != NULL) {
- (kex->kex[kex->kex_type])(kex);
- } else {
- fatal("Unsupported key exchange %d", kex->kex_type);
+/*
+ * Request key re-exchange, returns 0 on success or a ssherr.h error
+ * code otherwise. Must not be called if KEX is incomplete or in-progress.
+ */
+int
+kex_start_rekex(struct ssh *ssh)
+{
+ if (ssh->kex == NULL) {
+ error("%s: no kex", __func__);
+ return SSH_ERR_INTERNAL_ERROR;
}
+ if (ssh->kex->done == 0) {
+ error("%s: requested twice", __func__);
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ ssh->kex->done = 0;
+ return kex_send_kexinit(ssh);
}
-static void
-choose_enc(Enc *enc, char *client, char *server)
+static int
+choose_enc(struct sshenc *enc, char *client, char *server)
{
char *name = match_list(client, server, NULL);
+
if (name == NULL)
- fatal("no matching cipher found: client %s server %s",
- client, server);
+ return SSH_ERR_NO_CIPHER_ALG_MATCH;
if ((enc->cipher = cipher_by_name(name)) == NULL)
- fatal("matching cipher is not supported: %s", name);
+ return SSH_ERR_INTERNAL_ERROR;
enc->name = name;
enc->enabled = 0;
enc->iv = NULL;
@@ -363,31 +645,34 @@
enc->key = NULL;
enc->key_len = cipher_keylen(enc->cipher);
enc->block_size = cipher_blocksize(enc->cipher);
+ return 0;
}
-static void
-choose_mac(Mac *mac, char *client, char *server)
+static int
+choose_mac(struct ssh *ssh, struct sshmac *mac, char *client, char *server)
{
char *name = match_list(client, server, NULL);
+
if (name == NULL)
- fatal("no matching mac found: client %s server %s",
- client, server);
+ return SSH_ERR_NO_MAC_ALG_MATCH;
if (mac_setup(mac, name) < 0)
- fatal("unsupported mac %s", name);
+ return SSH_ERR_INTERNAL_ERROR;
/* truncate the key */
- if (datafellows & SSH_BUG_HMAC)
+ if (ssh->compat & SSH_BUG_HMAC)
mac->key_len = 16;
mac->name = name;
mac->key = NULL;
mac->enabled = 0;
+ return 0;
}
-static void
-choose_comp(Comp *comp, char *client, char *server)
+static int
+choose_comp(struct sshcomp *comp, char *client, char *server)
{
char *name = match_list(client, server, NULL);
+
if (name == NULL)
- fatal("no matching comp found: client %s server %s", client, server);
+ return SSH_ERR_NO_COMPRESS_ALG_MATCH;
if (strcmp(name, "zlib at openssh.com") == 0) {
comp->type = COMP_DELAYED;
} else if (strcmp(name, "zlib") == 0) {
@@ -395,36 +680,44 @@
} else if (strcmp(name, "none") == 0) {
comp->type = COMP_NONE;
} else {
- fatal("unsupported comp %s", name);
+ return SSH_ERR_INTERNAL_ERROR;
}
comp->name = name;
+ return 0;
}
-static void
-choose_kex(Kex *k, char *client, char *server)
+static int
+choose_kex(struct kex *k, char *client, char *server)
{
const struct kexalg *kexalg;
k->name = match_list(client, server, NULL);
+
+ debug("kex: algorithm: %s", k->name ? k->name : "(no match)");
if (k->name == NULL)
- fatal("Unable to negotiate a key exchange method");
+ return SSH_ERR_NO_KEX_ALG_MATCH;
if ((kexalg = kex_alg_by_name(k->name)) == NULL)
- fatal("unsupported kex alg %s", k->name);
+ return SSH_ERR_INTERNAL_ERROR;
k->kex_type = kexalg->type;
k->hash_alg = kexalg->hash_alg;
k->ec_nid = kexalg->ec_nid;
+ return 0;
}
-static void
-choose_hostkeyalg(Kex *k, char *client, char *server)
+static int
+choose_hostkeyalg(struct kex *k, char *client, char *server)
{
- char *hostkeyalg = match_list(client, server, NULL);
- if (hostkeyalg == NULL)
- fatal("no hostkey alg");
- k->hostkey_type = key_type_from_name(hostkeyalg);
+ k->hostkey_alg = match_list(client, server, NULL);
+
+ debug("kex: host key algorithm: %s",
+ k->hostkey_alg ? k->hostkey_alg : "(no match)");
+ if (k->hostkey_alg == NULL)
+ return SSH_ERR_NO_HOSTKEY_ALG_MATCH;
+ k->hostkey_type = sshkey_type_from_name(k->hostkey_alg);
if (k->hostkey_type == KEY_UNSPEC)
- fatal("bad hostkey alg '%s'", hostkeyalg);
- free(hostkeyalg);
+ return SSH_ERR_INTERNAL_ERROR;
+ k->hostkey_nid = sshkey_ecdsa_nid_from_name(k->hostkey_alg);
+ return 0;
}
static int
@@ -451,18 +744,23 @@
return (1);
}
-static void
-kex_choose_conf(Kex *kex)
+static int
+kex_choose_conf(struct ssh *ssh)
{
- Newkeys *newkeys;
- char **my, **peer;
+ struct kex *kex = ssh->kex;
+ struct newkeys *newkeys;
+ char **my = NULL, **peer = NULL;
char **cprop, **sprop;
int nenc, nmac, ncomp;
u_int mode, ctos, need, dh_need, authlen;
- int first_kex_follows, type;
+ int r, first_kex_follows;
- my = kex_buf2prop(&kex->my, NULL);
- peer = kex_buf2prop(&kex->peer, &first_kex_follows);
+ debug2("local %s KEXINIT proposal", kex->server ? "server" : "client");
+ if ((r = kex_buf2prop(kex->my, NULL, &my)) != 0)
+ goto out;
+ debug2("peer %s KEXINIT proposal", kex->server ? "client" : "server");
+ if ((r = kex_buf2prop(kex->peer, &first_kex_follows, &peer)) != 0)
+ goto out;
if (kex->server) {
cprop=peer;
@@ -472,19 +770,35 @@
sprop=peer;
}
- /* Check whether server offers roaming */
- if (!kex->server) {
- char *roaming;
- roaming = match_list(KEX_RESUME, peer[PROPOSAL_KEX_ALGS], NULL);
- if (roaming) {
- kex->roaming = 1;
- free(roaming);
+ /* Check whether client supports ext_info_c */
+ if (kex->server) {
+ char *ext;
+
+ ext = match_list("ext-info-c", peer[PROPOSAL_KEX_ALGS], NULL);
+ if (ext) {
+ kex->ext_info_c = 1;
+ free(ext);
}
}
/* Algorithm Negotiation */
+ if ((r = choose_kex(kex, cprop[PROPOSAL_KEX_ALGS],
+ sprop[PROPOSAL_KEX_ALGS])) != 0) {
+ kex->failed_choice = peer[PROPOSAL_KEX_ALGS];
+ peer[PROPOSAL_KEX_ALGS] = NULL;
+ goto out;
+ }
+ if ((r = choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
+ sprop[PROPOSAL_SERVER_HOST_KEY_ALGS])) != 0) {
+ kex->failed_choice = peer[PROPOSAL_SERVER_HOST_KEY_ALGS];
+ peer[PROPOSAL_SERVER_HOST_KEY_ALGS] = NULL;
+ goto out;
+ }
for (mode = 0; mode < MODE_MAX; mode++) {
- newkeys = xcalloc(1, sizeof(*newkeys));
+ if ((newkeys = calloc(1, sizeof(*newkeys))) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
kex->newkeys[mode] = newkeys;
ctos = (!kex->server && mode == MODE_OUT) ||
(kex->server && mode == MODE_IN);
@@ -491,21 +805,33 @@
nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
- choose_enc(&newkeys->enc, cprop[nenc], sprop[nenc]);
+ if ((r = choose_enc(&newkeys->enc, cprop[nenc],
+ sprop[nenc])) != 0) {
+ kex->failed_choice = peer[nenc];
+ peer[nenc] = NULL;
+ goto out;
+ }
+ authlen = cipher_authlen(newkeys->enc.cipher);
/* ignore mac for authenticated encryption */
- authlen = cipher_authlen(newkeys->enc.cipher);
- if (authlen == 0)
- choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
- choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
- debug("kex: %s %s %s %s",
+ if (authlen == 0 &&
+ (r = choose_mac(ssh, &newkeys->mac, cprop[nmac],
+ sprop[nmac])) != 0) {
+ kex->failed_choice = peer[nmac];
+ peer[nmac] = NULL;
+ goto out;
+ }
+ if ((r = choose_comp(&newkeys->comp, cprop[ncomp],
+ sprop[ncomp])) != 0) {
+ kex->failed_choice = peer[ncomp];
+ peer[ncomp] = NULL;
+ goto out;
+ }
+ debug("kex: %s cipher: %s MAC: %s compression: %s",
ctos ? "client->server" : "server->client",
newkeys->enc.name,
authlen == 0 ? newkeys->mac.name : "<implicit>",
newkeys->comp.name);
}
- choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
- choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
- sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
need = dh_need = 0;
for (mode = 0; mode < MODE_MAX; mode++) {
newkeys = kex->newkeys[mode];
@@ -524,45 +850,47 @@
/* ignore the next message if the proposals do not match */
if (first_kex_follows && !proposals_match(my, peer) &&
- !(datafellows & SSH_BUG_FIRSTKEX)) {
- type = packet_read();
- debug2("skipping next packet (type %u)", type);
- }
-
+ !(ssh->compat & SSH_BUG_FIRSTKEX))
+ ssh->dispatch_skip_packets = 1;
+ r = 0;
+ out:
kex_prop_free(my);
kex_prop_free(peer);
+ return r;
}
-static u_char *
-derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
- const u_char *shared_secret, u_int slen)
+static int
+derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
+ const struct sshbuf *shared_secret, u_char **keyp)
{
- Buffer b;
- struct ssh_digest_ctx *hashctx;
+ struct kex *kex = ssh->kex;
+ struct ssh_digest_ctx *hashctx = NULL;
char c = id;
u_int have;
size_t mdsz;
u_char *digest;
+ int r;
if ((mdsz = ssh_digest_bytes(kex->hash_alg)) == 0)
- fatal("bad kex md size %zu", mdsz);
- digest = xmalloc(roundup(need, mdsz));
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((digest = calloc(1, roundup(need, mdsz))) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
- buffer_init(&b);
- buffer_append(&b, shared_secret, slen);
-
/* K1 = HASH(K || H || "A" || session_id) */
- if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL)
- fatal("%s: ssh_digest_start failed", __func__);
- if (ssh_digest_update_buffer(hashctx, &b) != 0 ||
+ if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL ||
+ ssh_digest_update_buffer(hashctx, shared_secret) != 0 ||
ssh_digest_update(hashctx, hash, hashlen) != 0 ||
ssh_digest_update(hashctx, &c, 1) != 0 ||
ssh_digest_update(hashctx, kex->session_id,
- kex->session_id_len) != 0)
- fatal("%s: ssh_digest_update failed", __func__);
- if (ssh_digest_final(hashctx, digest, mdsz) != 0)
- fatal("%s: ssh_digest_final failed", __func__);
+ kex->session_id_len) != 0 ||
+ ssh_digest_final(hashctx, digest, mdsz) != 0) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
ssh_digest_free(hashctx);
+ hashctx = NULL;
/*
* expand key:
@@ -570,120 +898,122 @@
* Key = K1 || K2 || ... || Kn
*/
for (have = mdsz; need > have; have += mdsz) {
- if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL)
- fatal("%s: ssh_digest_start failed", __func__);
- if (ssh_digest_update_buffer(hashctx, &b) != 0 ||
+ if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL ||
+ ssh_digest_update_buffer(hashctx, shared_secret) != 0 ||
ssh_digest_update(hashctx, hash, hashlen) != 0 ||
- ssh_digest_update(hashctx, digest, have) != 0)
- fatal("%s: ssh_digest_update failed", __func__);
- if (ssh_digest_final(hashctx, digest + have, mdsz) != 0)
- fatal("%s: ssh_digest_final failed", __func__);
+ ssh_digest_update(hashctx, digest, have) != 0 ||
+ ssh_digest_final(hashctx, digest + have, mdsz) != 0) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
ssh_digest_free(hashctx);
+ hashctx = NULL;
}
- buffer_free(&b);
#ifdef DEBUG_KEX
fprintf(stderr, "key '%c'== ", c);
dump_digest("key", digest, need);
#endif
- return digest;
+ *keyp = digest;
+ digest = NULL;
+ r = 0;
+ out:
+ free(digest);
+ ssh_digest_free(hashctx);
+ return r;
}
-Newkeys *current_keys[MODE_MAX];
-
#define NKEYS 6
-void
-kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen,
- const u_char *shared_secret, u_int slen)
+int
+kex_derive_keys(struct ssh *ssh, u_char *hash, u_int hashlen,
+ const struct sshbuf *shared_secret)
{
+ struct kex *kex = ssh->kex;
u_char *keys[NKEYS];
- u_int i, mode, ctos;
+ u_int i, j, mode, ctos;
+ int r;
for (i = 0; i < NKEYS; i++) {
- keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
- shared_secret, slen);
+ if ((r = derive_key(ssh, 'A'+i, kex->we_need, hash, hashlen,
+ shared_secret, &keys[i])) != 0) {
+ for (j = 0; j < i; j++)
+ free(keys[j]);
+ return r;
+ }
}
-
- debug2("kex_derive_keys");
for (mode = 0; mode < MODE_MAX; mode++) {
- current_keys[mode] = kex->newkeys[mode];
- kex->newkeys[mode] = NULL;
ctos = (!kex->server && mode == MODE_OUT) ||
(kex->server && mode == MODE_IN);
- current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
- current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
- current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
+ kex->newkeys[mode]->enc.iv = keys[ctos ? 0 : 1];
+ kex->newkeys[mode]->enc.key = keys[ctos ? 2 : 3];
+ kex->newkeys[mode]->mac.key = keys[ctos ? 4 : 5];
}
+ return 0;
}
-void
-kex_derive_keys_bn(Kex *kex, u_char *hash, u_int hashlen, const BIGNUM *secret)
+#ifdef WITH_OPENSSL
+int
+kex_derive_keys_bn(struct ssh *ssh, u_char *hash, u_int hashlen,
+ const BIGNUM *secret)
{
- Buffer shared_secret;
+ struct sshbuf *shared_secret;
+ int r;
- buffer_init(&shared_secret);
- buffer_put_bignum2(&shared_secret, secret);
- kex_derive_keys(kex, hash, hashlen,
- buffer_ptr(&shared_secret), buffer_len(&shared_secret));
- buffer_free(&shared_secret);
+ if ((shared_secret = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_bignum2(shared_secret, secret)) == 0)
+ r = kex_derive_keys(ssh, hash, hashlen, shared_secret);
+ sshbuf_free(shared_secret);
+ return r;
}
+#endif
-Newkeys *
-kex_get_newkeys(int mode)
-{
- Newkeys *ret;
-
- ret = current_keys[mode];
- current_keys[mode] = NULL;
- return ret;
-}
-
-void
+#ifdef WITH_SSH1
+int
derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
u_int8_t cookie[8], u_int8_t id[16])
{
- u_int8_t nbuf[2048], obuf[SSH_DIGEST_MAX_LENGTH];
- int len;
- struct ssh_digest_ctx *hashctx;
+ u_int8_t hbuf[2048], sbuf[2048], obuf[SSH_DIGEST_MAX_LENGTH];
+ struct ssh_digest_ctx *hashctx = NULL;
+ size_t hlen, slen;
+ int r;
- if ((hashctx = ssh_digest_start(SSH_DIGEST_MD5)) == NULL)
- fatal("%s: ssh_digest_start", __func__);
-
- len = BN_num_bytes(host_modulus);
- if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
- fatal("%s: bad host modulus (len %d)", __func__, len);
- BN_bn2bin(host_modulus, nbuf);
- if (ssh_digest_update(hashctx, nbuf, len) != 0)
- fatal("%s: ssh_digest_update failed", __func__);
-
- len = BN_num_bytes(server_modulus);
- if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
- fatal("%s: bad server modulus (len %d)", __func__, len);
- BN_bn2bin(server_modulus, nbuf);
- if (ssh_digest_update(hashctx, nbuf, len) != 0 ||
- ssh_digest_update(hashctx, cookie, 8) != 0)
- fatal("%s: ssh_digest_update failed", __func__);
- if (ssh_digest_final(hashctx, obuf, sizeof(obuf)) != 0)
- fatal("%s: ssh_digest_final failed", __func__);
+ hlen = BN_num_bytes(host_modulus);
+ slen = BN_num_bytes(server_modulus);
+ if (hlen < (512 / 8) || (u_int)hlen > sizeof(hbuf) ||
+ slen < (512 / 8) || (u_int)slen > sizeof(sbuf))
+ return SSH_ERR_KEY_BITS_MISMATCH;
+ if (BN_bn2bin(host_modulus, hbuf) <= 0 ||
+ BN_bn2bin(server_modulus, sbuf) <= 0) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if ((hashctx = ssh_digest_start(SSH_DIGEST_MD5)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (ssh_digest_update(hashctx, hbuf, hlen) != 0 ||
+ ssh_digest_update(hashctx, sbuf, slen) != 0 ||
+ ssh_digest_update(hashctx, cookie, 8) != 0 ||
+ ssh_digest_final(hashctx, obuf, sizeof(obuf)) != 0) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
memcpy(id, obuf, ssh_digest_bytes(SSH_DIGEST_MD5));
-
- explicit_bzero(nbuf, sizeof(nbuf));
+ r = 0;
+ out:
+ ssh_digest_free(hashctx);
+ explicit_bzero(hbuf, sizeof(hbuf));
+ explicit_bzero(sbuf, sizeof(sbuf));
explicit_bzero(obuf, sizeof(obuf));
+ return r;
}
+#endif
#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
void
dump_digest(char *msg, u_char *digest, int len)
{
- int i;
-
fprintf(stderr, "%s\n", msg);
- for (i = 0; i < len; i++) {
- fprintf(stderr, "%02x", digest[i]);
- if (i%32 == 31)
- fprintf(stderr, "\n");
- else if (i%8 == 7)
- fprintf(stderr, " ");
- }
- fprintf(stderr, "\n");
+ sshbuf_dump_data(digest, len, stderr);
}
#endif
Modified: trunk/crypto/openssh/kex.h
===================================================================
--- trunk/crypto/openssh/kex.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kex.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.62 2014/01/27 18:58:14 markus Exp $ */
+/* $OpenBSD: kex.h,v 1.78 2016/05/02 10:26:04 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -26,20 +26,37 @@
#ifndef KEX_H
#define KEX_H
-#include <signal.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#ifdef OPENSSL_HAS_ECC
-#include <openssl/ec.h>
+#include "mac.h"
+#include "buffer.h" /* XXX for typedef */
+#include "key.h" /* XXX for typedef */
+
+#ifdef WITH_LEAKMALLOC
+#include "leakmalloc.h"
#endif
+#ifdef WITH_OPENSSL
+# ifdef OPENSSL_HAS_ECC
+# include <openssl/ec.h>
+# else /* OPENSSL_HAS_ECC */
+# define EC_KEY void
+# define EC_GROUP void
+# define EC_POINT void
+# endif /* OPENSSL_HAS_ECC */
+#else /* WITH_OPENSSL */
+# define EC_KEY void
+# define EC_GROUP void
+# define EC_POINT void
+#endif /* WITH_OPENSSL */
+
#define KEX_COOKIE_LEN 16
#define KEX_DH1 "diffie-hellman-group1-sha1"
-#define KEX_DH14 "diffie-hellman-group14-sha1"
+#define KEX_DH14_SHA1 "diffie-hellman-group14-sha1"
+#define KEX_DH14_SHA256 "diffie-hellman-group14-sha256"
+#define KEX_DH16_SHA512 "diffie-hellman-group16-sha512"
+#define KEX_DH18_SHA512 "diffie-hellman-group18-sha512"
#define KEX_DHGEX_SHA1 "diffie-hellman-group-exchange-sha1"
#define KEX_DHGEX_SHA256 "diffie-hellman-group-exchange-sha256"
-#define KEX_RESUME "resume at appgate.com"
#define KEX_ECDH_SHA2_NISTP256 "ecdh-sha2-nistp256"
#define KEX_ECDH_SHA2_NISTP384 "ecdh-sha2-nistp384"
#define KEX_ECDH_SHA2_NISTP521 "ecdh-sha2-nistp521"
@@ -49,6 +66,8 @@
#define COMP_ZLIB 1
#define COMP_DELAYED 2
+#define CURVE25519_SIZE 32
+
enum kex_init_proposals {
PROPOSAL_KEX_ALGS,
PROPOSAL_SERVER_HOST_KEY_ALGS,
@@ -72,6 +91,9 @@
enum kex_exchange {
KEX_DH_GRP1_SHA1,
KEX_DH_GRP14_SHA1,
+ KEX_DH_GRP14_SHA256,
+ KEX_DH_GRP16_SHA512,
+ KEX_DH_GRP18_SHA512,
KEX_DH_GEX_SHA1,
KEX_DH_GEX_SHA256,
KEX_ECDH_SHA2,
@@ -81,15 +103,9 @@
#define KEX_INIT_SENT 0x0001
-typedef struct Kex Kex;
-typedef struct Mac Mac;
-typedef struct Comp Comp;
-typedef struct Enc Enc;
-typedef struct Newkeys Newkeys;
-
-struct Enc {
+struct sshenc {
char *name;
- const Cipher *cipher;
+ const struct sshcipher *cipher;
int enabled;
u_int key_len;
u_int iv_len;
@@ -97,104 +113,118 @@
u_char *key;
u_char *iv;
};
-struct Mac {
- char *name;
+struct sshcomp {
+ u_int type;
int enabled;
- u_int mac_len;
- u_char *key;
- u_int key_len;
- int type;
- int etm; /* Encrypt-then-MAC */
- struct ssh_hmac_ctx *hmac_ctx;
- struct umac_ctx *umac_ctx;
-};
-struct Comp {
- int type;
- int enabled;
char *name;
};
-struct Newkeys {
- Enc enc;
- Mac mac;
- Comp comp;
+struct newkeys {
+ struct sshenc enc;
+ struct sshmac mac;
+ struct sshcomp comp;
};
-struct Kex {
+
+struct ssh;
+
+struct kex {
u_char *session_id;
- u_int session_id_len;
- Newkeys *newkeys[MODE_MAX];
+ size_t session_id_len;
+ struct newkeys *newkeys[MODE_MAX];
u_int we_need;
u_int dh_need;
int server;
char *name;
+ char *hostkey_alg;
int hostkey_type;
- int kex_type;
- int roaming;
- Buffer my;
- Buffer peer;
+ int hostkey_nid;
+ u_int kex_type;
+ int rsa_sha2;
+ int ext_info_c;
+ struct sshbuf *my;
+ struct sshbuf *peer;
sig_atomic_t done;
- int flags;
+ u_int flags;
int hash_alg;
int ec_nid;
char *client_version_string;
char *server_version_string;
- int (*verify_host_key)(Key *);
- Key *(*load_host_public_key)(int);
- Key *(*load_host_private_key)(int);
- int (*host_key_index)(Key *);
- void (*sign)(Key *, Key *, u_char **, u_int *, u_char *, u_int);
- void (*kex[KEX_MAX])(Kex *);
+ char *failed_choice;
+ int (*verify_host_key)(struct sshkey *, struct ssh *);
+ struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
+ struct sshkey *(*load_host_private_key)(int, int, struct ssh *);
+ int (*host_key_index)(struct sshkey *, int, struct ssh *);
+ int (*sign)(struct sshkey *, struct sshkey *, u_char **, size_t *,
+ const u_char *, size_t, const char *, u_int);
+ int (*kex[KEX_MAX])(struct ssh *);
+ /* kex specific state */
+ DH *dh; /* DH */
+ u_int min, max, nbits; /* GEX */
+ EC_KEY *ec_client_key; /* ECDH */
+ const EC_GROUP *ec_group; /* ECDH */
+ u_char c25519_client_key[CURVE25519_SIZE]; /* 25519 */
+ u_char c25519_client_pubkey[CURVE25519_SIZE]; /* 25519 */
};
int kex_names_valid(const char *);
char *kex_alg_list(char);
+char *kex_names_cat(const char *, const char *);
+int kex_assemble_names(const char *, char **);
-Kex *kex_setup(char *[PROPOSAL_MAX]);
-void kex_finish(Kex *);
+int kex_new(struct ssh *, char *[PROPOSAL_MAX], struct kex **);
+int kex_setup(struct ssh *, char *[PROPOSAL_MAX]);
+void kex_free_newkeys(struct newkeys *);
+void kex_free(struct kex *);
-void kex_send_kexinit(Kex *);
-void kex_input_kexinit(int, u_int32_t, void *);
-void kex_derive_keys(Kex *, u_char *, u_int, const u_char *, u_int);
-void kex_derive_keys_bn(Kex *, u_char *, u_int, const BIGNUM *);
+int kex_buf2prop(struct sshbuf *, int *, char ***);
+int kex_prop2buf(struct sshbuf *, char *proposal[PROPOSAL_MAX]);
+void kex_prop_free(char **);
-Newkeys *kex_get_newkeys(int);
+int kex_send_kexinit(struct ssh *);
+int kex_input_kexinit(int, u_int32_t, void *);
+int kex_input_ext_info(int, u_int32_t, void *);
+int kex_derive_keys(struct ssh *, u_char *, u_int, const struct sshbuf *);
+int kex_derive_keys_bn(struct ssh *, u_char *, u_int, const BIGNUM *);
+int kex_send_newkeys(struct ssh *);
+int kex_start_rekex(struct ssh *);
-void kexdh_client(Kex *);
-void kexdh_server(Kex *);
-void kexgex_client(Kex *);
-void kexgex_server(Kex *);
-void kexecdh_client(Kex *);
-void kexecdh_server(Kex *);
-void kexc25519_client(Kex *);
-void kexc25519_server(Kex *);
+int kexdh_client(struct ssh *);
+int kexdh_server(struct ssh *);
+int kexgex_client(struct ssh *);
+int kexgex_server(struct ssh *);
+int kexecdh_client(struct ssh *);
+int kexecdh_server(struct ssh *);
+int kexc25519_client(struct ssh *);
+int kexc25519_server(struct ssh *);
-void
-kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
- BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-void
-kexgex_hash(int, char *, char *, char *, int, char *,
- int, u_char *, int, int, int, int, BIGNUM *, BIGNUM *, BIGNUM *,
- BIGNUM *, BIGNUM *, u_char **, u_int *);
-#ifdef OPENSSL_HAS_ECC
-void
-kex_ecdh_hash(int, const EC_GROUP *, char *, char *, char *, int,
- char *, int, u_char *, int, const EC_POINT *, const EC_POINT *,
- const BIGNUM *, u_char **, u_int *);
-#endif
-void
-kex_c25519_hash(int, char *, char *, char *, int,
- char *, int, u_char *, int, const u_char *, const u_char *,
- const u_char *, u_int, u_char **, u_int *);
+int kex_dh_hash(int, const char *, const char *,
+ const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
+ const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *);
-#define CURVE25519_SIZE 32
-void kexc25519_keygen(u_char[CURVE25519_SIZE], u_char[CURVE25519_SIZE])
+int kexgex_hash(int, const char *, const char *,
+ const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
+ int, int, int,
+ const BIGNUM *, const BIGNUM *, const BIGNUM *,
+ const BIGNUM *, const BIGNUM *,
+ u_char *, size_t *);
+
+int kex_ecdh_hash(int, const EC_GROUP *, const char *, const char *,
+ const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
+ const EC_POINT *, const EC_POINT *, const BIGNUM *, u_char *, size_t *);
+
+int kex_c25519_hash(int, const char *, const char *,
+ const u_char *, size_t, const u_char *, size_t,
+ const u_char *, size_t, const u_char *, const u_char *,
+ const u_char *, size_t, u_char *, size_t *);
+
+void kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
-void kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
- const u_char pub[CURVE25519_SIZE], Buffer *out)
+int kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
+ const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
-void
+int
derive_ssh1_session_id(BIGNUM *, BIGNUM *, u_int8_t[8], u_int8_t[16]);
#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
@@ -201,4 +231,10 @@
void dump_digest(char *, u_char *, int);
#endif
+#if !defined(WITH_OPENSSL) || !defined(OPENSSL_HAS_ECC)
+# undef EC_KEY
+# undef EC_GROUP
+# undef EC_POINT
#endif
+
+#endif
Modified: trunk/crypto/openssh/kexc25519.c
===================================================================
--- trunk/crypto/openssh/kexc25519.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexc25519.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexc25519.c,v 1.5 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: kexc25519.c,v 1.10 2016/05/02 08:49:03 djm Exp $ */
/*
* Copyright (c) 2001, 2013 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -35,13 +35,14 @@
#include <openssl/bn.h>
#include <openssl/evp.h>
-#include "buffer.h"
+#include "sshbuf.h"
#include "ssh2.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
#include "kex.h"
#include "log.h"
#include "digest.h"
+#include "ssherr.h"
extern int crypto_scalarmult_curve25519(u_char a[CURVE25519_SIZE],
const u_char b[CURVE25519_SIZE], const u_char c[CURVE25519_SIZE])
@@ -58,65 +59,75 @@
crypto_scalarmult_curve25519(pub, key, basepoint);
}
-void
+int
kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
- const u_char pub[CURVE25519_SIZE], Buffer *out)
+ const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
{
u_char shared_key[CURVE25519_SIZE];
+ int r;
+ /* Check for all-zero public key */
+ explicit_bzero(shared_key, CURVE25519_SIZE);
+ if (timingsafe_bcmp(pub, shared_key, CURVE25519_SIZE) == 0)
+ return SSH_ERR_KEY_INVALID_EC_VALUE;
+
crypto_scalarmult_curve25519(shared_key, key, pub);
#ifdef DEBUG_KEXECDH
dump_digest("shared secret", shared_key, CURVE25519_SIZE);
#endif
- buffer_clear(out);
- buffer_put_bignum2_from_string(out, shared_key, CURVE25519_SIZE);
+ sshbuf_reset(out);
+ r = sshbuf_put_bignum2_bytes(out, shared_key, CURVE25519_SIZE);
explicit_bzero(shared_key, CURVE25519_SIZE);
+ return r;
}
-void
+int
kex_c25519_hash(
int hash_alg,
- char *client_version_string,
- char *server_version_string,
- char *ckexinit, int ckexinitlen,
- char *skexinit, int skexinitlen,
- u_char *serverhostkeyblob, int sbloblen,
+ const char *client_version_string,
+ const char *server_version_string,
+ const u_char *ckexinit, size_t ckexinitlen,
+ const u_char *skexinit, size_t skexinitlen,
+ const u_char *serverhostkeyblob, size_t sbloblen,
const u_char client_dh_pub[CURVE25519_SIZE],
const u_char server_dh_pub[CURVE25519_SIZE],
- const u_char *shared_secret, u_int secretlen,
- u_char **hash, u_int *hashlen)
+ const u_char *shared_secret, size_t secretlen,
+ u_char *hash, size_t *hashlen)
{
- Buffer b;
- static u_char digest[SSH_DIGEST_MAX_LENGTH];
+ struct sshbuf *b;
+ int r;
- buffer_init(&b);
- buffer_put_cstring(&b, client_version_string);
- buffer_put_cstring(&b, server_version_string);
-
- /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
- buffer_put_int(&b, ckexinitlen+1);
- buffer_put_char(&b, SSH2_MSG_KEXINIT);
- buffer_append(&b, ckexinit, ckexinitlen);
- buffer_put_int(&b, skexinitlen+1);
- buffer_put_char(&b, SSH2_MSG_KEXINIT);
- buffer_append(&b, skexinit, skexinitlen);
-
- buffer_put_string(&b, serverhostkeyblob, sbloblen);
- buffer_put_string(&b, client_dh_pub, CURVE25519_SIZE);
- buffer_put_string(&b, server_dh_pub, CURVE25519_SIZE);
- buffer_append(&b, shared_secret, secretlen);
-
+ if (*hashlen < ssh_digest_bytes(hash_alg))
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_cstring(b, client_version_string)) < 0 ||
+ (r = sshbuf_put_cstring(b, server_version_string)) < 0 ||
+ /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
+ (r = sshbuf_put_u32(b, ckexinitlen+1)) < 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) < 0 ||
+ (r = sshbuf_put(b, ckexinit, ckexinitlen)) < 0 ||
+ (r = sshbuf_put_u32(b, skexinitlen+1)) < 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) < 0 ||
+ (r = sshbuf_put(b, skexinit, skexinitlen)) < 0 ||
+ (r = sshbuf_put_string(b, serverhostkeyblob, sbloblen)) < 0 ||
+ (r = sshbuf_put_string(b, client_dh_pub, CURVE25519_SIZE)) < 0 ||
+ (r = sshbuf_put_string(b, server_dh_pub, CURVE25519_SIZE)) < 0 ||
+ (r = sshbuf_put(b, shared_secret, secretlen)) < 0) {
+ sshbuf_free(b);
+ return r;
+ }
#ifdef DEBUG_KEX
- buffer_dump(&b);
+ sshbuf_dump(b, stderr);
#endif
- if (ssh_digest_buffer(hash_alg, &b, digest, sizeof(digest)) != 0)
- fatal("%s: digest_buffer failed", __func__);
-
- buffer_free(&b);
-
+ if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
+ sshbuf_free(b);
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ }
+ sshbuf_free(b);
+ *hashlen = ssh_digest_bytes(hash_alg);
#ifdef DEBUG_KEX
- dump_digest("hash", digest, ssh_digest_bytes(hash_alg));
+ dump_digest("hash", hash, *hashlen);
#endif
- *hash = digest;
- *hashlen = ssh_digest_bytes(hash_alg);
+ return 0;
}
Modified: trunk/crypto/openssh/kexc25519c.c
===================================================================
--- trunk/crypto/openssh/kexc25519c.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexc25519c.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexc25519c.c,v 1.4 2014/01/12 08:13:13 djm Exp $ */
+/* $OpenBSD: kexc25519c.c,v 1.7 2015/01/26 06:10:03 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -33,97 +33,138 @@
#include <string.h>
#include <signal.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "ssh2.h"
+#include "sshbuf.h"
+#include "digest.h"
+#include "ssherr.h"
-void
-kexc25519_client(Kex *kex)
+static int
+input_kex_c25519_reply(int type, u_int32_t seq, void *ctxt);
+
+int
+kexc25519_client(struct ssh *ssh)
{
- Key *server_host_key;
- u_char client_key[CURVE25519_SIZE];
- u_char client_pubkey[CURVE25519_SIZE];
- u_char *server_pubkey = NULL;
- u_char *server_host_key_blob = NULL, *signature = NULL;
- u_char *hash;
- u_int slen, sbloblen, hashlen;
- Buffer shared_secret;
+ struct kex *kex = ssh->kex;
+ int r;
- kexc25519_keygen(client_key, client_pubkey);
-
- packet_start(SSH2_MSG_KEX_ECDH_INIT);
- packet_put_string(client_pubkey, sizeof(client_pubkey));
- packet_send();
- debug("sending SSH2_MSG_KEX_ECDH_INIT");
-
+ kexc25519_keygen(kex->c25519_client_key, kex->c25519_client_pubkey);
#ifdef DEBUG_KEXECDH
- dump_digest("client private key:", client_key, sizeof(client_key));
+ dump_digest("client private key:", kex->c25519_client_key,
+ sizeof(kex->c25519_client_key));
#endif
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 ||
+ (r = sshpkt_put_string(ssh, kex->c25519_client_pubkey,
+ sizeof(kex->c25519_client_pubkey))) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
debug("expecting SSH2_MSG_KEX_ECDH_REPLY");
- packet_read_expect(SSH2_MSG_KEX_ECDH_REPLY);
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_c25519_reply);
+ return 0;
+}
+static int
+input_kex_c25519_reply(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ struct sshkey *server_host_key = NULL;
+ struct sshbuf *shared_secret = NULL;
+ u_char *server_pubkey = NULL;
+ u_char *server_host_key_blob = NULL, *signature = NULL;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t slen, pklen, sbloblen, hashlen;
+ int r;
+
+ if (kex->verify_host_key == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+
/* hostkey */
- server_host_key_blob = packet_get_string(&sbloblen);
- server_host_key = key_from_blob(server_host_key_blob, sbloblen);
- if (server_host_key == NULL)
- fatal("cannot decode server_host_key_blob");
- if (server_host_key->type != kex->hostkey_type)
- fatal("type mismatch for decoded server_host_key_blob");
- if (kex->verify_host_key == NULL)
- fatal("cannot verify server_host_key");
- if (kex->verify_host_key(server_host_key) == -1)
- fatal("server_host_key verification failed");
+ if ((r = sshpkt_get_string(ssh, &server_host_key_blob,
+ &sbloblen)) != 0 ||
+ (r = sshkey_from_blob(server_host_key_blob, sbloblen,
+ &server_host_key)) != 0)
+ goto out;
+ if (server_host_key->type != kex->hostkey_type ||
+ (kex->hostkey_type == KEY_ECDSA &&
+ server_host_key->ecdsa_nid != kex->hostkey_nid)) {
+ r = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
+ }
+ if (kex->verify_host_key(server_host_key, ssh) == -1) {
+ r = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
+ }
/* Q_S, server public key */
- server_pubkey = packet_get_string(&slen);
- if (slen != CURVE25519_SIZE)
- fatal("Incorrect size for server Curve25519 pubkey: %d", slen);
+ /* signed H */
+ if ((r = sshpkt_get_string(ssh, &server_pubkey, &pklen)) != 0 ||
+ (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
+ if (pklen != CURVE25519_SIZE) {
+ r = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
+ }
#ifdef DEBUG_KEXECDH
dump_digest("server public key:", server_pubkey, CURVE25519_SIZE);
#endif
- /* signed H */
- signature = packet_get_string(&slen);
- packet_check_eom();
+ if ((shared_secret = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = kexc25519_shared_key(kex->c25519_client_key, server_pubkey,
+ shared_secret)) < 0)
+ goto out;
- buffer_init(&shared_secret);
- kexc25519_shared_key(client_key, server_pubkey, &shared_secret);
-
/* calc and verify H */
- kex_c25519_hash(
+ hashlen = sizeof(hash);
+ if ((r = kex_c25519_hash(
kex->hash_alg,
kex->client_version_string,
kex->server_version_string,
- buffer_ptr(&kex->my), buffer_len(&kex->my),
- buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
server_host_key_blob, sbloblen,
- client_pubkey,
+ kex->c25519_client_pubkey,
server_pubkey,
- buffer_ptr(&shared_secret), buffer_len(&shared_secret),
- &hash, &hashlen
- );
- free(server_host_key_blob);
- free(server_pubkey);
- if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
- fatal("key_verify failed for server_host_key");
- key_free(server_host_key);
- free(signature);
+ sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
+ hash, &hashlen)) < 0)
+ goto out;
+ if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
+ ssh->compat)) != 0)
+ goto out;
+
/* save session id */
if (kex->session_id == NULL) {
kex->session_id_len = hashlen;
- kex->session_id = xmalloc(kex->session_id_len);
+ kex->session_id = malloc(kex->session_id_len);
+ if (kex->session_id == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(kex->session_id, hash, kex->session_id_len);
}
- kex_derive_keys(kex, hash, hashlen,
- buffer_ptr(&shared_secret), buffer_len(&shared_secret));
- buffer_free(&shared_secret);
- kex_finish(kex);
+
+ if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
+ r = kex_send_newkeys(ssh);
+out:
+ explicit_bzero(hash, sizeof(hash));
+ explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
+ free(server_host_key_blob);
+ free(server_pubkey);
+ free(signature);
+ sshkey_free(server_host_key);
+ sshbuf_free(shared_secret);
+ return r;
}
Modified: trunk/crypto/openssh/kexc25519s.c
===================================================================
--- trunk/crypto/openssh/kexc25519s.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexc25519s.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexc25519s.c,v 1.4 2014/01/12 08:13:13 djm Exp $ */
+/* $OpenBSD: kexc25519s.c,v 1.10 2015/12/04 16:41:28 markus Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -27,29 +27,44 @@
#include "includes.h"
#include <sys/types.h>
+#include <stdio.h>
#include <string.h>
#include <signal.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
+#include "digest.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "ssh2.h"
+#include "sshbuf.h"
+#include "ssherr.h"
-void
-kexc25519_server(Kex *kex)
+static int input_kex_c25519_init(int, u_int32_t, void *);
+
+int
+kexc25519_server(struct ssh *ssh)
{
- Key *server_host_private, *server_host_public;
+ debug("expecting SSH2_MSG_KEX_ECDH_INIT");
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_c25519_init);
+ return 0;
+}
+
+static int
+input_kex_c25519_init(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ struct sshkey *server_host_private, *server_host_public;
+ struct sshbuf *shared_secret = NULL;
u_char *server_host_key_blob = NULL, *signature = NULL;
u_char server_key[CURVE25519_SIZE];
u_char *client_pubkey = NULL;
u_char server_pubkey[CURVE25519_SIZE];
- u_char *hash;
- u_int slen, sbloblen, hashlen;
- Buffer shared_secret;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t slen, pklen, sbloblen, hashlen;
+ int r;
/* generate private key */
kexc25519_keygen(server_key, server_pubkey);
@@ -56,71 +71,89 @@
#ifdef DEBUG_KEXECDH
dump_digest("server private key:", server_key, sizeof(server_key));
#endif
-
if (kex->load_host_public_key == NULL ||
- kex->load_host_private_key == NULL)
- fatal("Cannot load hostkey");
- server_host_public = kex->load_host_public_key(kex->hostkey_type);
- if (server_host_public == NULL)
- fatal("Unsupported hostkey type %d", kex->hostkey_type);
- server_host_private = kex->load_host_private_key(kex->hostkey_type);
+ kex->load_host_private_key == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ server_host_public = kex->load_host_public_key(kex->hostkey_type,
+ kex->hostkey_nid, ssh);
+ server_host_private = kex->load_host_private_key(kex->hostkey_type,
+ kex->hostkey_nid, ssh);
+ if (server_host_public == NULL) {
+ r = SSH_ERR_NO_HOSTKEY_LOADED;
+ goto out;
+ }
- debug("expecting SSH2_MSG_KEX_ECDH_INIT");
- packet_read_expect(SSH2_MSG_KEX_ECDH_INIT);
- client_pubkey = packet_get_string(&slen);
- if (slen != CURVE25519_SIZE)
- fatal("Incorrect size for server Curve25519 pubkey: %d", slen);
- packet_check_eom();
-
+ if ((r = sshpkt_get_string(ssh, &client_pubkey, &pklen)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
+ if (pklen != CURVE25519_SIZE) {
+ r = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
+ }
#ifdef DEBUG_KEXECDH
dump_digest("client public key:", client_pubkey, CURVE25519_SIZE);
#endif
- buffer_init(&shared_secret);
- kexc25519_shared_key(server_key, client_pubkey, &shared_secret);
+ if ((shared_secret = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = kexc25519_shared_key(server_key, client_pubkey,
+ shared_secret)) < 0)
+ goto out;
/* calc H */
- key_to_blob(server_host_public, &server_host_key_blob, &sbloblen);
- kex_c25519_hash(
+ if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
+ &sbloblen)) != 0)
+ goto out;
+ hashlen = sizeof(hash);
+ if ((r = kex_c25519_hash(
kex->hash_alg,
kex->client_version_string,
kex->server_version_string,
- buffer_ptr(&kex->peer), buffer_len(&kex->peer),
- buffer_ptr(&kex->my), buffer_len(&kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
server_host_key_blob, sbloblen,
client_pubkey,
server_pubkey,
- buffer_ptr(&shared_secret), buffer_len(&shared_secret),
- &hash, &hashlen
- );
+ sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
+ hash, &hashlen)) < 0)
+ goto out;
/* save session id := H */
if (kex->session_id == NULL) {
kex->session_id_len = hashlen;
- kex->session_id = xmalloc(kex->session_id_len);
+ kex->session_id = malloc(kex->session_id_len);
+ if (kex->session_id == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(kex->session_id, hash, kex->session_id_len);
}
/* sign H */
- kex->sign(server_host_private, server_host_public, &signature, &slen,
- hash, hashlen);
+ if ((r = kex->sign(server_host_private, server_host_public, &signature,
+ &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
+ goto out;
- /* destroy_sensitive_data(); */
-
/* send server hostkey, ECDH pubkey 'Q_S' and signed H */
- packet_start(SSH2_MSG_KEX_ECDH_REPLY);
- packet_put_string(server_host_key_blob, sbloblen);
- packet_put_string(server_pubkey, sizeof(server_pubkey));
- packet_put_string(signature, slen);
- packet_send();
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 ||
+ (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
+ (r = sshpkt_put_string(ssh, server_pubkey, sizeof(server_pubkey))) != 0 ||
+ (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
+ if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
+ r = kex_send_newkeys(ssh);
+out:
+ explicit_bzero(hash, sizeof(hash));
+ explicit_bzero(server_key, sizeof(server_key));
+ free(server_host_key_blob);
free(signature);
- free(server_host_key_blob);
- /* have keys, free server key */
free(client_pubkey);
-
- kex_derive_keys(kex, hash, hashlen,
- buffer_ptr(&shared_secret), buffer_len(&shared_secret));
- buffer_free(&shared_secret);
- kex_finish(kex);
+ sshbuf_free(shared_secret);
+ return r;
}
Modified: trunk/crypto/openssh/kexdh.c
===================================================================
--- trunk/crypto/openssh/kexdh.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexdh.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexdh.c,v 1.24 2014/01/09 23:20:00 djm Exp $ */
+/* $OpenBSD: kexdh.c,v 1.26 2016/05/02 10:26:04 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -25,6 +25,8 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
#include <signal.h>
@@ -31,57 +33,62 @@
#include <openssl/evp.h>
-#include "buffer.h"
#include "ssh2.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
#include "kex.h"
+#include "ssherr.h"
+#include "sshbuf.h"
#include "digest.h"
-#include "log.h"
-void
+int
kex_dh_hash(
- char *client_version_string,
- char *server_version_string,
- char *ckexinit, int ckexinitlen,
- char *skexinit, int skexinitlen,
- u_char *serverhostkeyblob, int sbloblen,
- BIGNUM *client_dh_pub,
- BIGNUM *server_dh_pub,
- BIGNUM *shared_secret,
- u_char **hash, u_int *hashlen)
+ int hash_alg,
+ const char *client_version_string,
+ const char *server_version_string,
+ const u_char *ckexinit, size_t ckexinitlen,
+ const u_char *skexinit, size_t skexinitlen,
+ const u_char *serverhostkeyblob, size_t sbloblen,
+ const BIGNUM *client_dh_pub,
+ const BIGNUM *server_dh_pub,
+ const BIGNUM *shared_secret,
+ u_char *hash, size_t *hashlen)
{
- Buffer b;
- static u_char digest[SSH_DIGEST_MAX_LENGTH];
+ struct sshbuf *b;
+ int r;
- buffer_init(&b);
- buffer_put_cstring(&b, client_version_string);
- buffer_put_cstring(&b, server_version_string);
-
- /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
- buffer_put_int(&b, ckexinitlen+1);
- buffer_put_char(&b, SSH2_MSG_KEXINIT);
- buffer_append(&b, ckexinit, ckexinitlen);
- buffer_put_int(&b, skexinitlen+1);
- buffer_put_char(&b, SSH2_MSG_KEXINIT);
- buffer_append(&b, skexinit, skexinitlen);
-
- buffer_put_string(&b, serverhostkeyblob, sbloblen);
- buffer_put_bignum2(&b, client_dh_pub);
- buffer_put_bignum2(&b, server_dh_pub);
- buffer_put_bignum2(&b, shared_secret);
-
+ if (*hashlen < ssh_digest_bytes(hash_alg))
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_cstring(b, client_version_string)) != 0 ||
+ (r = sshbuf_put_cstring(b, server_version_string)) != 0 ||
+ /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
+ (r = sshbuf_put_u32(b, ckexinitlen+1)) != 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
+ (r = sshbuf_put(b, ckexinit, ckexinitlen)) != 0 ||
+ (r = sshbuf_put_u32(b, skexinitlen+1)) != 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
+ (r = sshbuf_put(b, skexinit, skexinitlen)) != 0 ||
+ (r = sshbuf_put_string(b, serverhostkeyblob, sbloblen)) != 0 ||
+ (r = sshbuf_put_bignum2(b, client_dh_pub)) != 0 ||
+ (r = sshbuf_put_bignum2(b, server_dh_pub)) != 0 ||
+ (r = sshbuf_put_bignum2(b, shared_secret)) != 0) {
+ sshbuf_free(b);
+ return r;
+ }
#ifdef DEBUG_KEX
- buffer_dump(&b);
+ sshbuf_dump(b, stderr);
#endif
- if (ssh_digest_buffer(SSH_DIGEST_SHA1, &b, digest, sizeof(digest)) != 0)
- fatal("%s: ssh_digest_buffer failed", __func__);
-
- buffer_free(&b);
-
+ if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
+ sshbuf_free(b);
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ }
+ sshbuf_free(b);
+ *hashlen = ssh_digest_bytes(hash_alg);
#ifdef DEBUG_KEX
- dump_digest("hash", digest, ssh_digest_bytes(SSH_DIGEST_SHA1));
+ dump_digest("hash", hash, *hashlen);
#endif
- *hash = digest;
- *hashlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
+ return 0;
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/kexdhc.c
===================================================================
--- trunk/crypto/openssh/kexdhc.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexdhc.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexdhc.c,v 1.15 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: kexdhc.c,v 1.19 2016/05/02 10:26:04 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -25,6 +25,8 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
#include <openssl/dh.h>
@@ -34,71 +36,111 @@
#include <string.h>
#include <signal.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
+#include "digest.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "dh.h"
#include "ssh2.h"
+#include "dispatch.h"
+#include "compat.h"
+#include "ssherr.h"
+#include "sshbuf.h"
-void
-kexdh_client(Kex *kex)
+static int input_kex_dh(int, u_int32_t, void *);
+
+int
+kexdh_client(struct ssh *ssh)
{
- BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
- DH *dh;
- Key *server_host_key;
- u_char *server_host_key_blob = NULL, *signature = NULL;
- u_char *kbuf, *hash;
- u_int klen, slen, sbloblen, hashlen;
- int kout;
+ struct kex *kex = ssh->kex;
+ int r;
/* generate and send 'e', client DH public key */
switch (kex->kex_type) {
case KEX_DH_GRP1_SHA1:
- dh = dh_new_group1();
+ kex->dh = dh_new_group1();
break;
case KEX_DH_GRP14_SHA1:
- dh = dh_new_group14();
+ case KEX_DH_GRP14_SHA256:
+ kex->dh = dh_new_group14();
break;
+ case KEX_DH_GRP16_SHA512:
+ kex->dh = dh_new_group16();
+ break;
+ case KEX_DH_GRP18_SHA512:
+ kex->dh = dh_new_group18();
+ break;
default:
- fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
}
- dh_gen_key(dh, kex->we_need * 8);
- packet_start(SSH2_MSG_KEXDH_INIT);
- packet_put_bignum2(dh->pub_key);
- packet_send();
-
+ if (kex->dh == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
debug("sending SSH2_MSG_KEXDH_INIT");
+ if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0 ||
+ (r = sshpkt_start(ssh, SSH2_MSG_KEXDH_INIT)) != 0 ||
+ (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
#ifdef DEBUG_KEXDH
- DHparams_print_fp(stderr, dh);
+ DHparams_print_fp(stderr, kex->dh);
fprintf(stderr, "pub= ");
- BN_print_fp(stderr, dh->pub_key);
+ BN_print_fp(stderr, kex->dh->pub_key);
fprintf(stderr, "\n");
#endif
-
debug("expecting SSH2_MSG_KEXDH_REPLY");
- packet_read_expect(SSH2_MSG_KEXDH_REPLY);
+ ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_REPLY, &input_kex_dh);
+ r = 0;
+ out:
+ return r;
+}
+static int
+input_kex_dh(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
+ struct sshkey *server_host_key = NULL;
+ u_char *kbuf = NULL, *server_host_key_blob = NULL, *signature = NULL;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t klen = 0, slen, sbloblen, hashlen;
+ int kout, r;
+
+ if (kex->verify_host_key == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
/* key, cert */
- server_host_key_blob = packet_get_string(&sbloblen);
- server_host_key = key_from_blob(server_host_key_blob, sbloblen);
- if (server_host_key == NULL)
- fatal("cannot decode server_host_key_blob");
- if (server_host_key->type != kex->hostkey_type)
- fatal("type mismatch for decoded server_host_key_blob");
- if (kex->verify_host_key == NULL)
- fatal("cannot verify server_host_key");
- if (kex->verify_host_key(server_host_key) == -1)
- fatal("server_host_key verification failed");
-
+ if ((r = sshpkt_get_string(ssh, &server_host_key_blob,
+ &sbloblen)) != 0 ||
+ (r = sshkey_from_blob(server_host_key_blob, sbloblen,
+ &server_host_key)) != 0)
+ goto out;
+ if (server_host_key->type != kex->hostkey_type ||
+ (kex->hostkey_type == KEY_ECDSA &&
+ server_host_key->ecdsa_nid != kex->hostkey_nid)) {
+ r = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
+ }
+ if (kex->verify_host_key(server_host_key, ssh) == -1) {
+ r = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
+ }
/* DH parameter f, server public DH key */
- if ((dh_server_pub = BN_new()) == NULL)
- fatal("dh_server_pub == NULL");
- packet_get_bignum2(dh_server_pub);
-
+ if ((dh_server_pub = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ /* signed H */
+ if ((r = sshpkt_get_bignum2(ssh, dh_server_pub)) != 0 ||
+ (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
#ifdef DEBUG_KEXDH
fprintf(stderr, "dh_server_pub= ");
BN_print_fp(stderr, dh_server_pub);
@@ -105,57 +147,74 @@
fprintf(stderr, "\n");
debug("bits %d", BN_num_bits(dh_server_pub));
#endif
+ if (!dh_pub_is_valid(kex->dh, dh_server_pub)) {
+ sshpkt_disconnect(ssh, "bad server public DH value");
+ r = SSH_ERR_MESSAGE_INCOMPLETE;
+ goto out;
+ }
- /* signed H */
- signature = packet_get_string(&slen);
- packet_check_eom();
-
- if (!dh_pub_is_valid(dh, dh_server_pub))
- packet_disconnect("bad server public DH value");
-
- klen = DH_size(dh);
- kbuf = xmalloc(klen);
- if ((kout = DH_compute_key(kbuf, dh_server_pub, dh)) < 0)
- fatal("DH_compute_key: failed");
+ klen = DH_size(kex->dh);
+ if ((kbuf = malloc(klen)) == NULL ||
+ (shared_secret = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((kout = DH_compute_key(kbuf, dh_server_pub, kex->dh)) < 0 ||
+ BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
#ifdef DEBUG_KEXDH
dump_digest("shared secret", kbuf, kout);
#endif
- if ((shared_secret = BN_new()) == NULL)
- fatal("kexdh_client: BN_new failed");
- if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
- fatal("kexdh_client: BN_bin2bn failed");
- explicit_bzero(kbuf, klen);
- free(kbuf);
/* calc and verify H */
- kex_dh_hash(
+ hashlen = sizeof(hash);
+ if ((r = kex_dh_hash(
+ kex->hash_alg,
kex->client_version_string,
kex->server_version_string,
- buffer_ptr(&kex->my), buffer_len(&kex->my),
- buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
server_host_key_blob, sbloblen,
- dh->pub_key,
+ kex->dh->pub_key,
dh_server_pub,
shared_secret,
- &hash, &hashlen
- );
- free(server_host_key_blob);
- BN_clear_free(dh_server_pub);
- DH_free(dh);
+ hash, &hashlen)) != 0)
+ goto out;
- if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
- fatal("key_verify failed for server_host_key");
- key_free(server_host_key);
- free(signature);
+ if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
+ ssh->compat)) != 0)
+ goto out;
/* save session id */
if (kex->session_id == NULL) {
kex->session_id_len = hashlen;
- kex->session_id = xmalloc(kex->session_id_len);
+ kex->session_id = malloc(kex->session_id_len);
+ if (kex->session_id == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(kex->session_id, hash, kex->session_id_len);
}
- kex_derive_keys_bn(kex, hash, hashlen, shared_secret);
- BN_clear_free(shared_secret);
- kex_finish(kex);
+ if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
+ r = kex_send_newkeys(ssh);
+ out:
+ explicit_bzero(hash, sizeof(hash));
+ DH_free(kex->dh);
+ kex->dh = NULL;
+ if (dh_server_pub)
+ BN_clear_free(dh_server_pub);
+ if (kbuf) {
+ explicit_bzero(kbuf, klen);
+ free(kbuf);
+ }
+ if (shared_secret)
+ BN_clear_free(shared_secret);
+ sshkey_free(server_host_key);
+ free(server_host_key_blob);
+ free(signature);
+ return r;
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/kexdhs.c
===================================================================
--- trunk/crypto/openssh/kexdhs.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexdhs.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexdhs.c,v 1.18 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: kexdhs.c,v 1.24 2016/05/02 10:26:04 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -25,6 +25,8 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
#include <stdarg.h>
@@ -33,10 +35,9 @@
#include <openssl/dh.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
+#include "digest.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
@@ -43,45 +44,87 @@
#include "dh.h"
#include "ssh2.h"
-void
-kexdh_server(Kex *kex)
+#include "dispatch.h"
+#include "compat.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+
+static int input_kex_dh_init(int, u_int32_t, void *);
+
+int
+kexdh_server(struct ssh *ssh)
{
- BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
- DH *dh;
- Key *server_host_public, *server_host_private;
- u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
- u_int sbloblen, klen, hashlen, slen;
- int kout;
+ struct kex *kex = ssh->kex;
+ int r;
/* generate server DH public key */
switch (kex->kex_type) {
case KEX_DH_GRP1_SHA1:
- dh = dh_new_group1();
+ kex->dh = dh_new_group1();
break;
case KEX_DH_GRP14_SHA1:
- dh = dh_new_group14();
+ case KEX_DH_GRP14_SHA256:
+ kex->dh = dh_new_group14();
break;
+ case KEX_DH_GRP16_SHA512:
+ kex->dh = dh_new_group16();
+ break;
+ case KEX_DH_GRP18_SHA512:
+ kex->dh = dh_new_group18();
+ break;
default:
- fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
}
- dh_gen_key(dh, kex->we_need * 8);
+ if (kex->dh == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ goto out;
debug("expecting SSH2_MSG_KEXDH_INIT");
- packet_read_expect(SSH2_MSG_KEXDH_INIT);
+ ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_INIT, &input_kex_dh_init);
+ r = 0;
+ out:
+ return r;
+}
+int
+input_kex_dh_init(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
+ struct sshkey *server_host_public, *server_host_private;
+ u_char *kbuf = NULL, *signature = NULL, *server_host_key_blob = NULL;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t sbloblen, slen;
+ size_t klen = 0, hashlen;
+ int kout, r;
+
if (kex->load_host_public_key == NULL ||
- kex->load_host_private_key == NULL)
- fatal("Cannot load hostkey");
- server_host_public = kex->load_host_public_key(kex->hostkey_type);
- if (server_host_public == NULL)
- fatal("Unsupported hostkey type %d", kex->hostkey_type);
- server_host_private = kex->load_host_private_key(kex->hostkey_type);
+ kex->load_host_private_key == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ server_host_public = kex->load_host_public_key(kex->hostkey_type,
+ kex->hostkey_nid, ssh);
+ server_host_private = kex->load_host_private_key(kex->hostkey_type,
+ kex->hostkey_nid, ssh);
+ if (server_host_public == NULL) {
+ r = SSH_ERR_NO_HOSTKEY_LOADED;
+ goto out;
+ }
/* key, cert */
- if ((dh_client_pub = BN_new()) == NULL)
- fatal("dh_client_pub == NULL");
- packet_get_bignum2(dh_client_pub);
- packet_check_eom();
+ if ((dh_client_pub = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshpkt_get_bignum2(ssh, dh_client_pub)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
#ifdef DEBUG_KEXDH
fprintf(stderr, "dh_client_pub= ");
@@ -91,70 +134,91 @@
#endif
#ifdef DEBUG_KEXDH
- DHparams_print_fp(stderr, dh);
+ DHparams_print_fp(stderr, kex->dh);
fprintf(stderr, "pub= ");
- BN_print_fp(stderr, dh->pub_key);
+ BN_print_fp(stderr, kex->dh->pub_key);
fprintf(stderr, "\n");
#endif
- if (!dh_pub_is_valid(dh, dh_client_pub))
- packet_disconnect("bad client public DH value");
+ if (!dh_pub_is_valid(kex->dh, dh_client_pub)) {
+ sshpkt_disconnect(ssh, "bad client public DH value");
+ r = SSH_ERR_MESSAGE_INCOMPLETE;
+ goto out;
+ }
- klen = DH_size(dh);
- kbuf = xmalloc(klen);
- if ((kout = DH_compute_key(kbuf, dh_client_pub, dh)) < 0)
- fatal("DH_compute_key: failed");
+ klen = DH_size(kex->dh);
+ if ((kbuf = malloc(klen)) == NULL ||
+ (shared_secret = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((kout = DH_compute_key(kbuf, dh_client_pub, kex->dh)) < 0 ||
+ BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
#ifdef DEBUG_KEXDH
dump_digest("shared secret", kbuf, kout);
#endif
- if ((shared_secret = BN_new()) == NULL)
- fatal("kexdh_server: BN_new failed");
- if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
- fatal("kexdh_server: BN_bin2bn failed");
- explicit_bzero(kbuf, klen);
- free(kbuf);
-
- key_to_blob(server_host_public, &server_host_key_blob, &sbloblen);
-
+ if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
+ &sbloblen)) != 0)
+ goto out;
/* calc H */
- kex_dh_hash(
+ hashlen = sizeof(hash);
+ if ((r = kex_dh_hash(
+ kex->hash_alg,
kex->client_version_string,
kex->server_version_string,
- buffer_ptr(&kex->peer), buffer_len(&kex->peer),
- buffer_ptr(&kex->my), buffer_len(&kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
server_host_key_blob, sbloblen,
dh_client_pub,
- dh->pub_key,
+ kex->dh->pub_key,
shared_secret,
- &hash, &hashlen
- );
- BN_clear_free(dh_client_pub);
+ hash, &hashlen)) != 0)
+ goto out;
/* save session id := H */
if (kex->session_id == NULL) {
kex->session_id_len = hashlen;
- kex->session_id = xmalloc(kex->session_id_len);
+ kex->session_id = malloc(kex->session_id_len);
+ if (kex->session_id == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(kex->session_id, hash, kex->session_id_len);
}
/* sign H */
- kex->sign(server_host_private, server_host_public, &signature, &slen,
- hash, hashlen);
+ if ((r = kex->sign(server_host_private, server_host_public, &signature,
+ &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
+ goto out;
/* destroy_sensitive_data(); */
/* send server hostkey, DH pubkey 'f' and singed H */
- packet_start(SSH2_MSG_KEXDH_REPLY);
- packet_put_string(server_host_key_blob, sbloblen);
- packet_put_bignum2(dh->pub_key); /* f */
- packet_put_string(signature, slen);
- packet_send();
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_REPLY)) != 0 ||
+ (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
+ (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 || /* f */
+ (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
+ if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
+ r = kex_send_newkeys(ssh);
+ out:
+ explicit_bzero(hash, sizeof(hash));
+ DH_free(kex->dh);
+ kex->dh = NULL;
+ if (dh_client_pub)
+ BN_clear_free(dh_client_pub);
+ if (kbuf) {
+ explicit_bzero(kbuf, klen);
+ free(kbuf);
+ }
+ if (shared_secret)
+ BN_clear_free(shared_secret);
+ free(server_host_key_blob);
free(signature);
- free(server_host_key_blob);
- /* have keys, free DH */
- DH_free(dh);
-
- kex_derive_keys_bn(kex, hash, hashlen, shared_secret);
- BN_clear_free(shared_secret);
- kex_finish(kex);
+ return r;
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/kexecdh.c
===================================================================
--- trunk/crypto/openssh/kexecdh.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexecdh.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexecdh.c,v 1.5 2014/01/09 23:20:00 djm Exp $ */
+/* $OpenBSD: kexecdh.c,v 1.6 2015/01/19 20:16:15 markus Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -26,7 +26,7 @@
#include "includes.h"
-#ifdef OPENSSL_HAS_ECC
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
#include <sys/types.h>
@@ -38,60 +38,63 @@
#include <openssl/ec.h>
#include <openssl/ecdh.h>
-#include "buffer.h"
#include "ssh2.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
#include "kex.h"
-#include "log.h"
+#include "sshbuf.h"
#include "digest.h"
+#include "ssherr.h"
-void
+int
kex_ecdh_hash(
int hash_alg,
const EC_GROUP *ec_group,
- char *client_version_string,
- char *server_version_string,
- char *ckexinit, int ckexinitlen,
- char *skexinit, int skexinitlen,
- u_char *serverhostkeyblob, int sbloblen,
+ const char *client_version_string,
+ const char *server_version_string,
+ const u_char *ckexinit, size_t ckexinitlen,
+ const u_char *skexinit, size_t skexinitlen,
+ const u_char *serverhostkeyblob, size_t sbloblen,
const EC_POINT *client_dh_pub,
const EC_POINT *server_dh_pub,
const BIGNUM *shared_secret,
- u_char **hash, u_int *hashlen)
+ u_char *hash, size_t *hashlen)
{
- Buffer b;
- static u_char digest[SSH_DIGEST_MAX_LENGTH];
+ struct sshbuf *b;
+ int r;
- buffer_init(&b);
- buffer_put_cstring(&b, client_version_string);
- buffer_put_cstring(&b, server_version_string);
-
- /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
- buffer_put_int(&b, ckexinitlen+1);
- buffer_put_char(&b, SSH2_MSG_KEXINIT);
- buffer_append(&b, ckexinit, ckexinitlen);
- buffer_put_int(&b, skexinitlen+1);
- buffer_put_char(&b, SSH2_MSG_KEXINIT);
- buffer_append(&b, skexinit, skexinitlen);
-
- buffer_put_string(&b, serverhostkeyblob, sbloblen);
- buffer_put_ecpoint(&b, ec_group, client_dh_pub);
- buffer_put_ecpoint(&b, ec_group, server_dh_pub);
- buffer_put_bignum2(&b, shared_secret);
-
+ if (*hashlen < ssh_digest_bytes(hash_alg))
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_cstring(b, client_version_string)) != 0 ||
+ (r = sshbuf_put_cstring(b, server_version_string)) != 0 ||
+ /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
+ (r = sshbuf_put_u32(b, ckexinitlen+1)) != 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
+ (r = sshbuf_put(b, ckexinit, ckexinitlen)) != 0 ||
+ (r = sshbuf_put_u32(b, skexinitlen+1)) != 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
+ (r = sshbuf_put(b, skexinit, skexinitlen)) != 0 ||
+ (r = sshbuf_put_string(b, serverhostkeyblob, sbloblen)) != 0 ||
+ (r = sshbuf_put_ec(b, client_dh_pub, ec_group)) != 0 ||
+ (r = sshbuf_put_ec(b, server_dh_pub, ec_group)) != 0 ||
+ (r = sshbuf_put_bignum2(b, shared_secret)) != 0) {
+ sshbuf_free(b);
+ return r;
+ }
#ifdef DEBUG_KEX
- buffer_dump(&b);
+ sshbuf_dump(b, stderr);
#endif
- if (ssh_digest_buffer(hash_alg, &b, digest, sizeof(digest)) != 0)
- fatal("%s: ssh_digest_buffer failed", __func__);
-
- buffer_free(&b);
-
+ if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
+ sshbuf_free(b);
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ }
+ sshbuf_free(b);
+ *hashlen = ssh_digest_bytes(hash_alg);
#ifdef DEBUG_KEX
- dump_digest("hash", digest, ssh_digest_bytes(hash_alg));
+ dump_digest("hash", hash, *hashlen);
#endif
- *hash = digest;
- *hashlen = ssh_digest_bytes(hash_alg);
+ return 0;
}
-#endif /* OPENSSL_HAS_ECC */
+#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */
Modified: trunk/crypto/openssh/kexecdhc.c
===================================================================
--- trunk/crypto/openssh/kexecdhc.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexecdhc.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexecdhc.c,v 1.7 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: kexecdhc.c,v 1.10 2015/01/26 06:10:03 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -26,6 +26,8 @@
#include "includes.h"
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+
#include <sys/types.h>
#include <stdio.h>
@@ -32,134 +34,195 @@
#include <string.h>
#include <signal.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "key.h"
+#include <openssl/ecdh.h>
+
+#include "sshkey.h"
#include "cipher.h"
+#include "digest.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "dh.h"
#include "ssh2.h"
+#include "dispatch.h"
+#include "compat.h"
+#include "ssherr.h"
+#include "sshbuf.h"
-#ifdef OPENSSL_HAS_ECC
+static int input_kex_ecdh_reply(int, u_int32_t, void *);
-#include <openssl/ecdh.h>
-
-void
-kexecdh_client(Kex *kex)
+int
+kexecdh_client(struct ssh *ssh)
{
- EC_KEY *client_key;
- EC_POINT *server_public;
+ struct kex *kex = ssh->kex;
+ EC_KEY *client_key = NULL;
const EC_GROUP *group;
- BIGNUM *shared_secret;
- Key *server_host_key;
- u_char *server_host_key_blob = NULL, *signature = NULL;
- u_char *kbuf, *hash;
- u_int klen, slen, sbloblen, hashlen;
+ const EC_POINT *public_key;
+ int r;
- if ((client_key = EC_KEY_new_by_curve_name(kex->ec_nid)) == NULL)
- fatal("%s: EC_KEY_new_by_curve_name failed", __func__);
- if (EC_KEY_generate_key(client_key) != 1)
- fatal("%s: EC_KEY_generate_key failed", __func__);
+ if ((client_key = EC_KEY_new_by_curve_name(kex->ec_nid)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (EC_KEY_generate_key(client_key) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
group = EC_KEY_get0_group(client_key);
+ public_key = EC_KEY_get0_public_key(client_key);
- packet_start(SSH2_MSG_KEX_ECDH_INIT);
- packet_put_ecpoint(group, EC_KEY_get0_public_key(client_key));
- packet_send();
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 ||
+ (r = sshpkt_put_ec(ssh, public_key, group)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
debug("sending SSH2_MSG_KEX_ECDH_INIT");
#ifdef DEBUG_KEXECDH
fputs("client private key:\n", stderr);
- key_dump_ec_key(client_key);
+ sshkey_dump_ec_key(client_key);
#endif
+ kex->ec_client_key = client_key;
+ kex->ec_group = group;
+ client_key = NULL; /* owned by the kex */
debug("expecting SSH2_MSG_KEX_ECDH_REPLY");
- packet_read_expect(SSH2_MSG_KEX_ECDH_REPLY);
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_ecdh_reply);
+ r = 0;
+ out:
+ if (client_key)
+ EC_KEY_free(client_key);
+ return r;
+}
+static int
+input_kex_ecdh_reply(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ const EC_GROUP *group;
+ EC_POINT *server_public = NULL;
+ EC_KEY *client_key;
+ BIGNUM *shared_secret = NULL;
+ struct sshkey *server_host_key = NULL;
+ u_char *server_host_key_blob = NULL, *signature = NULL;
+ u_char *kbuf = NULL;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t slen, sbloblen;
+ size_t klen = 0, hashlen;
+ int r;
+
+ if (kex->verify_host_key == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ group = kex->ec_group;
+ client_key = kex->ec_client_key;
+
/* hostkey */
- server_host_key_blob = packet_get_string(&sbloblen);
- server_host_key = key_from_blob(server_host_key_blob, sbloblen);
- if (server_host_key == NULL)
- fatal("cannot decode server_host_key_blob");
- if (server_host_key->type != kex->hostkey_type)
- fatal("type mismatch for decoded server_host_key_blob");
- if (kex->verify_host_key == NULL)
- fatal("cannot verify server_host_key");
- if (kex->verify_host_key(server_host_key) == -1)
- fatal("server_host_key verification failed");
+ if ((r = sshpkt_get_string(ssh, &server_host_key_blob,
+ &sbloblen)) != 0 ||
+ (r = sshkey_from_blob(server_host_key_blob, sbloblen,
+ &server_host_key)) != 0)
+ goto out;
+ if (server_host_key->type != kex->hostkey_type ||
+ (kex->hostkey_type == KEY_ECDSA &&
+ server_host_key->ecdsa_nid != kex->hostkey_nid)) {
+ r = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
+ }
+ if (kex->verify_host_key(server_host_key, ssh) == -1) {
+ r = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
+ }
/* Q_S, server public key */
- if ((server_public = EC_POINT_new(group)) == NULL)
- fatal("%s: EC_POINT_new failed", __func__);
- packet_get_ecpoint(group, server_public);
+ /* signed H */
+ if ((server_public = EC_POINT_new(group)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshpkt_get_ec(ssh, server_public, group)) != 0 ||
+ (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
- if (key_ec_validate_public(group, server_public) != 0)
- fatal("%s: invalid server public key", __func__);
-
#ifdef DEBUG_KEXECDH
fputs("server public key:\n", stderr);
- key_dump_ec_point(group, server_public);
+ sshkey_dump_ec_point(group, server_public);
#endif
+ if (sshkey_ec_validate_public(group, server_public) != 0) {
+ sshpkt_disconnect(ssh, "invalid server public key");
+ r = SSH_ERR_MESSAGE_INCOMPLETE;
+ goto out;
+ }
- /* signed H */
- signature = packet_get_string(&slen);
- packet_check_eom();
-
klen = (EC_GROUP_get_degree(group) + 7) / 8;
- kbuf = xmalloc(klen);
+ if ((kbuf = malloc(klen)) == NULL ||
+ (shared_secret = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
if (ECDH_compute_key(kbuf, klen, server_public,
- client_key, NULL) != (int)klen)
- fatal("%s: ECDH_compute_key failed", __func__);
+ client_key, NULL) != (int)klen ||
+ BN_bin2bn(kbuf, klen, shared_secret) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
#ifdef DEBUG_KEXECDH
dump_digest("shared secret", kbuf, klen);
#endif
- if ((shared_secret = BN_new()) == NULL)
- fatal("%s: BN_new failed", __func__);
- if (BN_bin2bn(kbuf, klen, shared_secret) == NULL)
- fatal("%s: BN_bin2bn failed", __func__);
- explicit_bzero(kbuf, klen);
- free(kbuf);
-
/* calc and verify H */
- kex_ecdh_hash(
+ hashlen = sizeof(hash);
+ if ((r = kex_ecdh_hash(
kex->hash_alg,
group,
kex->client_version_string,
kex->server_version_string,
- buffer_ptr(&kex->my), buffer_len(&kex->my),
- buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
server_host_key_blob, sbloblen,
EC_KEY_get0_public_key(client_key),
server_public,
shared_secret,
- &hash, &hashlen
- );
- free(server_host_key_blob);
- EC_POINT_clear_free(server_public);
- EC_KEY_free(client_key);
+ hash, &hashlen)) != 0)
+ goto out;
- if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
- fatal("key_verify failed for server_host_key");
- key_free(server_host_key);
- free(signature);
+ if ((r = sshkey_verify(server_host_key, signature, slen, hash,
+ hashlen, ssh->compat)) != 0)
+ goto out;
/* save session id */
if (kex->session_id == NULL) {
kex->session_id_len = hashlen;
- kex->session_id = xmalloc(kex->session_id_len);
+ kex->session_id = malloc(kex->session_id_len);
+ if (kex->session_id == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(kex->session_id, hash, kex->session_id_len);
}
- kex_derive_keys_bn(kex, hash, hashlen, shared_secret);
- BN_clear_free(shared_secret);
- kex_finish(kex);
+ if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
+ r = kex_send_newkeys(ssh);
+ out:
+ explicit_bzero(hash, sizeof(hash));
+ if (kex->ec_client_key) {
+ EC_KEY_free(kex->ec_client_key);
+ kex->ec_client_key = NULL;
+ }
+ if (server_public)
+ EC_POINT_clear_free(server_public);
+ if (kbuf) {
+ explicit_bzero(kbuf, klen);
+ free(kbuf);
+ }
+ if (shared_secret)
+ BN_clear_free(shared_secret);
+ sshkey_free(server_host_key);
+ free(server_host_key_blob);
+ free(signature);
+ return r;
}
-#else /* OPENSSL_HAS_ECC */
-void
-kexecdh_client(Kex *kex)
-{
- fatal("ECC support is not enabled");
-}
-#endif /* OPENSSL_HAS_ECC */
+#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */
+
Modified: trunk/crypto/openssh/kexecdhs.c
===================================================================
--- trunk/crypto/openssh/kexecdhs.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexecdhs.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexecdhs.c,v 1.10 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: kexecdhs.c,v 1.15 2015/12/04 16:41:28 markus Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -26,136 +26,183 @@
#include "includes.h"
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+
#include <sys/types.h>
#include <string.h>
#include <signal.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "key.h"
+#include <openssl/ecdh.h>
+
+#include "sshkey.h"
#include "cipher.h"
+#include "digest.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "ssh2.h"
-#ifdef OPENSSL_HAS_ECC
+#include "dispatch.h"
+#include "compat.h"
+#include "ssherr.h"
+#include "sshbuf.h"
-#include <openssl/ecdh.h>
+static int input_kex_ecdh_init(int, u_int32_t, void *);
-void
-kexecdh_server(Kex *kex)
+int
+kexecdh_server(struct ssh *ssh)
{
+ debug("expecting SSH2_MSG_KEX_ECDH_INIT");
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_ecdh_init);
+ return 0;
+}
+
+static int
+input_kex_ecdh_init(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
EC_POINT *client_public;
- EC_KEY *server_key;
+ EC_KEY *server_key = NULL;
const EC_GROUP *group;
- BIGNUM *shared_secret;
- Key *server_host_private, *server_host_public;
+ const EC_POINT *public_key;
+ BIGNUM *shared_secret = NULL;
+ struct sshkey *server_host_private, *server_host_public;
u_char *server_host_key_blob = NULL, *signature = NULL;
- u_char *kbuf, *hash;
- u_int klen, slen, sbloblen, hashlen;
+ u_char *kbuf = NULL;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t slen, sbloblen;
+ size_t klen = 0, hashlen;
+ int r;
- if ((server_key = EC_KEY_new_by_curve_name(kex->ec_nid)) == NULL)
- fatal("%s: EC_KEY_new_by_curve_name failed", __func__);
- if (EC_KEY_generate_key(server_key) != 1)
- fatal("%s: EC_KEY_generate_key failed", __func__);
+ if ((server_key = EC_KEY_new_by_curve_name(kex->ec_nid)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (EC_KEY_generate_key(server_key) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
group = EC_KEY_get0_group(server_key);
#ifdef DEBUG_KEXECDH
fputs("server private key:\n", stderr);
- key_dump_ec_key(server_key);
+ sshkey_dump_ec_key(server_key);
#endif
if (kex->load_host_public_key == NULL ||
- kex->load_host_private_key == NULL)
- fatal("Cannot load hostkey");
- server_host_public = kex->load_host_public_key(kex->hostkey_type);
- if (server_host_public == NULL)
- fatal("Unsupported hostkey type %d", kex->hostkey_type);
- server_host_private = kex->load_host_private_key(kex->hostkey_type);
+ kex->load_host_private_key == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ server_host_public = kex->load_host_public_key(kex->hostkey_type,
+ kex->hostkey_nid, ssh);
+ server_host_private = kex->load_host_private_key(kex->hostkey_type,
+ kex->hostkey_nid, ssh);
+ if (server_host_public == NULL) {
+ r = SSH_ERR_NO_HOSTKEY_LOADED;
+ goto out;
+ }
+ if ((client_public = EC_POINT_new(group)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshpkt_get_ec(ssh, client_public, group)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
- debug("expecting SSH2_MSG_KEX_ECDH_INIT");
- packet_read_expect(SSH2_MSG_KEX_ECDH_INIT);
- if ((client_public = EC_POINT_new(group)) == NULL)
- fatal("%s: EC_POINT_new failed", __func__);
- packet_get_ecpoint(group, client_public);
- packet_check_eom();
-
- if (key_ec_validate_public(group, client_public) != 0)
- fatal("%s: invalid client public key", __func__);
-
#ifdef DEBUG_KEXECDH
fputs("client public key:\n", stderr);
- key_dump_ec_point(group, client_public);
+ sshkey_dump_ec_point(group, client_public);
#endif
+ if (sshkey_ec_validate_public(group, client_public) != 0) {
+ sshpkt_disconnect(ssh, "invalid client public key");
+ r = SSH_ERR_MESSAGE_INCOMPLETE;
+ goto out;
+ }
/* Calculate shared_secret */
klen = (EC_GROUP_get_degree(group) + 7) / 8;
- kbuf = xmalloc(klen);
+ if ((kbuf = malloc(klen)) == NULL ||
+ (shared_secret = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
if (ECDH_compute_key(kbuf, klen, client_public,
- server_key, NULL) != (int)klen)
- fatal("%s: ECDH_compute_key failed", __func__);
+ server_key, NULL) != (int)klen ||
+ BN_bin2bn(kbuf, klen, shared_secret) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
-#ifdef DEBUG_KEXDH
+#ifdef DEBUG_KEXECDH
dump_digest("shared secret", kbuf, klen);
#endif
- if ((shared_secret = BN_new()) == NULL)
- fatal("%s: BN_new failed", __func__);
- if (BN_bin2bn(kbuf, klen, shared_secret) == NULL)
- fatal("%s: BN_bin2bn failed", __func__);
- explicit_bzero(kbuf, klen);
- free(kbuf);
-
/* calc H */
- key_to_blob(server_host_public, &server_host_key_blob, &sbloblen);
- kex_ecdh_hash(
+ if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
+ &sbloblen)) != 0)
+ goto out;
+ hashlen = sizeof(hash);
+ if ((r = kex_ecdh_hash(
kex->hash_alg,
group,
kex->client_version_string,
kex->server_version_string,
- buffer_ptr(&kex->peer), buffer_len(&kex->peer),
- buffer_ptr(&kex->my), buffer_len(&kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
server_host_key_blob, sbloblen,
client_public,
EC_KEY_get0_public_key(server_key),
shared_secret,
- &hash, &hashlen
- );
- EC_POINT_clear_free(client_public);
+ hash, &hashlen)) != 0)
+ goto out;
/* save session id := H */
if (kex->session_id == NULL) {
kex->session_id_len = hashlen;
- kex->session_id = xmalloc(kex->session_id_len);
+ kex->session_id = malloc(kex->session_id_len);
+ if (kex->session_id == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(kex->session_id, hash, kex->session_id_len);
}
/* sign H */
- kex->sign(server_host_private, server_host_public, &signature, &slen,
- hash, hashlen);
+ if ((r = kex->sign(server_host_private, server_host_public, &signature,
+ &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
+ goto out;
/* destroy_sensitive_data(); */
+ public_key = EC_KEY_get0_public_key(server_key);
/* send server hostkey, ECDH pubkey 'Q_S' and signed H */
- packet_start(SSH2_MSG_KEX_ECDH_REPLY);
- packet_put_string(server_host_key_blob, sbloblen);
- packet_put_ecpoint(group, EC_KEY_get0_public_key(server_key));
- packet_put_string(signature, slen);
- packet_send();
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 ||
+ (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
+ (r = sshpkt_put_ec(ssh, public_key, group)) != 0 ||
+ (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
+ if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
+ r = kex_send_newkeys(ssh);
+ out:
+ explicit_bzero(hash, sizeof(hash));
+ if (kex->ec_client_key) {
+ EC_KEY_free(kex->ec_client_key);
+ kex->ec_client_key = NULL;
+ }
+ if (server_key)
+ EC_KEY_free(server_key);
+ if (kbuf) {
+ explicit_bzero(kbuf, klen);
+ free(kbuf);
+ }
+ if (shared_secret)
+ BN_clear_free(shared_secret);
+ free(server_host_key_blob);
free(signature);
- free(server_host_key_blob);
- /* have keys, free server key */
- EC_KEY_free(server_key);
+ return r;
+}
+#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */
- kex_derive_keys_bn(kex, hash, hashlen, shared_secret);
- BN_clear_free(shared_secret);
- kex_finish(kex);
-}
-#else /* OPENSSL_HAS_ECC */
-void
-kexecdh_server(Kex *kex)
-{
- fatal("ECC support is not enabled");
-}
-#endif /* OPENSSL_HAS_ECC */
Modified: trunk/crypto/openssh/kexgex.c
===================================================================
--- trunk/crypto/openssh/kexgex.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexgex.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgex.c,v 1.28 2014/01/09 23:20:00 djm Exp $ */
+/* $OpenBSD: kexgex.c,v 1.29 2015/01/19 20:16:15 markus Exp $ */
/*
* Copyright (c) 2000 Niels Provos. All rights reserved.
* Copyright (c) 2001 Markus Friedl. All rights reserved.
@@ -26,73 +26,77 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
#include <openssl/evp.h>
#include <signal.h>
-#include "buffer.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
#include "kex.h"
#include "ssh2.h"
+#include "ssherr.h"
+#include "sshbuf.h"
#include "digest.h"
-#include "log.h"
-void
+int
kexgex_hash(
int hash_alg,
- char *client_version_string,
- char *server_version_string,
- char *ckexinit, int ckexinitlen,
- char *skexinit, int skexinitlen,
- u_char *serverhostkeyblob, int sbloblen,
- int min, int wantbits, int max, BIGNUM *prime, BIGNUM *gen,
- BIGNUM *client_dh_pub,
- BIGNUM *server_dh_pub,
- BIGNUM *shared_secret,
- u_char **hash, u_int *hashlen)
+ const char *client_version_string,
+ const char *server_version_string,
+ const u_char *ckexinit, size_t ckexinitlen,
+ const u_char *skexinit, size_t skexinitlen,
+ const u_char *serverhostkeyblob, size_t sbloblen,
+ int min, int wantbits, int max,
+ const BIGNUM *prime,
+ const BIGNUM *gen,
+ const BIGNUM *client_dh_pub,
+ const BIGNUM *server_dh_pub,
+ const BIGNUM *shared_secret,
+ u_char *hash, size_t *hashlen)
{
- Buffer b;
- static u_char digest[SSH_DIGEST_MAX_LENGTH];
+ struct sshbuf *b;
+ int r;
- buffer_init(&b);
- buffer_put_cstring(&b, client_version_string);
- buffer_put_cstring(&b, server_version_string);
-
- /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
- buffer_put_int(&b, ckexinitlen+1);
- buffer_put_char(&b, SSH2_MSG_KEXINIT);
- buffer_append(&b, ckexinit, ckexinitlen);
- buffer_put_int(&b, skexinitlen+1);
- buffer_put_char(&b, SSH2_MSG_KEXINIT);
- buffer_append(&b, skexinit, skexinitlen);
-
- buffer_put_string(&b, serverhostkeyblob, sbloblen);
- if (min == -1 || max == -1)
- buffer_put_int(&b, wantbits);
- else {
- buffer_put_int(&b, min);
- buffer_put_int(&b, wantbits);
- buffer_put_int(&b, max);
+ if (*hashlen < ssh_digest_bytes(SSH_DIGEST_SHA1))
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_put_cstring(b, client_version_string)) != 0 ||
+ (r = sshbuf_put_cstring(b, server_version_string)) != 0 ||
+ /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
+ (r = sshbuf_put_u32(b, ckexinitlen+1)) != 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
+ (r = sshbuf_put(b, ckexinit, ckexinitlen)) != 0 ||
+ (r = sshbuf_put_u32(b, skexinitlen+1)) != 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
+ (r = sshbuf_put(b, skexinit, skexinitlen)) != 0 ||
+ (r = sshbuf_put_string(b, serverhostkeyblob, sbloblen)) != 0 ||
+ (min != -1 && (r = sshbuf_put_u32(b, min)) != 0) ||
+ (r = sshbuf_put_u32(b, wantbits)) != 0 ||
+ (max != -1 && (r = sshbuf_put_u32(b, max)) != 0) ||
+ (r = sshbuf_put_bignum2(b, prime)) != 0 ||
+ (r = sshbuf_put_bignum2(b, gen)) != 0 ||
+ (r = sshbuf_put_bignum2(b, client_dh_pub)) != 0 ||
+ (r = sshbuf_put_bignum2(b, server_dh_pub)) != 0 ||
+ (r = sshbuf_put_bignum2(b, shared_secret)) != 0) {
+ sshbuf_free(b);
+ return r;
}
- buffer_put_bignum2(&b, prime);
- buffer_put_bignum2(&b, gen);
- buffer_put_bignum2(&b, client_dh_pub);
- buffer_put_bignum2(&b, server_dh_pub);
- buffer_put_bignum2(&b, shared_secret);
-
#ifdef DEBUG_KEXDH
- buffer_dump(&b);
+ sshbuf_dump(b, stderr);
#endif
- if (ssh_digest_buffer(hash_alg, &b, digest, sizeof(digest)) != 0)
- fatal("%s: ssh_digest_buffer failed", __func__);
-
- buffer_free(&b);
-
-#ifdef DEBUG_KEX
- dump_digest("hash", digest, ssh_digest_bytes(hash_alg));
+ if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
+ sshbuf_free(b);
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ }
+ sshbuf_free(b);
+ *hashlen = ssh_digest_bytes(hash_alg);
+#ifdef DEBUG_KEXDH
+ dump_digest("hash", hash, *hashlen);
#endif
- *hash = digest;
- *hashlen = ssh_digest_bytes(hash_alg);
+ return 0;
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/kexgexc.c
===================================================================
--- trunk/crypto/openssh/kexgexc.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexgexc.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexc.c,v 1.17 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: kexgexc.c,v 1.22 2015/05/26 23:23:40 dtucker Exp $ */
/*
* Copyright (c) 2000 Niels Provos. All rights reserved.
* Copyright (c) 2001 Markus Friedl. All rights reserved.
@@ -26,6 +26,9 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
+#include <sys/param.h>
#include <sys/types.h>
#include <openssl/dh.h>
@@ -35,10 +38,9 @@
#include <string.h>
#include <signal.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
+#include "digest.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
@@ -45,98 +47,148 @@
#include "dh.h"
#include "ssh2.h"
#include "compat.h"
+#include "dispatch.h"
+#include "ssherr.h"
+#include "sshbuf.h"
-void
-kexgex_client(Kex *kex)
+static int input_kex_dh_gex_group(int, u_int32_t, void *);
+static int input_kex_dh_gex_reply(int, u_int32_t, void *);
+
+int
+kexgex_client(struct ssh *ssh)
{
- BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
- BIGNUM *p = NULL, *g = NULL;
- Key *server_host_key;
- u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
- u_int klen, slen, sbloblen, hashlen;
- int kout;
- int min, max, nbits;
- DH *dh;
+ struct kex *kex = ssh->kex;
+ int r;
+ u_int nbits;
nbits = dh_estimate(kex->dh_need * 8);
- if (datafellows & SSH_OLD_DHGEX) {
- /* Old GEX request */
- packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
- packet_put_int(nbits);
- min = DH_GRP_MIN;
- max = DH_GRP_MAX;
-
- debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD(%u) sent", nbits);
- } else {
- /* New GEX request */
- min = DH_GRP_MIN;
- max = DH_GRP_MAX;
- packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST);
- packet_put_int(min);
- packet_put_int(nbits);
- packet_put_int(max);
-
- debug("SSH2_MSG_KEX_DH_GEX_REQUEST(%u<%u<%u) sent",
- min, nbits, max);
- }
+ kex->min = DH_GRP_MIN;
+ kex->max = DH_GRP_MAX;
+ kex->nbits = nbits;
+ if (datafellows & SSH_BUG_DHGEX_LARGE)
+ kex->nbits = MIN(kex->nbits, 4096);
+ /* New GEX request */
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST)) != 0 ||
+ (r = sshpkt_put_u32(ssh, kex->min)) != 0 ||
+ (r = sshpkt_put_u32(ssh, kex->nbits)) != 0 ||
+ (r = sshpkt_put_u32(ssh, kex->max)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
+ debug("SSH2_MSG_KEX_DH_GEX_REQUEST(%u<%u<%u) sent",
+ kex->min, kex->nbits, kex->max);
#ifdef DEBUG_KEXDH
fprintf(stderr, "\nmin = %d, nbits = %d, max = %d\n",
- min, nbits, max);
+ kex->min, kex->nbits, kex->max);
#endif
- packet_send();
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_GROUP,
+ &input_kex_dh_gex_group);
+ r = 0;
+ out:
+ return r;
+}
- debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP");
- packet_read_expect(SSH2_MSG_KEX_DH_GEX_GROUP);
+static int
+input_kex_dh_gex_group(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ BIGNUM *p = NULL, *g = NULL;
+ int r, bits;
- if ((p = BN_new()) == NULL)
- fatal("BN_new");
- packet_get_bignum2(p);
- if ((g = BN_new()) == NULL)
- fatal("BN_new");
- packet_get_bignum2(g);
- packet_check_eom();
+ debug("got SSH2_MSG_KEX_DH_GEX_GROUP");
- if (BN_num_bits(p) < min || BN_num_bits(p) > max)
- fatal("DH_GEX group out of range: %d !< %d !< %d",
- min, BN_num_bits(p), max);
+ if ((p = BN_new()) == NULL ||
+ (g = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshpkt_get_bignum2(ssh, p)) != 0 ||
+ (r = sshpkt_get_bignum2(ssh, g)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
+ if ((bits = BN_num_bits(p)) < 0 ||
+ (u_int)bits < kex->min || (u_int)bits > kex->max) {
+ r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
+ goto out;
+ }
+ if ((kex->dh = dh_new_group(g, p)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ p = g = NULL; /* belong to kex->dh now */
- dh = dh_new_group(g, p);
- dh_gen_key(dh, kex->we_need * 8);
-
+ /* generate and send 'e', client DH public key */
+ if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0 ||
+ (r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_INIT)) != 0 ||
+ (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
+ debug("SSH2_MSG_KEX_DH_GEX_INIT sent");
#ifdef DEBUG_KEXDH
- DHparams_print_fp(stderr, dh);
+ DHparams_print_fp(stderr, kex->dh);
fprintf(stderr, "pub= ");
- BN_print_fp(stderr, dh->pub_key);
+ BN_print_fp(stderr, kex->dh->pub_key);
fprintf(stderr, "\n");
#endif
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_GROUP, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REPLY, &input_kex_dh_gex_reply);
+ r = 0;
+out:
+ if (p)
+ BN_clear_free(p);
+ if (g)
+ BN_clear_free(g);
+ return r;
+}
- debug("SSH2_MSG_KEX_DH_GEX_INIT sent");
- /* generate and send 'e', client DH public key */
- packet_start(SSH2_MSG_KEX_DH_GEX_INIT);
- packet_put_bignum2(dh->pub_key);
- packet_send();
+static int
+input_kex_dh_gex_reply(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
+ struct sshkey *server_host_key = NULL;
+ u_char *kbuf = NULL, *signature = NULL, *server_host_key_blob = NULL;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t klen = 0, slen, sbloblen, hashlen;
+ int kout, r;
- debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY");
- packet_read_expect(SSH2_MSG_KEX_DH_GEX_REPLY);
-
+ debug("got SSH2_MSG_KEX_DH_GEX_REPLY");
+ if (kex->verify_host_key == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
/* key, cert */
- server_host_key_blob = packet_get_string(&sbloblen);
- server_host_key = key_from_blob(server_host_key_blob, sbloblen);
- if (server_host_key == NULL)
- fatal("cannot decode server_host_key_blob");
- if (server_host_key->type != kex->hostkey_type)
- fatal("type mismatch for decoded server_host_key_blob");
- if (kex->verify_host_key == NULL)
- fatal("cannot verify server_host_key");
- if (kex->verify_host_key(server_host_key) == -1)
- fatal("server_host_key verification failed");
-
+ if ((r = sshpkt_get_string(ssh, &server_host_key_blob,
+ &sbloblen)) != 0 ||
+ (r = sshkey_from_blob(server_host_key_blob, sbloblen,
+ &server_host_key)) != 0)
+ goto out;
+ if (server_host_key->type != kex->hostkey_type) {
+ r = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
+ }
+ if (server_host_key->type != kex->hostkey_type ||
+ (kex->hostkey_type == KEY_ECDSA &&
+ server_host_key->ecdsa_nid != kex->hostkey_nid)) {
+ r = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
+ }
+ if (kex->verify_host_key(server_host_key, ssh) == -1) {
+ r = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
+ }
/* DH parameter f, server public DH key */
- if ((dh_server_pub = BN_new()) == NULL)
- fatal("dh_server_pub == NULL");
- packet_get_bignum2(dh_server_pub);
-
+ if ((dh_server_pub = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ /* signed H */
+ if ((r = sshpkt_get_bignum2(ssh, dh_server_pub)) != 0 ||
+ (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
#ifdef DEBUG_KEXDH
fprintf(stderr, "dh_server_pub= ");
BN_print_fp(stderr, dh_server_pub);
@@ -143,65 +195,78 @@
fprintf(stderr, "\n");
debug("bits %d", BN_num_bits(dh_server_pub));
#endif
+ if (!dh_pub_is_valid(kex->dh, dh_server_pub)) {
+ sshpkt_disconnect(ssh, "bad server public DH value");
+ r = SSH_ERR_MESSAGE_INCOMPLETE;
+ goto out;
+ }
- /* signed H */
- signature = packet_get_string(&slen);
- packet_check_eom();
-
- if (!dh_pub_is_valid(dh, dh_server_pub))
- packet_disconnect("bad server public DH value");
-
- klen = DH_size(dh);
- kbuf = xmalloc(klen);
- if ((kout = DH_compute_key(kbuf, dh_server_pub, dh)) < 0)
- fatal("DH_compute_key: failed");
+ klen = DH_size(kex->dh);
+ if ((kbuf = malloc(klen)) == NULL ||
+ (shared_secret = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((kout = DH_compute_key(kbuf, dh_server_pub, kex->dh)) < 0 ||
+ BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
#ifdef DEBUG_KEXDH
dump_digest("shared secret", kbuf, kout);
#endif
- if ((shared_secret = BN_new()) == NULL)
- fatal("kexgex_client: BN_new failed");
- if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
- fatal("kexgex_client: BN_bin2bn failed");
- explicit_bzero(kbuf, klen);
- free(kbuf);
+ if (ssh->compat & SSH_OLD_DHGEX)
+ kex->min = kex->max = -1;
- if (datafellows & SSH_OLD_DHGEX)
- min = max = -1;
-
/* calc and verify H */
- kexgex_hash(
+ hashlen = sizeof(hash);
+ if ((r = kexgex_hash(
kex->hash_alg,
kex->client_version_string,
kex->server_version_string,
- buffer_ptr(&kex->my), buffer_len(&kex->my),
- buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
server_host_key_blob, sbloblen,
- min, nbits, max,
- dh->p, dh->g,
- dh->pub_key,
+ kex->min, kex->nbits, kex->max,
+ kex->dh->p, kex->dh->g,
+ kex->dh->pub_key,
dh_server_pub,
shared_secret,
- &hash, &hashlen
- );
+ hash, &hashlen)) != 0)
+ goto out;
- /* have keys, free DH */
- DH_free(dh);
- free(server_host_key_blob);
- BN_clear_free(dh_server_pub);
+ if ((r = sshkey_verify(server_host_key, signature, slen, hash,
+ hashlen, ssh->compat)) != 0)
+ goto out;
- if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
- fatal("key_verify failed for server_host_key");
- key_free(server_host_key);
- free(signature);
-
/* save session id */
if (kex->session_id == NULL) {
kex->session_id_len = hashlen;
- kex->session_id = xmalloc(kex->session_id_len);
+ kex->session_id = malloc(kex->session_id_len);
+ if (kex->session_id == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(kex->session_id, hash, kex->session_id_len);
}
- kex_derive_keys_bn(kex, hash, hashlen, shared_secret);
- BN_clear_free(shared_secret);
- kex_finish(kex);
+ if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
+ r = kex_send_newkeys(ssh);
+ out:
+ explicit_bzero(hash, sizeof(hash));
+ DH_free(kex->dh);
+ kex->dh = NULL;
+ if (dh_server_pub)
+ BN_clear_free(dh_server_pub);
+ if (kbuf) {
+ explicit_bzero(kbuf, klen);
+ free(kbuf);
+ }
+ if (shared_secret)
+ BN_clear_free(shared_secret);
+ sshkey_free(server_host_key);
+ free(server_host_key_blob);
+ free(signature);
+ return r;
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/kexgexs.c
===================================================================
--- trunk/crypto/openssh/kexgexs.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/kexgexs.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexs.c,v 1.19 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: kexgexs.c,v 1.29 2016/06/08 02:13:01 dtucker Exp $ */
/*
* Copyright (c) 2000 Niels Provos. All rights reserved.
* Copyright (c) 2001 Markus Friedl. All rights reserved.
@@ -26,8 +26,10 @@
#include "includes.h"
-#include <sys/param.h>
+#ifdef WITH_OPENSSL
+#include <sys/param.h> /* MIN MAX */
+
#include <stdarg.h>
#include <stdio.h>
#include <string.h>
@@ -35,10 +37,9 @@
#include <openssl/dh.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshkey.h"
#include "cipher.h"
+#include "digest.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
@@ -49,79 +50,110 @@
#include "ssh-gss.h"
#endif
#include "monitor_wrap.h"
+#include "dispatch.h"
+#include "ssherr.h"
+#include "sshbuf.h"
-void
-kexgex_server(Kex *kex)
+static int input_kex_dh_gex_request(int, u_int32_t, void *);
+static int input_kex_dh_gex_init(int, u_int32_t, void *);
+
+int
+kexgex_server(struct ssh *ssh)
{
- BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
- Key *server_host_public, *server_host_private;
- DH *dh;
- u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
- u_int sbloblen, klen, slen, hashlen;
- int omin = -1, min = -1, omax = -1, max = -1, onbits = -1, nbits = -1;
- int type, kout;
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST,
+ &input_kex_dh_gex_request);
+ debug("expecting SSH2_MSG_KEX_DH_GEX_REQUEST");
+ return 0;
+}
- if (kex->load_host_public_key == NULL ||
- kex->load_host_private_key == NULL)
- fatal("Cannot load hostkey");
- server_host_public = kex->load_host_public_key(kex->hostkey_type);
- if (server_host_public == NULL)
- fatal("Unsupported hostkey type %d", kex->hostkey_type);
- server_host_private = kex->load_host_private_key(kex->hostkey_type);
+static int
+input_kex_dh_gex_request(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ int r;
+ u_int min = 0, max = 0, nbits = 0;
- type = packet_read();
- switch (type) {
- case SSH2_MSG_KEX_DH_GEX_REQUEST:
- debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
- omin = min = packet_get_int();
- onbits = nbits = packet_get_int();
- omax = max = packet_get_int();
- min = MAX(DH_GRP_MIN, min);
- max = MIN(DH_GRP_MAX, max);
- nbits = MAX(DH_GRP_MIN, nbits);
- nbits = MIN(DH_GRP_MAX, nbits);
- break;
- case SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:
- debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received");
- onbits = nbits = packet_get_int();
- /* unused for old GEX */
- omin = min = DH_GRP_MIN;
- omax = max = DH_GRP_MAX;
- break;
- default:
- fatal("protocol error during kex, no DH_GEX_REQUEST: %d", type);
+ debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
+ if ((r = sshpkt_get_u32(ssh, &min)) != 0 ||
+ (r = sshpkt_get_u32(ssh, &nbits)) != 0 ||
+ (r = sshpkt_get_u32(ssh, &max)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
+ kex->nbits = nbits;
+ kex->min = min;
+ kex->max = max;
+ min = MAX(DH_GRP_MIN, min);
+ max = MIN(DH_GRP_MAX, max);
+ nbits = MAX(DH_GRP_MIN, nbits);
+ nbits = MIN(DH_GRP_MAX, nbits);
+
+ if (kex->max < kex->min || kex->nbits < kex->min ||
+ kex->max < kex->nbits || kex->max < DH_GRP_MIN) {
+ r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
+ goto out;
}
- packet_check_eom();
- if (omax < omin || onbits < omin || omax < onbits)
- fatal("DH_GEX_REQUEST, bad parameters: %d !< %d !< %d",
- omin, onbits, omax);
-
/* Contact privileged parent */
- dh = PRIVSEP(choose_dh(min, nbits, max));
- if (dh == NULL)
- packet_disconnect("Protocol error: no matching DH grp found");
-
+ kex->dh = PRIVSEP(choose_dh(min, nbits, max));
+ if (kex->dh == NULL) {
+ sshpkt_disconnect(ssh, "no matching DH grp found");
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
- packet_start(SSH2_MSG_KEX_DH_GEX_GROUP);
- packet_put_bignum2(dh->p);
- packet_put_bignum2(dh->g);
- packet_send();
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_GROUP)) != 0 ||
+ (r = sshpkt_put_bignum2(ssh, kex->dh->p)) != 0 ||
+ (r = sshpkt_put_bignum2(ssh, kex->dh->g)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
- /* flush */
- packet_write_wait();
-
/* Compute our exchange value in parallel with the client */
- dh_gen_key(dh, kex->we_need * 8);
+ if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ goto out;
debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
- packet_read_expect(SSH2_MSG_KEX_DH_GEX_INIT);
+ ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_INIT, &input_kex_dh_gex_init);
+ r = 0;
+ out:
+ return r;
+}
+static int
+input_kex_dh_gex_init(int type, u_int32_t seq, void *ctxt)
+{
+ struct ssh *ssh = ctxt;
+ struct kex *kex = ssh->kex;
+ BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
+ struct sshkey *server_host_public, *server_host_private;
+ u_char *kbuf = NULL, *signature = NULL, *server_host_key_blob = NULL;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t sbloblen, slen;
+ size_t klen = 0, hashlen;
+ int kout, r;
+
+ if (kex->load_host_public_key == NULL ||
+ kex->load_host_private_key == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ server_host_public = kex->load_host_public_key(kex->hostkey_type,
+ kex->hostkey_nid, ssh);
+ server_host_private = kex->load_host_private_key(kex->hostkey_type,
+ kex->hostkey_nid, ssh);
+ if (server_host_public == NULL) {
+ r = SSH_ERR_NO_HOSTKEY_LOADED;
+ goto out;
+ }
+
/* key, cert */
- if ((dh_client_pub = BN_new()) == NULL)
- fatal("dh_client_pub == NULL");
- packet_get_bignum2(dh_client_pub);
- packet_check_eom();
+ if ((dh_client_pub = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshpkt_get_bignum2(ssh, dh_client_pub)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ goto out;
#ifdef DEBUG_KEXDH
fprintf(stderr, "dh_client_pub= ");
@@ -131,78 +163,92 @@
#endif
#ifdef DEBUG_KEXDH
- DHparams_print_fp(stderr, dh);
+ DHparams_print_fp(stderr, kex->dh);
fprintf(stderr, "pub= ");
- BN_print_fp(stderr, dh->pub_key);
+ BN_print_fp(stderr, kex->dh->pub_key);
fprintf(stderr, "\n");
#endif
- if (!dh_pub_is_valid(dh, dh_client_pub))
- packet_disconnect("bad client public DH value");
+ if (!dh_pub_is_valid(kex->dh, dh_client_pub)) {
+ sshpkt_disconnect(ssh, "bad client public DH value");
+ r = SSH_ERR_MESSAGE_INCOMPLETE;
+ goto out;
+ }
- klen = DH_size(dh);
- kbuf = xmalloc(klen);
- if ((kout = DH_compute_key(kbuf, dh_client_pub, dh)) < 0)
- fatal("DH_compute_key: failed");
+ klen = DH_size(kex->dh);
+ if ((kbuf = malloc(klen)) == NULL ||
+ (shared_secret = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((kout = DH_compute_key(kbuf, dh_client_pub, kex->dh)) < 0 ||
+ BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
#ifdef DEBUG_KEXDH
dump_digest("shared secret", kbuf, kout);
#endif
- if ((shared_secret = BN_new()) == NULL)
- fatal("kexgex_server: BN_new failed");
- if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
- fatal("kexgex_server: BN_bin2bn failed");
- explicit_bzero(kbuf, klen);
- free(kbuf);
-
- key_to_blob(server_host_public, &server_host_key_blob, &sbloblen);
-
- if (type == SSH2_MSG_KEX_DH_GEX_REQUEST_OLD)
- omin = min = omax = max = -1;
-
+ if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
+ &sbloblen)) != 0)
+ goto out;
/* calc H */
- kexgex_hash(
+ hashlen = sizeof(hash);
+ if ((r = kexgex_hash(
kex->hash_alg,
kex->client_version_string,
kex->server_version_string,
- buffer_ptr(&kex->peer), buffer_len(&kex->peer),
- buffer_ptr(&kex->my), buffer_len(&kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
server_host_key_blob, sbloblen,
- omin, onbits, omax,
- dh->p, dh->g,
+ kex->min, kex->nbits, kex->max,
+ kex->dh->p, kex->dh->g,
dh_client_pub,
- dh->pub_key,
+ kex->dh->pub_key,
shared_secret,
- &hash, &hashlen
- );
- BN_clear_free(dh_client_pub);
+ hash, &hashlen)) != 0)
+ goto out;
/* save session id := H */
if (kex->session_id == NULL) {
kex->session_id_len = hashlen;
- kex->session_id = xmalloc(kex->session_id_len);
+ kex->session_id = malloc(kex->session_id_len);
+ if (kex->session_id == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(kex->session_id, hash, kex->session_id_len);
}
/* sign H */
- kex->sign(server_host_private, server_host_public, &signature, &slen,
- hash, hashlen);
+ if ((r = kex->sign(server_host_private, server_host_public, &signature,
+ &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
+ goto out;
/* destroy_sensitive_data(); */
/* send server hostkey, DH pubkey 'f' and singed H */
- debug("SSH2_MSG_KEX_DH_GEX_REPLY sent");
- packet_start(SSH2_MSG_KEX_DH_GEX_REPLY);
- packet_put_string(server_host_key_blob, sbloblen);
- packet_put_bignum2(dh->pub_key); /* f */
- packet_put_string(signature, slen);
- packet_send();
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REPLY)) != 0 ||
+ (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
+ (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 || /* f */
+ (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ goto out;
+ if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
+ r = kex_send_newkeys(ssh);
+ out:
+ DH_free(kex->dh);
+ kex->dh = NULL;
+ if (dh_client_pub)
+ BN_clear_free(dh_client_pub);
+ if (kbuf) {
+ explicit_bzero(kbuf, klen);
+ free(kbuf);
+ }
+ if (shared_secret)
+ BN_clear_free(shared_secret);
+ free(server_host_key_blob);
free(signature);
- free(server_host_key_blob);
- /* have keys, free DH */
- DH_free(dh);
-
- kex_derive_keys_bn(kex, hash, hashlen, shared_secret);
- BN_clear_free(shared_secret);
-
- kex_finish(kex);
+ return r;
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/key.c
===================================================================
--- trunk/crypto/openssh/key.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/key.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,2089 +1,224 @@
-/* $OpenBSD: key.c,v 1.116 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: key.c,v 1.130 2016/05/02 09:36:42 djm Exp $ */
/*
- * read_bignum():
- * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose. Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
- * Copyright (c) 2008 Alexander von Gernler. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * placed in the public domain
*/
#include "includes.h"
-#include <sys/param.h>
#include <sys/types.h>
-
-#include "crypto_api.h"
-
-#include <openssl/evp.h>
-#include <openbsd-compat/openssl-compat.h>
-
+#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
-#include <string.h>
+#include <limits.h>
-#include "xmalloc.h"
+#define SSH_KEY_NO_DEFINE
#include "key.h"
-#include "rsa.h"
-#include "uuencode.h"
-#include "buffer.h"
+
+#include "compat.h"
+#include "sshkey.h"
+#include "ssherr.h"
#include "log.h"
-#include "misc.h"
-#include "ssh2.h"
-#include "digest.h"
+#include "authfile.h"
-static int to_blob(const Key *, u_char **, u_int *, int);
-static Key *key_from_blob2(const u_char *, u_int, int);
-
-static struct KeyCert *
-cert_new(void)
-{
- struct KeyCert *cert;
-
- cert = xcalloc(1, sizeof(*cert));
- buffer_init(&cert->certblob);
- buffer_init(&cert->critical);
- buffer_init(&cert->extensions);
- cert->key_id = NULL;
- cert->principals = NULL;
- cert->signature_key = NULL;
- return cert;
-}
-
-Key *
-key_new(int type)
-{
- Key *k;
- RSA *rsa;
- DSA *dsa;
- k = xcalloc(1, sizeof(*k));
- k->type = type;
- k->ecdsa = NULL;
- k->ecdsa_nid = -1;
- k->dsa = NULL;
- k->rsa = NULL;
- k->cert = NULL;
- k->ed25519_sk = NULL;
- k->ed25519_pk = NULL;
- switch (k->type) {
- case KEY_RSA1:
- case KEY_RSA:
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- if ((rsa = RSA_new()) == NULL)
- fatal("key_new: RSA_new failed");
- if ((rsa->n = BN_new()) == NULL)
- fatal("key_new: BN_new failed");
- if ((rsa->e = BN_new()) == NULL)
- fatal("key_new: BN_new failed");
- k->rsa = rsa;
- break;
- case KEY_DSA:
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- if ((dsa = DSA_new()) == NULL)
- fatal("key_new: DSA_new failed");
- if ((dsa->p = BN_new()) == NULL)
- fatal("key_new: BN_new failed");
- if ((dsa->q = BN_new()) == NULL)
- fatal("key_new: BN_new failed");
- if ((dsa->g = BN_new()) == NULL)
- fatal("key_new: BN_new failed");
- if ((dsa->pub_key = BN_new()) == NULL)
- fatal("key_new: BN_new failed");
- k->dsa = dsa;
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- case KEY_ECDSA_CERT:
- /* Cannot do anything until we know the group */
- break;
-#endif
- case KEY_ED25519:
- case KEY_ED25519_CERT:
- /* no need to prealloc */
- break;
- case KEY_UNSPEC:
- break;
- default:
- fatal("key_new: bad key type %d", k->type);
- break;
- }
-
- if (key_is_cert(k))
- k->cert = cert_new();
-
- return k;
-}
-
void
key_add_private(Key *k)
{
- switch (k->type) {
- case KEY_RSA1:
- case KEY_RSA:
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- if ((k->rsa->d = BN_new()) == NULL)
- fatal("key_new_private: BN_new failed");
- if ((k->rsa->iqmp = BN_new()) == NULL)
- fatal("key_new_private: BN_new failed");
- if ((k->rsa->q = BN_new()) == NULL)
- fatal("key_new_private: BN_new failed");
- if ((k->rsa->p = BN_new()) == NULL)
- fatal("key_new_private: BN_new failed");
- if ((k->rsa->dmq1 = BN_new()) == NULL)
- fatal("key_new_private: BN_new failed");
- if ((k->rsa->dmp1 = BN_new()) == NULL)
- fatal("key_new_private: BN_new failed");
- break;
- case KEY_DSA:
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- if ((k->dsa->priv_key = BN_new()) == NULL)
- fatal("key_new_private: BN_new failed");
- break;
- case KEY_ECDSA:
- case KEY_ECDSA_CERT:
- /* Cannot do anything until we know the group */
- break;
- case KEY_ED25519:
- case KEY_ED25519_CERT:
- /* no need to prealloc */
- break;
- case KEY_UNSPEC:
- break;
- default:
- break;
- }
+ int r;
+
+ if ((r = sshkey_add_private(k)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
}
Key *
key_new_private(int type)
{
- Key *k = key_new(type);
+ Key *ret = NULL;
- key_add_private(k);
- return k;
+ if ((ret = sshkey_new_private(type)) == NULL)
+ fatal("%s: failed", __func__);
+ return ret;
}
-static void
-cert_free(struct KeyCert *cert)
-{
- u_int i;
-
- buffer_free(&cert->certblob);
- buffer_free(&cert->critical);
- buffer_free(&cert->extensions);
- free(cert->key_id);
- for (i = 0; i < cert->nprincipals; i++)
- free(cert->principals[i]);
- free(cert->principals);
- if (cert->signature_key != NULL)
- key_free(cert->signature_key);
- free(cert);
-}
-
-void
-key_free(Key *k)
-{
- if (k == NULL)
- fatal("key_free: key is NULL");
- switch (k->type) {
- case KEY_RSA1:
- case KEY_RSA:
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- if (k->rsa != NULL)
- RSA_free(k->rsa);
- k->rsa = NULL;
- break;
- case KEY_DSA:
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- if (k->dsa != NULL)
- DSA_free(k->dsa);
- k->dsa = NULL;
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- case KEY_ECDSA_CERT:
- if (k->ecdsa != NULL)
- EC_KEY_free(k->ecdsa);
- k->ecdsa = NULL;
- break;
-#endif
- case KEY_ED25519:
- case KEY_ED25519_CERT:
- if (k->ed25519_pk) {
- explicit_bzero(k->ed25519_pk, ED25519_PK_SZ);
- free(k->ed25519_pk);
- k->ed25519_pk = NULL;
- }
- if (k->ed25519_sk) {
- explicit_bzero(k->ed25519_sk, ED25519_SK_SZ);
- free(k->ed25519_sk);
- k->ed25519_sk = NULL;
- }
- break;
- case KEY_UNSPEC:
- break;
- default:
- fatal("key_free: bad key type %d", k->type);
- break;
- }
- if (key_is_cert(k)) {
- if (k->cert != NULL)
- cert_free(k->cert);
- k->cert = NULL;
- }
-
- free(k);
-}
-
-static int
-cert_compare(struct KeyCert *a, struct KeyCert *b)
-{
- if (a == NULL && b == NULL)
- return 1;
- if (a == NULL || b == NULL)
- return 0;
- if (buffer_len(&a->certblob) != buffer_len(&b->certblob))
- return 0;
- if (timingsafe_bcmp(buffer_ptr(&a->certblob), buffer_ptr(&b->certblob),
- buffer_len(&a->certblob)) != 0)
- return 0;
- return 1;
-}
-
-/*
- * Compare public portions of key only, allowing comparisons between
- * certificates and plain keys too.
- */
int
-key_equal_public(const Key *a, const Key *b)
-{
-#ifdef OPENSSL_HAS_ECC
- BN_CTX *bnctx;
-#endif
-
- if (a == NULL || b == NULL ||
- key_type_plain(a->type) != key_type_plain(b->type))
- return 0;
-
- switch (a->type) {
- case KEY_RSA1:
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- case KEY_RSA:
- return a->rsa != NULL && b->rsa != NULL &&
- BN_cmp(a->rsa->e, b->rsa->e) == 0 &&
- BN_cmp(a->rsa->n, b->rsa->n) == 0;
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- case KEY_DSA:
- return a->dsa != NULL && b->dsa != NULL &&
- BN_cmp(a->dsa->p, b->dsa->p) == 0 &&
- BN_cmp(a->dsa->q, b->dsa->q) == 0 &&
- BN_cmp(a->dsa->g, b->dsa->g) == 0 &&
- BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA_CERT:
- case KEY_ECDSA:
- if (a->ecdsa == NULL || b->ecdsa == NULL ||
- EC_KEY_get0_public_key(a->ecdsa) == NULL ||
- EC_KEY_get0_public_key(b->ecdsa) == NULL)
- return 0;
- if ((bnctx = BN_CTX_new()) == NULL)
- fatal("%s: BN_CTX_new failed", __func__);
- if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa),
- EC_KEY_get0_group(b->ecdsa), bnctx) != 0 ||
- EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa),
- EC_KEY_get0_public_key(a->ecdsa),
- EC_KEY_get0_public_key(b->ecdsa), bnctx) != 0) {
- BN_CTX_free(bnctx);
- return 0;
- }
- BN_CTX_free(bnctx);
- return 1;
-#endif /* OPENSSL_HAS_ECC */
- case KEY_ED25519:
- case KEY_ED25519_CERT:
- return a->ed25519_pk != NULL && b->ed25519_pk != NULL &&
- memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0;
- default:
- fatal("key_equal: bad key type %d", a->type);
- }
- /* NOTREACHED */
-}
-
-int
-key_equal(const Key *a, const Key *b)
-{
- if (a == NULL || b == NULL || a->type != b->type)
- return 0;
- if (key_is_cert(a)) {
- if (!cert_compare(a->cert, b->cert))
- return 0;
- }
- return key_equal_public(a, b);
-}
-
-u_char*
-key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
- u_int *dgst_raw_length)
-{
- u_char *blob = NULL;
- u_char *retval = NULL;
- u_int len = 0;
- int nlen, elen, hash_alg = -1;
-
- *dgst_raw_length = 0;
-
- /* XXX switch to DIGEST_* directly? */
- switch (dgst_type) {
- case SSH_FP_MD5:
- hash_alg = SSH_DIGEST_MD5;
- break;
- case SSH_FP_SHA1:
- hash_alg = SSH_DIGEST_SHA1;
- break;
- case SSH_FP_SHA256:
- hash_alg = SSH_DIGEST_SHA256;
- break;
- default:
- fatal("%s: bad digest type %d", __func__, dgst_type);
- }
- switch (k->type) {
- case KEY_RSA1:
- nlen = BN_num_bytes(k->rsa->n);
- elen = BN_num_bytes(k->rsa->e);
- len = nlen + elen;
- blob = xmalloc(len);
- BN_bn2bin(k->rsa->n, blob);
- BN_bn2bin(k->rsa->e, blob + nlen);
- break;
- case KEY_DSA:
- case KEY_ECDSA:
- case KEY_RSA:
- case KEY_ED25519:
- key_to_blob(k, &blob, &len);
- break;
- case KEY_DSA_CERT_V00:
- case KEY_RSA_CERT_V00:
- case KEY_DSA_CERT:
- case KEY_ECDSA_CERT:
- case KEY_RSA_CERT:
- case KEY_ED25519_CERT:
- /* We want a fingerprint of the _key_ not of the cert */
- to_blob(k, &blob, &len, 1);
- break;
- case KEY_UNSPEC:
- return retval;
- default:
- fatal("%s: bad key type %d", __func__, k->type);
- break;
- }
- if (blob != NULL) {
- retval = xmalloc(SSH_DIGEST_MAX_LENGTH);
- if ((ssh_digest_memory(hash_alg, blob, len,
- retval, SSH_DIGEST_MAX_LENGTH)) != 0)
- fatal("%s: digest_memory failed", __func__);
- explicit_bzero(blob, len);
- free(blob);
- *dgst_raw_length = ssh_digest_bytes(hash_alg);
- } else {
- fatal("%s: blob is null", __func__);
- }
- return retval;
-}
-
-static char *
-key_fingerprint_hex(u_char *dgst_raw, u_int dgst_raw_len)
-{
- char *retval;
- u_int i;
-
- retval = xcalloc(1, dgst_raw_len * 3 + 1);
- for (i = 0; i < dgst_raw_len; i++) {
- char hex[4];
- snprintf(hex, sizeof(hex), "%02x:", dgst_raw[i]);
- strlcat(retval, hex, dgst_raw_len * 3 + 1);
- }
-
- /* Remove the trailing ':' character */
- retval[(dgst_raw_len * 3) - 1] = '\0';
- return retval;
-}
-
-static char *
-key_fingerprint_bubblebabble(u_char *dgst_raw, u_int dgst_raw_len)
-{
- char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' };
- char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm',
- 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' };
- u_int i, j = 0, rounds, seed = 1;
- char *retval;
-
- rounds = (dgst_raw_len / 2) + 1;
- retval = xcalloc((rounds * 6), sizeof(char));
- retval[j++] = 'x';
- for (i = 0; i < rounds; i++) {
- u_int idx0, idx1, idx2, idx3, idx4;
- if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) {
- idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) +
- seed) % 6;
- idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15;
- idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) +
- (seed / 6)) % 6;
- retval[j++] = vowels[idx0];
- retval[j++] = consonants[idx1];
- retval[j++] = vowels[idx2];
- if ((i + 1) < rounds) {
- idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15;
- idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15;
- retval[j++] = consonants[idx3];
- retval[j++] = '-';
- retval[j++] = consonants[idx4];
- seed = ((seed * 5) +
- ((((u_int)(dgst_raw[2 * i])) * 7) +
- ((u_int)(dgst_raw[(2 * i) + 1])))) % 36;
- }
- } else {
- idx0 = seed % 6;
- idx1 = 16;
- idx2 = seed / 6;
- retval[j++] = vowels[idx0];
- retval[j++] = consonants[idx1];
- retval[j++] = vowels[idx2];
- }
- }
- retval[j++] = 'x';
- retval[j++] = '\0';
- return retval;
-}
-
-/*
- * Draw an ASCII-Art representing the fingerprint so human brain can
- * profit from its built-in pattern recognition ability.
- * This technique is called "random art" and can be found in some
- * scientific publications like this original paper:
- *
- * "Hash Visualization: a New Technique to improve Real-World Security",
- * Perrig A. and Song D., 1999, International Workshop on Cryptographic
- * Techniques and E-Commerce (CrypTEC '99)
- * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
- *
- * The subject came up in a talk by Dan Kaminsky, too.
- *
- * If you see the picture is different, the key is different.
- * If the picture looks the same, you still know nothing.
- *
- * The algorithm used here is a worm crawling over a discrete plane,
- * leaving a trace (augmenting the field) everywhere it goes.
- * Movement is taken from dgst_raw 2bit-wise. Bumping into walls
- * makes the respective movement vector be ignored for this turn.
- * Graphs are not unambiguous, because circles in graphs can be
- * walked in either direction.
- */
-
-/*
- * Field sizes for the random art. Have to be odd, so the starting point
- * can be in the exact middle of the picture, and FLDBASE should be >=8 .
- * Else pictures would be too dense, and drawing the frame would
- * fail, too, because the key type would not fit in anymore.
- */
-#define FLDBASE 8
-#define FLDSIZE_Y (FLDBASE + 1)
-#define FLDSIZE_X (FLDBASE * 2 + 1)
-static char *
-key_fingerprint_randomart(u_char *dgst_raw, u_int dgst_raw_len, const Key *k)
-{
- /*
- * Chars to be used after each other every time the worm
- * intersects with itself. Matter of taste.
- */
- char *augmentation_string = " .o+=*BOX@%&#/^SE";
- char *retval, *p;
- u_char field[FLDSIZE_X][FLDSIZE_Y];
- u_int i, b;
- int x, y;
- size_t len = strlen(augmentation_string) - 1;
-
- retval = xcalloc(1, (FLDSIZE_X + 3) * (FLDSIZE_Y + 2));
-
- /* initialize field */
- memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char));
- x = FLDSIZE_X / 2;
- y = FLDSIZE_Y / 2;
-
- /* process raw key */
- for (i = 0; i < dgst_raw_len; i++) {
- int input;
- /* each byte conveys four 2-bit move commands */
- input = dgst_raw[i];
- for (b = 0; b < 4; b++) {
- /* evaluate 2 bit, rest is shifted later */
- x += (input & 0x1) ? 1 : -1;
- y += (input & 0x2) ? 1 : -1;
-
- /* assure we are still in bounds */
- x = MAX(x, 0);
- y = MAX(y, 0);
- x = MIN(x, FLDSIZE_X - 1);
- y = MIN(y, FLDSIZE_Y - 1);
-
- /* augment the field */
- if (field[x][y] < len - 2)
- field[x][y]++;
- input = input >> 2;
- }
- }
-
- /* mark starting point and end point*/
- field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1;
- field[x][y] = len;
-
- /* fill in retval */
- snprintf(retval, FLDSIZE_X, "+--[%4s %4u]", key_type(k), key_size(k));
- p = strchr(retval, '\0');
-
- /* output upper border */
- for (i = p - retval - 1; i < FLDSIZE_X; i++)
- *p++ = '-';
- *p++ = '+';
- *p++ = '\n';
-
- /* output content */
- for (y = 0; y < FLDSIZE_Y; y++) {
- *p++ = '|';
- for (x = 0; x < FLDSIZE_X; x++)
- *p++ = augmentation_string[MIN(field[x][y], len)];
- *p++ = '|';
- *p++ = '\n';
- }
-
- /* output lower border */
- *p++ = '+';
- for (i = 0; i < FLDSIZE_X; i++)
- *p++ = '-';
- *p++ = '+';
-
- return retval;
-}
-
-char *
-key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
-{
- char *retval = NULL;
- u_char *dgst_raw;
- u_int dgst_raw_len;
-
- dgst_raw = key_fingerprint_raw(k, dgst_type, &dgst_raw_len);
- if (!dgst_raw)
- fatal("key_fingerprint: null from key_fingerprint_raw()");
- switch (dgst_rep) {
- case SSH_FP_HEX:
- retval = key_fingerprint_hex(dgst_raw, dgst_raw_len);
- break;
- case SSH_FP_BUBBLEBABBLE:
- retval = key_fingerprint_bubblebabble(dgst_raw, dgst_raw_len);
- break;
- case SSH_FP_RANDOMART:
- retval = key_fingerprint_randomart(dgst_raw, dgst_raw_len, k);
- break;
- default:
- fatal("key_fingerprint: bad digest representation %d",
- dgst_rep);
- break;
- }
- explicit_bzero(dgst_raw, dgst_raw_len);
- free(dgst_raw);
- return retval;
-}
-
-/*
- * Reads a multiple-precision integer in decimal from the buffer, and advances
- * the pointer. The integer must already be initialized. This function is
- * permitted to modify the buffer. This leaves *cpp to point just beyond the
- * last processed (and maybe modified) character. Note that this may modify
- * the buffer containing the number.
- */
-static int
-read_bignum(char **cpp, BIGNUM * value)
-{
- char *cp = *cpp;
- int old;
-
- /* Skip any leading whitespace. */
- for (; *cp == ' ' || *cp == '\t'; cp++)
- ;
-
- /* Check that it begins with a decimal digit. */
- if (*cp < '0' || *cp > '9')
- return 0;
-
- /* Save starting position. */
- *cpp = cp;
-
- /* Move forward until all decimal digits skipped. */
- for (; *cp >= '0' && *cp <= '9'; cp++)
- ;
-
- /* Save the old terminating character, and replace it by \0. */
- old = *cp;
- *cp = 0;
-
- /* Parse the number. */
- if (BN_dec2bn(&value, *cpp) == 0)
- return 0;
-
- /* Restore old terminating character. */
- *cp = old;
-
- /* Move beyond the number and return success. */
- *cpp = cp;
- return 1;
-}
-
-static int
-write_bignum(FILE *f, BIGNUM *num)
-{
- char *buf = BN_bn2dec(num);
- if (buf == NULL) {
- error("write_bignum: BN_bn2dec() failed");
- return 0;
- }
- fprintf(f, " %s", buf);
- OPENSSL_free(buf);
- return 1;
-}
-
-/* returns 1 ok, -1 error */
-int
key_read(Key *ret, char **cpp)
{
- Key *k;
- int success = -1;
- char *cp, *space;
- int len, n, type;
- u_int bits;
- u_char *blob;
-#ifdef OPENSSL_HAS_ECC
- int curve_nid = -1;
-#endif
-
- cp = *cpp;
-
- switch (ret->type) {
- case KEY_RSA1:
- /* Get number of bits. */
- if (*cp < '0' || *cp > '9')
- return -1; /* Bad bit count... */
- for (bits = 0; *cp >= '0' && *cp <= '9'; cp++)
- bits = 10 * bits + *cp - '0';
- if (bits == 0)
- return -1;
- *cpp = cp;
- /* Get public exponent, public modulus. */
- if (!read_bignum(cpp, ret->rsa->e))
- return -1;
- if (!read_bignum(cpp, ret->rsa->n))
- return -1;
- /* validate the claimed number of bits */
- if ((u_int)BN_num_bits(ret->rsa->n) != bits) {
- verbose("key_read: claimed key size %d does not match "
- "actual %d", bits, BN_num_bits(ret->rsa->n));
- return -1;
- }
- success = 1;
- break;
- case KEY_UNSPEC:
- case KEY_RSA:
- case KEY_DSA:
- case KEY_ECDSA:
- case KEY_ED25519:
- case KEY_DSA_CERT_V00:
- case KEY_RSA_CERT_V00:
- case KEY_DSA_CERT:
- case KEY_ECDSA_CERT:
- case KEY_RSA_CERT:
- case KEY_ED25519_CERT:
- space = strchr(cp, ' ');
- if (space == NULL) {
- debug3("key_read: missing whitespace");
- return -1;
- }
- *space = '\0';
- type = key_type_from_name(cp);
-#ifdef OPENSSL_HAS_ECC
- if (key_type_plain(type) == KEY_ECDSA &&
- (curve_nid = key_ecdsa_nid_from_name(cp)) == -1) {
- debug("key_read: invalid curve");
- return -1;
- }
-#endif
- *space = ' ';
- if (type == KEY_UNSPEC) {
- debug3("key_read: missing keytype");
- return -1;
- }
- cp = space+1;
- if (*cp == '\0') {
- debug3("key_read: short string");
- return -1;
- }
- if (ret->type == KEY_UNSPEC) {
- ret->type = type;
- } else if (ret->type != type) {
- /* is a key, but different type */
- debug3("key_read: type mismatch");
- return -1;
- }
- len = 2*strlen(cp);
- blob = xmalloc(len);
- n = uudecode(cp, blob, len);
- if (n < 0) {
- error("key_read: uudecode %s failed", cp);
- free(blob);
- return -1;
- }
- k = key_from_blob(blob, (u_int)n);
- free(blob);
- if (k == NULL) {
- error("key_read: key_from_blob %s failed", cp);
- return -1;
- }
- if (k->type != type) {
- error("key_read: type mismatch: encoding error");
- key_free(k);
- return -1;
- }
-#ifdef OPENSSL_HAS_ECC
- if (key_type_plain(type) == KEY_ECDSA &&
- curve_nid != k->ecdsa_nid) {
- error("key_read: type mismatch: EC curve mismatch");
- key_free(k);
- return -1;
- }
-#endif
-/*XXXX*/
- if (key_is_cert(ret)) {
- if (!key_is_cert(k)) {
- error("key_read: loaded key is not a cert");
- key_free(k);
- return -1;
- }
- if (ret->cert != NULL)
- cert_free(ret->cert);
- ret->cert = k->cert;
- k->cert = NULL;
- }
- if (key_type_plain(ret->type) == KEY_RSA) {
- if (ret->rsa != NULL)
- RSA_free(ret->rsa);
- ret->rsa = k->rsa;
- k->rsa = NULL;
-#ifdef DEBUG_PK
- RSA_print_fp(stderr, ret->rsa, 8);
-#endif
- }
- if (key_type_plain(ret->type) == KEY_DSA) {
- if (ret->dsa != NULL)
- DSA_free(ret->dsa);
- ret->dsa = k->dsa;
- k->dsa = NULL;
-#ifdef DEBUG_PK
- DSA_print_fp(stderr, ret->dsa, 8);
-#endif
- }
-#ifdef OPENSSL_HAS_ECC
- if (key_type_plain(ret->type) == KEY_ECDSA) {
- if (ret->ecdsa != NULL)
- EC_KEY_free(ret->ecdsa);
- ret->ecdsa = k->ecdsa;
- ret->ecdsa_nid = k->ecdsa_nid;
- k->ecdsa = NULL;
- k->ecdsa_nid = -1;
-#ifdef DEBUG_PK
- key_dump_ec_key(ret->ecdsa);
-#endif
- }
-#endif
- if (key_type_plain(ret->type) == KEY_ED25519) {
- free(ret->ed25519_pk);
- ret->ed25519_pk = k->ed25519_pk;
- k->ed25519_pk = NULL;
-#ifdef DEBUG_PK
- /* XXX */
-#endif
- }
- success = 1;
-/*XXXX*/
- key_free(k);
- if (success != 1)
- break;
- /* advance cp: skip whitespace and data */
- while (*cp == ' ' || *cp == '\t')
- cp++;
- while (*cp != '\0' && *cp != ' ' && *cp != '\t')
- cp++;
- *cpp = cp;
- break;
- default:
- fatal("key_read: bad key type: %d", ret->type);
- break;
- }
- return success;
+ return sshkey_read(ret, cpp) == 0 ? 1 : -1;
}
int
key_write(const Key *key, FILE *f)
{
- int n, success = 0;
- u_int len, bits = 0;
- u_char *blob;
- char *uu;
-
- if (key_is_cert(key)) {
- if (key->cert == NULL) {
- error("%s: no cert data", __func__);
- return 0;
- }
- if (buffer_len(&key->cert->certblob) == 0) {
- error("%s: no signed certificate blob", __func__);
- return 0;
- }
- }
-
- switch (key->type) {
- case KEY_RSA1:
- if (key->rsa == NULL)
- return 0;
- /* size of modulus 'n' */
- bits = BN_num_bits(key->rsa->n);
- fprintf(f, "%u", bits);
- if (write_bignum(f, key->rsa->e) &&
- write_bignum(f, key->rsa->n))
- return 1;
- error("key_write: failed for RSA key");
- return 0;
- case KEY_DSA:
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- if (key->dsa == NULL)
- return 0;
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- case KEY_ECDSA_CERT:
- if (key->ecdsa == NULL)
- return 0;
- break;
-#endif
- case KEY_ED25519:
- case KEY_ED25519_CERT:
- if (key->ed25519_pk == NULL)
- return 0;
- break;
- case KEY_RSA:
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- if (key->rsa == NULL)
- return 0;
- break;
- default:
- return 0;
- }
-
- key_to_blob(key, &blob, &len);
- uu = xmalloc(2*len);
- n = uuencode(blob, len, uu, 2*len);
- if (n > 0) {
- fprintf(f, "%s %s", key_ssh_name(key), uu);
- success = 1;
- }
- free(blob);
- free(uu);
-
- return success;
+ return sshkey_write(key, f) == 0 ? 1 : 0;
}
-const char *
-key_cert_type(const Key *k)
+Key *
+key_generate(int type, u_int bits)
{
- switch (k->cert->type) {
- case SSH2_CERT_TYPE_USER:
- return "user";
- case SSH2_CERT_TYPE_HOST:
- return "host";
- default:
- return "unknown";
- }
-}
+ int r;
+ Key *ret = NULL;
-struct keytype {
- char *name;
- char *shortname;
- int type;
- int nid;
- int cert;
-};
-static const struct keytype keytypes[] = {
- { NULL, "RSA1", KEY_RSA1, 0, 0 },
- { "ssh-rsa", "RSA", KEY_RSA, 0, 0 },
- { "ssh-dss", "DSA", KEY_DSA, 0, 0 },
- { "ssh-ed25519", "ED25519", KEY_ED25519, 0, 0 },
-#ifdef OPENSSL_HAS_ECC
- { "ecdsa-sha2-nistp256", "ECDSA", KEY_ECDSA, NID_X9_62_prime256v1, 0 },
- { "ecdsa-sha2-nistp384", "ECDSA", KEY_ECDSA, NID_secp384r1, 0 },
-# ifdef OPENSSL_HAS_NISTP521
- { "ecdsa-sha2-nistp521", "ECDSA", KEY_ECDSA, NID_secp521r1, 0 },
-# endif
-#endif /* OPENSSL_HAS_ECC */
- { "ssh-rsa-cert-v01 at openssh.com", "RSA-CERT", KEY_RSA_CERT, 0, 1 },
- { "ssh-dss-cert-v01 at openssh.com", "DSA-CERT", KEY_DSA_CERT, 0, 1 },
-#ifdef OPENSSL_HAS_ECC
- { "ecdsa-sha2-nistp256-cert-v01 at openssh.com", "ECDSA-CERT",
- KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1 },
- { "ecdsa-sha2-nistp384-cert-v01 at openssh.com", "ECDSA-CERT",
- KEY_ECDSA_CERT, NID_secp384r1, 1 },
-# ifdef OPENSSL_HAS_NISTP521
- { "ecdsa-sha2-nistp521-cert-v01 at openssh.com", "ECDSA-CERT",
- KEY_ECDSA_CERT, NID_secp521r1, 1 },
-# endif
-#endif /* OPENSSL_HAS_ECC */
- { "ssh-rsa-cert-v00 at openssh.com", "RSA-CERT-V00",
- KEY_RSA_CERT_V00, 0, 1 },
- { "ssh-dss-cert-v00 at openssh.com", "DSA-CERT-V00",
- KEY_DSA_CERT_V00, 0, 1 },
- { "ssh-ed25519-cert-v01 at openssh.com", "ED25519-CERT",
- KEY_ED25519_CERT, 0, 1 },
- { NULL, NULL, -1, -1, 0 }
-};
-
-const char *
-key_type(const Key *k)
-{
- const struct keytype *kt;
-
- for (kt = keytypes; kt->type != -1; kt++) {
- if (kt->type == k->type)
- return kt->shortname;
- }
- return "unknown";
-}
-
-static const char *
-key_ssh_name_from_type_nid(int type, int nid)
-{
- const struct keytype *kt;
-
- for (kt = keytypes; kt->type != -1; kt++) {
- if (kt->type == type && (kt->nid == 0 || kt->nid == nid))
- return kt->name;
- }
- return "ssh-unknown";
-}
-
-const char *
-key_ssh_name(const Key *k)
-{
- return key_ssh_name_from_type_nid(k->type, k->ecdsa_nid);
-}
-
-const char *
-key_ssh_name_plain(const Key *k)
-{
- return key_ssh_name_from_type_nid(key_type_plain(k->type),
- k->ecdsa_nid);
-}
-
-int
-key_type_from_name(char *name)
-{
- const struct keytype *kt;
-
- for (kt = keytypes; kt->type != -1; kt++) {
- /* Only allow shortname matches for plain key types */
- if ((kt->name != NULL && strcmp(name, kt->name) == 0) ||
- (!kt->cert && strcasecmp(kt->shortname, name) == 0))
- return kt->type;
- }
- debug2("key_type_from_name: unknown key type '%s'", name);
- return KEY_UNSPEC;
-}
-
-int
-key_ecdsa_nid_from_name(const char *name)
-{
- const struct keytype *kt;
-
- for (kt = keytypes; kt->type != -1; kt++) {
- if (kt->type != KEY_ECDSA && kt->type != KEY_ECDSA_CERT)
- continue;
- if (kt->name != NULL && strcmp(name, kt->name) == 0)
- return kt->nid;
- }
- debug2("%s: unknown/non-ECDSA key type '%s'", __func__, name);
- return -1;
-}
-
-char *
-key_alg_list(int certs_only, int plain_only)
-{
- char *ret = NULL;
- size_t nlen, rlen = 0;
- const struct keytype *kt;
-
- for (kt = keytypes; kt->type != -1; kt++) {
- if (kt->name == NULL)
- continue;
- if ((certs_only && !kt->cert) || (plain_only && kt->cert))
- continue;
- if (ret != NULL)
- ret[rlen++] = '\n';
- nlen = strlen(kt->name);
- ret = xrealloc(ret, 1, rlen + nlen + 2);
- memcpy(ret + rlen, kt->name, nlen + 1);
- rlen += nlen;
- }
+ if ((r = sshkey_generate(type, bits, &ret)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
return ret;
}
-int
-key_type_is_cert(int type)
-{
- const struct keytype *kt;
-
- for (kt = keytypes; kt->type != -1; kt++) {
- if (kt->type == type)
- return kt->cert;
- }
- return 0;
-}
-
-static int
-key_type_is_valid_ca(int type)
-{
- switch (type) {
- case KEY_RSA:
- case KEY_DSA:
- case KEY_ECDSA:
- case KEY_ED25519:
- return 1;
- default:
- return 0;
- }
-}
-
-u_int
-key_size(const Key *k)
-{
- switch (k->type) {
- case KEY_RSA1:
- case KEY_RSA:
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- return BN_num_bits(k->rsa->n);
- case KEY_DSA:
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- return BN_num_bits(k->dsa->p);
- case KEY_ED25519:
- return 256; /* XXX */
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- case KEY_ECDSA_CERT:
- return key_curve_nid_to_bits(k->ecdsa_nid);
-#endif
- }
- return 0;
-}
-
-static RSA *
-rsa_generate_private_key(u_int bits)
-{
- RSA *private = RSA_new();
- BIGNUM *f4 = BN_new();
-
- if (private == NULL)
- fatal("%s: RSA_new failed", __func__);
- if (f4 == NULL)
- fatal("%s: BN_new failed", __func__);
- if (!BN_set_word(f4, RSA_F4))
- fatal("%s: BN_new failed", __func__);
- if (!RSA_generate_key_ex(private, bits, f4, NULL))
- fatal("%s: key generation failed.", __func__);
- BN_free(f4);
- return private;
-}
-
-static DSA*
-dsa_generate_private_key(u_int bits)
-{
- DSA *private = DSA_new();
-
- if (private == NULL)
- fatal("%s: DSA_new failed", __func__);
- if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL,
- NULL, NULL))
- fatal("%s: DSA_generate_parameters failed", __func__);
- if (!DSA_generate_key(private))
- fatal("%s: DSA_generate_key failed.", __func__);
- return private;
-}
-
-int
-key_ecdsa_bits_to_nid(int bits)
-{
- switch (bits) {
-#ifdef OPENSSL_HAS_ECC
- case 256:
- return NID_X9_62_prime256v1;
- case 384:
- return NID_secp384r1;
-# ifdef OPENSSL_HAS_NISTP521
- case 521:
- return NID_secp521r1;
-# endif
-#endif
- default:
- return -1;
- }
-}
-
-#ifdef OPENSSL_HAS_ECC
-int
-key_ecdsa_key_to_nid(EC_KEY *k)
-{
- EC_GROUP *eg;
- int nids[] = {
- NID_X9_62_prime256v1,
- NID_secp384r1,
-# ifdef OPENSSL_HAS_NISTP521
- NID_secp521r1,
-# endif
- -1
- };
- int nid;
- u_int i;
- BN_CTX *bnctx;
- const EC_GROUP *g = EC_KEY_get0_group(k);
-
- /*
- * The group may be stored in a ASN.1 encoded private key in one of two
- * ways: as a "named group", which is reconstituted by ASN.1 object ID
- * or explicit group parameters encoded into the key blob. Only the
- * "named group" case sets the group NID for us, but we can figure
- * it out for the other case by comparing against all the groups that
- * are supported.
- */
- if ((nid = EC_GROUP_get_curve_name(g)) > 0)
- return nid;
- if ((bnctx = BN_CTX_new()) == NULL)
- fatal("%s: BN_CTX_new() failed", __func__);
- for (i = 0; nids[i] != -1; i++) {
- if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL)
- fatal("%s: EC_GROUP_new_by_curve_name failed",
- __func__);
- if (EC_GROUP_cmp(g, eg, bnctx) == 0)
- break;
- EC_GROUP_free(eg);
- }
- BN_CTX_free(bnctx);
- debug3("%s: nid = %d", __func__, nids[i]);
- if (nids[i] != -1) {
- /* Use the group with the NID attached */
- EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE);
- if (EC_KEY_set_group(k, eg) != 1)
- fatal("%s: EC_KEY_set_group", __func__);
- }
- return nids[i];
-}
-
-static EC_KEY*
-ecdsa_generate_private_key(u_int bits, int *nid)
-{
- EC_KEY *private;
-
- if ((*nid = key_ecdsa_bits_to_nid(bits)) == -1)
- fatal("%s: invalid key length", __func__);
- if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL)
- fatal("%s: EC_KEY_new_by_curve_name failed", __func__);
- if (EC_KEY_generate_key(private) != 1)
- fatal("%s: EC_KEY_generate_key failed", __func__);
- EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE);
- return private;
-}
-#endif /* OPENSSL_HAS_ECC */
-
-Key *
-key_generate(int type, u_int bits)
-{
- Key *k = key_new(KEY_UNSPEC);
- switch (type) {
- case KEY_DSA:
- k->dsa = dsa_generate_private_key(bits);
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- k->ecdsa = ecdsa_generate_private_key(bits, &k->ecdsa_nid);
- break;
-#endif
- case KEY_RSA:
- case KEY_RSA1:
- k->rsa = rsa_generate_private_key(bits);
- break;
- case KEY_ED25519:
- k->ed25519_pk = xmalloc(ED25519_PK_SZ);
- k->ed25519_sk = xmalloc(ED25519_SK_SZ);
- crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk);
- break;
- case KEY_RSA_CERT_V00:
- case KEY_DSA_CERT_V00:
- case KEY_RSA_CERT:
- case KEY_DSA_CERT:
- fatal("key_generate: cert keys cannot be generated directly");
- default:
- fatal("key_generate: unknown type %d", type);
- }
- k->type = type;
- return k;
-}
-
void
-key_cert_copy(const Key *from_key, struct Key *to_key)
+key_cert_copy(const Key *from_key, Key *to_key)
{
- u_int i;
- const struct KeyCert *from;
- struct KeyCert *to;
+ int r;
- if (to_key->cert != NULL) {
- cert_free(to_key->cert);
- to_key->cert = NULL;
- }
-
- if ((from = from_key->cert) == NULL)
- return;
-
- to = to_key->cert = cert_new();
-
- buffer_append(&to->certblob, buffer_ptr(&from->certblob),
- buffer_len(&from->certblob));
-
- buffer_append(&to->critical,
- buffer_ptr(&from->critical), buffer_len(&from->critical));
- buffer_append(&to->extensions,
- buffer_ptr(&from->extensions), buffer_len(&from->extensions));
-
- to->serial = from->serial;
- to->type = from->type;
- to->key_id = from->key_id == NULL ? NULL : xstrdup(from->key_id);
- to->valid_after = from->valid_after;
- to->valid_before = from->valid_before;
- to->signature_key = from->signature_key == NULL ?
- NULL : key_from_private(from->signature_key);
-
- to->nprincipals = from->nprincipals;
- if (to->nprincipals > CERT_MAX_PRINCIPALS)
- fatal("%s: nprincipals (%u) > CERT_MAX_PRINCIPALS (%u)",
- __func__, to->nprincipals, CERT_MAX_PRINCIPALS);
- if (to->nprincipals > 0) {
- to->principals = xcalloc(from->nprincipals,
- sizeof(*to->principals));
- for (i = 0; i < to->nprincipals; i++)
- to->principals[i] = xstrdup(from->principals[i]);
- }
+ if ((r = sshkey_cert_copy(from_key, to_key)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
}
Key *
key_from_private(const Key *k)
{
- Key *n = NULL;
- switch (k->type) {
- case KEY_DSA:
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- n = key_new(k->type);
- if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) ||
- (BN_copy(n->dsa->q, k->dsa->q) == NULL) ||
- (BN_copy(n->dsa->g, k->dsa->g) == NULL) ||
- (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL))
- fatal("key_from_private: BN_copy failed");
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- case KEY_ECDSA_CERT:
- n = key_new(k->type);
- n->ecdsa_nid = k->ecdsa_nid;
- if ((n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid)) == NULL)
- fatal("%s: EC_KEY_new_by_curve_name failed", __func__);
- if (EC_KEY_set_public_key(n->ecdsa,
- EC_KEY_get0_public_key(k->ecdsa)) != 1)
- fatal("%s: EC_KEY_set_public_key failed", __func__);
- break;
-#endif
- case KEY_RSA:
- case KEY_RSA1:
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- n = key_new(k->type);
- if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) ||
- (BN_copy(n->rsa->e, k->rsa->e) == NULL))
- fatal("key_from_private: BN_copy failed");
- break;
- case KEY_ED25519:
- case KEY_ED25519_CERT:
- n = key_new(k->type);
- if (k->ed25519_pk != NULL) {
- n->ed25519_pk = xmalloc(ED25519_PK_SZ);
- memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ);
- }
- break;
- default:
- fatal("key_from_private: unknown type %d", k->type);
- break;
- }
- if (key_is_cert(k))
- key_cert_copy(k, n);
- return n;
-}
+ int r;
+ Key *ret = NULL;
-int
-key_names_valid2(const char *names)
-{
- char *s, *cp, *p;
-
- if (names == NULL || strcmp(names, "") == 0)
- return 0;
- s = cp = xstrdup(names);
- for ((p = strsep(&cp, ",")); p && *p != '\0';
- (p = strsep(&cp, ","))) {
- switch (key_type_from_name(p)) {
- case KEY_RSA1:
- case KEY_UNSPEC:
- free(s);
- return 0;
- }
- }
- debug3("key names ok: [%s]", names);
- free(s);
- return 1;
-}
-
-static int
-cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen)
-{
- u_char *principals, *critical, *exts, *sig_key, *sig;
- u_int signed_len, plen, clen, sklen, slen, kidlen, elen;
- Buffer tmp;
- char *principal;
- int ret = -1;
- int v00 = key->type == KEY_DSA_CERT_V00 ||
- key->type == KEY_RSA_CERT_V00;
-
- buffer_init(&tmp);
-
- /* Copy the entire key blob for verification and later serialisation */
- buffer_append(&key->cert->certblob, blob, blen);
-
- elen = 0; /* Not touched for v00 certs */
- principals = exts = critical = sig_key = sig = NULL;
- if ((!v00 && buffer_get_int64_ret(&key->cert->serial, b) != 0) ||
- buffer_get_int_ret(&key->cert->type, b) != 0 ||
- (key->cert->key_id = buffer_get_cstring_ret(b, &kidlen)) == NULL ||
- (principals = buffer_get_string_ret(b, &plen)) == NULL ||
- buffer_get_int64_ret(&key->cert->valid_after, b) != 0 ||
- buffer_get_int64_ret(&key->cert->valid_before, b) != 0 ||
- (critical = buffer_get_string_ret(b, &clen)) == NULL ||
- (!v00 && (exts = buffer_get_string_ret(b, &elen)) == NULL) ||
- (v00 && buffer_get_string_ptr_ret(b, NULL) == NULL) || /* nonce */
- buffer_get_string_ptr_ret(b, NULL) == NULL || /* reserved */
- (sig_key = buffer_get_string_ret(b, &sklen)) == NULL) {
- error("%s: parse error", __func__);
- goto out;
- }
-
- /* Signature is left in the buffer so we can calculate this length */
- signed_len = buffer_len(&key->cert->certblob) - buffer_len(b);
-
- if ((sig = buffer_get_string_ret(b, &slen)) == NULL) {
- error("%s: parse error", __func__);
- goto out;
- }
-
- if (key->cert->type != SSH2_CERT_TYPE_USER &&
- key->cert->type != SSH2_CERT_TYPE_HOST) {
- error("Unknown certificate type %u", key->cert->type);
- goto out;
- }
-
- buffer_append(&tmp, principals, plen);
- while (buffer_len(&tmp) > 0) {
- if (key->cert->nprincipals >= CERT_MAX_PRINCIPALS) {
- error("%s: Too many principals", __func__);
- goto out;
- }
- if ((principal = buffer_get_cstring_ret(&tmp, &plen)) == NULL) {
- error("%s: Principals data invalid", __func__);
- goto out;
- }
- key->cert->principals = xrealloc(key->cert->principals,
- key->cert->nprincipals + 1, sizeof(*key->cert->principals));
- key->cert->principals[key->cert->nprincipals++] = principal;
- }
-
- buffer_clear(&tmp);
-
- buffer_append(&key->cert->critical, critical, clen);
- buffer_append(&tmp, critical, clen);
- /* validate structure */
- while (buffer_len(&tmp) != 0) {
- if (buffer_get_string_ptr_ret(&tmp, NULL) == NULL ||
- buffer_get_string_ptr_ret(&tmp, NULL) == NULL) {
- error("%s: critical option data invalid", __func__);
- goto out;
- }
- }
- buffer_clear(&tmp);
-
- buffer_append(&key->cert->extensions, exts, elen);
- buffer_append(&tmp, exts, elen);
- /* validate structure */
- while (buffer_len(&tmp) != 0) {
- if (buffer_get_string_ptr_ret(&tmp, NULL) == NULL ||
- buffer_get_string_ptr_ret(&tmp, NULL) == NULL) {
- error("%s: extension data invalid", __func__);
- goto out;
- }
- }
- buffer_clear(&tmp);
-
- if ((key->cert->signature_key = key_from_blob2(sig_key, sklen, 0))
- == NULL) {
- error("%s: Signature key invalid", __func__);
- goto out;
- }
- if (!key_type_is_valid_ca(key->cert->signature_key->type)) {
- error("%s: Invalid signature key type %s (%d)", __func__,
- key_type(key->cert->signature_key),
- key->cert->signature_key->type);
- goto out;
- }
-
- switch (key_verify(key->cert->signature_key, sig, slen,
- buffer_ptr(&key->cert->certblob), signed_len)) {
- case 1:
- ret = 0;
- break; /* Good signature */
- case 0:
- error("%s: Invalid signature on certificate", __func__);
- goto out;
- case -1:
- error("%s: Certificate signature verification failed",
- __func__);
- goto out;
- }
-
- out:
- buffer_free(&tmp);
- free(principals);
- free(critical);
- free(exts);
- free(sig_key);
- free(sig);
+ if ((r = sshkey_from_private(k, &ret)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
return ret;
}
-static Key *
-key_from_blob2(const u_char *blob, u_int blen, int allow_cert)
+static void
+fatal_on_fatal_errors(int r, const char *func, int extra_fatal)
{
- Buffer b;
- int rlen, type;
- u_int len;
- char *ktype = NULL, *curve = NULL;
- u_char *pk = NULL;
- Key *key = NULL;
-#ifdef OPENSSL_HAS_ECC
- EC_POINT *q = NULL;
- int nid = -1;
-#endif
-
-#ifdef DEBUG_PK
- dump_base64(stderr, blob, blen);
-#endif
- buffer_init(&b);
- buffer_append(&b, blob, blen);
- if ((ktype = buffer_get_cstring_ret(&b, NULL)) == NULL) {
- error("key_from_blob: can't read key type");
- goto out;
- }
-
- type = key_type_from_name(ktype);
-#ifdef OPENSSL_HAS_ECC
- if (key_type_plain(type) == KEY_ECDSA)
- nid = key_ecdsa_nid_from_name(ktype);
-#endif
- if (!allow_cert && key_type_is_cert(type)) {
- error("key_from_blob: certificate not allowed in this context");
- goto out;
- }
- switch (type) {
- case KEY_RSA_CERT:
- (void)buffer_get_string_ptr_ret(&b, NULL); /* Skip nonce */
- /* FALLTHROUGH */
- case KEY_RSA:
- case KEY_RSA_CERT_V00:
- key = key_new(type);
- if (buffer_get_bignum2_ret(&b, key->rsa->e) == -1 ||
- buffer_get_bignum2_ret(&b, key->rsa->n) == -1) {
- error("key_from_blob: can't read rsa key");
- badkey:
- key_free(key);
- key = NULL;
- goto out;
- }
-#ifdef DEBUG_PK
- RSA_print_fp(stderr, key->rsa, 8);
-#endif
- break;
- case KEY_DSA_CERT:
- (void)buffer_get_string_ptr_ret(&b, NULL); /* Skip nonce */
- /* FALLTHROUGH */
- case KEY_DSA:
- case KEY_DSA_CERT_V00:
- key = key_new(type);
- if (buffer_get_bignum2_ret(&b, key->dsa->p) == -1 ||
- buffer_get_bignum2_ret(&b, key->dsa->q) == -1 ||
- buffer_get_bignum2_ret(&b, key->dsa->g) == -1 ||
- buffer_get_bignum2_ret(&b, key->dsa->pub_key) == -1) {
- error("key_from_blob: can't read dsa key");
- goto badkey;
- }
-#ifdef DEBUG_PK
- DSA_print_fp(stderr, key->dsa, 8);
-#endif
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA_CERT:
- (void)buffer_get_string_ptr_ret(&b, NULL); /* Skip nonce */
- /* FALLTHROUGH */
- case KEY_ECDSA:
- key = key_new(type);
- key->ecdsa_nid = nid;
- if ((curve = buffer_get_string_ret(&b, NULL)) == NULL) {
- error("key_from_blob: can't read ecdsa curve");
- goto badkey;
- }
- if (key->ecdsa_nid != key_curve_name_to_nid(curve)) {
- error("key_from_blob: ecdsa curve doesn't match type");
- goto badkey;
- }
- if (key->ecdsa != NULL)
- EC_KEY_free(key->ecdsa);
- if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid))
- == NULL)
- fatal("key_from_blob: EC_KEY_new_by_curve_name failed");
- if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL)
- fatal("key_from_blob: EC_POINT_new failed");
- if (buffer_get_ecpoint_ret(&b, EC_KEY_get0_group(key->ecdsa),
- q) == -1) {
- error("key_from_blob: can't read ecdsa key point");
- goto badkey;
- }
- if (key_ec_validate_public(EC_KEY_get0_group(key->ecdsa),
- q) != 0)
- goto badkey;
- if (EC_KEY_set_public_key(key->ecdsa, q) != 1)
- fatal("key_from_blob: EC_KEY_set_public_key failed");
-#ifdef DEBUG_PK
- key_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q);
-#endif
- break;
-#endif /* OPENSSL_HAS_ECC */
- case KEY_ED25519_CERT:
- (void)buffer_get_string_ptr_ret(&b, NULL); /* Skip nonce */
- /* FALLTHROUGH */
- case KEY_ED25519:
- if ((pk = buffer_get_string_ret(&b, &len)) == NULL) {
- error("key_from_blob: can't read ed25519 key");
- goto badkey;
- }
- if (len != ED25519_PK_SZ) {
- error("key_from_blob: ed25519 len %d != %d",
- len, ED25519_PK_SZ);
- goto badkey;
- }
- key = key_new(type);
- key->ed25519_pk = pk;
- pk = NULL;
- break;
- case KEY_UNSPEC:
- key = key_new(type);
- break;
- default:
- error("key_from_blob: cannot handle type %s", ktype);
- goto out;
- }
- if (key_is_cert(key) && cert_parse(&b, key, blob, blen) == -1) {
- error("key_from_blob: can't parse cert data");
- goto badkey;
- }
- rlen = buffer_len(&b);
- if (key != NULL && rlen != 0)
- error("key_from_blob: remaining bytes in key blob %d", rlen);
- out:
- free(ktype);
- free(curve);
- free(pk);
-#ifdef OPENSSL_HAS_ECC
- if (q != NULL)
- EC_POINT_free(q);
-#endif
- buffer_free(&b);
- return key;
+ if (r == SSH_ERR_INTERNAL_ERROR ||
+ r == SSH_ERR_ALLOC_FAIL ||
+ (extra_fatal != 0 && r == extra_fatal))
+ fatal("%s: %s", func, ssh_err(r));
}
Key *
key_from_blob(const u_char *blob, u_int blen)
{
- return key_from_blob2(blob, blen, 1);
+ int r;
+ Key *ret = NULL;
+
+ if ((r = sshkey_from_blob(blob, blen, &ret)) != 0) {
+ fatal_on_fatal_errors(r, __func__, 0);
+ error("%s: %s", __func__, ssh_err(r));
+ return NULL;
+ }
+ return ret;
}
-static int
-to_blob(const Key *key, u_char **blobp, u_int *lenp, int force_plain)
+int
+key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
{
- Buffer b;
- int len, type;
+ u_char *blob;
+ size_t blen;
+ int r;
if (blobp != NULL)
*blobp = NULL;
if (lenp != NULL)
*lenp = 0;
- if (key == NULL) {
- error("key_to_blob: key == NULL");
+ if ((r = sshkey_to_blob(key, &blob, &blen)) != 0) {
+ fatal_on_fatal_errors(r, __func__, 0);
+ error("%s: %s", __func__, ssh_err(r));
return 0;
}
- buffer_init(&b);
- type = force_plain ? key_type_plain(key->type) : key->type;
- switch (type) {
- case KEY_DSA_CERT_V00:
- case KEY_RSA_CERT_V00:
- case KEY_DSA_CERT:
- case KEY_ECDSA_CERT:
- case KEY_RSA_CERT:
- case KEY_ED25519_CERT:
- /* Use the existing blob */
- buffer_append(&b, buffer_ptr(&key->cert->certblob),
- buffer_len(&key->cert->certblob));
- break;
- case KEY_DSA:
- buffer_put_cstring(&b,
- key_ssh_name_from_type_nid(type, key->ecdsa_nid));
- buffer_put_bignum2(&b, key->dsa->p);
- buffer_put_bignum2(&b, key->dsa->q);
- buffer_put_bignum2(&b, key->dsa->g);
- buffer_put_bignum2(&b, key->dsa->pub_key);
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- buffer_put_cstring(&b,
- key_ssh_name_from_type_nid(type, key->ecdsa_nid));
- buffer_put_cstring(&b, key_curve_nid_to_name(key->ecdsa_nid));
- buffer_put_ecpoint(&b, EC_KEY_get0_group(key->ecdsa),
- EC_KEY_get0_public_key(key->ecdsa));
- break;
-#endif
- case KEY_RSA:
- buffer_put_cstring(&b,
- key_ssh_name_from_type_nid(type, key->ecdsa_nid));
- buffer_put_bignum2(&b, key->rsa->e);
- buffer_put_bignum2(&b, key->rsa->n);
- break;
- case KEY_ED25519:
- buffer_put_cstring(&b,
- key_ssh_name_from_type_nid(type, key->ecdsa_nid));
- buffer_put_string(&b, key->ed25519_pk, ED25519_PK_SZ);
- break;
- default:
- error("key_to_blob: unsupported key type %d", key->type);
- buffer_free(&b);
- return 0;
- }
- len = buffer_len(&b);
+ if (blen > INT_MAX)
+ fatal("%s: giant len %zu", __func__, blen);
+ if (blobp != NULL)
+ *blobp = blob;
if (lenp != NULL)
- *lenp = len;
- if (blobp != NULL) {
- *blobp = xmalloc(len);
- memcpy(*blobp, buffer_ptr(&b), len);
- }
- explicit_bzero(buffer_ptr(&b), len);
- buffer_free(&b);
- return len;
+ *lenp = blen;
+ return blen;
}
int
-key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
+key_sign(const Key *key, u_char **sigp, u_int *lenp,
+ const u_char *data, u_int datalen, const char *alg)
{
- return to_blob(key, blobp, lenp, 0);
-}
+ int r;
+ u_char *sig;
+ size_t siglen;
-int
-key_sign(
- const Key *key,
- u_char **sigp, u_int *lenp,
- const u_char *data, u_int datalen)
-{
- switch (key->type) {
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- case KEY_DSA:
- return ssh_dss_sign(key, sigp, lenp, data, datalen);
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA_CERT:
- case KEY_ECDSA:
- return ssh_ecdsa_sign(key, sigp, lenp, data, datalen);
-#endif
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- case KEY_RSA:
- return ssh_rsa_sign(key, sigp, lenp, data, datalen);
- case KEY_ED25519:
- case KEY_ED25519_CERT:
- return ssh_ed25519_sign(key, sigp, lenp, data, datalen);
- default:
- error("key_sign: invalid key type %d", key->type);
+ if (sigp != NULL)
+ *sigp = NULL;
+ if (lenp != NULL)
+ *lenp = 0;
+ if ((r = sshkey_sign(key, &sig, &siglen,
+ data, datalen, alg, datafellows)) != 0) {
+ fatal_on_fatal_errors(r, __func__, 0);
+ error("%s: %s", __func__, ssh_err(r));
return -1;
}
+ if (siglen > INT_MAX)
+ fatal("%s: giant len %zu", __func__, siglen);
+ if (sigp != NULL)
+ *sigp = sig;
+ if (lenp != NULL)
+ *lenp = siglen;
+ return 0;
}
-/*
- * key_verify returns 1 for a correct signature, 0 for an incorrect signature
- * and -1 on error.
- */
int
-key_verify(
- const Key *key,
- const u_char *signature, u_int signaturelen,
+key_verify(const Key *key, const u_char *signature, u_int signaturelen,
const u_char *data, u_int datalen)
{
- if (signaturelen == 0)
- return -1;
+ int r;
- switch (key->type) {
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- case KEY_DSA:
- return ssh_dss_verify(key, signature, signaturelen, data, datalen);
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA_CERT:
- case KEY_ECDSA:
- return ssh_ecdsa_verify(key, signature, signaturelen, data, datalen);
-#endif
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- case KEY_RSA:
- return ssh_rsa_verify(key, signature, signaturelen, data, datalen);
- case KEY_ED25519:
- case KEY_ED25519_CERT:
- return ssh_ed25519_verify(key, signature, signaturelen, data, datalen);
- default:
- error("key_verify: invalid key type %d", key->type);
- return -1;
+ if ((r = sshkey_verify(key, signature, signaturelen,
+ data, datalen, datafellows)) != 0) {
+ fatal_on_fatal_errors(r, __func__, 0);
+ error("%s: %s", __func__, ssh_err(r));
+ return r == SSH_ERR_SIGNATURE_INVALID ? 0 : -1;
}
+ return 1;
}
-/* Converts a private to a public key */
Key *
key_demote(const Key *k)
{
- Key *pk;
+ int r;
+ Key *ret = NULL;
- pk = xcalloc(1, sizeof(*pk));
- pk->type = k->type;
- pk->flags = k->flags;
- pk->ecdsa_nid = k->ecdsa_nid;
- pk->dsa = NULL;
- pk->ecdsa = NULL;
- pk->rsa = NULL;
- pk->ed25519_pk = NULL;
- pk->ed25519_sk = NULL;
-
- switch (k->type) {
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- key_cert_copy(k, pk);
- /* FALLTHROUGH */
- case KEY_RSA1:
- case KEY_RSA:
- if ((pk->rsa = RSA_new()) == NULL)
- fatal("key_demote: RSA_new failed");
- if ((pk->rsa->e = BN_dup(k->rsa->e)) == NULL)
- fatal("key_demote: BN_dup failed");
- if ((pk->rsa->n = BN_dup(k->rsa->n)) == NULL)
- fatal("key_demote: BN_dup failed");
- break;
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- key_cert_copy(k, pk);
- /* FALLTHROUGH */
- case KEY_DSA:
- if ((pk->dsa = DSA_new()) == NULL)
- fatal("key_demote: DSA_new failed");
- if ((pk->dsa->p = BN_dup(k->dsa->p)) == NULL)
- fatal("key_demote: BN_dup failed");
- if ((pk->dsa->q = BN_dup(k->dsa->q)) == NULL)
- fatal("key_demote: BN_dup failed");
- if ((pk->dsa->g = BN_dup(k->dsa->g)) == NULL)
- fatal("key_demote: BN_dup failed");
- if ((pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL)
- fatal("key_demote: BN_dup failed");
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA_CERT:
- key_cert_copy(k, pk);
- /* FALLTHROUGH */
- case KEY_ECDSA:
- if ((pk->ecdsa = EC_KEY_new_by_curve_name(pk->ecdsa_nid)) == NULL)
- fatal("key_demote: EC_KEY_new_by_curve_name failed");
- if (EC_KEY_set_public_key(pk->ecdsa,
- EC_KEY_get0_public_key(k->ecdsa)) != 1)
- fatal("key_demote: EC_KEY_set_public_key failed");
- break;
-#endif
- case KEY_ED25519_CERT:
- key_cert_copy(k, pk);
- /* FALLTHROUGH */
- case KEY_ED25519:
- if (k->ed25519_pk != NULL) {
- pk->ed25519_pk = xmalloc(ED25519_PK_SZ);
- memcpy(pk->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ);
- }
- break;
- default:
- fatal("key_demote: bad key type %d", k->type);
- break;
- }
-
- return (pk);
+ if ((r = sshkey_demote(k, &ret)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+ return ret;
}
int
-key_is_cert(const Key *k)
+key_to_certified(Key *k)
{
- if (k == NULL)
- return 0;
- return key_type_is_cert(k->type);
-}
+ int r;
-/* Return the cert-less equivalent to a certified key type */
-int
-key_type_plain(int type)
-{
- switch (type) {
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- return KEY_RSA;
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- return KEY_DSA;
- case KEY_ECDSA_CERT:
- return KEY_ECDSA;
- case KEY_ED25519_CERT:
- return KEY_ED25519;
- default:
- return type;
- }
-}
-
-/* Convert a plain key to their _CERT equivalent */
-int
-key_to_certified(Key *k, int legacy)
-{
- switch (k->type) {
- case KEY_RSA:
- k->cert = cert_new();
- k->type = legacy ? KEY_RSA_CERT_V00 : KEY_RSA_CERT;
- return 0;
- case KEY_DSA:
- k->cert = cert_new();
- k->type = legacy ? KEY_DSA_CERT_V00 : KEY_DSA_CERT;
- return 0;
- case KEY_ECDSA:
- if (legacy)
- fatal("%s: legacy ECDSA certificates are not supported",
- __func__);
- k->cert = cert_new();
- k->type = KEY_ECDSA_CERT;
- return 0;
- case KEY_ED25519:
- if (legacy)
- fatal("%s: legacy ED25519 certificates are not "
- "supported", __func__);
- k->cert = cert_new();
- k->type = KEY_ED25519_CERT;
- return 0;
- default:
- error("%s: key has incorrect type %s", __func__, key_type(k));
+ if ((r = sshkey_to_certified(k)) != 0) {
+ fatal_on_fatal_errors(r, __func__, 0);
+ error("%s: %s", __func__, ssh_err(r));
return -1;
}
+ return 0;
}
-/* Convert a certificate to its raw key equivalent */
int
key_drop_cert(Key *k)
{
- if (!key_type_is_cert(k->type)) {
- error("%s: key has incorrect type %s", __func__, key_type(k));
+ int r;
+
+ if ((r = sshkey_drop_cert(k)) != 0) {
+ fatal_on_fatal_errors(r, __func__, 0);
+ error("%s: %s", __func__, ssh_err(r));
return -1;
}
- cert_free(k->cert);
- k->cert = NULL;
- k->type = key_type_plain(k->type);
return 0;
}
-/* Sign a certified key, (re-)generating the signed certblob. */
int
key_certify(Key *k, Key *ca)
{
- Buffer principals;
- u_char *ca_blob, *sig_blob, nonce[32];
- u_int i, ca_len, sig_len;
+ int r;
- if (k->cert == NULL) {
- error("%s: key lacks cert info", __func__);
+ if ((r = sshkey_certify(k, ca, NULL)) != 0) {
+ fatal_on_fatal_errors(r, __func__, 0);
+ error("%s: %s", __func__, ssh_err(r));
return -1;
}
-
- if (!key_is_cert(k)) {
- error("%s: certificate has unknown type %d", __func__,
- k->cert->type);
- return -1;
- }
-
- if (!key_type_is_valid_ca(ca->type)) {
- error("%s: CA key has unsupported type %s", __func__,
- key_type(ca));
- return -1;
- }
-
- key_to_blob(ca, &ca_blob, &ca_len);
-
- buffer_clear(&k->cert->certblob);
- buffer_put_cstring(&k->cert->certblob, key_ssh_name(k));
-
- /* -v01 certs put nonce first */
- arc4random_buf(&nonce, sizeof(nonce));
- if (!key_cert_is_legacy(k))
- buffer_put_string(&k->cert->certblob, nonce, sizeof(nonce));
-
- /* XXX this substantially duplicates to_blob(); refactor */
- switch (k->type) {
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- buffer_put_bignum2(&k->cert->certblob, k->dsa->p);
- buffer_put_bignum2(&k->cert->certblob, k->dsa->q);
- buffer_put_bignum2(&k->cert->certblob, k->dsa->g);
- buffer_put_bignum2(&k->cert->certblob, k->dsa->pub_key);
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA_CERT:
- buffer_put_cstring(&k->cert->certblob,
- key_curve_nid_to_name(k->ecdsa_nid));
- buffer_put_ecpoint(&k->cert->certblob,
- EC_KEY_get0_group(k->ecdsa),
- EC_KEY_get0_public_key(k->ecdsa));
- break;
-#endif
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- buffer_put_bignum2(&k->cert->certblob, k->rsa->e);
- buffer_put_bignum2(&k->cert->certblob, k->rsa->n);
- break;
- case KEY_ED25519_CERT:
- buffer_put_string(&k->cert->certblob,
- k->ed25519_pk, ED25519_PK_SZ);
- break;
- default:
- error("%s: key has incorrect type %s", __func__, key_type(k));
- buffer_clear(&k->cert->certblob);
- free(ca_blob);
- return -1;
- }
-
- /* -v01 certs have a serial number next */
- if (!key_cert_is_legacy(k))
- buffer_put_int64(&k->cert->certblob, k->cert->serial);
-
- buffer_put_int(&k->cert->certblob, k->cert->type);
- buffer_put_cstring(&k->cert->certblob, k->cert->key_id);
-
- buffer_init(&principals);
- for (i = 0; i < k->cert->nprincipals; i++)
- buffer_put_cstring(&principals, k->cert->principals[i]);
- buffer_put_string(&k->cert->certblob, buffer_ptr(&principals),
- buffer_len(&principals));
- buffer_free(&principals);
-
- buffer_put_int64(&k->cert->certblob, k->cert->valid_after);
- buffer_put_int64(&k->cert->certblob, k->cert->valid_before);
- buffer_put_string(&k->cert->certblob,
- buffer_ptr(&k->cert->critical), buffer_len(&k->cert->critical));
-
- /* -v01 certs have non-critical options here */
- if (!key_cert_is_legacy(k)) {
- buffer_put_string(&k->cert->certblob,
- buffer_ptr(&k->cert->extensions),
- buffer_len(&k->cert->extensions));
- }
-
- /* -v00 certs put the nonce at the end */
- if (key_cert_is_legacy(k))
- buffer_put_string(&k->cert->certblob, nonce, sizeof(nonce));
-
- buffer_put_string(&k->cert->certblob, NULL, 0); /* reserved */
- buffer_put_string(&k->cert->certblob, ca_blob, ca_len);
- free(ca_blob);
-
- /* Sign the whole mess */
- if (key_sign(ca, &sig_blob, &sig_len, buffer_ptr(&k->cert->certblob),
- buffer_len(&k->cert->certblob)) != 0) {
- error("%s: signature operation failed", __func__);
- buffer_clear(&k->cert->certblob);
- return -1;
- }
- /* Append signature and we are done */
- buffer_put_string(&k->cert->certblob, sig_blob, sig_len);
- free(sig_blob);
-
return 0;
}
@@ -2091,535 +226,201 @@
key_cert_check_authority(const Key *k, int want_host, int require_principal,
const char *name, const char **reason)
{
- u_int i, principal_matches;
- time_t now = time(NULL);
+ int r;
- if (want_host) {
- if (k->cert->type != SSH2_CERT_TYPE_HOST) {
- *reason = "Certificate invalid: not a host certificate";
- return -1;
- }
- } else {
- if (k->cert->type != SSH2_CERT_TYPE_USER) {
- *reason = "Certificate invalid: not a user certificate";
- return -1;
- }
- }
- if (now < 0) {
- error("%s: system clock lies before epoch", __func__);
- *reason = "Certificate invalid: not yet valid";
+ if ((r = sshkey_cert_check_authority(k, want_host, require_principal,
+ name, reason)) != 0) {
+ fatal_on_fatal_errors(r, __func__, 0);
+ error("%s: %s", __func__, ssh_err(r));
return -1;
}
- if ((u_int64_t)now < k->cert->valid_after) {
- *reason = "Certificate invalid: not yet valid";
- return -1;
- }
- if ((u_int64_t)now >= k->cert->valid_before) {
- *reason = "Certificate invalid: expired";
- return -1;
- }
- if (k->cert->nprincipals == 0) {
- if (require_principal) {
- *reason = "Certificate lacks principal list";
- return -1;
- }
- } else if (name != NULL) {
- principal_matches = 0;
- for (i = 0; i < k->cert->nprincipals; i++) {
- if (strcmp(name, k->cert->principals[i]) == 0) {
- principal_matches = 1;
- break;
- }
- }
- if (!principal_matches) {
- *reason = "Certificate invalid: name is not a listed "
- "principal";
- return -1;
- }
- }
return 0;
}
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
int
-key_cert_is_legacy(const Key *k)
+key_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
{
- switch (k->type) {
- case KEY_DSA_CERT_V00:
- case KEY_RSA_CERT_V00:
- return 1;
- default:
- return 0;
+ int r;
+
+ if ((r = sshkey_ec_validate_public(group, public)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ error("%s: %s", __func__, ssh_err(r));
+ return -1;
}
+ return 0;
}
-/* XXX: these are really begging for a table-driven approach */
int
-key_curve_name_to_nid(const char *name)
+key_ec_validate_private(const EC_KEY *key)
{
-#ifdef OPENSSL_HAS_ECC
- if (strcmp(name, "nistp256") == 0)
- return NID_X9_62_prime256v1;
- else if (strcmp(name, "nistp384") == 0)
- return NID_secp384r1;
-# ifdef OPENSSL_HAS_NISTP521
- else if (strcmp(name, "nistp521") == 0)
- return NID_secp521r1;
-# endif
-#endif
+ int r;
- debug("%s: unsupported EC curve name \"%.100s\"", __func__, name);
- return -1;
+ if ((r = sshkey_ec_validate_private(key)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ error("%s: %s", __func__, ssh_err(r));
+ return -1;
+ }
+ return 0;
}
+#endif /* WITH_OPENSSL */
-u_int
-key_curve_nid_to_bits(int nid)
+void
+key_private_serialize(const Key *key, struct sshbuf *b)
{
- switch (nid) {
-#ifdef OPENSSL_HAS_ECC
- case NID_X9_62_prime256v1:
- return 256;
- case NID_secp384r1:
- return 384;
-# ifdef OPENSSL_HAS_NISTP521
- case NID_secp521r1:
- return 521;
-# endif
-#endif
- default:
- error("%s: unsupported EC curve nid %d", __func__, nid);
- return 0;
- }
+ int r;
+
+ if ((r = sshkey_private_serialize(key, b)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
}
-const char *
-key_curve_nid_to_name(int nid)
+Key *
+key_private_deserialize(struct sshbuf *blob)
{
-#ifdef OPENSSL_HAS_ECC
- if (nid == NID_X9_62_prime256v1)
- return "nistp256";
- else if (nid == NID_secp384r1)
- return "nistp384";
-# ifdef OPENSSL_HAS_NISTP521
- else if (nid == NID_secp521r1)
- return "nistp521";
-# endif
-#endif
- error("%s: unsupported EC curve nid %d", __func__, nid);
- return NULL;
+ int r;
+ Key *ret = NULL;
+
+ if ((r = sshkey_private_deserialize(blob, &ret)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ error("%s: %s", __func__, ssh_err(r));
+ return NULL;
+ }
+ return ret;
}
-#ifdef OPENSSL_HAS_ECC
+/* authfile.c */
+
int
-key_ec_nid_to_hash_alg(int nid)
+key_save_private(Key *key, const char *filename, const char *passphrase,
+ const char *comment, int force_new_format, const char *new_format_cipher,
+ int new_format_rounds)
{
- int kbits = key_curve_nid_to_bits(nid);
+ int r;
- if (kbits == 0)
- fatal("%s: invalid nid %d", __func__, nid);
- /* RFC5656 section 6.2.1 */
- if (kbits <= 256)
- return SSH_DIGEST_SHA256;
- else if (kbits <= 384)
- return SSH_DIGEST_SHA384;
- else
- return SSH_DIGEST_SHA512;
+ if ((r = sshkey_save_private(key, filename, passphrase, comment,
+ force_new_format, new_format_cipher, new_format_rounds)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ error("%s: %s", __func__, ssh_err(r));
+ return 0;
+ }
+ return 1;
}
int
-key_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
+key_load_file(int fd, const char *filename, struct sshbuf *blob)
{
- BN_CTX *bnctx;
- EC_POINT *nq = NULL;
- BIGNUM *order, *x, *y, *tmp;
- int ret = -1;
+ int r;
- if ((bnctx = BN_CTX_new()) == NULL)
- fatal("%s: BN_CTX_new failed", __func__);
- BN_CTX_start(bnctx);
-
- /*
- * We shouldn't ever hit this case because bignum_get_ecpoint()
- * refuses to load GF2m points.
- */
- if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
- NID_X9_62_prime_field) {
- error("%s: group is not a prime field", __func__);
- goto out;
+ if ((r = sshkey_load_file(fd, blob)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ error("%s: %s", __func__, ssh_err(r));
+ return 0;
}
+ return 1;
+}
- /* Q != infinity */
- if (EC_POINT_is_at_infinity(group, public)) {
- error("%s: received degenerate public key (infinity)",
- __func__);
- goto out;
- }
+Key *
+key_load_cert(const char *filename)
+{
+ int r;
+ Key *ret = NULL;
- if ((x = BN_CTX_get(bnctx)) == NULL ||
- (y = BN_CTX_get(bnctx)) == NULL ||
- (order = BN_CTX_get(bnctx)) == NULL ||
- (tmp = BN_CTX_get(bnctx)) == NULL)
- fatal("%s: BN_CTX_get failed", __func__);
-
- /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */
- if (EC_GROUP_get_order(group, order, bnctx) != 1)
- fatal("%s: EC_GROUP_get_order failed", __func__);
- if (EC_POINT_get_affine_coordinates_GFp(group, public,
- x, y, bnctx) != 1)
- fatal("%s: EC_POINT_get_affine_coordinates_GFp", __func__);
- if (BN_num_bits(x) <= BN_num_bits(order) / 2) {
- error("%s: public key x coordinate too small: "
- "bits(x) = %d, bits(order)/2 = %d", __func__,
- BN_num_bits(x), BN_num_bits(order) / 2);
- goto out;
+ if ((r = sshkey_load_cert(filename, &ret)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ /* Old authfile.c ignored all file errors. */
+ if (r == SSH_ERR_SYSTEM_ERROR)
+ debug("%s: %s", __func__, ssh_err(r));
+ else
+ error("%s: %s", __func__, ssh_err(r));
+ return NULL;
}
- if (BN_num_bits(y) <= BN_num_bits(order) / 2) {
- error("%s: public key y coordinate too small: "
- "bits(y) = %d, bits(order)/2 = %d", __func__,
- BN_num_bits(x), BN_num_bits(order) / 2);
- goto out;
- }
+ return ret;
- /* nQ == infinity (n == order of subgroup) */
- if ((nq = EC_POINT_new(group)) == NULL)
- fatal("%s: BN_CTX_tmp failed", __func__);
- if (EC_POINT_mul(group, nq, NULL, public, order, bnctx) != 1)
- fatal("%s: EC_GROUP_mul failed", __func__);
- if (EC_POINT_is_at_infinity(group, nq) != 1) {
- error("%s: received degenerate public key (nQ != infinity)",
- __func__);
- goto out;
- }
-
- /* x < order - 1, y < order - 1 */
- if (!BN_sub(tmp, order, BN_value_one()))
- fatal("%s: BN_sub failed", __func__);
- if (BN_cmp(x, tmp) >= 0) {
- error("%s: public key x coordinate >= group order - 1",
- __func__);
- goto out;
- }
- if (BN_cmp(y, tmp) >= 0) {
- error("%s: public key y coordinate >= group order - 1",
- __func__);
- goto out;
- }
- ret = 0;
- out:
- BN_CTX_free(bnctx);
- EC_POINT_free(nq);
- return ret;
}
-int
-key_ec_validate_private(const EC_KEY *key)
+Key *
+key_load_public(const char *filename, char **commentp)
{
- BN_CTX *bnctx;
- BIGNUM *order, *tmp;
- int ret = -1;
+ int r;
+ Key *ret = NULL;
- if ((bnctx = BN_CTX_new()) == NULL)
- fatal("%s: BN_CTX_new failed", __func__);
- BN_CTX_start(bnctx);
-
- if ((order = BN_CTX_get(bnctx)) == NULL ||
- (tmp = BN_CTX_get(bnctx)) == NULL)
- fatal("%s: BN_CTX_get failed", __func__);
-
- /* log2(private) > log2(order)/2 */
- if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, bnctx) != 1)
- fatal("%s: EC_GROUP_get_order failed", __func__);
- if (BN_num_bits(EC_KEY_get0_private_key(key)) <=
- BN_num_bits(order) / 2) {
- error("%s: private key too small: "
- "bits(y) = %d, bits(order)/2 = %d", __func__,
- BN_num_bits(EC_KEY_get0_private_key(key)),
- BN_num_bits(order) / 2);
- goto out;
+ if ((r = sshkey_load_public(filename, &ret, commentp)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ /* Old authfile.c ignored all file errors. */
+ if (r == SSH_ERR_SYSTEM_ERROR)
+ debug("%s: %s", __func__, ssh_err(r));
+ else
+ error("%s: %s", __func__, ssh_err(r));
+ return NULL;
}
-
- /* private < order - 1 */
- if (!BN_sub(tmp, order, BN_value_one()))
- fatal("%s: BN_sub failed", __func__);
- if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) {
- error("%s: private key >= group order - 1", __func__);
- goto out;
- }
- ret = 0;
- out:
- BN_CTX_free(bnctx);
return ret;
}
-#if defined(DEBUG_KEXECDH) || defined(DEBUG_PK)
-void
-key_dump_ec_point(const EC_GROUP *group, const EC_POINT *point)
+Key *
+key_load_private(const char *path, const char *passphrase,
+ char **commentp)
{
- BIGNUM *x, *y;
- BN_CTX *bnctx;
+ int r;
+ Key *ret = NULL;
- if (point == NULL) {
- fputs("point=(NULL)\n", stderr);
- return;
+ if ((r = sshkey_load_private(path, passphrase, &ret, commentp)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ /* Old authfile.c ignored all file errors. */
+ if (r == SSH_ERR_SYSTEM_ERROR ||
+ r == SSH_ERR_KEY_WRONG_PASSPHRASE)
+ debug("%s: %s", __func__, ssh_err(r));
+ else
+ error("%s: %s", __func__, ssh_err(r));
+ return NULL;
}
- if ((bnctx = BN_CTX_new()) == NULL)
- fatal("%s: BN_CTX_new failed", __func__);
- BN_CTX_start(bnctx);
- if ((x = BN_CTX_get(bnctx)) == NULL || (y = BN_CTX_get(bnctx)) == NULL)
- fatal("%s: BN_CTX_get failed", __func__);
- if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
- NID_X9_62_prime_field)
- fatal("%s: group is not a prime field", __func__);
- if (EC_POINT_get_affine_coordinates_GFp(group, point, x, y, bnctx) != 1)
- fatal("%s: EC_POINT_get_affine_coordinates_GFp", __func__);
- fputs("x=", stderr);
- BN_print_fp(stderr, x);
- fputs("\ny=", stderr);
- BN_print_fp(stderr, y);
- fputs("\n", stderr);
- BN_CTX_free(bnctx);
+ return ret;
}
-void
-key_dump_ec_key(const EC_KEY *key)
+Key *
+key_load_private_cert(int type, const char *filename, const char *passphrase,
+ int *perm_ok)
{
- const BIGNUM *exponent;
+ int r;
+ Key *ret = NULL;
- key_dump_ec_point(EC_KEY_get0_group(key), EC_KEY_get0_public_key(key));
- fputs("exponent=", stderr);
- if ((exponent = EC_KEY_get0_private_key(key)) == NULL)
- fputs("(NULL)", stderr);
- else
- BN_print_fp(stderr, EC_KEY_get0_private_key(key));
- fputs("\n", stderr);
-}
-#endif /* defined(DEBUG_KEXECDH) || defined(DEBUG_PK) */
-#endif /* OPENSSL_HAS_ECC */
-
-void
-key_private_serialize(const Key *key, Buffer *b)
-{
- buffer_put_cstring(b, key_ssh_name(key));
- switch (key->type) {
- case KEY_RSA:
- buffer_put_bignum2(b, key->rsa->n);
- buffer_put_bignum2(b, key->rsa->e);
- buffer_put_bignum2(b, key->rsa->d);
- buffer_put_bignum2(b, key->rsa->iqmp);
- buffer_put_bignum2(b, key->rsa->p);
- buffer_put_bignum2(b, key->rsa->q);
- break;
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- if (key->cert == NULL || buffer_len(&key->cert->certblob) == 0)
- fatal("%s: no cert/certblob", __func__);
- buffer_put_string(b, buffer_ptr(&key->cert->certblob),
- buffer_len(&key->cert->certblob));
- buffer_put_bignum2(b, key->rsa->d);
- buffer_put_bignum2(b, key->rsa->iqmp);
- buffer_put_bignum2(b, key->rsa->p);
- buffer_put_bignum2(b, key->rsa->q);
- break;
- case KEY_DSA:
- buffer_put_bignum2(b, key->dsa->p);
- buffer_put_bignum2(b, key->dsa->q);
- buffer_put_bignum2(b, key->dsa->g);
- buffer_put_bignum2(b, key->dsa->pub_key);
- buffer_put_bignum2(b, key->dsa->priv_key);
- break;
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- if (key->cert == NULL || buffer_len(&key->cert->certblob) == 0)
- fatal("%s: no cert/certblob", __func__);
- buffer_put_string(b, buffer_ptr(&key->cert->certblob),
- buffer_len(&key->cert->certblob));
- buffer_put_bignum2(b, key->dsa->priv_key);
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- buffer_put_cstring(b, key_curve_nid_to_name(key->ecdsa_nid));
- buffer_put_ecpoint(b, EC_KEY_get0_group(key->ecdsa),
- EC_KEY_get0_public_key(key->ecdsa));
- buffer_put_bignum2(b, EC_KEY_get0_private_key(key->ecdsa));
- break;
- case KEY_ECDSA_CERT:
- if (key->cert == NULL || buffer_len(&key->cert->certblob) == 0)
- fatal("%s: no cert/certblob", __func__);
- buffer_put_string(b, buffer_ptr(&key->cert->certblob),
- buffer_len(&key->cert->certblob));
- buffer_put_bignum2(b, EC_KEY_get0_private_key(key->ecdsa));
- break;
-#endif /* OPENSSL_HAS_ECC */
- case KEY_ED25519:
- buffer_put_string(b, key->ed25519_pk, ED25519_PK_SZ);
- buffer_put_string(b, key->ed25519_sk, ED25519_SK_SZ);
- break;
- case KEY_ED25519_CERT:
- if (key->cert == NULL || buffer_len(&key->cert->certblob) == 0)
- fatal("%s: no cert/certblob", __func__);
- buffer_put_string(b, buffer_ptr(&key->cert->certblob),
- buffer_len(&key->cert->certblob));
- buffer_put_string(b, key->ed25519_pk, ED25519_PK_SZ);
- buffer_put_string(b, key->ed25519_sk, ED25519_SK_SZ);
- break;
+ if ((r = sshkey_load_private_cert(type, filename, passphrase,
+ &ret, perm_ok)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ /* Old authfile.c ignored all file errors. */
+ if (r == SSH_ERR_SYSTEM_ERROR ||
+ r == SSH_ERR_KEY_WRONG_PASSPHRASE)
+ debug("%s: %s", __func__, ssh_err(r));
+ else
+ error("%s: %s", __func__, ssh_err(r));
+ return NULL;
}
+ return ret;
}
Key *
-key_private_deserialize(Buffer *blob)
+key_load_private_type(int type, const char *filename, const char *passphrase,
+ char **commentp, int *perm_ok)
{
- char *type_name;
- Key *k = NULL;
- u_char *cert;
- u_int len, pklen, sklen;
- int type;
-#ifdef OPENSSL_HAS_ECC
- char *curve;
- BIGNUM *exponent;
- EC_POINT *q;
-#endif
+ int r;
+ Key *ret = NULL;
- type_name = buffer_get_string(blob, NULL);
- type = key_type_from_name(type_name);
- switch (type) {
- case KEY_DSA:
- k = key_new_private(type);
- buffer_get_bignum2(blob, k->dsa->p);
- buffer_get_bignum2(blob, k->dsa->q);
- buffer_get_bignum2(blob, k->dsa->g);
- buffer_get_bignum2(blob, k->dsa->pub_key);
- buffer_get_bignum2(blob, k->dsa->priv_key);
- break;
- case KEY_DSA_CERT_V00:
- case KEY_DSA_CERT:
- cert = buffer_get_string(blob, &len);
- if ((k = key_from_blob(cert, len)) == NULL)
- fatal("Certificate parse failed");
- free(cert);
- key_add_private(k);
- buffer_get_bignum2(blob, k->dsa->priv_key);
- break;
-#ifdef OPENSSL_HAS_ECC
- case KEY_ECDSA:
- k = key_new_private(type);
- k->ecdsa_nid = key_ecdsa_nid_from_name(type_name);
- curve = buffer_get_string(blob, NULL);
- if (k->ecdsa_nid != key_curve_name_to_nid(curve))
- fatal("%s: curve names mismatch", __func__);
- free(curve);
- k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
- if (k->ecdsa == NULL)
- fatal("%s: EC_KEY_new_by_curve_name failed",
- __func__);
- q = EC_POINT_new(EC_KEY_get0_group(k->ecdsa));
- if (q == NULL)
- fatal("%s: BN_new failed", __func__);
- if ((exponent = BN_new()) == NULL)
- fatal("%s: BN_new failed", __func__);
- buffer_get_ecpoint(blob,
- EC_KEY_get0_group(k->ecdsa), q);
- buffer_get_bignum2(blob, exponent);
- if (EC_KEY_set_public_key(k->ecdsa, q) != 1)
- fatal("%s: EC_KEY_set_public_key failed",
- __func__);
- if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1)
- fatal("%s: EC_KEY_set_private_key failed",
- __func__);
- if (key_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
- EC_KEY_get0_public_key(k->ecdsa)) != 0)
- fatal("%s: bad ECDSA public key", __func__);
- if (key_ec_validate_private(k->ecdsa) != 0)
- fatal("%s: bad ECDSA private key", __func__);
- BN_clear_free(exponent);
- EC_POINT_free(q);
- break;
- case KEY_ECDSA_CERT:
- cert = buffer_get_string(blob, &len);
- if ((k = key_from_blob(cert, len)) == NULL)
- fatal("Certificate parse failed");
- free(cert);
- key_add_private(k);
- if ((exponent = BN_new()) == NULL)
- fatal("%s: BN_new failed", __func__);
- buffer_get_bignum2(blob, exponent);
- if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1)
- fatal("%s: EC_KEY_set_private_key failed",
- __func__);
- if (key_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
- EC_KEY_get0_public_key(k->ecdsa)) != 0 ||
- key_ec_validate_private(k->ecdsa) != 0)
- fatal("%s: bad ECDSA key", __func__);
- BN_clear_free(exponent);
- break;
-#endif
- case KEY_RSA:
- k = key_new_private(type);
- buffer_get_bignum2(blob, k->rsa->n);
- buffer_get_bignum2(blob, k->rsa->e);
- buffer_get_bignum2(blob, k->rsa->d);
- buffer_get_bignum2(blob, k->rsa->iqmp);
- buffer_get_bignum2(blob, k->rsa->p);
- buffer_get_bignum2(blob, k->rsa->q);
-
- /* Generate additional parameters */
- rsa_generate_additional_parameters(k->rsa);
- break;
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- cert = buffer_get_string(blob, &len);
- if ((k = key_from_blob(cert, len)) == NULL)
- fatal("Certificate parse failed");
- free(cert);
- key_add_private(k);
- buffer_get_bignum2(blob, k->rsa->d);
- buffer_get_bignum2(blob, k->rsa->iqmp);
- buffer_get_bignum2(blob, k->rsa->p);
- buffer_get_bignum2(blob, k->rsa->q);
- break;
- case KEY_ED25519:
- k = key_new_private(type);
- k->ed25519_pk = buffer_get_string(blob, &pklen);
- k->ed25519_sk = buffer_get_string(blob, &sklen);
- if (pklen != ED25519_PK_SZ)
- fatal("%s: ed25519 pklen %d != %d",
- __func__, pklen, ED25519_PK_SZ);
- if (sklen != ED25519_SK_SZ)
- fatal("%s: ed25519 sklen %d != %d",
- __func__, sklen, ED25519_SK_SZ);
- break;
- case KEY_ED25519_CERT:
- cert = buffer_get_string(blob, &len);
- if ((k = key_from_blob(cert, len)) == NULL)
- fatal("Certificate parse failed");
- free(cert);
- key_add_private(k);
- k->ed25519_pk = buffer_get_string(blob, &pklen);
- k->ed25519_sk = buffer_get_string(blob, &sklen);
- if (pklen != ED25519_PK_SZ)
- fatal("%s: ed25519 pklen %d != %d",
- __func__, pklen, ED25519_PK_SZ);
- if (sklen != ED25519_SK_SZ)
- fatal("%s: ed25519 sklen %d != %d",
- __func__, sklen, ED25519_SK_SZ);
- break;
- default:
- free(type_name);
- buffer_clear(blob);
+ if ((r = sshkey_load_private_type(type, filename, passphrase,
+ &ret, commentp, perm_ok)) != 0) {
+ fatal_on_fatal_errors(r, __func__, SSH_ERR_LIBCRYPTO_ERROR);
+ /* Old authfile.c ignored all file errors. */
+ if (r == SSH_ERR_SYSTEM_ERROR ||
+ (r == SSH_ERR_KEY_WRONG_PASSPHRASE))
+ debug("%s: %s", __func__, ssh_err(r));
+ else
+ error("%s: %s", __func__, ssh_err(r));
return NULL;
}
- free(type_name);
+ return ret;
+}
- /* enable blinding */
- switch (k->type) {
- case KEY_RSA:
- case KEY_RSA_CERT_V00:
- case KEY_RSA_CERT:
- case KEY_RSA1:
- if (RSA_blinding_on(k->rsa, NULL) != 1) {
- error("%s: RSA_blinding_on failed", __func__);
- key_free(k);
- return NULL;
- }
- break;
- }
- return k;
+int
+key_perm_ok(int fd, const char *filename)
+{
+ return sshkey_perm_ok(fd, filename) == 0 ? 1 : 0;
}
+
Modified: trunk/crypto/openssh/key.h
===================================================================
--- trunk/crypto/openssh/key.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/key.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.h,v 1.41 2014/01/09 23:20:00 djm Exp $ */
+/* $OpenBSD: key.h,v 1.49 2015/12/04 16:41:28 markus Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -26,141 +26,80 @@
#ifndef KEY_H
#define KEY_H
-#include "buffer.h"
-#include <openssl/rsa.h>
-#include <openssl/dsa.h>
-#ifdef OPENSSL_HAS_ECC
-#include <openssl/ec.h>
-#endif
+#include "sshkey.h"
-typedef struct Key Key;
-enum types {
- KEY_RSA1,
- KEY_RSA,
- KEY_DSA,
- KEY_ECDSA,
- KEY_ED25519,
- KEY_RSA_CERT,
- KEY_DSA_CERT,
- KEY_ECDSA_CERT,
- KEY_ED25519_CERT,
- KEY_RSA_CERT_V00,
- KEY_DSA_CERT_V00,
- KEY_UNSPEC
-};
-enum fp_type {
- SSH_FP_SHA1,
- SSH_FP_MD5,
- SSH_FP_SHA256
-};
-enum fp_rep {
- SSH_FP_HEX,
- SSH_FP_BUBBLEBABBLE,
- SSH_FP_RANDOMART
-};
+typedef struct sshkey Key;
-/* key is stored in external hardware */
-#define KEY_FLAG_EXT 0x0001
+#define types sshkey_types
+#define fp_type sshkey_fp_type
+#define fp_rep sshkey_fp_rep
-#define CERT_MAX_PRINCIPALS 256
-struct KeyCert {
- Buffer certblob; /* Kept around for use on wire */
- u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
- u_int64_t serial;
- char *key_id;
- u_int nprincipals;
- char **principals;
- u_int64_t valid_after, valid_before;
- Buffer critical;
- Buffer extensions;
- Key *signature_key;
-};
-
-struct Key {
- int type;
- int flags;
- RSA *rsa;
- DSA *dsa;
- int ecdsa_nid; /* NID of curve */
-#ifdef OPENSSL_HAS_ECC
- EC_KEY *ecdsa;
-#else
- void *ecdsa;
+#ifndef SSH_KEY_NO_DEFINE
+#define key_new sshkey_new
+#define key_free sshkey_free
+#define key_equal_public sshkey_equal_public
+#define key_equal sshkey_equal
+#define key_type sshkey_type
+#define key_cert_type sshkey_cert_type
+#define key_ssh_name sshkey_ssh_name
+#define key_ssh_name_plain sshkey_ssh_name_plain
+#define key_type_from_name sshkey_type_from_name
+#define key_ecdsa_nid_from_name sshkey_ecdsa_nid_from_name
+#define key_type_is_cert sshkey_type_is_cert
+#define key_size sshkey_size
+#define key_ecdsa_bits_to_nid sshkey_ecdsa_bits_to_nid
+#define key_ecdsa_key_to_nid sshkey_ecdsa_key_to_nid
+#define key_is_cert sshkey_is_cert
+#define key_type_plain sshkey_type_plain
+#define key_curve_name_to_nid sshkey_curve_name_to_nid
+#define key_curve_nid_to_bits sshkey_curve_nid_to_bits
+#define key_curve_nid_to_name sshkey_curve_nid_to_name
+#define key_ec_nid_to_hash_alg sshkey_ec_nid_to_hash_alg
+#define key_dump_ec_point sshkey_dump_ec_point
+#define key_dump_ec_key sshkey_dump_ec_key
#endif
- struct KeyCert *cert;
- u_char *ed25519_sk;
- u_char *ed25519_pk;
-};
-#define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES
-#define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES
+void key_add_private(Key *);
+Key *key_new_private(int);
+void key_free(Key *);
+Key *key_demote(const Key *);
+int key_write(const Key *, FILE *);
+int key_read(Key *, char **);
-Key *key_new(int);
-void key_add_private(Key *);
-Key *key_new_private(int);
-void key_free(Key *);
-Key *key_demote(const Key *);
-int key_equal_public(const Key *, const Key *);
-int key_equal(const Key *, const Key *);
-char *key_fingerprint(const Key *, enum fp_type, enum fp_rep);
-u_char *key_fingerprint_raw(const Key *, enum fp_type, u_int *);
-const char *key_type(const Key *);
-const char *key_cert_type(const Key *);
-int key_write(const Key *, FILE *);
-int key_read(Key *, char **);
-u_int key_size(const Key *);
-
Key *key_generate(int, u_int);
Key *key_from_private(const Key *);
-int key_type_from_name(char *);
-int key_is_cert(const Key *);
-int key_type_is_cert(int);
-int key_type_plain(int);
-int key_to_certified(Key *, int);
+int key_to_certified(Key *);
int key_drop_cert(Key *);
int key_certify(Key *, Key *);
-void key_cert_copy(const Key *, struct Key *);
+void key_cert_copy(const Key *, Key *);
int key_cert_check_authority(const Key *, int, int, const char *,
const char **);
-int key_cert_is_legacy(const Key *);
+char *key_alg_list(int, int);
-int key_ecdsa_nid_from_name(const char *);
-int key_curve_name_to_nid(const char *);
-const char *key_curve_nid_to_name(int);
-u_int key_curve_nid_to_bits(int);
-int key_ecdsa_bits_to_nid(int);
-#ifdef OPENSSL_HAS_ECC
-int key_ecdsa_key_to_nid(EC_KEY *);
-int key_ec_nid_to_hash_alg(int nid);
-int key_ec_validate_public(const EC_GROUP *, const EC_POINT *);
-int key_ec_validate_private(const EC_KEY *);
-#endif
-char *key_alg_list(int, int);
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+int key_ec_validate_public(const EC_GROUP *, const EC_POINT *);
+int key_ec_validate_private(const EC_KEY *);
+#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */
-Key *key_from_blob(const u_char *, u_int);
-int key_to_blob(const Key *, u_char **, u_int *);
-const char *key_ssh_name(const Key *);
-const char *key_ssh_name_plain(const Key *);
-int key_names_valid2(const char *);
+Key *key_from_blob(const u_char *, u_int);
+int key_to_blob(const Key *, u_char **, u_int *);
-int key_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
+int key_sign(const Key *, u_char **, u_int *, const u_char *, u_int,
+ const char *);
int key_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
-int ssh_dss_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
-int ssh_dss_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
-int ssh_ecdsa_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
-int ssh_ecdsa_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
-int ssh_rsa_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
-int ssh_rsa_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
-int ssh_ed25519_sign(const Key *, u_char **, u_int *, const u_char *, u_int);
-int ssh_ed25519_verify(const Key *, const u_char *, u_int, const u_char *, u_int);
+void key_private_serialize(const Key *, struct sshbuf *);
+Key *key_private_deserialize(struct sshbuf *);
-#if defined(OPENSSL_HAS_ECC) && (defined(DEBUG_KEXECDH) || defined(DEBUG_PK))
-void key_dump_ec_point(const EC_GROUP *, const EC_POINT *);
-void key_dump_ec_key(const EC_KEY *);
-#endif
+/* authfile.c */
+int key_save_private(Key *, const char *, const char *, const char *,
+ int, const char *, int);
+int key_load_file(int, const char *, struct sshbuf *);
+Key *key_load_cert(const char *);
+Key *key_load_public(const char *, char **);
+Key *key_load_private(const char *, const char *, char **);
+Key *key_load_private_cert(int, const char *, const char *, int *);
+Key *key_load_private_type(int, const char *, const char *, char **, int *);
+int key_perm_ok(int, const char *);
-void key_private_serialize(const Key *, Buffer *);
-Key *key_private_deserialize(Buffer *);
-
#endif
Modified: trunk/crypto/openssh/krl.c
===================================================================
--- trunk/crypto/openssh/krl.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/krl.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -14,12 +14,12 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $OpenBSD: krl.c,v 1.14 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: krl.c,v 1.37 2015/12/31 00:33:52 djm Exp $ */
#include "includes.h"
+#include <sys/param.h> /* MIN */
#include <sys/types.h>
-#include <sys/param.h>
#include <openbsd-compat/sys-tree.h>
#include <openbsd-compat/sys-queue.h>
@@ -30,12 +30,14 @@
#include <time.h>
#include <unistd.h>
-#include "buffer.h"
-#include "key.h"
+#include "sshbuf.h"
+#include "ssherr.h"
+#include "sshkey.h"
#include "authfile.h"
#include "misc.h"
#include "log.h"
-#include "xmalloc.h"
+#include "digest.h"
+#include "bitmap.h"
#include "krl.h"
@@ -72,7 +74,7 @@
/* Tree of blobs (used for keys and fingerprints) */
struct revoked_blob {
u_char *blob;
- u_int len;
+ size_t len;
RB_ENTRY(revoked_blob) tree_entry;
};
static int blob_cmp(struct revoked_blob *a, struct revoked_blob *b);
@@ -81,7 +83,7 @@
/* Tracks revoked certs for a single CA */
struct revoked_certs {
- Key *ca_key;
+ struct sshkey *ca_key;
struct revoked_serial_tree revoked_serials;
struct revoked_key_id_tree revoked_key_ids;
TAILQ_ENTRY(revoked_certs) entry;
@@ -154,8 +156,7 @@
free(rki->key_id);
free(rki);
}
- if (rc->ca_key != NULL)
- key_free(rc->ca_key);
+ sshkey_free(rc->ca_key);
}
void
@@ -190,12 +191,13 @@
krl->krl_version = version;
}
-void
+int
ssh_krl_set_comment(struct ssh_krl *krl, const char *comment)
{
free(krl->comment);
if ((krl->comment = strdup(comment)) == NULL)
- fatal("%s: strdup", __func__);
+ return SSH_ERR_ALLOC_FAIL;
+ return 0;
}
/*
@@ -203,14 +205,16 @@
* create a new one in the tree if one did not exist already.
*/
static int
-revoked_certs_for_ca_key(struct ssh_krl *krl, const Key *ca_key,
+revoked_certs_for_ca_key(struct ssh_krl *krl, const struct sshkey *ca_key,
struct revoked_certs **rcp, int allow_create)
{
struct revoked_certs *rc;
+ int r;
*rcp = NULL;
TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
- if (key_equal(rc->ca_key, ca_key)) {
+ if ((ca_key == NULL && rc->ca_key == NULL) ||
+ sshkey_equal(rc->ca_key, ca_key)) {
*rcp = rc;
return 0;
}
@@ -219,15 +223,18 @@
return 0;
/* If this CA doesn't exist in the list then add it now */
if ((rc = calloc(1, sizeof(*rc))) == NULL)
- return -1;
- if ((rc->ca_key = key_from_private(ca_key)) == NULL) {
+ return SSH_ERR_ALLOC_FAIL;
+ if (ca_key == NULL)
+ rc->ca_key = NULL;
+ else if ((r = sshkey_from_private(ca_key, &rc->ca_key)) != 0) {
free(rc);
- return -1;
+ return r;
}
RB_INIT(&rc->revoked_serials);
RB_INIT(&rc->revoked_key_ids);
TAILQ_INSERT_TAIL(&krl->revoked_certs, rc, entry);
- debug3("%s: new CA %s", __func__, key_type(ca_key));
+ KRL_DBG(("%s: new CA %s", __func__,
+ ca_key == NULL ? "*" : sshkey_type(ca_key)));
*rcp = rc;
return 0;
}
@@ -245,7 +252,7 @@
if (ers == NULL || serial_cmp(ers, &rs) != 0) {
/* No entry matches. Just insert */
if ((irs = malloc(sizeof(rs))) == NULL)
- return -1;
+ return SSH_ERR_ALLOC_FAIL;
memcpy(irs, &rs, sizeof(*irs));
ers = RB_INSERT(revoked_serial_tree, rt, irs);
if (ers != NULL) {
@@ -252,7 +259,7 @@
KRL_DBG(("%s: bad: ers != NULL", __func__));
/* Shouldn't happen */
free(irs);
- return -1;
+ return SSH_ERR_INTERNAL_ERROR;
}
ers = irs;
} else {
@@ -267,6 +274,7 @@
if (ers->hi < hi)
ers->hi = hi;
}
+
/*
* The inserted or revised range might overlap or abut adjacent ones;
* coalesce as necessary.
@@ -305,7 +313,7 @@
}
int
-ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const Key *ca_key,
+ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const struct sshkey *ca_key,
u_int64_t serial)
{
return ssh_krl_revoke_cert_by_serial_range(krl, ca_key, serial, serial);
@@ -312,33 +320,35 @@
}
int
-ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl, const Key *ca_key,
- u_int64_t lo, u_int64_t hi)
+ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl,
+ const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi)
{
struct revoked_certs *rc;
+ int r;
if (lo > hi || lo == 0)
- return -1;
- if (revoked_certs_for_ca_key(krl, ca_key, &rc, 1) != 0)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
+ return r;
return insert_serial_range(&rc->revoked_serials, lo, hi);
}
int
-ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const Key *ca_key,
+ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const struct sshkey *ca_key,
const char *key_id)
{
struct revoked_key_id *rki, *erki;
struct revoked_certs *rc;
+ int r;
- if (revoked_certs_for_ca_key(krl, ca_key, &rc, 1) != 0)
- return -1;
+ if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
+ return r;
- debug3("%s: revoke %s", __func__, key_id);
+ KRL_DBG(("%s: revoke %s", __func__, key_id));
if ((rki = calloc(1, sizeof(*rki))) == NULL ||
(rki->key_id = strdup(key_id)) == NULL) {
free(rki);
- fatal("%s: strdup", __func__);
+ return SSH_ERR_ALLOC_FAIL;
}
erki = RB_INSERT(revoked_key_id_tree, &rc->revoked_key_ids, rki);
if (erki != NULL) {
@@ -350,33 +360,32 @@
/* Convert "key" to a public key blob without any certificate information */
static int
-plain_key_blob(const Key *key, u_char **blob, u_int *blen)
+plain_key_blob(const struct sshkey *key, u_char **blob, size_t *blen)
{
- Key *kcopy;
+ struct sshkey *kcopy;
int r;
- if ((kcopy = key_from_private(key)) == NULL)
- return -1;
- if (key_is_cert(kcopy)) {
- if (key_drop_cert(kcopy) != 0) {
- error("%s: key_drop_cert", __func__);
- key_free(kcopy);
- return -1;
+ if ((r = sshkey_from_private(key, &kcopy)) != 0)
+ return r;
+ if (sshkey_is_cert(kcopy)) {
+ if ((r = sshkey_drop_cert(kcopy)) != 0) {
+ sshkey_free(kcopy);
+ return r;
}
}
- r = key_to_blob(kcopy, blob, blen);
- free(kcopy);
- return r == 0 ? -1 : 0;
+ r = sshkey_to_blob(kcopy, blob, blen);
+ sshkey_free(kcopy);
+ return r;
}
/* Revoke a key blob. Ownership of blob is transferred to the tree */
static int
-revoke_blob(struct revoked_blob_tree *rbt, u_char *blob, u_int len)
+revoke_blob(struct revoked_blob_tree *rbt, u_char *blob, size_t len)
{
struct revoked_blob *rb, *erb;
if ((rb = calloc(1, sizeof(*rb))) == NULL)
- return -1;
+ return SSH_ERR_ALLOC_FAIL;
rb->blob = blob;
rb->len = len;
erb = RB_INSERT(revoked_blob_tree, rbt, rb);
@@ -388,36 +397,39 @@
}
int
-ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const Key *key)
+ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const struct sshkey *key)
{
u_char *blob;
- u_int len;
+ size_t len;
+ int r;
- debug3("%s: revoke type %s", __func__, key_type(key));
- if (plain_key_blob(key, &blob, &len) != 0)
- return -1;
+ debug3("%s: revoke type %s", __func__, sshkey_type(key));
+ if ((r = plain_key_blob(key, &blob, &len)) != 0)
+ return r;
return revoke_blob(&krl->revoked_keys, blob, len);
}
int
-ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const Key *key)
+ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const struct sshkey *key)
{
u_char *blob;
- u_int len;
+ size_t len;
+ int r;
- debug3("%s: revoke type %s by sha1", __func__, key_type(key));
- if ((blob = key_fingerprint_raw(key, SSH_FP_SHA1, &len)) == NULL)
- return -1;
+ debug3("%s: revoke type %s by sha1", __func__, sshkey_type(key));
+ if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA1,
+ &blob, &len)) != 0)
+ return r;
return revoke_blob(&krl->revoked_sha1s, blob, len);
}
int
-ssh_krl_revoke_key(struct ssh_krl *krl, const Key *key)
+ssh_krl_revoke_key(struct ssh_krl *krl, const struct sshkey *key)
{
- if (!key_is_cert(key))
+ if (!sshkey_is_cert(key))
return ssh_krl_revoke_key_sha1(krl, key);
- if (key_cert_is_legacy(key) || key->cert->serial == 0) {
+ if (key->cert->serial == 0) {
return ssh_krl_revoke_cert_by_key_id(krl,
key->cert->signature_key,
key->cert->key_id);
@@ -429,8 +441,8 @@
}
/*
- * Select a copact next section type to emit in a KRL based on the
- * current section type, the run length of contiguous revoked serial
+ * Select the most compact section type to emit next in a KRL based on
+ * the current section type, the run length of contiguous revoked serial
* numbers and the gaps from the last and to the next revoked serial.
* Applies a mostly-accurate bit cost model to select the section type
* that will minimise the size of the resultant KRL.
@@ -500,7 +512,7 @@
*force_new_section = 1;
cost = cost_bitmap_restart;
}
- debug3("%s: contig %llu last_gap %llu next_gap %llu final %d, costs:"
+ KRL_DBG(("%s: contig %llu last_gap %llu next_gap %llu final %d, costs:"
"list %llu range %llu bitmap %llu new bitmap %llu, "
"selected 0x%02x%s", __func__, (long long unsigned)contig,
(long long unsigned)last_gap, (long long unsigned)next_gap, final,
@@ -507,43 +519,62 @@
(long long unsigned)cost_list, (long long unsigned)cost_range,
(long long unsigned)cost_bitmap,
(long long unsigned)cost_bitmap_restart, new_state,
- *force_new_section ? " restart" : "");
+ *force_new_section ? " restart" : ""));
return new_state;
}
+static int
+put_bitmap(struct sshbuf *buf, struct bitmap *bitmap)
+{
+ size_t len;
+ u_char *blob;
+ int r;
+
+ len = bitmap_nbytes(bitmap);
+ if ((blob = malloc(len)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (bitmap_to_string(bitmap, blob, len) != 0) {
+ free(blob);
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ r = sshbuf_put_bignum2_bytes(buf, blob, len);
+ free(blob);
+ return r;
+}
+
/* Generate a KRL_SECTION_CERTIFICATES KRL section */
static int
-revoked_certs_generate(struct revoked_certs *rc, Buffer *buf)
+revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
{
- int final, force_new_sect, r = -1;
+ int final, force_new_sect, r = SSH_ERR_INTERNAL_ERROR;
u_int64_t i, contig, gap, last = 0, bitmap_start = 0;
struct revoked_serial *rs, *nrs;
struct revoked_key_id *rki;
int next_state, state = 0;
- Buffer sect;
- u_char *kblob = NULL;
- u_int klen;
- BIGNUM *bitmap = NULL;
+ struct sshbuf *sect;
+ struct bitmap *bitmap = NULL;
- /* Prepare CA scope key blob if we have one supplied */
- if (key_to_blob(rc->ca_key, &kblob, &klen) == 0)
- return -1;
+ if ((sect = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
- buffer_init(§);
+ /* Store the header: optional CA scope key, reserved */
+ if (rc->ca_key == NULL) {
+ if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
+ goto out;
+ } else {
+ if ((r = sshkey_puts(rc->ca_key, buf)) != 0)
+ goto out;
+ }
+ if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
+ goto out;
- /* Store the header */
- buffer_put_string(buf, kblob, klen);
- buffer_put_string(buf, NULL, 0); /* Reserved */
-
- free(kblob);
-
/* Store the revoked serials. */
for (rs = RB_MIN(revoked_serial_tree, &rc->revoked_serials);
rs != NULL;
rs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs)) {
- debug3("%s: serial %llu:%llu state 0x%02x", __func__,
+ KRL_DBG(("%s: serial %llu:%llu state 0x%02x", __func__,
(long long unsigned)rs->lo, (long long unsigned)rs->hi,
- state);
+ state));
/* Check contiguous length and gap to next section (if any) */
nrs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs);
@@ -561,36 +592,43 @@
*/
if (state != 0 && (force_new_sect || next_state != state ||
state == KRL_SECTION_CERT_SERIAL_RANGE)) {
- debug3("%s: finish state 0x%02x", __func__, state);
+ KRL_DBG(("%s: finish state 0x%02x", __func__, state));
switch (state) {
case KRL_SECTION_CERT_SERIAL_LIST:
case KRL_SECTION_CERT_SERIAL_RANGE:
break;
case KRL_SECTION_CERT_SERIAL_BITMAP:
- buffer_put_bignum2(§, bitmap);
- BN_free(bitmap);
+ if ((r = put_bitmap(sect, bitmap)) != 0)
+ goto out;
+ bitmap_free(bitmap);
bitmap = NULL;
break;
}
- buffer_put_char(buf, state);
- buffer_put_string(buf,
- buffer_ptr(§), buffer_len(§));
+ if ((r = sshbuf_put_u8(buf, state)) != 0 ||
+ (r = sshbuf_put_stringb(buf, sect)) != 0)
+ goto out;
+ sshbuf_reset(sect);
}
/* If we are starting a new section then prepare it now */
if (next_state != state || force_new_sect) {
- debug3("%s: start state 0x%02x", __func__, next_state);
+ KRL_DBG(("%s: start state 0x%02x", __func__,
+ next_state));
state = next_state;
- buffer_clear(§);
+ sshbuf_reset(sect);
switch (state) {
case KRL_SECTION_CERT_SERIAL_LIST:
case KRL_SECTION_CERT_SERIAL_RANGE:
break;
case KRL_SECTION_CERT_SERIAL_BITMAP:
- if ((bitmap = BN_new()) == NULL)
+ if ((bitmap = bitmap_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
goto out;
+ }
bitmap_start = rs->lo;
- buffer_put_int64(§, bitmap_start);
+ if ((r = sshbuf_put_u64(sect,
+ bitmap_start)) != 0)
+ goto out;
break;
}
}
@@ -598,12 +636,15 @@
/* Perform section-specific processing */
switch (state) {
case KRL_SECTION_CERT_SERIAL_LIST:
- for (i = 0; i < contig; i++)
- buffer_put_int64(§, rs->lo + i);
+ for (i = 0; i < contig; i++) {
+ if ((r = sshbuf_put_u64(sect, rs->lo + i)) != 0)
+ goto out;
+ }
break;
case KRL_SECTION_CERT_SERIAL_RANGE:
- buffer_put_int64(§, rs->lo);
- buffer_put_int64(§, rs->hi);
+ if ((r = sshbuf_put_u64(sect, rs->lo)) != 0 ||
+ (r = sshbuf_put_u64(sect, rs->hi)) != 0)
+ goto out;
break;
case KRL_SECTION_CERT_SERIAL_BITMAP:
if (rs->lo - bitmap_start > INT_MAX) {
@@ -611,9 +652,11 @@
goto out;
}
for (i = 0; i < contig; i++) {
- if (BN_set_bit(bitmap,
- rs->lo + i - bitmap_start) != 1)
+ if (bitmap_set_bit(bitmap,
+ rs->lo + i - bitmap_start) != 0) {
+ r = SSH_ERR_ALLOC_FAIL;
goto out;
+ }
}
break;
}
@@ -621,119 +664,125 @@
}
/* Flush the remaining section, if any */
if (state != 0) {
- debug3("%s: serial final flush for state 0x%02x",
- __func__, state);
+ KRL_DBG(("%s: serial final flush for state 0x%02x",
+ __func__, state));
switch (state) {
case KRL_SECTION_CERT_SERIAL_LIST:
case KRL_SECTION_CERT_SERIAL_RANGE:
break;
case KRL_SECTION_CERT_SERIAL_BITMAP:
- buffer_put_bignum2(§, bitmap);
- BN_free(bitmap);
+ if ((r = put_bitmap(sect, bitmap)) != 0)
+ goto out;
+ bitmap_free(bitmap);
bitmap = NULL;
break;
}
- buffer_put_char(buf, state);
- buffer_put_string(buf,
- buffer_ptr(§), buffer_len(§));
+ if ((r = sshbuf_put_u8(buf, state)) != 0 ||
+ (r = sshbuf_put_stringb(buf, sect)) != 0)
+ goto out;
}
- debug3("%s: serial done ", __func__);
+ KRL_DBG(("%s: serial done ", __func__));
/* Now output a section for any revocations by key ID */
- buffer_clear(§);
+ sshbuf_reset(sect);
RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
- debug3("%s: key ID %s", __func__, rki->key_id);
- buffer_put_cstring(§, rki->key_id);
+ KRL_DBG(("%s: key ID %s", __func__, rki->key_id));
+ if ((r = sshbuf_put_cstring(sect, rki->key_id)) != 0)
+ goto out;
}
- if (buffer_len(§) != 0) {
- buffer_put_char(buf, KRL_SECTION_CERT_KEY_ID);
- buffer_put_string(buf, buffer_ptr(§),
- buffer_len(§));
+ if (sshbuf_len(sect) != 0) {
+ if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERT_KEY_ID)) != 0 ||
+ (r = sshbuf_put_stringb(buf, sect)) != 0)
+ goto out;
}
r = 0;
out:
- if (bitmap != NULL)
- BN_free(bitmap);
- buffer_free(§);
+ bitmap_free(bitmap);
+ sshbuf_free(sect);
return r;
}
int
-ssh_krl_to_blob(struct ssh_krl *krl, Buffer *buf, const Key **sign_keys,
- u_int nsign_keys)
+ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf,
+ const struct sshkey **sign_keys, u_int nsign_keys)
{
- int r = -1;
+ int r = SSH_ERR_INTERNAL_ERROR;
struct revoked_certs *rc;
struct revoked_blob *rb;
- Buffer sect;
- u_char *kblob = NULL, *sblob = NULL;
- u_int klen, slen, i;
+ struct sshbuf *sect;
+ u_char *sblob = NULL;
+ size_t slen, i;
if (krl->generated_date == 0)
krl->generated_date = time(NULL);
- buffer_init(§);
+ if ((sect = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
/* Store the header */
- buffer_append(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1);
- buffer_put_int(buf, KRL_FORMAT_VERSION);
- buffer_put_int64(buf, krl->krl_version);
- buffer_put_int64(buf, krl->generated_date);
- buffer_put_int64(buf, krl->flags);
- buffer_put_string(buf, NULL, 0);
- buffer_put_cstring(buf, krl->comment ? krl->comment : "");
+ if ((r = sshbuf_put(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0 ||
+ (r = sshbuf_put_u32(buf, KRL_FORMAT_VERSION)) != 0 ||
+ (r = sshbuf_put_u64(buf, krl->krl_version)) != 0 ||
+ (r = sshbuf_put_u64(buf, krl->generated_date)) != 0 ||
+ (r = sshbuf_put_u64(buf, krl->flags)) != 0 ||
+ (r = sshbuf_put_string(buf, NULL, 0)) != 0 ||
+ (r = sshbuf_put_cstring(buf, krl->comment)) != 0)
+ goto out;
/* Store sections for revoked certificates */
TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
- if (revoked_certs_generate(rc, §) != 0)
+ sshbuf_reset(sect);
+ if ((r = revoked_certs_generate(rc, sect)) != 0)
goto out;
- buffer_put_char(buf, KRL_SECTION_CERTIFICATES);
- buffer_put_string(buf, buffer_ptr(§),
- buffer_len(§));
+ if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERTIFICATES)) != 0 ||
+ (r = sshbuf_put_stringb(buf, sect)) != 0)
+ goto out;
}
/* Finally, output sections for revocations by public key/hash */
- buffer_clear(§);
+ sshbuf_reset(sect);
RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
- debug3("%s: key len %u ", __func__, rb->len);
- buffer_put_string(§, rb->blob, rb->len);
+ KRL_DBG(("%s: key len %zu ", __func__, rb->len));
+ if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
+ goto out;
}
- if (buffer_len(§) != 0) {
- buffer_put_char(buf, KRL_SECTION_EXPLICIT_KEY);
- buffer_put_string(buf, buffer_ptr(§),
- buffer_len(§));
+ if (sshbuf_len(sect) != 0) {
+ if ((r = sshbuf_put_u8(buf, KRL_SECTION_EXPLICIT_KEY)) != 0 ||
+ (r = sshbuf_put_stringb(buf, sect)) != 0)
+ goto out;
}
- buffer_clear(§);
+ sshbuf_reset(sect);
RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
- debug3("%s: hash len %u ", __func__, rb->len);
- buffer_put_string(§, rb->blob, rb->len);
+ KRL_DBG(("%s: hash len %zu ", __func__, rb->len));
+ if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
+ goto out;
}
- if (buffer_len(§) != 0) {
- buffer_put_char(buf, KRL_SECTION_FINGERPRINT_SHA1);
- buffer_put_string(buf, buffer_ptr(§),
- buffer_len(§));
+ if (sshbuf_len(sect) != 0) {
+ if ((r = sshbuf_put_u8(buf,
+ KRL_SECTION_FINGERPRINT_SHA1)) != 0 ||
+ (r = sshbuf_put_stringb(buf, sect)) != 0)
+ goto out;
}
for (i = 0; i < nsign_keys; i++) {
- if (key_to_blob(sign_keys[i], &kblob, &klen) == 0)
+ KRL_DBG(("%s: signature key %s", __func__,
+ sshkey_ssh_name(sign_keys[i])));
+ if ((r = sshbuf_put_u8(buf, KRL_SECTION_SIGNATURE)) != 0 ||
+ (r = sshkey_puts(sign_keys[i], buf)) != 0)
goto out;
- debug3("%s: signature key len %u", __func__, klen);
- buffer_put_char(buf, KRL_SECTION_SIGNATURE);
- buffer_put_string(buf, kblob, klen);
-
- if (key_sign(sign_keys[i], &sblob, &slen,
- buffer_ptr(buf), buffer_len(buf)) == -1)
+ if ((r = sshkey_sign(sign_keys[i], &sblob, &slen,
+ sshbuf_ptr(buf), sshbuf_len(buf), NULL, 0)) != 0)
goto out;
- debug3("%s: signature sig len %u", __func__, slen);
- buffer_put_string(buf, sblob, slen);
+ KRL_DBG(("%s: signature sig len %zu", __func__, slen));
+ if ((r = sshbuf_put_string(buf, sblob, slen)) != 0)
+ goto out;
}
r = 0;
out:
- free(kblob);
free(sblob);
- buffer_free(§);
+ sshbuf_free(sect);
return r;
}
@@ -745,112 +794,101 @@
t = timestamp;
tm = localtime(&t);
- *ts = '\0';
- strftime(ts, nts, "%Y%m%dT%H%M%S", tm);
+ if (tm == NULL)
+ strlcpy(ts, "<INVALID>", nts);
+ else {
+ *ts = '\0';
+ strftime(ts, nts, "%Y%m%dT%H%M%S", tm);
+ }
}
static int
-parse_revoked_certs(Buffer *buf, struct ssh_krl *krl)
+parse_revoked_certs(struct sshbuf *buf, struct ssh_krl *krl)
{
- int ret = -1, nbits;
- u_char type, *blob;
- u_int blen;
- Buffer subsect;
+ int r = SSH_ERR_INTERNAL_ERROR;
+ u_char type;
+ const u_char *blob;
+ size_t blen, nbits;
+ struct sshbuf *subsect = NULL;
u_int64_t serial, serial_lo, serial_hi;
- BIGNUM *bitmap = NULL;
+ struct bitmap *bitmap = NULL;
char *key_id = NULL;
- Key *ca_key = NULL;
+ struct sshkey *ca_key = NULL;
- buffer_init(&subsect);
+ if ((subsect = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
- if ((blob = buffer_get_string_ptr_ret(buf, &blen)) == NULL ||
- buffer_get_string_ptr_ret(buf, NULL) == NULL) { /* reserved */
- error("%s: buffer error", __func__);
+ /* Header: key, reserved */
+ if ((r = sshbuf_get_string_direct(buf, &blob, &blen)) != 0 ||
+ (r = sshbuf_skip_string(buf)) != 0)
goto out;
- }
- if ((ca_key = key_from_blob(blob, blen)) == NULL)
+ if (blen != 0 && (r = sshkey_from_blob(blob, blen, &ca_key)) != 0)
goto out;
- while (buffer_len(buf) > 0) {
- if (buffer_get_char_ret(&type, buf) != 0 ||
- (blob = buffer_get_string_ptr_ret(buf, &blen)) == NULL) {
- error("%s: buffer error", __func__);
+ while (sshbuf_len(buf) > 0) {
+ sshbuf_free(subsect);
+ subsect = NULL;
+ if ((r = sshbuf_get_u8(buf, &type)) != 0 ||
+ (r = sshbuf_froms(buf, &subsect)) != 0)
goto out;
- }
- buffer_clear(&subsect);
- buffer_append(&subsect, blob, blen);
- debug3("%s: subsection type 0x%02x", __func__, type);
- /* buffer_dump(&subsect); */
+ KRL_DBG(("%s: subsection type 0x%02x", __func__, type));
+ /* sshbuf_dump(subsect, stderr); */
switch (type) {
case KRL_SECTION_CERT_SERIAL_LIST:
- while (buffer_len(&subsect) > 0) {
- if (buffer_get_int64_ret(&serial,
- &subsect) != 0) {
- error("%s: buffer error", __func__);
+ while (sshbuf_len(subsect) > 0) {
+ if ((r = sshbuf_get_u64(subsect, &serial)) != 0)
goto out;
- }
- if (ssh_krl_revoke_cert_by_serial(krl, ca_key,
- serial) != 0) {
- error("%s: update failed", __func__);
+ if ((r = ssh_krl_revoke_cert_by_serial(krl,
+ ca_key, serial)) != 0)
goto out;
- }
}
break;
case KRL_SECTION_CERT_SERIAL_RANGE:
- if (buffer_get_int64_ret(&serial_lo, &subsect) != 0 ||
- buffer_get_int64_ret(&serial_hi, &subsect) != 0) {
- error("%s: buffer error", __func__);
+ if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
+ (r = sshbuf_get_u64(subsect, &serial_hi)) != 0)
goto out;
- }
- if (ssh_krl_revoke_cert_by_serial_range(krl, ca_key,
- serial_lo, serial_hi) != 0) {
- error("%s: update failed", __func__);
+ if ((r = ssh_krl_revoke_cert_by_serial_range(krl,
+ ca_key, serial_lo, serial_hi)) != 0)
goto out;
- }
break;
case KRL_SECTION_CERT_SERIAL_BITMAP:
- if ((bitmap = BN_new()) == NULL) {
- error("%s: BN_new", __func__);
+ if ((bitmap = bitmap_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
goto out;
}
- if (buffer_get_int64_ret(&serial_lo, &subsect) != 0 ||
- buffer_get_bignum2_ret(&subsect, bitmap) != 0) {
- error("%s: buffer error", __func__);
+ if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
+ (r = sshbuf_get_bignum2_bytes_direct(subsect,
+ &blob, &blen)) != 0)
goto out;
- }
- if ((nbits = BN_num_bits(bitmap)) < 0) {
- error("%s: bitmap bits < 0", __func__);
+ if (bitmap_from_string(bitmap, blob, blen) != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
- for (serial = 0; serial < (u_int)nbits; serial++) {
+ nbits = bitmap_nbits(bitmap);
+ for (serial = 0; serial < (u_int64_t)nbits; serial++) {
if (serial > 0 && serial_lo + serial == 0) {
error("%s: bitmap wraps u64", __func__);
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
- if (!BN_is_bit_set(bitmap, serial))
+ if (!bitmap_test_bit(bitmap, serial))
continue;
- if (ssh_krl_revoke_cert_by_serial(krl, ca_key,
- serial_lo + serial) != 0) {
- error("%s: update failed", __func__);
+ if ((r = ssh_krl_revoke_cert_by_serial(krl,
+ ca_key, serial_lo + serial)) != 0)
goto out;
- }
}
- BN_free(bitmap);
+ bitmap_free(bitmap);
bitmap = NULL;
break;
case KRL_SECTION_CERT_KEY_ID:
- while (buffer_len(&subsect) > 0) {
- if ((key_id = buffer_get_cstring_ret(&subsect,
- NULL)) == NULL) {
- error("%s: buffer error", __func__);
+ while (sshbuf_len(subsect) > 0) {
+ if ((r = sshbuf_get_cstring(subsect,
+ &key_id, NULL)) != 0)
goto out;
- }
- if (ssh_krl_revoke_cert_by_key_id(krl, ca_key,
- key_id) != 0) {
- error("%s: update failed", __func__);
+ if ((r = ssh_krl_revoke_cert_by_key_id(krl,
+ ca_key, key_id)) != 0)
goto out;
- }
free(key_id);
key_id = NULL;
}
@@ -857,80 +895,75 @@
break;
default:
error("Unsupported KRL certificate section %u", type);
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
- if (buffer_len(&subsect) > 0) {
+ if (sshbuf_len(subsect) > 0) {
error("KRL certificate section contains unparsed data");
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
}
- ret = 0;
+ r = 0;
out:
- if (ca_key != NULL)
- key_free(ca_key);
if (bitmap != NULL)
- BN_free(bitmap);
+ bitmap_free(bitmap);
free(key_id);
- buffer_free(&subsect);
- return ret;
+ sshkey_free(ca_key);
+ sshbuf_free(subsect);
+ return r;
}
/* Attempt to parse a KRL, checking its signature (if any) with sign_ca_keys. */
int
-ssh_krl_from_blob(Buffer *buf, struct ssh_krl **krlp,
- const Key **sign_ca_keys, u_int nsign_ca_keys)
+ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
+ const struct sshkey **sign_ca_keys, size_t nsign_ca_keys)
{
- Buffer copy, sect;
- struct ssh_krl *krl;
+ struct sshbuf *copy = NULL, *sect = NULL;
+ struct ssh_krl *krl = NULL;
char timestamp[64];
- int ret = -1, r, sig_seen;
- Key *key = NULL, **ca_used = NULL;
- u_char type, *blob, *rdata = NULL;
- u_int i, j, sig_off, sects_off, rlen, blen, format_version, nca_used;
+ int r = SSH_ERR_INTERNAL_ERROR, sig_seen;
+ struct sshkey *key = NULL, **ca_used = NULL, **tmp_ca_used;
+ u_char type, *rdata = NULL;
+ const u_char *blob;
+ size_t i, j, sig_off, sects_off, rlen, blen, nca_used;
+ u_int format_version;
nca_used = 0;
*krlp = NULL;
- if (buffer_len(buf) < sizeof(KRL_MAGIC) - 1 ||
- memcmp(buffer_ptr(buf), KRL_MAGIC, sizeof(KRL_MAGIC) - 1) != 0) {
+ if (sshbuf_len(buf) < sizeof(KRL_MAGIC) - 1 ||
+ memcmp(sshbuf_ptr(buf), KRL_MAGIC, sizeof(KRL_MAGIC) - 1) != 0) {
debug3("%s: not a KRL", __func__);
- /*
- * Return success but a NULL *krlp here to signal that the
- * file might be a simple list of keys.
- */
- return 0;
+ return SSH_ERR_KRL_BAD_MAGIC;
}
/* Take a copy of the KRL buffer so we can verify its signature later */
- buffer_init(©);
- buffer_append(©, buffer_ptr(buf), buffer_len(buf));
+ if ((copy = sshbuf_fromb(buf)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_consume(copy, sizeof(KRL_MAGIC) - 1)) != 0)
+ goto out;
- buffer_init(§);
- buffer_consume(©, sizeof(KRL_MAGIC) - 1);
-
if ((krl = ssh_krl_init()) == NULL) {
error("%s: alloc failed", __func__);
goto out;
}
- if (buffer_get_int_ret(&format_version, ©) != 0) {
- error("%s: KRL truncated", __func__);
+ if ((r = sshbuf_get_u32(copy, &format_version)) != 0)
goto out;
- }
if (format_version != KRL_FORMAT_VERSION) {
- error("%s: KRL unsupported format version %u",
- __func__, format_version);
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
- if (buffer_get_int64_ret(&krl->krl_version, ©) != 0 ||
- buffer_get_int64_ret(&krl->generated_date, ©) != 0 ||
- buffer_get_int64_ret(&krl->flags, ©) != 0 ||
- buffer_get_string_ptr_ret(©, NULL) == NULL || /* reserved */
- (krl->comment = buffer_get_cstring_ret(©, NULL)) == NULL) {
- error("%s: buffer error", __func__);
+ if ((r = sshbuf_get_u64(copy, &krl->krl_version)) != 0 ||
+ (r = sshbuf_get_u64(copy, &krl->generated_date)) != 0 ||
+ (r = sshbuf_get_u64(copy, &krl->flags)) != 0 ||
+ (r = sshbuf_skip_string(copy)) != 0 ||
+ (r = sshbuf_get_cstring(copy, &krl->comment, NULL)) != 0)
goto out;
- }
format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
debug("KRL version %llu generated at %s%s%s",
@@ -942,18 +975,22 @@
* detailed parsing of data whose provenance is unverified.
*/
sig_seen = 0;
- sects_off = buffer_len(buf) - buffer_len(©);
- while (buffer_len(©) > 0) {
- if (buffer_get_char_ret(&type, ©) != 0 ||
- (blob = buffer_get_string_ptr_ret(©, &blen)) == NULL) {
- error("%s: buffer error", __func__);
+ if (sshbuf_len(buf) < sshbuf_len(copy)) {
+ /* Shouldn't happen */
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
+ }
+ sects_off = sshbuf_len(buf) - sshbuf_len(copy);
+ while (sshbuf_len(copy) > 0) {
+ if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
+ (r = sshbuf_get_string_direct(copy, &blob, &blen)) != 0)
goto out;
- }
- debug3("%s: first pass, section 0x%02x", __func__, type);
+ KRL_DBG(("%s: first pass, section 0x%02x", __func__, type));
if (type != KRL_SECTION_SIGNATURE) {
if (sig_seen) {
error("KRL contains non-signature section "
"after signature");
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
/* Not interested for now. */
@@ -961,94 +998,111 @@
}
sig_seen = 1;
/* First string component is the signing key */
- if ((key = key_from_blob(blob, blen)) == NULL) {
- error("%s: invalid signature key", __func__);
+ if ((r = sshkey_from_blob(blob, blen, &key)) != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
- sig_off = buffer_len(buf) - buffer_len(©);
+ if (sshbuf_len(buf) < sshbuf_len(copy)) {
+ /* Shouldn't happen */
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
+ }
+ sig_off = sshbuf_len(buf) - sshbuf_len(copy);
/* Second string component is the signature itself */
- if ((blob = buffer_get_string_ptr_ret(©, &blen)) == NULL) {
- error("%s: buffer error", __func__);
+ if ((r = sshbuf_get_string_direct(copy, &blob, &blen)) != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
/* Check signature over entire KRL up to this point */
- if (key_verify(key, blob, blen,
- buffer_ptr(buf), buffer_len(buf) - sig_off) != 1) {
- error("bad signaure on KRL");
+ if ((r = sshkey_verify(key, blob, blen,
+ sshbuf_ptr(buf), sig_off, 0)) != 0)
goto out;
- }
/* Check if this key has already signed this KRL */
for (i = 0; i < nca_used; i++) {
- if (key_equal(ca_used[i], key)) {
+ if (sshkey_equal(ca_used[i], key)) {
error("KRL signed more than once with "
"the same key");
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
}
/* Record keys used to sign the KRL */
- ca_used = xrealloc(ca_used, nca_used + 1, sizeof(*ca_used));
+ tmp_ca_used = reallocarray(ca_used, nca_used + 1,
+ sizeof(*ca_used));
+ if (tmp_ca_used == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ ca_used = tmp_ca_used;
ca_used[nca_used++] = key;
key = NULL;
- break;
}
+ if (sshbuf_len(copy) != 0) {
+ /* Shouldn't happen */
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
+ }
+
/*
* 2nd pass: parse and load the KRL, skipping the header to the point
* where the section start.
*/
- buffer_append(©, (u_char*)buffer_ptr(buf) + sects_off,
- buffer_len(buf) - sects_off);
- while (buffer_len(©) > 0) {
- if (buffer_get_char_ret(&type, ©) != 0 ||
- (blob = buffer_get_string_ptr_ret(©, &blen)) == NULL) {
- error("%s: buffer error", __func__);
+ sshbuf_free(copy);
+ if ((copy = sshbuf_fromb(buf)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_consume(copy, sects_off)) != 0)
+ goto out;
+ while (sshbuf_len(copy) > 0) {
+ sshbuf_free(sect);
+ sect = NULL;
+ if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
+ (r = sshbuf_froms(copy, §)) != 0)
goto out;
- }
- debug3("%s: second pass, section 0x%02x", __func__, type);
- buffer_clear(§);
- buffer_append(§, blob, blen);
+ KRL_DBG(("%s: second pass, section 0x%02x", __func__, type));
switch (type) {
case KRL_SECTION_CERTIFICATES:
- if ((r = parse_revoked_certs(§, krl)) != 0)
+ if ((r = parse_revoked_certs(sect, krl)) != 0)
goto out;
break;
case KRL_SECTION_EXPLICIT_KEY:
case KRL_SECTION_FINGERPRINT_SHA1:
- while (buffer_len(§) > 0) {
- if ((rdata = buffer_get_string_ret(§,
- &rlen)) == NULL) {
- error("%s: buffer error", __func__);
+ while (sshbuf_len(sect) > 0) {
+ if ((r = sshbuf_get_string(sect,
+ &rdata, &rlen)) != 0)
goto out;
- }
if (type == KRL_SECTION_FINGERPRINT_SHA1 &&
rlen != 20) {
error("%s: bad SHA1 length", __func__);
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
- if (revoke_blob(
+ if ((r = revoke_blob(
type == KRL_SECTION_EXPLICIT_KEY ?
&krl->revoked_keys : &krl->revoked_sha1s,
- rdata, rlen) != 0)
+ rdata, rlen)) != 0)
goto out;
- rdata = NULL; /* revoke_blob frees blob */
+ rdata = NULL; /* revoke_blob frees rdata */
}
break;
case KRL_SECTION_SIGNATURE:
/* Handled above, but still need to stay in synch */
- buffer_clear(§);
- if ((blob = buffer_get_string_ptr_ret(©,
- &blen)) == NULL) {
- error("%s: buffer error", __func__);
+ sshbuf_reset(sect);
+ sect = NULL;
+ if ((r = sshbuf_skip_string(copy)) != 0)
goto out;
- }
break;
default:
error("Unsupported KRL section %u", type);
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
- if (buffer_len(§) > 0) {
+ if (sect != NULL && sshbuf_len(sect) > 0) {
error("KRL section contains unparsed data");
+ r = SSH_ERR_INVALID_FORMAT;
goto out;
}
}
@@ -1059,12 +1113,13 @@
if (ssh_krl_check_key(krl, ca_used[i]) == 0)
sig_seen = 1;
else {
- key_free(ca_used[i]);
+ sshkey_free(ca_used[i]);
ca_used[i] = NULL;
}
}
if (nca_used && !sig_seen) {
error("All keys used to sign KRL were revoked");
+ r = SSH_ERR_KEY_REVOKED;
goto out;
}
@@ -1075,7 +1130,7 @@
for (j = 0; j < nca_used; j++) {
if (ca_used[j] == NULL)
continue;
- if (key_equal(ca_used[j], sign_ca_keys[i])) {
+ if (sshkey_equal(ca_used[j], sign_ca_keys[i])) {
sig_seen = 1;
break;
}
@@ -1082,6 +1137,7 @@
}
}
if (!sig_seen) {
+ r = SSH_ERR_SIGNATURE_INVALID;
error("KRL not signed with any trusted key");
goto out;
}
@@ -1088,150 +1144,155 @@
}
*krlp = krl;
- ret = 0;
+ r = 0;
out:
- if (ret != 0)
+ if (r != 0)
ssh_krl_free(krl);
- for (i = 0; i < nca_used; i++) {
- if (ca_used[i] != NULL)
- key_free(ca_used[i]);
- }
+ for (i = 0; i < nca_used; i++)
+ sshkey_free(ca_used[i]);
free(ca_used);
free(rdata);
- if (key != NULL)
- key_free(key);
- buffer_free(©);
- buffer_free(§);
- return ret;
+ sshkey_free(key);
+ sshbuf_free(copy);
+ sshbuf_free(sect);
+ return r;
}
+/* Checks certificate serial number and key ID revocation */
+static int
+is_cert_revoked(const struct sshkey *key, struct revoked_certs *rc)
+{
+ struct revoked_serial rs, *ers;
+ struct revoked_key_id rki, *erki;
+
+ /* Check revocation by cert key ID */
+ memset(&rki, 0, sizeof(rki));
+ rki.key_id = key->cert->key_id;
+ erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
+ if (erki != NULL) {
+ KRL_DBG(("%s: revoked by key ID", __func__));
+ return SSH_ERR_KEY_REVOKED;
+ }
+
+ /*
+ * Zero serials numbers are ignored (it's the default when the
+ * CA doesn't specify one).
+ */
+ if (key->cert->serial == 0)
+ return 0;
+
+ memset(&rs, 0, sizeof(rs));
+ rs.lo = rs.hi = key->cert->serial;
+ ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
+ if (ers != NULL) {
+ KRL_DBG(("%s: revoked serial %llu matched %llu:%llu", __func__,
+ key->cert->serial, ers->lo, ers->hi));
+ return SSH_ERR_KEY_REVOKED;
+ }
+ return 0;
+}
+
/* Checks whether a given key/cert is revoked. Does not check its CA */
static int
-is_key_revoked(struct ssh_krl *krl, const Key *key)
+is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
{
struct revoked_blob rb, *erb;
- struct revoked_serial rs, *ers;
- struct revoked_key_id rki, *erki;
struct revoked_certs *rc;
+ int r;
/* Check explicitly revoked hashes first */
memset(&rb, 0, sizeof(rb));
- if ((rb.blob = key_fingerprint_raw(key, SSH_FP_SHA1, &rb.len)) == NULL)
- return -1;
+ if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA1,
+ &rb.blob, &rb.len)) != 0)
+ return r;
erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
free(rb.blob);
if (erb != NULL) {
- debug("%s: revoked by key SHA1", __func__);
- return -1;
+ KRL_DBG(("%s: revoked by key SHA1", __func__));
+ return SSH_ERR_KEY_REVOKED;
}
/* Next, explicit keys */
memset(&rb, 0, sizeof(rb));
- if (plain_key_blob(key, &rb.blob, &rb.len) != 0)
- return -1;
+ if ((r = plain_key_blob(key, &rb.blob, &rb.len)) != 0)
+ return r;
erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
free(rb.blob);
if (erb != NULL) {
- debug("%s: revoked by explicit key", __func__);
- return -1;
+ KRL_DBG(("%s: revoked by explicit key", __func__));
+ return SSH_ERR_KEY_REVOKED;
}
- if (!key_is_cert(key))
+ if (!sshkey_is_cert(key))
return 0;
- /* Check cert revocation */
- if (revoked_certs_for_ca_key(krl, key->cert->signature_key,
- &rc, 0) != 0)
- return -1;
- if (rc == NULL)
- return 0; /* No entry for this CA */
-
- /* Check revocation by cert key ID */
- memset(&rki, 0, sizeof(rki));
- rki.key_id = key->cert->key_id;
- erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
- if (erki != NULL) {
- debug("%s: revoked by key ID", __func__);
- return -1;
+ /* Check cert revocation for the specified CA */
+ if ((r = revoked_certs_for_ca_key(krl, key->cert->signature_key,
+ &rc, 0)) != 0)
+ return r;
+ if (rc != NULL) {
+ if ((r = is_cert_revoked(key, rc)) != 0)
+ return r;
}
+ /* Check cert revocation for the wildcard CA */
+ if ((r = revoked_certs_for_ca_key(krl, NULL, &rc, 0)) != 0)
+ return r;
+ if (rc != NULL) {
+ if ((r = is_cert_revoked(key, rc)) != 0)
+ return r;
+ }
- /*
- * Legacy cert formats lack serial numbers. Zero serials numbers
- * are ignored (it's the default when the CA doesn't specify one).
- */
- if (key_cert_is_legacy(key) || key->cert->serial == 0)
- return 0;
-
- memset(&rs, 0, sizeof(rs));
- rs.lo = rs.hi = key->cert->serial;
- ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
- if (ers != NULL) {
- KRL_DBG(("%s: %llu matched %llu:%llu", __func__,
- key->cert->serial, ers->lo, ers->hi));
- debug("%s: revoked by serial", __func__);
- return -1;
- }
KRL_DBG(("%s: %llu no match", __func__, key->cert->serial));
-
return 0;
}
int
-ssh_krl_check_key(struct ssh_krl *krl, const Key *key)
+ssh_krl_check_key(struct ssh_krl *krl, const struct sshkey *key)
{
int r;
- debug2("%s: checking key", __func__);
+ KRL_DBG(("%s: checking key", __func__));
if ((r = is_key_revoked(krl, key)) != 0)
return r;
- if (key_is_cert(key)) {
+ if (sshkey_is_cert(key)) {
debug2("%s: checking CA key", __func__);
if ((r = is_key_revoked(krl, key->cert->signature_key)) != 0)
return r;
}
- debug3("%s: key okay", __func__);
+ KRL_DBG(("%s: key okay", __func__));
return 0;
}
-/* Returns 0 on success, -1 on error or key revoked, -2 if path is not a KRL */
int
-ssh_krl_file_contains_key(const char *path, const Key *key)
+ssh_krl_file_contains_key(const char *path, const struct sshkey *key)
{
- Buffer krlbuf;
- struct ssh_krl *krl;
- int revoked, fd;
+ struct sshbuf *krlbuf = NULL;
+ struct ssh_krl *krl = NULL;
+ int oerrno = 0, r, fd;
if (path == NULL)
return 0;
+ if ((krlbuf = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
if ((fd = open(path, O_RDONLY)) == -1) {
- error("open %s: %s", path, strerror(errno));
- error("Revoked keys file not accessible - refusing public key "
- "authentication");
- return -1;
+ r = SSH_ERR_SYSTEM_ERROR;
+ oerrno = errno;
+ goto out;
}
- buffer_init(&krlbuf);
- if (!key_load_file(fd, path, &krlbuf)) {
- close(fd);
- buffer_free(&krlbuf);
- error("Revoked keys file not readable - refusing public key "
- "authentication");
- return -1;
+ if ((r = sshkey_load_file(fd, krlbuf)) != 0) {
+ oerrno = errno;
+ goto out;
}
+ if ((r = ssh_krl_from_blob(krlbuf, &krl, NULL, 0)) != 0)
+ goto out;
+ debug2("%s: checking KRL %s", __func__, path);
+ r = ssh_krl_check_key(krl, key);
+ out:
close(fd);
- if (ssh_krl_from_blob(&krlbuf, &krl, NULL, 0) != 0) {
- buffer_free(&krlbuf);
- error("Invalid KRL, refusing public key "
- "authentication");
- return -1;
- }
- buffer_free(&krlbuf);
- if (krl == NULL) {
- debug3("%s: %s is not a KRL file", __func__, path);
- return -2;
- }
- debug2("%s: checking KRL %s", __func__, path);
- revoked = ssh_krl_check_key(krl, key) != 0;
+ sshbuf_free(krlbuf);
ssh_krl_free(krl);
- return revoked ? -1 : 0;
+ if (r != 0)
+ errno = oerrno;
+ return r;
}
Modified: trunk/crypto/openssh/krl.h
===================================================================
--- trunk/crypto/openssh/krl.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/krl.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -14,7 +14,7 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $OpenBSD: krl.h,v 1.2 2013/01/18 00:24:58 djm Exp $ */
+/* $OpenBSD: krl.h,v 1.5 2015/12/30 23:46:14 djm Exp $ */
#ifndef _KRL_H
#define _KRL_H
@@ -36,28 +36,29 @@
#define KRL_SECTION_CERT_SERIAL_BITMAP 0x22
#define KRL_SECTION_CERT_KEY_ID 0x23
+struct sshkey;
+struct sshbuf;
struct ssh_krl;
struct ssh_krl *ssh_krl_init(void);
void ssh_krl_free(struct ssh_krl *krl);
void ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version);
-void ssh_krl_set_sign_key(struct ssh_krl *krl, const Key *sign_key);
-void ssh_krl_set_comment(struct ssh_krl *krl, const char *comment);
-int ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const Key *ca_key,
- u_int64_t serial);
-int ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl, const Key *ca_key,
- u_int64_t lo, u_int64_t hi);
-int ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const Key *ca_key,
- const char *key_id);
-int ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const Key *key);
-int ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const Key *key);
-int ssh_krl_revoke_key(struct ssh_krl *krl, const Key *key);
-int ssh_krl_to_blob(struct ssh_krl *krl, Buffer *buf, const Key **sign_keys,
- u_int nsign_keys);
-int ssh_krl_from_blob(Buffer *buf, struct ssh_krl **krlp,
- const Key **sign_ca_keys, u_int nsign_ca_keys);
-int ssh_krl_check_key(struct ssh_krl *krl, const Key *key);
-int ssh_krl_file_contains_key(const char *path, const Key *key);
+int ssh_krl_set_comment(struct ssh_krl *krl, const char *comment);
+int ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl,
+ const struct sshkey *ca_key, u_int64_t serial);
+int ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl,
+ const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi);
+int ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl,
+ const struct sshkey *ca_key, const char *key_id);
+int ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const struct sshkey *key);
+int ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const struct sshkey *key);
+int ssh_krl_revoke_key(struct ssh_krl *krl, const struct sshkey *key);
+int ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf,
+ const struct sshkey **sign_keys, u_int nsign_keys);
+int ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
+ const struct sshkey **sign_ca_keys, size_t nsign_ca_keys);
+int ssh_krl_check_key(struct ssh_krl *krl, const struct sshkey *key);
+int ssh_krl_file_contains_key(const char *path, const struct sshkey *key);
#endif /* _KRL_H */
Modified: trunk/crypto/openssh/log.c
===================================================================
--- trunk/crypto/openssh/log.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/log.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: log.c,v 1.45 2013/05/16 09:08:41 dtucker Exp $ */
+/* $OpenBSD: log.c,v 1.48 2016/07/15 05:01:58 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -50,7 +50,6 @@
# include <vis.h>
#endif
-#include "xmalloc.h"
#include "log.h"
static LogLevel log_level = SYSLOG_LEVEL_INFO;
@@ -177,7 +176,17 @@
_exit(1);
}
+void
+logdie(const char *fmt,...)
+{
+ va_list args;
+ va_start(args, fmt);
+ do_log(SYSLOG_LEVEL_INFO, fmt, args);
+ va_end(args);
+ cleanup_exit(255);
+}
+
/* Log this message (information that usually should go to the log). */
void
@@ -343,7 +352,7 @@
int
log_is_on_stderr(void)
{
- return log_on_stderr;
+ return log_on_stderr && log_stderr_fd == STDERR_FILENO;
}
/* redirect what would usually get written to stderr to specified file */
Modified: trunk/crypto/openssh/log.h
===================================================================
--- trunk/crypto/openssh/log.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/log.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: log.h,v 1.20 2013/04/07 02:10:33 dtucker Exp $ */
+/* $OpenBSD: log.h,v 1.21 2016/07/15 05:01:58 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -63,6 +63,8 @@
void error(const char *, ...) __attribute__((format(printf, 1, 2)));
void sigdie(const char *, ...) __attribute__((noreturn))
__attribute__((format(printf, 1, 2)));
+void logdie(const char *, ...) __attribute__((noreturn))
+ __attribute__((format(printf, 1, 2)));
void logit(const char *, ...) __attribute__((format(printf, 1, 2)));
void verbose(const char *, ...) __attribute__((format(printf, 1, 2)));
void debug(const char *, ...) __attribute__((format(printf, 1, 2)));
Modified: trunk/crypto/openssh/loginrec.c
===================================================================
--- trunk/crypto/openssh/loginrec.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/loginrec.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -150,6 +150,9 @@
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
#include <netinet/in.h>
@@ -787,12 +790,12 @@
/* this is just a 128-bit IPv6 address */
if (li->hostaddr.sa.sa_family == AF_INET6) {
sa6 = ((struct sockaddr_in6 *)&li->hostaddr.sa);
- memcpy(ut->ut_addr_v6, sa6->sin6_addr.s6_addr, 16);
+ memcpy(utx->ut_addr_v6, sa6->sin6_addr.s6_addr, 16);
if (IN6_IS_ADDR_V4MAPPED(&sa6->sin6_addr)) {
- ut->ut_addr_v6[0] = ut->ut_addr_v6[3];
- ut->ut_addr_v6[1] = 0;
- ut->ut_addr_v6[2] = 0;
- ut->ut_addr_v6[3] = 0;
+ utx->ut_addr_v6[0] = utx->ut_addr_v6[3];
+ utx->ut_addr_v6[1] = 0;
+ utx->ut_addr_v6[2] = 0;
+ utx->ut_addr_v6[3] = 0;
}
}
# endif
Modified: trunk/crypto/openssh/mac.c
===================================================================
--- trunk/crypto/openssh/mac.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/mac.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: mac.c,v 1.28 2014/02/07 06:55:54 djm Exp $ */
+/* $OpenBSD: mac.c,v 1.33 2016/07/08 03:44:42 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -27,22 +27,16 @@
#include <sys/types.h>
-#include <stdarg.h>
#include <string.h>
-#include <signal.h>
+#include <stdio.h>
-#include "xmalloc.h"
-#include "log.h"
-#include "cipher.h"
-#include "buffer.h"
-#include "key.h"
-#include "kex.h"
-#include "mac.h"
-#include "misc.h"
-
#include "digest.h"
#include "hmac.h"
#include "umac.h"
+#include "mac.h"
+#include "misc.h"
+#include "ssherr.h"
+#include "sshbuf.h"
#include "openbsd-compat/openssl-compat.h"
@@ -95,7 +89,7 @@
char *
mac_alg_list(char sep)
{
- char *ret = NULL;
+ char *ret = NULL, *tmp;
size_t nlen, rlen = 0;
const struct macalg *m;
@@ -103,7 +97,11 @@
if (ret != NULL)
ret[rlen++] = sep;
nlen = strlen(m->name);
- ret = xrealloc(ret, 1, rlen + nlen + 2);
+ if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) {
+ free(ret);
+ return NULL;
+ }
+ ret = tmp;
memcpy(ret + rlen, m->name, nlen + 1);
rlen += nlen;
}
@@ -110,13 +108,13 @@
return ret;
}
-static void
-mac_setup_by_alg(Mac *mac, const struct macalg *macalg)
+static int
+mac_setup_by_alg(struct sshmac *mac, const struct macalg *macalg)
{
mac->type = macalg->type;
if (mac->type == SSH_DIGEST) {
if ((mac->hmac_ctx = ssh_hmac_start(macalg->alg)) == NULL)
- fatal("ssh_hmac_start(alg=%d) failed", macalg->alg);
+ return SSH_ERR_ALLOC_FAIL;
mac->key_len = mac->mac_len = ssh_hmac_bytes(macalg->alg);
} else {
mac->mac_len = macalg->len / 8;
@@ -126,10 +124,11 @@
if (macalg->truncatebits != 0)
mac->mac_len = macalg->truncatebits / 8;
mac->etm = macalg->etm;
+ return 0;
}
int
-mac_setup(Mac *mac, char *name)
+mac_setup(struct sshmac *mac, char *name)
{
const struct macalg *m;
@@ -136,50 +135,51 @@
for (m = macs; m->name != NULL; m++) {
if (strcmp(name, m->name) != 0)
continue;
- if (mac != NULL) {
- mac_setup_by_alg(mac, m);
- debug2("mac_setup: setup %s", name);
- }
- return (0);
+ if (mac != NULL)
+ return mac_setup_by_alg(mac, m);
+ return 0;
}
- debug2("mac_setup: unknown %s", name);
- return (-1);
+ return SSH_ERR_INVALID_ARGUMENT;
}
int
-mac_init(Mac *mac)
+mac_init(struct sshmac *mac)
{
if (mac->key == NULL)
- fatal("%s: no key", __func__);
+ return SSH_ERR_INVALID_ARGUMENT;
switch (mac->type) {
case SSH_DIGEST:
if (mac->hmac_ctx == NULL ||
ssh_hmac_init(mac->hmac_ctx, mac->key, mac->key_len) < 0)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
return 0;
case SSH_UMAC:
- mac->umac_ctx = umac_new(mac->key);
+ if ((mac->umac_ctx = umac_new(mac->key)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
return 0;
case SSH_UMAC128:
- mac->umac_ctx = umac128_new(mac->key);
+ if ((mac->umac_ctx = umac128_new(mac->key)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
return 0;
default:
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
}
}
-u_char *
-mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
+int
+mac_compute(struct sshmac *mac, u_int32_t seqno,
+ const u_char *data, int datalen,
+ u_char *digest, size_t dlen)
{
static union {
- u_char m[EVP_MAX_MD_SIZE];
+ u_char m[SSH_DIGEST_MAX_LENGTH];
u_int64_t for_align;
} u;
- u_char b[4], nonce[8];
+ u_char b[4];
+ u_char nonce[8];
if (mac->mac_len > sizeof(u))
- fatal("mac_compute: mac too long %u %zu",
- mac->mac_len, sizeof(u));
+ return SSH_ERR_INTERNAL_ERROR;
switch (mac->type) {
case SSH_DIGEST:
@@ -189,10 +189,10 @@
ssh_hmac_update(mac->hmac_ctx, b, sizeof(b)) < 0 ||
ssh_hmac_update(mac->hmac_ctx, data, datalen) < 0 ||
ssh_hmac_final(mac->hmac_ctx, u.m, sizeof(u.m)) < 0)
- fatal("ssh_hmac failed");
+ return SSH_ERR_LIBCRYPTO_ERROR;
break;
case SSH_UMAC:
- put_u64(nonce, seqno);
+ POKE_U64(nonce, seqno);
umac_update(mac->umac_ctx, data, datalen);
umac_final(mac->umac_ctx, u.m, nonce);
break;
@@ -202,13 +202,36 @@
umac128_final(mac->umac_ctx, u.m, nonce);
break;
default:
- fatal("mac_compute: unknown MAC type");
+ return SSH_ERR_INVALID_ARGUMENT;
}
- return (u.m);
+ if (digest != NULL) {
+ if (dlen > mac->mac_len)
+ dlen = mac->mac_len;
+ memcpy(digest, u.m, dlen);
+ }
+ return 0;
}
+int
+mac_check(struct sshmac *mac, u_int32_t seqno,
+ const u_char *data, size_t dlen,
+ const u_char *theirmac, size_t mlen)
+{
+ u_char ourmac[SSH_DIGEST_MAX_LENGTH];
+ int r;
+
+ if (mac->mac_len > mlen)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((r = mac_compute(mac, seqno, data, dlen,
+ ourmac, sizeof(ourmac))) != 0)
+ return r;
+ if (timingsafe_bcmp(ourmac, theirmac, mac->mac_len) != 0)
+ return SSH_ERR_MAC_INVALID;
+ return 0;
+}
+
void
-mac_clear(Mac *mac)
+mac_clear(struct sshmac *mac)
{
if (mac->type == SSH_UMAC) {
if (mac->umac_ctx != NULL)
@@ -230,17 +253,16 @@
char *maclist, *cp, *p;
if (names == NULL || strcmp(names, "") == 0)
- return (0);
- maclist = cp = xstrdup(names);
+ return 0;
+ if ((maclist = cp = strdup(names)) == NULL)
+ return 0;
for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0';
(p = strsep(&cp, MAC_SEP))) {
if (mac_setup(NULL, p) < 0) {
- debug("bad mac %s [%s]", p, names);
free(maclist);
- return (0);
+ return 0;
}
}
- debug3("macs ok: [%s]", names);
free(maclist);
- return (1);
+ return 1;
}
Modified: trunk/crypto/openssh/mac.h
===================================================================
--- trunk/crypto/openssh/mac.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/mac.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: mac.h,v 1.8 2013/11/07 11:58:27 dtucker Exp $ */
+/* $OpenBSD: mac.h,v 1.10 2016/07/08 03:44:42 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -23,9 +23,31 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
+#ifndef SSHMAC_H
+#define SSHMAC_H
+
+#include <sys/types.h>
+
+struct sshmac {
+ char *name;
+ int enabled;
+ u_int mac_len;
+ u_char *key;
+ u_int key_len;
+ int type;
+ int etm; /* Encrypt-then-MAC */
+ struct ssh_hmac_ctx *hmac_ctx;
+ struct umac_ctx *umac_ctx;
+};
+
int mac_valid(const char *);
char *mac_alg_list(char);
-int mac_setup(Mac *, char *);
-int mac_init(Mac *);
-u_char *mac_compute(Mac *, u_int32_t, u_char *, int);
-void mac_clear(Mac *);
+int mac_setup(struct sshmac *, char *);
+int mac_init(struct sshmac *);
+int mac_compute(struct sshmac *, u_int32_t, const u_char *, int,
+ u_char *, size_t);
+int mac_check(struct sshmac *, u_int32_t, const u_char *, size_t,
+ const u_char *, size_t);
+void mac_clear(struct sshmac *);
+
+#endif /* SSHMAC_H */
Modified: trunk/crypto/openssh/match.c
===================================================================
--- trunk/crypto/openssh/match.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/match.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: match.c,v 1.29 2013/11/20 20:54:10 deraadt Exp $ */
+/* $OpenBSD: match.c,v 1.30 2015/05/04 06:10:48 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -115,15 +115,13 @@
* indicate negation). Returns -1 if negation matches, 1 if there is
* a positive match, 0 if there is no match at all.
*/
-
int
-match_pattern_list(const char *string, const char *pattern, u_int len,
- int dolower)
+match_pattern_list(const char *string, const char *pattern, int dolower)
{
char sub[1024];
int negated;
int got_positive;
- u_int i, subi;
+ u_int i, subi, len = strlen(pattern);
got_positive = 0;
for (i = 0; i < len;) {
@@ -177,9 +175,9 @@
* a positive match, 0 if there is no match at all.
*/
int
-match_hostname(const char *host, const char *pattern, u_int len)
+match_hostname(const char *host, const char *pattern)
{
- return match_pattern_list(host, pattern, len, 1);
+ return match_pattern_list(host, pattern, 1);
}
/*
@@ -200,7 +198,7 @@
return 0;
/* negative hostname match */
- if ((mhost = match_hostname(host, patterns, strlen(patterns))) == -1)
+ if ((mhost = match_hostname(host, patterns)) == -1)
return 0;
/* no match at all */
if (mhost == 0 && mip == 0)
Modified: trunk/crypto/openssh/match.h
===================================================================
--- trunk/crypto/openssh/match.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/match.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: match.h,v 1.15 2010/02/26 20:29:54 djm Exp $ */
+/* $OpenBSD: match.h,v 1.16 2015/05/04 06:10:48 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -15,8 +15,8 @@
#define MATCH_H
int match_pattern(const char *, const char *);
-int match_pattern_list(const char *, const char *, u_int, int);
-int match_hostname(const char *, const char *, u_int);
+int match_pattern_list(const char *, const char *, int);
+int match_hostname(const char *, const char *);
int match_host_and_ip(const char *, const char *, const char *);
int match_user(const char *, const char *, const char *, const char *);
char *match_list(const char *, const char *, u_int *);
Modified: trunk/crypto/openssh/misc.c
===================================================================
--- trunk/crypto/openssh/misc.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/misc.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: misc.c,v 1.92 2013/10/14 23:28:23 djm Exp $ */
+/* $OpenBSD: misc.c,v 1.105 2016/07/15 00:24:30 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2005,2006 Damien Miller. All rights reserved.
@@ -29,8 +29,10 @@
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
-#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/un.h>
+#include <limits.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
@@ -82,9 +84,9 @@
{
int val;
- val = fcntl(fd, F_GETFL, 0);
+ val = fcntl(fd, F_GETFL);
if (val < 0) {
- error("fcntl(%d, F_GETFL, 0): %s", fd, strerror(errno));
+ error("fcntl(%d, F_GETFL): %s", fd, strerror(errno));
return (-1);
}
if (val & O_NONBLOCK) {
@@ -106,9 +108,9 @@
{
int val;
- val = fcntl(fd, F_GETFL, 0);
+ val = fcntl(fd, F_GETFL);
if (val < 0) {
- error("fcntl(%d, F_GETFL, 0): %s", fd, strerror(errno));
+ error("fcntl(%d, F_GETFL): %s", fd, strerror(errno));
return (-1);
}
if (!(val & O_NONBLOCK)) {
@@ -449,6 +451,67 @@
return NULL;
}
+/*
+ * Parse a [user@]host[:port] string.
+ * Caller must free returned user and host.
+ * Any of the pointer return arguments may be NULL (useful for syntax checking).
+ * If user was not specified then *userp will be set to NULL.
+ * If port was not specified then *portp will be -1.
+ * Returns 0 on success, -1 on failure.
+ */
+int
+parse_user_host_port(const char *s, char **userp, char **hostp, int *portp)
+{
+ char *sdup, *cp, *tmp;
+ char *user = NULL, *host = NULL;
+ int port = -1, ret = -1;
+
+ if (userp != NULL)
+ *userp = NULL;
+ if (hostp != NULL)
+ *hostp = NULL;
+ if (portp != NULL)
+ *portp = -1;
+
+ if ((sdup = tmp = strdup(s)) == NULL)
+ return -1;
+ /* Extract optional username */
+ if ((cp = strchr(tmp, '@')) != NULL) {
+ *cp = '\0';
+ if (*tmp == '\0')
+ goto out;
+ if ((user = strdup(tmp)) == NULL)
+ goto out;
+ tmp = cp + 1;
+ }
+ /* Extract mandatory hostname */
+ if ((cp = hpdelim(&tmp)) == NULL || *cp == '\0')
+ goto out;
+ host = xstrdup(cleanhostname(cp));
+ /* Convert and verify optional port */
+ if (tmp != NULL && *tmp != '\0') {
+ if ((port = a2port(tmp)) <= 0)
+ goto out;
+ }
+ /* Success */
+ if (userp != NULL) {
+ *userp = user;
+ user = NULL;
+ }
+ if (hostp != NULL) {
+ *hostp = host;
+ host = NULL;
+ }
+ if (portp != NULL)
+ *portp = port;
+ ret = 0;
+ out:
+ free(sdup);
+ free(user);
+ free(host);
+ return ret;
+}
+
/* function to assist building execv() arguments */
void
addargs(arglist *args, char *fmt, ...)
@@ -471,7 +534,7 @@
} else if (args->num+2 >= nalloc)
nalloc *= 2;
- args->list = xrealloc(args->list, nalloc, sizeof(char *));
+ args->list = xreallocarray(args->list, nalloc, sizeof(char *));
args->nalloc = nalloc;
args->list[args->num++] = cp;
args->list[args->num] = NULL;
@@ -550,7 +613,7 @@
if (path != NULL)
filename = path + 1;
- if (xasprintf(&ret, "%s%s%s", pw->pw_dir, sep, filename) >= MAXPATHLEN)
+ if (xasprintf(&ret, "%s%s%s", pw->pw_dir, sep, filename) >= PATH_MAX)
fatal("tilde_expand_filename: Path too long");
return (ret);
@@ -603,6 +666,8 @@
/* %% case */
if (*string == '%')
goto append;
+ if (*string == '\0')
+ fatal("%s: invalid format", __func__);
for (j = 0; j < num_keys; j++) {
if (strchr(keys[j].key, *string) != NULL) {
i = strlcat(buf, keys[j].repl, sizeof(buf));
@@ -652,53 +717,56 @@
struct ifreq ifr;
char name[100];
int fd = -1, sock;
+ const char *tunbase = "tun";
+ if (mode == SSH_TUNMODE_ETHERNET)
+ tunbase = "tap";
+
/* Open the tunnel device */
if (tun <= SSH_TUNID_MAX) {
- snprintf(name, sizeof(name), "/dev/tun%d", tun);
+ snprintf(name, sizeof(name), "/dev/%s%d", tunbase, tun);
fd = open(name, O_RDWR);
} else if (tun == SSH_TUNID_ANY) {
for (tun = 100; tun >= 0; tun--) {
- snprintf(name, sizeof(name), "/dev/tun%d", tun);
+ snprintf(name, sizeof(name), "/dev/%s%d",
+ tunbase, tun);
if ((fd = open(name, O_RDWR)) >= 0)
break;
}
} else {
debug("%s: invalid tunnel %u", __func__, tun);
- return (-1);
+ return -1;
}
if (fd < 0) {
- debug("%s: %s open failed: %s", __func__, name, strerror(errno));
- return (-1);
+ debug("%s: %s open: %s", __func__, name, strerror(errno));
+ return -1;
}
debug("%s: %s mode %d fd %d", __func__, name, mode, fd);
- /* Set the tunnel device operation mode */
- snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "tun%d", tun);
+ /* Bring interface up if it is not already */
+ snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s%d", tunbase, tun);
if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
goto failed;
- if (ioctl(sock, SIOCGIFFLAGS, &ifr) == -1)
+ if (ioctl(sock, SIOCGIFFLAGS, &ifr) == -1) {
+ debug("%s: get interface %s flags: %s", __func__,
+ ifr.ifr_name, strerror(errno));
goto failed;
+ }
- /* Set interface mode */
- ifr.ifr_flags &= ~IFF_UP;
- if (mode == SSH_TUNMODE_ETHERNET)
- ifr.ifr_flags |= IFF_LINK0;
- else
- ifr.ifr_flags &= ~IFF_LINK0;
- if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1)
- goto failed;
+ if (!(ifr.ifr_flags & IFF_UP)) {
+ ifr.ifr_flags |= IFF_UP;
+ if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1) {
+ debug("%s: activate interface %s: %s", __func__,
+ ifr.ifr_name, strerror(errno));
+ goto failed;
+ }
+ }
- /* Bring interface up */
- ifr.ifr_flags |= IFF_UP;
- if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1)
- goto failed;
-
close(sock);
- return (fd);
+ return fd;
failed:
if (fd >= 0)
@@ -705,9 +773,7 @@
close(fd);
if (sock >= 0)
close(sock);
- debug("%s: failed to set %s mode %d: %s", __func__, name,
- mode, strerror(errno));
- return (-1);
+ return -1;
#else
error("Tunnel interfaces are not supported on this platform");
return (-1);
@@ -724,16 +790,16 @@
strerror(errno));
exit(1);
}
- while (++dupfd <= 2) {
- /* Only clobber closed fds */
- if (fcntl(dupfd, F_GETFL, 0) >= 0)
- continue;
- if (dup2(nullfd, dupfd) == -1) {
- fprintf(stderr, "dup2: %s\n", strerror(errno));
- exit(1);
+ while (++dupfd <= STDERR_FILENO) {
+ /* Only populate closed fds. */
+ if (fcntl(dupfd, F_GETFL) == -1 && errno == EBADF) {
+ if (dup2(nullfd, dupfd) == -1) {
+ fprintf(stderr, "dup2: %s\n", strerror(errno));
+ exit(1);
+ }
}
}
- if (nullfd > 2)
+ if (nullfd > STDERR_FILENO)
close(nullfd);
}
@@ -788,6 +854,20 @@
return (v);
}
+u_int32_t
+get_u32_le(const void *vp)
+{
+ const u_char *p = (const u_char *)vp;
+ u_int32_t v;
+
+ v = (u_int32_t)p[0];
+ v |= (u_int32_t)p[1] << 8;
+ v |= (u_int32_t)p[2] << 16;
+ v |= (u_int32_t)p[3] << 24;
+
+ return (v);
+}
+
u_int16_t
get_u16(const void *vp)
{
@@ -826,7 +906,17 @@
p[3] = (u_char)v & 0xff;
}
+void
+put_u32_le(void *vp, u_int32_t v)
+{
+ u_char *p = (u_char *)vp;
+ p[0] = (u_char)v & 0xff;
+ p[1] = (u_char)(v >> 8) & 0xff;
+ p[2] = (u_char)(v >> 16) & 0xff;
+ p[3] = (u_char)(v >> 24) & 0xff;
+}
+
void
put_u16(void *vp, u_int16_t v)
{
@@ -858,21 +948,53 @@
time_t
monotime(void)
{
-#if defined(HAVE_CLOCK_GETTIME) && defined(CLOCK_MONOTONIC)
+#if defined(HAVE_CLOCK_GETTIME) && \
+ (defined(CLOCK_MONOTONIC) || defined(CLOCK_BOOTTIME))
struct timespec ts;
static int gettime_failed = 0;
if (!gettime_failed) {
+#if defined(CLOCK_BOOTTIME)
+ if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0)
+ return (ts.tv_sec);
+#endif
+#if defined(CLOCK_MONOTONIC)
if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0)
return (ts.tv_sec);
+#endif
debug3("clock_gettime: %s", strerror(errno));
gettime_failed = 1;
}
-#endif
+#endif /* HAVE_CLOCK_GETTIME && (CLOCK_MONOTONIC || CLOCK_BOOTTIME */
return time(NULL);
}
+double
+monotime_double(void)
+{
+#if defined(HAVE_CLOCK_GETTIME) && \
+ (defined(CLOCK_MONOTONIC) || defined(CLOCK_BOOTTIME))
+ struct timespec ts;
+ static int gettime_failed = 0;
+
+ if (!gettime_failed) {
+#if defined(CLOCK_BOOTTIME)
+ if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0)
+ return (ts.tv_sec + (double)ts.tv_nsec / 1000000000);
+#endif
+#if defined(CLOCK_MONOTONIC)
+ if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0)
+ return (ts.tv_sec + (double)ts.tv_nsec / 1000000000);
+#endif
+ debug3("clock_gettime: %s", strerror(errno));
+ gettime_failed = 1;
+ }
+#endif /* HAVE_CLOCK_GETTIME && (CLOCK_MONOTONIC || CLOCK_BOOTTIME */
+
+ return (double)time(NULL);
+}
+
void
bandwidth_limit_init(struct bwlimit *bw, u_int64_t kbps, size_t buflen)
{
@@ -1025,10 +1147,57 @@
for (; *s; s++)
*s = tolower((u_char)*s);
}
+
+int
+unix_listener(const char *path, int backlog, int unlink_first)
+{
+ struct sockaddr_un sunaddr;
+ int saved_errno, sock;
+
+ memset(&sunaddr, 0, sizeof(sunaddr));
+ sunaddr.sun_family = AF_UNIX;
+ if (strlcpy(sunaddr.sun_path, path, sizeof(sunaddr.sun_path)) >= sizeof(sunaddr.sun_path)) {
+ error("%s: \"%s\" too long for Unix domain socket", __func__,
+ path);
+ errno = ENAMETOOLONG;
+ return -1;
+ }
+
+ sock = socket(PF_UNIX, SOCK_STREAM, 0);
+ if (sock < 0) {
+ saved_errno = errno;
+ error("socket: %.100s", strerror(errno));
+ errno = saved_errno;
+ return -1;
+ }
+ if (unlink_first == 1) {
+ if (unlink(path) != 0 && errno != ENOENT)
+ error("unlink(%s): %.100s", path, strerror(errno));
+ }
+ if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) {
+ saved_errno = errno;
+ error("bind: %.100s", strerror(errno));
+ close(sock);
+ error("%s: cannot bind to path: %s", __func__, path);
+ errno = saved_errno;
+ return -1;
+ }
+ if (listen(sock, backlog) < 0) {
+ saved_errno = errno;
+ error("listen: %.100s", strerror(errno));
+ close(sock);
+ unlink(path);
+ error("%s: cannot listen on path: %s", __func__, path);
+ errno = saved_errno;
+ return -1;
+ }
+ return sock;
+}
+
void
sock_set_v6only(int s)
{
-#ifdef IPV6_V6ONLY
+#if defined(IPV6_V6ONLY) && !defined(__OpenBSD__)
int on = 1;
debug3("%s: set socket %d IPV6_V6ONLY", __func__, s);
@@ -1036,3 +1205,41 @@
error("setsockopt IPV6_V6ONLY: %s", strerror(errno));
#endif
}
+
+/*
+ * Compares two strings that maybe be NULL. Returns non-zero if strings
+ * are both NULL or are identical, returns zero otherwise.
+ */
+static int
+strcmp_maybe_null(const char *a, const char *b)
+{
+ if ((a == NULL && b != NULL) || (a != NULL && b == NULL))
+ return 0;
+ if (a != NULL && strcmp(a, b) != 0)
+ return 0;
+ return 1;
+}
+
+/*
+ * Compare two forwards, returning non-zero if they are identical or
+ * zero otherwise.
+ */
+int
+forward_equals(const struct Forward *a, const struct Forward *b)
+{
+ if (strcmp_maybe_null(a->listen_host, b->listen_host) == 0)
+ return 0;
+ if (a->listen_port != b->listen_port)
+ return 0;
+ if (strcmp_maybe_null(a->listen_path, b->listen_path) == 0)
+ return 0;
+ if (strcmp_maybe_null(a->connect_host, b->connect_host) == 0)
+ return 0;
+ if (a->connect_port != b->connect_port)
+ return 0;
+ if (strcmp_maybe_null(a->connect_path, b->connect_path) == 0)
+ return 0;
+ /* allocated_port and handle are not checked */
+ return 1;
+}
+
Modified: trunk/crypto/openssh/misc.h
===================================================================
--- trunk/crypto/openssh/misc.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/misc.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: misc.h,v 1.50 2013/10/14 23:28:23 djm Exp $ */
+/* $OpenBSD: misc.h,v 1.57 2016/07/15 00:24:30 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -15,6 +15,27 @@
#ifndef _MISC_H
#define _MISC_H
+/* Data structure for representing a forwarding request. */
+struct Forward {
+ char *listen_host; /* Host (address) to listen on. */
+ int listen_port; /* Port to forward. */
+ char *listen_path; /* Path to bind domain socket. */
+ char *connect_host; /* Host to connect. */
+ int connect_port; /* Port to connect on connect_host. */
+ char *connect_path; /* Path to connect domain socket. */
+ int allocated_port; /* Dynamically allocated listen port */
+ int handle; /* Handle for dynamic listen ports */
+};
+
+int forward_equals(const struct Forward *, const struct Forward *);
+
+/* Common server and client forwarding options. */
+struct ForwardOptions {
+ int gateway_ports; /* Allow remote connects to forwarded ports. */
+ mode_t streamlocal_bind_mask; /* umask for streamlocal binds */
+ int streamlocal_bind_unlink; /* unlink socket before bind */
+};
+
/* misc.c */
char *chop(char *);
@@ -28,6 +49,7 @@
char *hpdelim(char **);
char *cleanhostname(char *);
char *colon(char *);
+int parse_user_host_port(const char *, char **, char **, int *);
long convtime(const char *);
char *tilde_expand_filename(const char *, uid_t);
char *percent_expand(const char *, ...) __attribute__((__sentinel__));
@@ -36,7 +58,9 @@
void ms_subtract_diff(struct timeval *, int *);
void ms_to_timeval(struct timeval *, int);
time_t monotime(void);
+double monotime_double(void);
void lowercase(char *s);
+int unix_listener(const char *, int, int);
void sock_set_v6only(int);
@@ -68,6 +92,9 @@
#define SSH_TUNID_ERR (SSH_TUNID_ANY - 1)
#define SSH_TUNID_MAX (SSH_TUNID_ANY - 2)
+/* Fake port to indicate that host field is really a path. */
+#define PORT_STREAMLOCAL -2
+
/* Functions to extract or store big-endian words of various sizes */
u_int64_t get_u64(const void *)
__attribute__((__bounded__( __minbytes__, 1, 8)));
@@ -82,6 +109,12 @@
void put_u16(void *, u_int16_t)
__attribute__((__bounded__( __minbytes__, 1, 2)));
+/* Little-endian store/load, used by umac.c */
+u_int32_t get_u32_le(const void *)
+ __attribute__((__bounded__(__minbytes__, 1, 4)));
+void put_u32_le(void *, u_int32_t)
+ __attribute__((__bounded__(__minbytes__, 1, 4)));
+
struct bwlimit {
size_t buflen;
u_int64_t rate, thresh, lamt;
Modified: trunk/crypto/openssh/moduli
===================================================================
--- trunk/crypto/openssh/moduli 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/moduli 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,262 +1,208 @@
-# $OpenBSD: moduli,v 1.8 2012/08/29 05:06:54 dtucker Exp $
+# $OpenBSD: moduli,v 1.17 2016/03/01 04:23:08 dtucker Exp $
# Time Type Tests Tries Size Generator Modulus
-20120821044040 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A770E2EC9F
-20120821044046 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7711F2C6B
-20120821044047 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771225323
-20120821044048 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7712507AB
-20120821044050 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7712A2DB3
-20120821044051 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7712CACEF
-20120821044053 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7713959C3
-20120821044057 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7715BBA13
-20120821044103 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A77191592F
-20120821044104 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771938E1F
-20120821044106 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771A1E127
-20120821044108 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771B3CDFB
-20120821044109 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771B71913
-20120821044111 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771C2759F
-20120821044113 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771CF8ABF
-20120821044114 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771D2B49B
-20120821044116 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771DF6193
-20120821044117 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771E67E33
-20120821044120 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771FA581B
-20120821044121 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772027DDB
-20120821044123 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772093F8B
-20120821044124 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7720EEF6F
-20120821044125 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A77216CAD7
-20120821044126 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A77219A90B
-20120821044129 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7722A0103
-20120821044130 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772343DBF
-20120821044133 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772460C3F
-20120821044137 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7726A4E0F
-20120821044138 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772716D8B
-20120821044141 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7728D719B
-20120821044143 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A77297AA8B
-20120821044145 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772A8794B
-20120821044147 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772B4D6AB
-20120821044149 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772BD325F
-20120821044150 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772BDAE07
-20120821044151 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772C95CE3
-20120821044502 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F96361507
-20120821044515 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F965885BF
-20120821044519 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F966006C7
-20120821044528 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9674A0EB
-20120821044539 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F969457F3
-20120821044544 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F969BE79B
-20120821044606 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F96E1E827
-20120821044623 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9714284B
-20120821044630 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97231CB7
-20120821044636 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F972E01DF
-20120821044647 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F974BCED3
-20120821044650 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F974C3A43
-20120821044653 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F974E8F73
-20120821044701 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9763403B
-20120821044705 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9767666B
-20120821044708 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9768D81F
-20120821044726 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F979FD437
-20120821044729 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97A29BC7
-20120821044732 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97A56447
-20120821044737 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97AEDBDB
-20120821044740 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97B187F3
-20120821044746 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97BC6EE3
-20120821044757 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97DCCDEB
-20120821044817 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F981975F7
-20120821044831 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F983EC267
-20120821044841 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F985A032F
-20120821044846 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9863B0AB
-20120821044852 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F986E5C7F
-20120821044911 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F98A8FF6B
-20120821044917 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F98B40E4B
-20120821044924 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F98C5840F
-20120821044940 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F98F22CEB
-20120821044947 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99040FFF
-20120821044954 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99139AE3
-20120821045010 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9940BEFB
-20120821045017 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9954379F
-20120821045020 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99548C23
-20120821045023 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99562FC3
-20120821045028 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9960CDCF
-20120821045038 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F997AC0B3
-20120821045045 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F998D9B6B
-20120821045050 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9994BB77
-20120821045059 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99AC001B
-20120821045101 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99AC5547
-20120821045107 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99B86567
-20120821045110 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99BA2677
-20120821045128 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99EF4523
-20120821045154 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9A419DAB
-20120821045214 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9A7D1E67
-20120821045218 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9A826443
-20120821045639 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293680B09D63
-20120821045830 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936814C2FFB
-20120821050046 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368214FC53
-20120821050054 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368218E83F
-20120821050118 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293682361D5F
-20120821050218 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936828ADA17
-20120821050243 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293682A8A7CB
-20120821050427 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368341AC87
-20120821050515 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936837F8657
-20120821050545 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293683A3DFD3
-20120821050554 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293683A9635F
-20120821050636 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293683DF582B
-20120821050648 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293683E86803
-20120821050758 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684495A13
-20120821050807 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936844FAB5B
-20120821050849 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368486D99B
-20120821050916 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684A776A7
-20120821050942 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684C4FF73
-20120821051003 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684DB980F
-20120821051010 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684DD4FBF
-20120821051158 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685721537
-20120821051206 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685768253
-20120821051231 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685930F13
-20120821051240 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685987B0B
-20120821051324 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685D5E36B
-20120821051349 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685F3AB7F
-20120821051424 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293686206187
-20120821051516 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368668EB4B
-20120821051540 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368686EB87
-20120821051622 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293686BCCF13
-20120821051703 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293686F13B9F
-20120821051715 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293686FB2D4F
-20120821051837 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936876ED7DF
-20120821051843 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936876F05DB
-20120821051930 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293687AEDE8F
-20120821052131 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293688637CFF
-20120821053137 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942284EA9F
-20120821053209 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94228B7F67
-20120821053317 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9422A2B3C7
-20120821053841 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94232DEF87
-20120821054039 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942359AB7B
-20120821054334 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9423A371A7
-20120821054455 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9423C1CEEF
-20120821054844 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9424273F1F
-20120821055307 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9424987667
-20120821055436 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9424B90BAB
-20120821055700 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9424F6C7CF
-20120821060224 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94258ADCEF
-20120821060334 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9425A1FCEB
-20120821060420 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9425AEBF43
-20120821060927 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942634C34F
-20120821061829 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94272F0D4F
-20120821062020 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94275B00B7
-20120821062241 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9427941F5F
-20120821063416 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9428D5E367
-20120821063648 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942917E127
-20120821064052 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9429825A2B
-20120821064951 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942A74C4EB
-20120821065736 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942B4640D3
-20120821071146 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942CCD6D1B
-20120821071337 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942CF9321B
-20120821072545 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942E48654F
-20120821075022 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9430F1B6A3
-20120821080229 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9432356F63
-20120821081230 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94333D9363
-20120821081746 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9433C6A7A7
-20120821081811 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9433C94C93
-20120821084945 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45B27D047
-20120821091240 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45C370A33
-20120821092428 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45CBB9FBB
-20120821093047 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45D001E73
-20120821095420 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45E104D6F
-20120821095624 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45E21E2BF
-20120821102749 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45F9B1B7B
-20120821105854 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4610E205F
-20120821110658 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA461631FBF
-20120821110744 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA461635E3B
-20120821115206 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4636E0DF7
-20120821121256 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4645F38B3
-20120821121421 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46467609B
-20120821122649 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA464F87D6B
-20120821122854 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46508F94B
-20120821125200 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4661CBC5B
-20120821130613 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA466BC6B33
-20120821131115 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA466ED9CC7
-20120821132817 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA467B278B3
-20120821135349 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA468D8351B
-20120821141206 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA469A817A7
-20120821144909 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46B488EF7
-20120821150021 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46BC5D5E7
-20120821153843 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46D774723
-20120821162006 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46F5488DB
-20120821170404 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA47157A067
-20120821173305 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA472A1E94B
-20120821173936 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA472E0E57F
-20120821174533 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4731F7433
-20120821180053 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA473C7CE3F
-20120821180952 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4742A8237
-20120821181124 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA474343C5B
-20120821183540 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4754D89DB
-20120821183852 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA47569B47F
-20120821184512 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA475AC57DB
-20120821184603 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA475AD78CB
-20120821184701 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA475B0038F
-20120821185939 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4763BD72F
-20120821190630 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA476853BB7
-20120821190945 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA476A47843
-20120821195501 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA478A96AEF
-20120705232031 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B241215BB
-20120705233800 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B246EC93B
-20120706002709 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B2582B477
-20120706013826 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B271419A3
-20120706014732 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B273FB1BB
-20120706021008 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B27B7E59F
-20120705225552 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B29C4E81B
-20120705233754 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B2AB07037
-20120705234834 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B2AE25CBB
-20120706024556 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B2EDFAA6F
-20120705233556 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B30EE83EB
-20120706002117 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B31E6F727
-20120705233808 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B37267537
-20120706001148 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B3DF98C1F
-20120706013155 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B3FBB98EB
-20120706025705 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B418898A7
-20120706022948 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B4707179B
-20120705233534 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B4F3D25C7
-20120706014542 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B520205CB
-20120706030026 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B539518DB
-20120706003519 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B566E0243
-20120706032218 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B59E508EF
-20120706033523 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B5A254F5F
-20120705235242 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B5B60C48F
-20120706022615 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B646A1B3B
-20120706032540 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B6594B14F
-20120706001843 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B677C3593
-20120705054703 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234453518A0F7
-20120705060217 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445353B291F
-20120705100916 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE2344537DF8F1B
-20120705112627 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE2344538AF7C7B
-20120705121419 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445392BB61F
-20120705162623 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234453BD5FE03
-20120705171958 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234453C6257EF
-20120705222541 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234453FBF1073
-20120705120012 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE2344544BA2363
-20120705143238 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445464ED33B
-20120705175610 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445486B9E93
-20120705143839 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE2344551AEBB1B
-20120705164833 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE2344553053057
-20120705195911 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE2344560200E33
-20120705051445 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445620DCB9B
-20120705090103 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234456453E2C3
-20120705102457 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234456520F7B3
-20120705045958 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234456CC34FE7
-20120705064048 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234456DBB1643
-20120705100057 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234456FACFC3F
-20120705130216 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445716EEFD3
-20120705184211 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE2344574BD3B0F
-20120705075506 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234457918ED6F
-20120705111016 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445857E1707
-20120705051124 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234458C6078E3
-20120705054255 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234458CA4E313
-20120705155949 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234459281E7B3
-20120705065517 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE2344597A57CB3
-20120705082307 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445987253DB
-20120705182442 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234459E124B2F
-20120705184956 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE234459E442F5B
-20120705071209 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445A1E0FD83
-20120705155527 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445A6BDA473
-20120705103912 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445ADCE429F
-20120705115451 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445AE75FB83
-20120705133531 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445AF5813A3
-20120705144902 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445AFF92FDF
-20120705160631 2 6 100 8191 5 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445B0A9AF9F
-20120705194100 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B433770B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE320640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE83D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B45CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C720B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF0189BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA3236171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D882B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC456107454AAC470DBD627C3EE2132E7C6FCEB61C2BA1CBE4FE6F07A2A4E398FDFBECC0283E9CF440F9F8F6893D019A98EFE992BA7433951DF341A3B3A8E879B090FB0E11907382853FBD6FA79B5B3FFF4EBE286F92A99D24C548949209867B1116BDBE1F104230EE26CCA0A12602A328B9B7A86D18415881AEFC9527AD4BB563CC330F29DF51199E1E9F0317EE6F3768C0849351FC1F95D47A1DE90484BE923ADC004D8287A90168C1D1491AD9A9B3266A826F966AA964E814F171FF9F3BA755DF83961182D95317844D6064D8BDED2DDB9AB4D74C325C1748036103690D88D85B532B692B74ED199253CB77E3BA57A2369BD9DD3B4FE68A66A1EFE507BA1F1A0164B6EDF397DF550EAC7FA155F7DED564A34DA73BC1F72E2D56CBABADAF3ED6B03C56FE00CA51548604403757ACAE67C71C564D4F688BA44465C7D3FFC84DB2BA142E06A967181CA0806E732134D795AD6E936BB25C00A14FE0DA5A83A7095D0271B380E802CD9E6E601C582EAC20CB6AC0C670108376302BA364FFD30E78D0CAB72BADB15F2!
82CD256BC3B365896D80DC170BE23445B296E223
+20150520235007 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031E9A9C5F7
+20150520235015 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031E9CBB21F
+20150520235039 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EA2E9623
+20150520235043 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EA33E3DF
+20150520235057 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EA68038B
+20150520235114 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EAAB0717
+20150520235122 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EAC2A7FB
+20150520235125 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EAC82DD3
+20150520235154 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EB40583F
+20150520235214 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EB94F247
+20150520235218 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EB9DF49F
+20150520235239 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EBF7BE27
+20150520235244 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EC0B4F4F
+20150520235250 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EC21070F
+20150520235256 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EC36541F
+20150520235307 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EC5FE22B
+20150520235322 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031ECA1FB57
+20150520235331 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031ECC3C823
+20150520235349 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031ED035187
+20150520235400 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031ED2F07DB
+20150520235407 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031ED4620CF
+20150520235422 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031ED86D39F
+20150520235424 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031ED86E683
+20150520235427 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031ED8C3073
+20150520235443 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EDCB1F63
+20150520235450 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EDE00B77
+20150520235452 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EDE42247
+20150520235458 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EDF8F493
+20150520235503 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EE04D69F
+20150520235508 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EE14B92B
+20150520235510 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EE167933
+20150520235517 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EE2DC63B
+20150520235527 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EE52259F
+20150520235539 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EE829247
+20150520235557 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EED044BF
+20150520235608 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EEFD34CF
+20150520235614 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EF0F709F
+20150520235616 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EF12110B
+20150520235622 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EF25FE1F
+20150520235637 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EF6BF4D3
+20150520235654 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EFAF28BF
+20150520235701 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EFBFB8BB
+20150520235704 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EFC7A62F
+20150520235710 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031EFD79323
+20150520235725 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F0158F1F
+20150520235728 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F01A9E6B
+20150520235743 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F055798B
+20150520235752 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F0730BC3
+20150520235757 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F08283FF
+20150520235825 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F0F451E3
+20150520235830 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F0FDEFB7
+20150520235901 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F1828ECF
+20150521000008 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F185D7BF
+20150521000011 2 6 100 2047 2 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F18C58FB
+20150521000014 2 6 100 2047 5 F7360753237CF1837003CDFE89D99C8149BE6C4B4CCD9D09D834FF137878C452FB4FAB5CA51BE6619BC6FEC4184FA9A96D21FDE83505B67262EEA4870FD709F4DD3A2EC36E5746ED80D762467E794FE524992EAC42D2F0F391A63E027F24411B231D25AEFE60C9329CE8FFB61A8A123C74F6755211C8CFD59915CE0DE28579B66CB426D111F90B19A5BD83AB8C2CAB09FB1F09509B029883BD154B82418B4F3A9EE4564E5F344D5B911C10829C1E975817EB2DFF49F34D95277897A7198C9C4921037B8AA091C380663A6D5260F98FA784565DE2D977C50A1079B485F4BE63B4E3D6A63FD8DD59704116A41CB1C7C2AAA449071BFBAFB0F867FCC031F191F757
+20150521000841 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CC7F06BB
+20150521001025 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CD1057AB
+20150521001131 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CD717D6F
+20150521001248 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CDDA85F7
+20150521001453 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CE8959BF
+20150521001510 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CE98227B
+20150521001623 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CEF967BF
+20150521001651 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CF18156B
+20150521001758 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CF717197
+20150521001924 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622CFE1507B
+20150521002244 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D0F75427
+20150521002509 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D1BD2823
+20150521002808 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D2B4950F
+20150521002846 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D2E6D6D7
+20150521003203 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D3F5D0D3
+20150521003322 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D45851E3
+20150521003430 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D4AEE517
+20150521003629 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D5538E0B
+20150521003714 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D58BAFCF
+20150521003722 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D5916FC7
+20150521003739 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D5A378F7
+20150521004506 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D82B5113
+20150521004613 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D880CB43
+20150521004753 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D909305B
+20150521004802 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D90DBDC3
+20150521005025 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D9CBF44F
+20150521005051 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622D9E89DA7
+20150521005252 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622DA8BA403
+20150521005347 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622DAD07F73
+20150521005825 2 6 100 3071 2 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622DC5CE5A3
+20150521005858 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622DC84A597
+20150521010014 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622DCE62957
+20150521010219 2 6 100 3071 5 E0C2D7F7B6E4C69A3B6632FC77BED88CAC663CE39D91DDF017816529795F33B591F80F445BE16F8FB51D11861682154B904AE2282FA0462EB6C508FD7B7AEC551A6C630FE9CC7E17E660377558E4F841CD77AABD81E6A0988823047B3A00C2E50C33035987D6EA42C65FD776051F5D43045848D4385FB37482DC9E5133D1B75E34CC81C2B87C9530F5229FF2154604A286C2E257D3A89CF330AEDBA16288E852277C5D7C6AA947B4510625312DF982A30A4D75679F707EB325CD4DF65C7A58154C6C05E28545DE69673B3EA9CCD41529A7CCEB49A3392D23E9AB083148DD956F8CA9B8CDD76496FF95B5782EE888C40EF1201EB3A52CAE1A635BBF82CD479B38DABD6DEE7A2844F8C614215B04CEBDD41039C2DC2D1CF00AFC78C0363E548FAE1DE8A7B535CC41CED767BE05F300F50C59307061ADE1CAA4614F8FEFAECE8F8C5DB3F425B348A206B0E95703EEA8785768CDB53972422C75B58A7AEA2AD9E2546EA991466E6AFE1FA157D75D3F6616DB715D10CCD6B71C73051FE622DD9517D7
+20150521011229 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F951FEB83
+20150521011834 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F960399B7
+20150521012438 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F96EE7973
+20150521014010 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F99453213
+20150521015607 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F9B549727
+20150521015640 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F9B600A7B
+20150521020946 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F9D5299DF
+20150521021536 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F9E2793D3
+20150521022706 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877F9FE131CB
+20150521023922 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FA1BAC073
+20150521025234 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FA3BC9483
+20150521025424 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FA3FB3513
+20150521032445 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FA87E0FAB
+20150521032932 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FA929F00F
+20150521032947 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FA92B272B
+20150521033245 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FA9953D0B
+20150521034828 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FABDD4AEF
+20150521035044 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FAC298C7F
+20150521035111 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FAC31F17B
+20150521035749 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FAD250357
+20150521040009 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FAD788A73
+20150521040220 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FADC5F173
+20150521040316 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FADDFFC03
+20150521041042 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FAEEBDEB3
+20150521041443 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FAF7AD7BB
+20150521041831 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FB007D653
+20150521041928 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FB025C91B
+20150521042301 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FB0A4C143
+20150521042631 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FB12009F7
+20150521042740 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FB145360F
+20150521043358 2 6 100 4095 2 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FB22FAE93
+20150521044013 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FB31527AF
+20150521044543 2 6 100 4095 5 C8BCE52E2AE7AE1EC20056B2D0764047C92392C9DF75C3A57EB8AF1062A809E6EA975D9910AA5C55833CC47D4DA76E92BF63FEBB289E5FE2ED729429DE9567D0A489FA27B41810066B96602B2E555B34628A37C4CE04984D15C36F1EAD09081D2CB2147D5F0B7E8BCF0774FFCF5F649E0CB797DD23D0801C153B6B8480828CF165C7ED3181F316F371C6EC0B6EF6B8CBE36E5A4E8C070854668AF07FE6C73C3EB817CD0E8C7F264546A1B0402AC0FCEBA5032EBA2323769CC401D262971F4B44FC1151EC4F6E761709FD6ABDC84D9C36046811F54DC86D293D16D235DC712BF7346CDAC005AE5C0DCD96480C9BD0CF7C4BD50026553E27F957B6640BA6A87C6642FF3D97A3E63DA468276E3A22C0C3F2A1CFFB4F190D5E23700BB468EA31FD3EB87B44B51BDABDB0667FCFB618CECFB2BC440A5F2E237E93A6DFF96AB3561AF5EE1BDA21720129FF2123F7038C70B4CADF1BC70B2EF5EBC264E1E3B2A4B3780D4A11507D03A498A556A923B0EFAF90D024341A47818F03D5ADD961086C2573DABF02C4E2F303817D323E1D8D88EFBE3F5E0D6688593C65254907745CA6176C8ED7D6B830875A0BA8FFEEB1882742A4553E4E55A93A7AD4F3224B7BFA03E29C77DB0FCCE0E37E6D3A64C5555ED9555FA1E2C34EC04DA3B6E0AAA7BF64879BC4724859FE806E7DC49A5394AD3D01492F05AE69CF10C67B18BDFF8E877FB3DDFBB7
+20150521004745 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F52665F2B
+20150521003352 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F57C7B577
+20150521005557 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F591BBC57
+20150521014228 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F5BDF5CE7
+20150521015455 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F5C9CFD1F
+20150521001701 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F5CF6FF9B
+20150521002558 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F5D7C4FE3
+20150521003319 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F5DE41DFB
+20150521003721 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F5E1B5FAF
+20150521010943 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F600B866F
+20150521014141 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F61F01EC3
+20150521010312 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F65EAB753
+20150521002914 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F69FD9357
+20150521011058 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F6C6B8513
+20150521013628 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F6DE7D9EF
+20150521015040 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F6EB0C897
+20150521001307 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F6F15473B
+20150521012712 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F7377044B
+20150521005218 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F7767DEA3
+20150521003512 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F7C5546F7
+20150521005420 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F7D68EDC3
+20150521011347 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F7E859CF3
+20150521002429 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F819A93E7
+20150521004826 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F88D91A57
+20150521010541 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F89D29B9F
+20150521012418 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F8ADC38F7
+20150521015506 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F8C91980B
+20150521004000 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F8E369B97
+20150521005659 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F8F2B1BEB
+20150521010328 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F8F7DD1D3
+20150521011152 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F8FF052BB
+20150521001457 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F92940463
+20150521011129 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F95C47DCB
+20150521013515 2 6 100 6143 2 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F9710A103
+20150521013841 2 6 100 6143 5 D9F2DC4F4AB3E451AB7781730AE26AE5AB1927A8F93D05C7765C4F23947CBAD218690437DDE587137100CA657CB902597743E8B05CB9B821A48E081C451227F5E42404534A28EE1D0A52FA903FBB15B79139D130420B8C7BD2477CDF0C06CF4C9943DF76A74C3B503B2229A5628E13983B0426A10FD164A720488DE3A1639D004B694ADB5216C21F481519865529CE6E3C9C8B89AC00FBF2B4C1F0B0033AC2A5072A157B5D4346950917B055227557FF1EB5F0873D75E648BEE4B6F88D4B228CB89C7602E34F85BF86DDBD09CA39993C73FF59B0310754F0D24740316F7D8D21D67EC65C8715B7130EBC8E19EB712990BBB30D650ACB0B7864B632ABBC2AEE7221393A5C74B043568043480DB41821A0CE1E6D271456C2FDC243D39868FB0D7BDA3FAD5894F7DCBBC5751B77B3DF99F6E8A5BD7A5B82F594E3E0CA2BBF7DA74312227B323652E6856B597326206CAFF2380C23CF94B8CD3EAA56BE60F8C372887CD37A62FC6F5FD467ED96E7CD9C285E75C2C353E520DFB3F39FE7B8E35FFB485B1B043F52321675EDF4848266997D059810F71D21E9DB3E3AB1BCE3713DB67155F41B7C21939B285AB63DBF1770228E4EE36314310D89200F132E8ECF2968CDA0E57DBBCE589E4DDBAD009994A817032EFA52F0659A319FBD813901BF5847EC2D7979CBA5870F3DA25BE09673952628E1EA70C82EC0BE67B402E48DF85C5983516BBEEAB811D1ECAB02928D4087B826139D073501149D47B3339CDA763840E4492661FFEF96C81C816B862EEE820019CD83C93BF9DFF8EC8C59331780D5D86B164EC12BBE59F4C9E62FD7819A941D10AFE32179B2361A17618FA84864F58C09AECB817E67BC352371BB7D7F8209E4EB9002013A585092D4721B1CB464A8480CC76173989144EF51692E373E9CCEAC9807EF190D6BBDD3BB0D16CA87DC6A54890D6F074ABD83E3CF077F2F592C0745BE15D7D6871552BB6139E5CF70D684C6D1D0C4516733E0639BBEC847313BE3D1D923B6A5FAF43A5341DD8C0779881BEB92736BA4F18BD6CDC1FC922B3809ED244748101A6C7E30DDE0C232FA3F9733A497
+20150521041810 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7BE934407F
+20150521070624 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7BEEB1E407
+20150521051555 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7BF50EEEC3
+20150521061258 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C00AF225F
+20150521034225 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C058D5963
+20150521035956 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C0616723F
+20150521054248 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C12F16C3F
+20150521060112 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C1379EA23
+20150521023340 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C165F2773
+20150521043505 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C1A3EC717
+20150521024626 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C202ABED3
+20150521064303 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C27790087
+20150521060604 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C2F9DF583
+20150521062143 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C3003EEAB
+20150521044311 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C363D0A77
+20150521053731 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C37D6EFCF
+20150521065640 2 6 100 7679 5 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C3A20A2DF
+20150521044717 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C3F622E8B
+20150521065426 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C430ED7CB
+20150521023632 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C445E575B
+20150521032945 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C45EEE643
+20150521054538 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C49FB77CB
+20150521024620 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C4D86D0FB
+20150521042108 2 6 100 7679 2 D67DA234F46097F7EE3B230456E7C895BCA86395DF43D60D9D587C64EA4525FBCAD22442143068578CE8ECC8280B2D81F747B484AA668FFCDBEB067EB824B42E5FA1A40BC08EE8CC4A064298CB31C36340951EC7A006878C79C80068196180DA31E1DEF79A72B2D059203DDE461485D1B9783AF79E981CDAEF88589D8343E5B52D96FE90EA13194AFAF7459B17B80971720357ABD09CFE992966FFC1C239821C910F55D69E44277E5DE9841F4E5B2D25D6A265D321059B762F7D6AC5F0E260DEEB628D32940002B219B354486CC5BBF6390F19899EA5E145A28487029DF0517564A81FA10FA60AFA04CE77794775392829DB636E7F5EE00868D5027A6BA75CA922CEF3CA78683D14AB2E58439789033ACF441236F5E3C7849E3662B5123304F82D0061EA9C18EA1676A736FFD628AE982CCEAB8979568C43FB34207E0DEC7D8A6AA391846C910F77771ECF2D0531A234D3798BC1B1433091A895E23A77792F4BE403D526F1D260A3627F2E80E863A204A774F58D7DE2C5C4A7E463A46BC436F0B7AF07179EC334D31073BF035FD94454ECD54146473F786EA15A1CEBB3B9C0D282195AD612D33B31F5528DAB5231CB17A3DE9AB5C8BD7BF8F773C255845BC9B70A1E53A50E5AEA801FFE604A2B2C1FBE86A2A883632E7AE75ADA007FB6AB1AA529DE3151CAA8D1D07FA19EFF5679398340E720CF2CFC4E1AEDD73C44983CC8E610DD419AE2E88206573837D6E44018D9498B62F9C0B8EA7741450FC7DBFF7C546D3CBCBA5B9123577FD5531880A18F1275F9181A922803D8F03512C58B5FBBC41CE8095EDD920A3E36CEB6EDB56900E6CEC2928288909D61B3B426EBC54F0A69C261A848B358C3A8E332567B9FFC1A7A07E9414BB1F75DE0795CF87632F5D6A87A246FD4E98E70489F779FE99C5BC4DB24BFA860C3551888FC721CDBC6AB5783B02BEF893E0984B6FDB5142A1AFD3277FE8F36B87849BC00B3FB3ADAFE4EDAE4839B83894C27FEF93514D7E3FFB7A30E99C6875D96C582E81D45FB463DC37B8791FC28A759301FC2F9879960C82BC7C427382A41B9AEFAC0051A2C653E55A47B48860CDA32812A192C1508A6C012C7E4BBAB1619B7926549FD8CE27928618F035BE31D56CBC9586D88E00DA69341F6F01554E205344E49E8871CCF80F9FF5CB54479AFA66806DD02FAFEE7D43572B3AA22742635FE65BFC8004960DC679FC7F8C0E5B50B3CE1E446B7A5E189BB9AAFA06FEC472D6E67EA4905373A01A2B662F534131405FBAB9BBAE892F0C265439EA1ABC91B186B5AC1E53A0C786607B1069BC026359955CFD614D7F80DF416A08AB18991A0398A83DF3CF2D65D7C505E524B
+20150521041835 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354CD3703FA7
+20150521051726 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354CD4CEF96F
+20150521074626 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354CD86439C3
+20150521082439 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354CD947F7F3
+20150521012012 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354CE0694343
+20150521073153 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354CE93D436F
+20150521094433 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354CEC4EE993
+20150521074128 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354CFA190CE3
+20150521014004 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D0235296F
+20150521014736 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D025961EB
+20150521065737 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D0961218F
+20150521043653 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D163706C7
+20150521085322 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D1BC6858F
+20150521093922 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D1CC27FE3
+20150521120407 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D1FE2874F
+20150521124157 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D20A8A19B
+20150521035417 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D24E0665B
+20150521062806 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D2828F7AB
+20150521074218 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D29B42017
+20150521114937 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D2F027D3F
+20150521073847 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D3905A9FF
+20150521024512 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D41DB2FFB
+20150521024827 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D41E2852F
+20150521042402 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D43D9B0E3
+20150521083756 2 6 100 8191 5 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D491D852F
+20150521113241 2 6 100 8191 2 D7182545CB6AFDA1CCF5BB87F606DDD1CD25D4BAF110D7CCCC0BC78929189C09DC69308FBF76A16338AB8351B974081AEFE6F68B9DD0B3F661ED84DAF8736BF328122D00A803AD05DDB334CF5C98B2670F0B2ED0E2FA602CE2F6157A2A8E649A546957CE4F723C84B6AC46D64C5B329304181F2B70F48D15181C38777F4E18BB0344F5DAE703CC3A46B670713A7B99E536D30F92D1E5E683F2C5540105F425E01234968D1A63E0220A02721183E30302F029E4D0E0664E30329B730D99D03E53D67793F31BBA6C4274FB2ACA9181655B766246C598E4CD402737B682232B8534BE43A790ED6C04EF8047E1796048099B65EF415375D87BC7A01CB6086C9E23B667D22F52F5F44D6960601C15515D14F7D6A6BF6D7F6B1D834866ADF9FCFA1CDE00EF04C05591B05D4752471F124406D034BC8E6D71E03880BD3E7A77FD22E7D90B90A491E528EDE2E4B6FCF7C638883A4CDE80AF2C839569A4FB641C7B8948200DB0F51CA9B2613966C51F026A007D0696D14A4E4897556C7BB0E60A407B7B8C57643F278A47CC8089E24D38BAC1350A0E6D19FE540A773B8E90A6312D4B038C643B03ADDC741BDD3012F7714863BB63688E6145D47A6F40D15D6485E5AC278E229EA800FE705FEBEB2183CEF7C55DB952B627D4890B45441B3D4CF03BF0D132A7042C24447518B14956C11703131981CD69D7B6BA2A9F8C62057FE3A4319D17739DE0BBDAC9600E4809CD856E5F41C580863D93C251F0A31BA1CBCCAA499FEB79184E165C436A3B2FA9791C4526B47B0D1F6FE3BDE2730421E5DCA10483D91AA873ABD1236674EBE3A0D134C685CCE9D632280AE11C0D9CF7275517C1F14BCB81F2B23860D86F5028B21DF85868972EDF70A0704B3853EB1B16970834C661BC65693D38368DDB0D6E781DD2F52AE279913304601F5709E1C4B1A12B0FFDA93369001186FE8716027667F4B816E927A9977D3030CE211F4BE8B6F48836EABF4D8457FC5CFE39DF5BE96146D3B8C5BA11C3D75D252B0C190DEA5757049DE6BA89249166D60163ADDD38EAE171B53D44E135973AA05293AA7407693AE5478F480A3BE97BACBD8C7DE6EDF39EFB8BDDF8B0A2169228FD98A863C450129C8BA561A1D0F29C4EC75060A27E028E1321BCF7ADCB34B2C2B037E2C6B705F74002E0C844092025A630CFB2105F04D40135794DDF30C7E19187AE2AB8E6296C9EACFF43279F0ABE6E1150ABC2C3C8A6C4B95A7AA18CFBF953BF7662C16A0FE26D9EE7CF62BA16AA87B06373082E7551F42B8BE57BE19A50B059DC652BA46157FB7CC29AC1BF2834E668443637F87B2B12FD338706D69935D2C6348CF72F568B89B66345BF42209AA6D898F4388A54B4CFFD735EAF987CD6B738B401A14FACDAC97F63529118ED56DFB7DAC4967FFA252D!
185DBC29652E3F62A45D6BF990FB354D4CAD7D8B
Modified: trunk/crypto/openssh/moduli.0
===================================================================
--- trunk/crypto/openssh/moduli.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/moduli.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-MODULI(5) OpenBSD Programmer's Manual MODULI(5)
+MODULI(5) File Formats Manual MODULI(5)
NAME
- moduli - Diffie-Hellman moduli
+ moduli M-bM-^@M-^S Diffie-Hellman moduli
DESCRIPTION
The /etc/moduli file contains prime numbers and generators for use by
@@ -38,7 +38,7 @@
bitmask of the following values:
0x00 Not tested.
- 0x01 Composite number - not prime.
+ 0x01 Composite number M-bM-^@M-^S not prime.
0x02 Sieve of Eratosthenes.
0x04 Probabilistic Miller-Rabin primality tests.
@@ -71,4 +71,4 @@
the Secure Shell (SSH) Transport Layer Protocol, RFC 4419, March 2006,
2006.
-OpenBSD 5.5 September 26, 2012 OpenBSD 5.5
+OpenBSD 6.0 September 26, 2012 OpenBSD 6.0
Modified: trunk/crypto/openssh/moduli.c
===================================================================
--- trunk/crypto/openssh/moduli.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/moduli.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: moduli.c,v 1.28 2013/10/24 00:49:49 dtucker Exp $ */
+/* $OpenBSD: moduli.c,v 1.30 2015/01/20 23:14:00 deraadt Exp $ */
/*
* Copyright 1994 Phil Karn <karn at qualcomm.com>
* Copyright 1996-1998, 2003 William Allen Simpson <wsimpson at greendragon.com>
@@ -39,7 +39,9 @@
#include "includes.h"
-#include <sys/param.h>
+#ifdef WITH_OPENSSL
+
+#include <sys/param.h> /* MAX */
#include <sys/types.h>
#include <openssl/bn.h>
@@ -52,6 +54,7 @@
#include <stdarg.h>
#include <time.h>
#include <unistd.h>
+#include <limits.h>
#include "xmalloc.h"
#include "dh.h"
@@ -447,11 +450,11 @@
write_checkpoint(char *cpfile, u_int32_t lineno)
{
FILE *fp;
- char tmp[MAXPATHLEN];
+ char tmp[PATH_MAX];
int r;
r = snprintf(tmp, sizeof(tmp), "%s.XXXXXXXXXX", cpfile);
- if (r == -1 || r >= MAXPATHLEN) {
+ if (r == -1 || r >= PATH_MAX) {
logit("write_checkpoint: temp pathname too long");
return;
}
@@ -461,6 +464,7 @@
}
if ((fp = fdopen(r, "w")) == NULL) {
logit("write_checkpoint: fdopen: %s", strerror(errno));
+ unlink(tmp);
close(r);
return;
}
@@ -801,3 +805,5 @@
return (res);
}
+
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/monitor.c
===================================================================
--- trunk/crypto/openssh/monitor.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/monitor.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.131 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.161 2016/07/22 03:39:13 djm Exp $ */
/*
* Copyright 2002 Niels Provos <provos at citi.umich.edu>
* Copyright 2002 Markus Friedl <markus at openbsd.org>
@@ -28,7 +28,6 @@
#include "includes.h"
#include <sys/types.h>
-#include <sys/param.h>
#include <sys/socket.h>
#include "openbsd-compat/sys-tree.h"
#include <sys/wait.h>
@@ -35,14 +34,19 @@
#include <errno.h>
#include <fcntl.h>
+#include <limits.h>
#ifdef HAVE_PATHS_H
#include <paths.h>
#endif
#include <pwd.h>
#include <signal.h>
-#include <stdarg.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
#include <stdlib.h>
#include <string.h>
+#include <stdarg.h>
+#include <stdio.h>
#include <unistd.h>
#ifdef HAVE_POLL_H
#include <poll.h>
@@ -56,7 +60,9 @@
#include <skey.h>
#endif
+#ifdef WITH_OPENSSL
#include <openssl/dh.h>
+#endif
#include "openbsd-compat/sys-queue.h"
#include "atomicio.h"
@@ -69,6 +75,7 @@
#include "cipher.h"
#include "kex.h"
#include "dh.h"
+#include "auth-pam.h"
#ifdef TARGET_OS_MAC /* XXX Broken krb5 headers on Mac */
#undef TARGET_OS_MAC
#include "zlib.h"
@@ -84,6 +91,7 @@
#include "sshlogin.h"
#include "canohost.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "monitor.h"
#include "monitor_mm.h"
@@ -92,11 +100,11 @@
#endif
#include "monitor_wrap.h"
#include "monitor_fdpass.h"
-#include "misc.h"
#include "compat.h"
#include "ssh2.h"
-#include "roaming.h"
#include "authfd.h"
+#include "match.h"
+#include "ssherr.h"
#ifdef GSSAPI
static Gssctxt *gsscontext = NULL;
@@ -105,9 +113,6 @@
/* Imports */
extern ServerOptions options;
extern u_int utmp_len;
-extern Newkeys *current_keys[];
-extern z_stream incoming_stream;
-extern z_stream outgoing_stream;
extern u_char session_id[];
extern Buffer auth_debug;
extern int auth_debug_init;
@@ -114,30 +119,8 @@
extern Buffer loginmsg;
/* State exported from the child */
+static struct sshbuf *child_state;
-struct {
- z_stream incoming;
- z_stream outgoing;
- u_char *keyin;
- u_int keyinlen;
- u_char *keyout;
- u_int keyoutlen;
- u_char *ivin;
- u_int ivinlen;
- u_char *ivout;
- u_int ivoutlen;
- u_char *ssh1key;
- u_int ssh1keylen;
- int ssh1cipher;
- int ssh1protoflags;
- u_char *input;
- u_int ilen;
- u_char *output;
- u_int olen;
- u_int64_t sent_bytes;
- u_int64_t recv_bytes;
-} child_state;
-
/* Functions on the monitor that answer unprivileged requests */
int mm_answer_moduli(int, Buffer *);
@@ -185,7 +168,10 @@
static int monitor_read_log(struct monitor *);
static Authctxt *authctxt;
+
+#ifdef WITH_SSH1
static BIGNUM *ssh1_challenge = NULL; /* used for ssh1 rsa auth */
+#endif
/* local state for key verify */
static u_char *key_blob = NULL;
@@ -215,7 +201,9 @@
#define MON_PERMIT 0x1000 /* Request is permitted */
struct mon_table mon_dispatch_proto20[] = {
+#ifdef WITH_OPENSSL
{MONITOR_REQ_MODULI, MON_ONCE, mm_answer_moduli},
+#endif
{MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
{MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -252,7 +240,9 @@
};
struct mon_table mon_dispatch_postauth20[] = {
+#ifdef WITH_OPENSSL
{MONITOR_REQ_MODULI, 0, mm_answer_moduli},
+#endif
{MONITOR_REQ_SIGN, 0, mm_answer_sign},
{MONITOR_REQ_PTY, 0, mm_answer_pty},
{MONITOR_REQ_PTYCLEANUP, 0, mm_answer_pty_cleanup},
@@ -265,6 +255,7 @@
};
struct mon_table mon_dispatch_proto15[] = {
+#ifdef WITH_SSH1
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
{MONITOR_REQ_SESSKEY, MON_ONCE, mm_answer_sesskey},
{MONITOR_REQ_SESSID, MON_ONCE, mm_answer_sessid},
@@ -292,10 +283,12 @@
#ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
#endif
+#endif /* WITH_SSH1 */
{0, 0, NULL}
};
struct mon_table mon_dispatch_postauth15[] = {
+#ifdef WITH_SSH1
{MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
{MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
{MONITOR_REQ_TERM, 0, mm_answer_term},
@@ -303,6 +296,7 @@
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
#endif
+#endif /* WITH_SSH1 */
{0, 0, NULL}
};
@@ -411,7 +405,7 @@
if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) {
auth_log(authctxt, authenticated, partial,
auth_method, auth_submethod);
- if (!authenticated)
+ if (!partial && !authenticated)
authctxt->failures++;
}
}
@@ -457,6 +451,9 @@
signal(SIGHUP, &monitor_child_handler);
signal(SIGTERM, &monitor_child_handler);
signal(SIGINT, &monitor_child_handler);
+#ifdef SIGXFSZ
+ signal(SIGXFSZ, SIG_IGN);
+#endif
if (compat20) {
mon_dispatch = mon_dispatch_postauth20;
@@ -487,6 +484,22 @@
}
}
+/* Allocation functions for zlib */
+static void *
+mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
+{
+ if (size == 0 || ncount == 0 || ncount > SIZE_MAX / size)
+ fatal("%s: mm_zalloc(%u, %u)", __func__, ncount, size);
+
+ return mm_malloc(mm, size * ncount);
+}
+
+static void
+mm_zfree(struct mm_master *mm, void *address)
+{
+ mm_free(mm, address);
+}
+
static int
monitor_read_log(struct monitor *pmonitor)
{
@@ -630,6 +643,7 @@
hostbased_chost = NULL;
}
+#ifdef WITH_OPENSSL
int
mm_answer_moduli(int sock, Buffer *m)
{
@@ -664,29 +678,66 @@
mm_request_send(sock, MONITOR_ANS_MODULI, m);
return (0);
}
+#endif
-extern AuthenticationConnection *auth_conn;
-
int
mm_answer_sign(int sock, Buffer *m)
{
- Key *key;
- u_char *p;
- u_char *signature;
- u_int siglen, datlen;
- int keyid;
+ struct ssh *ssh = active_state; /* XXX */
+ extern int auth_sock; /* XXX move to state struct? */
+ struct sshkey *key;
+ struct sshbuf *sigbuf = NULL;
+ u_char *p = NULL, *signature = NULL;
+ char *alg = NULL;
+ size_t datlen, siglen, alglen;
+ int r, is_proof = 0;
+ u_int keyid;
+ const char proof_req[] = "hostkeys-prove-00 at openssh.com";
debug3("%s", __func__);
- keyid = buffer_get_int(m);
- p = buffer_get_string(m, &datlen);
+ if ((r = sshbuf_get_u32(m, &keyid)) != 0 ||
+ (r = sshbuf_get_string(m, &p, &datlen)) != 0 ||
+ (r = sshbuf_get_cstring(m, &alg, &alglen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (keyid > INT_MAX)
+ fatal("%s: invalid key ID", __func__);
/*
* Supported KEX types use SHA1 (20 bytes), SHA256 (32 bytes),
* SHA384 (48 bytes) and SHA512 (64 bytes).
+ *
+ * Otherwise, verify the signature request is for a hostkey
+ * proof.
+ *
+ * XXX perform similar check for KEX signature requests too?
+ * it's not trivial, since what is signed is the hash, rather
+ * than the full kex structure...
*/
- if (datlen != 20 && datlen != 32 && datlen != 48 && datlen != 64)
- fatal("%s: data length incorrect: %u", __func__, datlen);
+ if (datlen != 20 && datlen != 32 && datlen != 48 && datlen != 64) {
+ /*
+ * Construct expected hostkey proof and compare it to what
+ * the client sent us.
+ */
+ if (session_id2_len == 0) /* hostkeys is never first */
+ fatal("%s: bad data length: %zu", __func__, datlen);
+ if ((key = get_hostkey_public_by_index(keyid, ssh)) == NULL)
+ fatal("%s: no hostkey for index %d", __func__, keyid);
+ if ((sigbuf = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new", __func__);
+ if ((r = sshbuf_put_cstring(sigbuf, proof_req)) != 0 ||
+ (r = sshbuf_put_string(sigbuf, session_id2,
+ session_id2_len)) != 0 ||
+ (r = sshkey_puts(key, sigbuf)) != 0)
+ fatal("%s: couldn't prepare private key "
+ "proof buffer: %s", __func__, ssh_err(r));
+ if (datlen != sshbuf_len(sigbuf) ||
+ memcmp(p, sshbuf_ptr(sigbuf), sshbuf_len(sigbuf)) != 0)
+ fatal("%s: bad data length: %zu, hostkey proof len %zu",
+ __func__, datlen, sshbuf_len(sigbuf));
+ sshbuf_free(sigbuf);
+ is_proof = 1;
+ }
/* save session id, it will be passed on the first call */
if (session_id2_len == 0) {
@@ -696,21 +747,28 @@
}
if ((key = get_hostkey_by_index(keyid)) != NULL) {
- if (key_sign(key, &signature, &siglen, p, datlen) < 0)
- fatal("%s: key_sign failed", __func__);
- } else if ((key = get_hostkey_public_by_index(keyid)) != NULL &&
- auth_conn != NULL) {
- if (ssh_agent_sign(auth_conn, key, &signature, &siglen, p,
- datlen) < 0)
- fatal("%s: ssh_agent_sign failed", __func__);
+ if ((r = sshkey_sign(key, &signature, &siglen, p, datlen, alg,
+ datafellows)) != 0)
+ fatal("%s: sshkey_sign failed: %s",
+ __func__, ssh_err(r));
+ } else if ((key = get_hostkey_public_by_index(keyid, ssh)) != NULL &&
+ auth_sock > 0) {
+ if ((r = ssh_agent_sign(auth_sock, key, &signature, &siglen,
+ p, datlen, alg, datafellows)) != 0) {
+ fatal("%s: ssh_agent_sign failed: %s",
+ __func__, ssh_err(r));
+ }
} else
fatal("%s: no hostkey from index %d", __func__, keyid);
- debug3("%s: signature %p(%u)", __func__, signature, siglen);
+ debug3("%s: %s signature %p(%zu)", __func__,
+ is_proof ? "KEX" : "hostkey proof", signature, siglen);
- buffer_clear(m);
- buffer_put_string(m, signature, siglen);
+ sshbuf_reset(m);
+ if ((r = sshbuf_put_string(m, signature, siglen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ free(alg);
free(p);
free(signature);
@@ -863,6 +921,9 @@
buffer_clear(m);
buffer_put_int(m, authenticated);
+#ifdef USE_PAM
+ buffer_put_int(m, sshpam_get_maxtries_reached());
+#endif
debug3("%s: sending result %d", __func__, authenticated);
mm_request_send(sock, MONITOR_ANS_AUTHPASSWORD, m);
@@ -914,7 +975,7 @@
char *response;
int authok;
- if (authctxt->as == 0)
+ if (authctxt->as == NULL)
fatal("%s: no bsd auth session", __func__);
response = buffer_get_string(m, NULL);
@@ -983,7 +1044,8 @@
debug3("%s: sending authenticated: %d", __func__, authok);
mm_request_send(sock, MONITOR_ANS_SKEYRESPOND, m);
- auth_method = "skey";
+ auth_method = "keyboard-interactive";
+ auth_submethod = "skey";
return (authok != 0);
}
@@ -1061,6 +1123,7 @@
free(name);
buffer_put_cstring(m, info);
free(info);
+ buffer_put_int(m, sshpam_get_maxtries_reached());
buffer_put_int(m, num);
for (i = 0; i < num; ++i) {
buffer_put_cstring(m, prompts[i]);
@@ -1128,7 +1191,7 @@
Key *key;
char *cuser, *chost;
u_char *blob;
- u_int bloblen;
+ u_int bloblen, pubkey_auth_attempt;
enum mm_keytype type = 0;
int allowed = 0;
@@ -1138,6 +1201,7 @@
cuser = buffer_get_string(m, NULL);
chost = buffer_get_string(m, NULL);
blob = buffer_get_string(m, &bloblen);
+ pubkey_auth_attempt = buffer_get_int(m);
key = key_from_blob(blob, bloblen);
@@ -1148,17 +1212,29 @@
debug3("%s: key_from_blob: %p", __func__, key);
if (key != NULL && authctxt->valid) {
+ /* These should not make it past the privsep child */
+ if (key_type_plain(key->type) == KEY_RSA &&
+ (datafellows & SSH_BUG_RSASIGMD5) != 0)
+ fatal("%s: passed a SSH_BUG_RSASIGMD5 key", __func__);
+
switch (type) {
case MM_USERKEY:
allowed = options.pubkey_authentication &&
- user_key_allowed(authctxt->pw, key);
+ !auth2_userkey_already_used(authctxt, key) &&
+ match_pattern_list(sshkey_ssh_name(key),
+ options.pubkey_key_types, 0) == 1 &&
+ user_key_allowed(authctxt->pw, key,
+ pubkey_auth_attempt);
pubkey_auth_info(authctxt, key, NULL);
auth_method = "publickey";
- if (options.pubkey_authentication && allowed != 1)
+ if (options.pubkey_authentication &&
+ (!pubkey_auth_attempt || allowed != 1))
auth_clear_options();
break;
case MM_HOSTKEY:
allowed = options.hostbased_authentication &&
+ match_pattern_list(sshkey_ssh_name(key),
+ options.hostbased_key_types, 0) == 1 &&
hostbased_key_allowed(authctxt->pw,
cuser, chost, key);
pubkey_auth_info(authctxt, key,
@@ -1166,6 +1242,7 @@
cuser, chost);
auth_method = "hostbased";
break;
+#ifdef WITH_SSH1
case MM_RSAHOSTKEY:
key->type = KEY_RSA1; /* XXX */
allowed = options.rhosts_rsa_authentication &&
@@ -1175,11 +1252,16 @@
auth_clear_options();
auth_method = "rsa";
break;
+#endif
default:
fatal("%s: unknown key type %d", __func__, type);
break;
}
}
+
+ debug3("%s: key %p is %s",
+ __func__, key, allowed ? "allowed" : "not allowed");
+
if (key != NULL)
key_free(key);
@@ -1201,9 +1283,6 @@
free(chost);
}
- debug3("%s: key %p is %s",
- __func__, key, allowed ? "allowed" : "not allowed");
-
buffer_clear(m);
buffer_put_int(m, allowed);
buffer_put_int(m, forced_command != NULL);
@@ -1220,7 +1299,8 @@
monitor_valid_userblob(u_char *data, u_int datalen)
{
Buffer b;
- char *p, *userstyle;
+ u_char *p;
+ char *userstyle, *cp;
u_int len;
int fail = 0;
@@ -1245,26 +1325,26 @@
}
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
fail++;
- p = buffer_get_cstring(&b, NULL);
+ cp = buffer_get_cstring(&b, NULL);
xasprintf(&userstyle, "%s%s%s", authctxt->user,
authctxt->style ? ":" : "",
authctxt->style ? authctxt->style : "");
- if (strcmp(userstyle, p) != 0) {
- logit("wrong user name passed to monitor: expected %s != %.100s",
- userstyle, p);
+ if (strcmp(userstyle, cp) != 0) {
+ logit("wrong user name passed to monitor: "
+ "expected %s != %.100s", userstyle, cp);
fail++;
}
free(userstyle);
- free(p);
+ free(cp);
buffer_skip_string(&b);
if (datafellows & SSH_BUG_PKAUTH) {
if (!buffer_get_char(&b))
fail++;
} else {
- p = buffer_get_cstring(&b, NULL);
- if (strcmp("publickey", p) != 0)
+ cp = buffer_get_cstring(&b, NULL);
+ if (strcmp("publickey", cp) != 0)
fail++;
- free(p);
+ free(cp);
if (!buffer_get_char(&b))
fail++;
buffer_skip_string(&b);
@@ -1376,7 +1456,12 @@
debug3("%s: key %p signature %s",
__func__, key, (verified == 1) ? "verified" : "unverified");
- key_free(key);
+ /* If auth was successful then record key to ensure it isn't reused */
+ if (verified == 1 && key_blobtype == MM_USERKEY)
+ auth2_record_userkey(authctxt, key);
+ else
+ key_free(key);
+
free(blob);
free(signature);
free(data);
@@ -1395,9 +1480,13 @@
static void
mm_record_login(Session *s, struct passwd *pw)
{
+ struct ssh *ssh = active_state; /* XXX */
socklen_t fromlen;
struct sockaddr_storage from;
+ if (options.use_login)
+ return;
+
/*
* Get IP address of client. If the connection is not a socket, let
* the address be 0.0.0.0.
@@ -1413,7 +1502,7 @@
}
/* Record that there was a login on that tty from the remote host. */
record_login(s->pid, s->tty, pw->pw_name, pw->pw_uid,
- get_remote_name_or_ip(utmp_len, options.use_dns),
+ session_get_remote_name_or_ip(ssh, utmp_len, options.use_dns),
(struct sockaddr *)&from, fromlen);
}
@@ -1511,6 +1600,7 @@
return (0);
}
+#ifdef WITH_SSH1
int
mm_answer_sesskey(int sock, Buffer *m)
{
@@ -1688,6 +1778,7 @@
return (success);
}
+#endif
int
mm_answer_term(int sock, Buffer *req)
@@ -1760,220 +1851,60 @@
void
monitor_apply_keystate(struct monitor *pmonitor)
{
- if (compat20) {
- set_newkeys(MODE_IN);
- set_newkeys(MODE_OUT);
- } else {
- packet_set_protocol_flags(child_state.ssh1protoflags);
- packet_set_encryption_key(child_state.ssh1key,
- child_state.ssh1keylen, child_state.ssh1cipher);
- free(child_state.ssh1key);
- }
+ struct ssh *ssh = active_state; /* XXX */
+ struct kex *kex;
+ int r;
- /* for rc4 and other stateful ciphers */
- packet_set_keycontext(MODE_OUT, child_state.keyout);
- free(child_state.keyout);
- packet_set_keycontext(MODE_IN, child_state.keyin);
- free(child_state.keyin);
+ debug3("%s: packet_set_state", __func__);
+ if ((r = ssh_packet_set_state(ssh, child_state)) != 0)
+ fatal("%s: packet_set_state: %s", __func__, ssh_err(r));
+ sshbuf_free(child_state);
+ child_state = NULL;
- if (!compat20) {
- packet_set_iv(MODE_OUT, child_state.ivout);
- free(child_state.ivout);
- packet_set_iv(MODE_IN, child_state.ivin);
- free(child_state.ivin);
+ if ((kex = ssh->kex) != NULL) {
+ /* XXX set callbacks */
+#ifdef WITH_OPENSSL
+ kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
+ kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
+ kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
+ kex->kex[KEX_DH_GRP16_SHA512] = kexdh_server;
+ kex->kex[KEX_DH_GRP18_SHA512] = kexdh_server;
+ kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+ kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
+# ifdef OPENSSL_HAS_ECC
+ kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+# endif
+#endif /* WITH_OPENSSL */
+ kex->kex[KEX_C25519_SHA256] = kexc25519_server;
+ kex->load_host_public_key=&get_hostkey_public_by_type;
+ kex->load_host_private_key=&get_hostkey_private_by_type;
+ kex->host_key_index=&get_hostkey_index;
+ kex->sign = sshd_hostkey_sign;
}
- memcpy(&incoming_stream, &child_state.incoming,
- sizeof(incoming_stream));
- memcpy(&outgoing_stream, &child_state.outgoing,
- sizeof(outgoing_stream));
-
/* Update with new address */
- if (options.compression)
- mm_init_compression(pmonitor->m_zlib);
-
- if (options.rekey_limit || options.rekey_interval)
- packet_set_rekey_limits((u_int32_t)options.rekey_limit,
- (time_t)options.rekey_interval);
-
- /* Network I/O buffers */
- /* XXX inefficient for large buffers, need: buffer_init_from_string */
- buffer_clear(packet_get_input());
- buffer_append(packet_get_input(), child_state.input, child_state.ilen);
- explicit_bzero(child_state.input, child_state.ilen);
- free(child_state.input);
-
- buffer_clear(packet_get_output());
- buffer_append(packet_get_output(), child_state.output,
- child_state.olen);
- explicit_bzero(child_state.output, child_state.olen);
- free(child_state.output);
-
- /* Roaming */
- if (compat20)
- roam_set_bytes(child_state.sent_bytes, child_state.recv_bytes);
+ if (options.compression) {
+ ssh_packet_set_compress_hooks(ssh, pmonitor->m_zlib,
+ (ssh_packet_comp_alloc_func *)mm_zalloc,
+ (ssh_packet_comp_free_func *)mm_zfree);
+ }
}
-static Kex *
-mm_get_kex(Buffer *m)
-{
- Kex *kex;
- void *blob;
- u_int bloblen;
-
- kex = xcalloc(1, sizeof(*kex));
- kex->session_id = buffer_get_string(m, &kex->session_id_len);
- if (session_id2 == NULL ||
- kex->session_id_len != session_id2_len ||
- timingsafe_bcmp(kex->session_id, session_id2, session_id2_len) != 0)
- fatal("mm_get_get: internal error: bad session id");
- kex->we_need = buffer_get_int(m);
- kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
- kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
- kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
- kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
- kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
- kex->kex[KEX_C25519_SHA256] = kexc25519_server;
- kex->server = 1;
- kex->hostkey_type = buffer_get_int(m);
- kex->kex_type = buffer_get_int(m);
- blob = buffer_get_string(m, &bloblen);
- buffer_init(&kex->my);
- buffer_append(&kex->my, blob, bloblen);
- free(blob);
- blob = buffer_get_string(m, &bloblen);
- buffer_init(&kex->peer);
- buffer_append(&kex->peer, blob, bloblen);
- free(blob);
- kex->done = 1;
- kex->flags = buffer_get_int(m);
- kex->client_version_string = buffer_get_string(m, NULL);
- kex->server_version_string = buffer_get_string(m, NULL);
- kex->load_host_public_key=&get_hostkey_public_by_type;
- kex->load_host_private_key=&get_hostkey_private_by_type;
- kex->host_key_index=&get_hostkey_index;
- kex->sign = sshd_hostkey_sign;
-
- return (kex);
-}
-
/* This function requries careful sanity checking */
void
mm_get_keystate(struct monitor *pmonitor)
{
- Buffer m;
- u_char *blob, *p;
- u_int bloblen, plen;
- u_int32_t seqnr, packets;
- u_int64_t blocks, bytes;
-
debug3("%s: Waiting for new keys", __func__);
- buffer_init(&m);
- mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT, &m);
- if (!compat20) {
- child_state.ssh1protoflags = buffer_get_int(&m);
- child_state.ssh1cipher = buffer_get_int(&m);
- child_state.ssh1key = buffer_get_string(&m,
- &child_state.ssh1keylen);
- child_state.ivout = buffer_get_string(&m,
- &child_state.ivoutlen);
- child_state.ivin = buffer_get_string(&m, &child_state.ivinlen);
- goto skip;
- } else {
- /* Get the Kex for rekeying */
- *pmonitor->m_pkex = mm_get_kex(&m);
- }
-
- blob = buffer_get_string(&m, &bloblen);
- current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
- free(blob);
-
- debug3("%s: Waiting for second key", __func__);
- blob = buffer_get_string(&m, &bloblen);
- current_keys[MODE_IN] = mm_newkeys_from_blob(blob, bloblen);
- free(blob);
-
- /* Now get sequence numbers for the packets */
- seqnr = buffer_get_int(&m);
- blocks = buffer_get_int64(&m);
- packets = buffer_get_int(&m);
- bytes = buffer_get_int64(&m);
- packet_set_state(MODE_OUT, seqnr, blocks, packets, bytes);
- seqnr = buffer_get_int(&m);
- blocks = buffer_get_int64(&m);
- packets = buffer_get_int(&m);
- bytes = buffer_get_int64(&m);
- packet_set_state(MODE_IN, seqnr, blocks, packets, bytes);
-
- skip:
- /* Get the key context */
- child_state.keyout = buffer_get_string(&m, &child_state.keyoutlen);
- child_state.keyin = buffer_get_string(&m, &child_state.keyinlen);
-
- debug3("%s: Getting compression state", __func__);
- /* Get compression state */
- p = buffer_get_string(&m, &plen);
- if (plen != sizeof(child_state.outgoing))
- fatal("%s: bad request size", __func__);
- memcpy(&child_state.outgoing, p, sizeof(child_state.outgoing));
- free(p);
-
- p = buffer_get_string(&m, &plen);
- if (plen != sizeof(child_state.incoming))
- fatal("%s: bad request size", __func__);
- memcpy(&child_state.incoming, p, sizeof(child_state.incoming));
- free(p);
-
- /* Network I/O buffers */
- debug3("%s: Getting Network I/O buffers", __func__);
- child_state.input = buffer_get_string(&m, &child_state.ilen);
- child_state.output = buffer_get_string(&m, &child_state.olen);
-
- /* Roaming */
- if (compat20) {
- child_state.sent_bytes = buffer_get_int64(&m);
- child_state.recv_bytes = buffer_get_int64(&m);
- }
-
- buffer_free(&m);
+ if ((child_state = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT,
+ child_state);
+ debug3("%s: GOT new keys", __func__);
}
-/* Allocation functions for zlib */
-void *
-mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
-{
- size_t len = (size_t) size * ncount;
- void *address;
-
- if (len == 0 || ncount > SIZE_T_MAX / size)
- fatal("%s: mm_zalloc(%u, %u)", __func__, ncount, size);
-
- address = mm_malloc(mm, len);
-
- return (address);
-}
-
-void
-mm_zfree(struct mm_master *mm, void *address)
-{
- mm_free(mm, address);
-}
-
-void
-mm_init_compression(struct mm_master *mm)
-{
- outgoing_stream.zalloc = (alloc_func)mm_zalloc;
- outgoing_stream.zfree = (free_func)mm_zfree;
- outgoing_stream.opaque = mm;
-
- incoming_stream.zalloc = (alloc_func)mm_zalloc;
- incoming_stream.zfree = (free_func)mm_zfree;
- incoming_stream.opaque = mm;
-}
-
/* XXX */
#define FD_CLOSEONEXEC(x) do { \
@@ -2009,6 +1940,7 @@
struct monitor *
monitor_init(void)
{
+ struct ssh *ssh = active_state; /* XXX */
struct monitor *mon;
mon = xcalloc(1, sizeof(*mon));
@@ -2021,7 +1953,9 @@
mon->m_zlib = mm_create(mon->m_zback, 20 * MM_MEMSIZE);
/* Compression needs to share state across borders */
- mm_init_compression(mon->m_zlib);
+ ssh_packet_set_compress_hooks(ssh, mon->m_zlib,
+ (ssh_packet_comp_alloc_func *)mm_zalloc,
+ (ssh_packet_comp_free_func *)mm_zfree);
}
return mon;
Modified: trunk/crypto/openssh/monitor.h
===================================================================
--- trunk/crypto/openssh/monitor.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/monitor.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.h,v 1.18 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: monitor.h,v 1.19 2015/01/19 19:52:16 markus Exp $ */
/*
* Copyright 2002 Niels Provos <provos at citi.umich.edu>
@@ -75,7 +75,7 @@
int m_log_sendfd;
struct mm_master *m_zback;
struct mm_master *m_zlib;
- struct Kex **m_pkex;
+ struct kex **m_pkex;
pid_t m_pid;
};
Modified: trunk/crypto/openssh/monitor_fdpass.c
===================================================================
--- trunk/crypto/openssh/monitor_fdpass.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/monitor_fdpass.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_fdpass.c,v 1.19 2010/01/12 00:58:25 djm Exp $ */
+/* $OpenBSD: monitor_fdpass.c,v 1.21 2016/02/29 20:22:36 jca Exp $ */
/*
* Copyright 2001 Niels Provos <provos at citi.umich.edu>
* All rights reserved.
@@ -34,12 +34,17 @@
#endif
#include <errno.h>
-#ifdef HAVE_POLL_H
-#include <poll.h>
-#endif
#include <string.h>
#include <stdarg.h>
+#ifdef HAVE_POLL_H
+# include <poll.h>
+#else
+# ifdef HAVE_SYS_POLL_H
+# include <sys/poll.h>
+# endif
+#endif
+
#include "log.h"
#include "monitor_fdpass.h"
@@ -65,6 +70,7 @@
msg.msg_accrights = (caddr_t)&fd;
msg.msg_accrightslen = sizeof(fd);
#else
+ memset(&cmsgbuf, 0, sizeof(cmsgbuf));
msg.msg_control = (caddr_t)&cmsgbuf.buf;
msg.msg_controllen = sizeof(cmsgbuf.buf);
cmsg = CMSG_FIRSTHDR(&msg);
@@ -93,8 +99,7 @@
}
if (n != 1) {
- error("%s: sendmsg: expected sent 1 got %ld",
- __func__, (long)n);
+ error("%s: sendmsg: expected sent 1 got %zd", __func__, n);
return -1;
}
return 0;
@@ -131,6 +136,7 @@
msg.msg_accrights = (caddr_t)&fd;
msg.msg_accrightslen = sizeof(fd);
#else
+ memset(&cmsgbuf, 0, sizeof(cmsgbuf));
msg.msg_control = &cmsgbuf.buf;
msg.msg_controllen = sizeof(cmsgbuf.buf);
#endif
@@ -148,8 +154,7 @@
}
if (n != 1) {
- error("%s: recvmsg: expected received 1 got %ld",
- __func__, (long)n);
+ error("%s: recvmsg: expected received 1 got %zd", __func__, n);
return -1;
}
Modified: trunk/crypto/openssh/monitor_mm.c
===================================================================
--- trunk/crypto/openssh/monitor_mm.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/monitor_mm.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_mm.c,v 1.19 2014/01/04 17:50:55 tedu Exp $ */
+/* $OpenBSD: monitor_mm.c,v 1.21 2015/02/06 23:21:59 millert Exp $ */
/*
* Copyright 2002 Niels Provos <provos at citi.umich.edu>
* All rights reserved.
@@ -30,12 +30,14 @@
#ifdef HAVE_SYS_MMAN_H
#include <sys/mman.h>
#endif
-#include <sys/param.h>
#include "openbsd-compat/sys-tree.h"
#include <errno.h>
#include <stdarg.h>
#include <stddef.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
#include <stdlib.h>
#include <string.h>
@@ -176,7 +178,7 @@
if (size == 0)
fatal("mm_malloc: try to allocate 0 space");
- if (size > SIZE_T_MAX - MM_MINSIZE + 1)
+ if (size > SIZE_MAX - MM_MINSIZE + 1)
fatal("mm_malloc: size too big");
size = ((size + (MM_MINSIZE - 1)) / MM_MINSIZE) * MM_MINSIZE;
Modified: trunk/crypto/openssh/monitor_wrap.c
===================================================================
--- trunk/crypto/openssh/monitor_wrap.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/monitor_wrap.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.79 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.88 2016/03/07 19:02:43 djm Exp $ */
/*
* Copyright 2002 Niels Provos <provos at citi.umich.edu>
* Copyright 2002 Markus Friedl <markus at openbsd.org>
@@ -38,14 +38,18 @@
#include <string.h>
#include <unistd.h>
+#ifdef WITH_OPENSSL
#include <openssl/bn.h>
#include <openssl/dh.h>
#include <openssl/evp.h>
+#endif
#include "openbsd-compat/sys-queue.h"
#include "xmalloc.h"
#include "ssh.h"
+#ifdef WITH_OPENSSL
#include "dh.h"
+#endif
#include "buffer.h"
#include "key.h"
#include "cipher.h"
@@ -56,6 +60,7 @@
#include "packet.h"
#include "mac.h"
#include "log.h"
+#include "auth-pam.h"
#ifdef TARGET_OS_MAC /* XXX Broken krb5 headers on Mac */
#undef TARGET_OS_MAC
#include "zlib.h"
@@ -76,8 +81,9 @@
#include "channels.h"
#include "session.h"
#include "servconf.h"
-#include "roaming.h"
+#include "ssherr.h"
+
/* Imports */
extern int compat20;
extern z_stream incoming_stream;
@@ -174,6 +180,7 @@
rtype, type);
}
+#ifdef WITH_OPENSSL
DH *
mm_choose_dh(int min, int nbits, int max)
{
@@ -207,18 +214,21 @@
return (dh_new_group(g, p));
}
+#endif
int
-mm_key_sign(Key *key, u_char **sigp, u_int *lenp, u_char *data, u_int datalen)
+mm_key_sign(Key *key, u_char **sigp, u_int *lenp,
+ const u_char *data, u_int datalen, const char *hostkey_alg)
{
- Kex *kex = *pmonitor->m_pkex;
+ struct kex *kex = *pmonitor->m_pkex;
Buffer m;
debug3("%s entering", __func__);
buffer_init(&m);
- buffer_put_int(&m, kex->host_key_index(key));
+ buffer_put_int(&m, kex->host_key_index(key, 0, active_state));
buffer_put_string(&m, data, datalen);
+ buffer_put_cstring(&m, hostkey_alg);
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, &m);
@@ -353,6 +363,9 @@
mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTHPASSWORD, &m);
authenticated = buffer_get_int(&m);
+#ifdef USE_PAM
+ sshpam_set_maxtries_reached(buffer_get_int(&m));
+#endif
buffer_free(&m);
@@ -362,32 +375,34 @@
}
int
-mm_user_key_allowed(struct passwd *pw, Key *key)
+mm_user_key_allowed(struct passwd *pw, Key *key, int pubkey_auth_attempt)
{
- return (mm_key_allowed(MM_USERKEY, NULL, NULL, key));
+ return (mm_key_allowed(MM_USERKEY, NULL, NULL, key,
+ pubkey_auth_attempt));
}
int
-mm_hostbased_key_allowed(struct passwd *pw, char *user, char *host,
+mm_hostbased_key_allowed(struct passwd *pw, const char *user, const char *host,
Key *key)
{
- return (mm_key_allowed(MM_HOSTKEY, user, host, key));
+ return (mm_key_allowed(MM_HOSTKEY, user, host, key, 0));
}
int
-mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, char *user,
- char *host, Key *key)
+mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, const char *user,
+ const char *host, Key *key)
{
int ret;
key->type = KEY_RSA; /* XXX hack for key_to_blob */
- ret = mm_key_allowed(MM_RSAHOSTKEY, user, host, key);
+ ret = mm_key_allowed(MM_RSAHOSTKEY, user, host, key, 0);
key->type = KEY_RSA1;
return (ret);
}
int
-mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key)
+mm_key_allowed(enum mm_keytype type, const char *user, const char *host,
+ Key *key, int pubkey_auth_attempt)
{
Buffer m;
u_char *blob;
@@ -405,6 +420,7 @@
buffer_put_cstring(&m, user ? user : "");
buffer_put_cstring(&m, host ? host : "");
buffer_put_string(&m, blob, len);
+ buffer_put_int(&m, pubkey_auth_attempt);
free(blob);
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, &m);
@@ -462,239 +478,21 @@
return (verified);
}
-/* Export key state after authentication */
-Newkeys *
-mm_newkeys_from_blob(u_char *blob, int blen)
-{
- Buffer b;
- u_int len;
- Newkeys *newkey = NULL;
- Enc *enc;
- Mac *mac;
- Comp *comp;
-
- debug3("%s: %p(%d)", __func__, blob, blen);
-#ifdef DEBUG_PK
- dump_base64(stderr, blob, blen);
-#endif
- buffer_init(&b);
- buffer_append(&b, blob, blen);
-
- newkey = xcalloc(1, sizeof(*newkey));
- enc = &newkey->enc;
- mac = &newkey->mac;
- comp = &newkey->comp;
-
- /* Enc structure */
- enc->name = buffer_get_string(&b, NULL);
- buffer_get(&b, &enc->cipher, sizeof(enc->cipher));
- enc->enabled = buffer_get_int(&b);
- enc->block_size = buffer_get_int(&b);
- enc->key = buffer_get_string(&b, &enc->key_len);
- enc->iv = buffer_get_string(&b, &enc->iv_len);
-
- if (enc->name == NULL || cipher_by_name(enc->name) != enc->cipher)
- fatal("%s: bad cipher name %s or pointer %p", __func__,
- enc->name, enc->cipher);
-
- /* Mac structure */
- if (cipher_authlen(enc->cipher) == 0) {
- mac->name = buffer_get_string(&b, NULL);
- if (mac->name == NULL || mac_setup(mac, mac->name) == -1)
- fatal("%s: can not setup mac %s", __func__, mac->name);
- mac->enabled = buffer_get_int(&b);
- mac->key = buffer_get_string(&b, &len);
- if (len > mac->key_len)
- fatal("%s: bad mac key length: %u > %d", __func__, len,
- mac->key_len);
- mac->key_len = len;
- }
-
- /* Comp structure */
- comp->type = buffer_get_int(&b);
- comp->enabled = buffer_get_int(&b);
- comp->name = buffer_get_string(&b, NULL);
-
- len = buffer_len(&b);
- if (len != 0)
- error("newkeys_from_blob: remaining bytes in blob %u", len);
- buffer_free(&b);
- return (newkey);
-}
-
-int
-mm_newkeys_to_blob(int mode, u_char **blobp, u_int *lenp)
-{
- Buffer b;
- int len;
- Enc *enc;
- Mac *mac;
- Comp *comp;
- Newkeys *newkey = (Newkeys *)packet_get_newkeys(mode);
-
- debug3("%s: converting %p", __func__, newkey);
-
- if (newkey == NULL) {
- error("%s: newkey == NULL", __func__);
- return 0;
- }
- enc = &newkey->enc;
- mac = &newkey->mac;
- comp = &newkey->comp;
-
- buffer_init(&b);
- /* Enc structure */
- buffer_put_cstring(&b, enc->name);
- /* The cipher struct is constant and shared, you export pointer */
- buffer_append(&b, &enc->cipher, sizeof(enc->cipher));
- buffer_put_int(&b, enc->enabled);
- buffer_put_int(&b, enc->block_size);
- buffer_put_string(&b, enc->key, enc->key_len);
- packet_get_keyiv(mode, enc->iv, enc->iv_len);
- buffer_put_string(&b, enc->iv, enc->iv_len);
-
- /* Mac structure */
- if (cipher_authlen(enc->cipher) == 0) {
- buffer_put_cstring(&b, mac->name);
- buffer_put_int(&b, mac->enabled);
- buffer_put_string(&b, mac->key, mac->key_len);
- }
-
- /* Comp structure */
- buffer_put_int(&b, comp->type);
- buffer_put_int(&b, comp->enabled);
- buffer_put_cstring(&b, comp->name);
-
- len = buffer_len(&b);
- if (lenp != NULL)
- *lenp = len;
- if (blobp != NULL) {
- *blobp = xmalloc(len);
- memcpy(*blobp, buffer_ptr(&b), len);
- }
- explicit_bzero(buffer_ptr(&b), len);
- buffer_free(&b);
- return len;
-}
-
-static void
-mm_send_kex(Buffer *m, Kex *kex)
-{
- buffer_put_string(m, kex->session_id, kex->session_id_len);
- buffer_put_int(m, kex->we_need);
- buffer_put_int(m, kex->hostkey_type);
- buffer_put_int(m, kex->kex_type);
- buffer_put_string(m, buffer_ptr(&kex->my), buffer_len(&kex->my));
- buffer_put_string(m, buffer_ptr(&kex->peer), buffer_len(&kex->peer));
- buffer_put_int(m, kex->flags);
- buffer_put_cstring(m, kex->client_version_string);
- buffer_put_cstring(m, kex->server_version_string);
-}
-
void
mm_send_keystate(struct monitor *monitor)
{
- Buffer m, *input, *output;
- u_char *blob, *p;
- u_int bloblen, plen;
- u_int32_t seqnr, packets;
- u_int64_t blocks, bytes;
+ struct ssh *ssh = active_state; /* XXX */
+ struct sshbuf *m;
+ int r;
- buffer_init(&m);
-
- if (!compat20) {
- u_char iv[24];
- u_char *key;
- u_int ivlen, keylen;
-
- buffer_put_int(&m, packet_get_protocol_flags());
-
- buffer_put_int(&m, packet_get_ssh1_cipher());
-
- debug3("%s: Sending ssh1 KEY+IV", __func__);
- keylen = packet_get_encryption_key(NULL);
- key = xmalloc(keylen+1); /* add 1 if keylen == 0 */
- keylen = packet_get_encryption_key(key);
- buffer_put_string(&m, key, keylen);
- explicit_bzero(key, keylen);
- free(key);
-
- ivlen = packet_get_keyiv_len(MODE_OUT);
- packet_get_keyiv(MODE_OUT, iv, ivlen);
- buffer_put_string(&m, iv, ivlen);
- ivlen = packet_get_keyiv_len(MODE_IN);
- packet_get_keyiv(MODE_IN, iv, ivlen);
- buffer_put_string(&m, iv, ivlen);
- goto skip;
- } else {
- /* Kex for rekeying */
- mm_send_kex(&m, *monitor->m_pkex);
- }
-
- debug3("%s: Sending new keys: %p %p",
- __func__, packet_get_newkeys(MODE_OUT),
- packet_get_newkeys(MODE_IN));
-
- /* Keys from Kex */
- if (!mm_newkeys_to_blob(MODE_OUT, &blob, &bloblen))
- fatal("%s: conversion of newkeys failed", __func__);
-
- buffer_put_string(&m, blob, bloblen);
- free(blob);
-
- if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
- fatal("%s: conversion of newkeys failed", __func__);
-
- buffer_put_string(&m, blob, bloblen);
- free(blob);
-
- packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes);
- buffer_put_int(&m, seqnr);
- buffer_put_int64(&m, blocks);
- buffer_put_int(&m, packets);
- buffer_put_int64(&m, bytes);
- packet_get_state(MODE_IN, &seqnr, &blocks, &packets, &bytes);
- buffer_put_int(&m, seqnr);
- buffer_put_int64(&m, blocks);
- buffer_put_int(&m, packets);
- buffer_put_int64(&m, bytes);
-
- debug3("%s: New keys have been sent", __func__);
- skip:
- /* More key context */
- plen = packet_get_keycontext(MODE_OUT, NULL);
- p = xmalloc(plen+1);
- packet_get_keycontext(MODE_OUT, p);
- buffer_put_string(&m, p, plen);
- free(p);
-
- plen = packet_get_keycontext(MODE_IN, NULL);
- p = xmalloc(plen+1);
- packet_get_keycontext(MODE_IN, p);
- buffer_put_string(&m, p, plen);
- free(p);
-
- /* Compression state */
- debug3("%s: Sending compression state", __func__);
- buffer_put_string(&m, &outgoing_stream, sizeof(outgoing_stream));
- buffer_put_string(&m, &incoming_stream, sizeof(incoming_stream));
-
- /* Network I/O buffers */
- input = (Buffer *)packet_get_input();
- output = (Buffer *)packet_get_output();
- buffer_put_string(&m, buffer_ptr(input), buffer_len(input));
- buffer_put_string(&m, buffer_ptr(output), buffer_len(output));
-
- /* Roaming */
- if (compat20) {
- buffer_put_int64(&m, get_sent_bytes());
- buffer_put_int64(&m, get_recv_bytes());
- }
-
- mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m);
+ if ((m = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = ssh_packet_get_state(ssh, m)) != 0)
+ fatal("%s: get_state failed: %s",
+ __func__, ssh_err(r));
+ mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, m);
debug3("%s: Finished sending state", __func__);
-
- buffer_free(&m);
+ sshbuf_free(m);
}
int
@@ -850,6 +648,7 @@
debug3("%s: pam_query returned %d", __func__, ret);
*name = buffer_get_string(&m, NULL);
*info = buffer_get_string(&m, NULL);
+ sshpam_set_maxtries_reached(buffer_get_int(&m));
*num = buffer_get_int(&m);
if (*num > PAM_MAX_NUM_MSG)
fatal("%s: recieved %u PAM messages, expected <= %u",
@@ -911,6 +710,7 @@
buffer_free(&m);
}
+#ifdef WITH_SSH1
int
mm_ssh1_session_key(BIGNUM *num)
{
@@ -930,6 +730,7 @@
return (rsafail);
}
+#endif
static void
mm_chall_setup(char **name, char **infotxt, u_int *numprompts,
@@ -1077,6 +878,7 @@
buffer_free(&m);
}
+#ifdef WITH_SSH1
int
mm_auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
{
@@ -1172,6 +974,7 @@
return (success);
}
+#endif
#ifdef SSH_AUDIT_EVENTS
void
Modified: trunk/crypto/openssh/monitor_wrap.h
===================================================================
--- trunk/crypto/openssh/monitor_wrap.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/monitor_wrap.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.h,v 1.24 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: monitor_wrap.h,v 1.30 2016/03/07 19:02:43 djm Exp $ */
/*
* Copyright 2002 Niels Provos <provos at citi.umich.edu>
@@ -40,15 +40,17 @@
void mm_log_handler(LogLevel, const char *, void *);
int mm_is_monitor(void);
DH *mm_choose_dh(int, int, int);
-int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
+int mm_key_sign(Key *, u_char **, u_int *, const u_char *, u_int, const char *);
void mm_inform_authserv(char *, char *);
struct passwd *mm_getpwnamallow(const char *);
char *mm_auth2_read_banner(void);
int mm_auth_password(struct Authctxt *, char *);
-int mm_key_allowed(enum mm_keytype, char *, char *, Key *);
-int mm_user_key_allowed(struct passwd *, Key *);
-int mm_hostbased_key_allowed(struct passwd *, char *, char *, Key *);
-int mm_auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
+int mm_key_allowed(enum mm_keytype, const char *, const char *, Key *, int);
+int mm_user_key_allowed(struct passwd *, Key *, int);
+int mm_hostbased_key_allowed(struct passwd *, const char *,
+ const char *, Key *);
+int mm_auth_rhosts_rsa_key_allowed(struct passwd *, const char *,
+ const char *, Key *);
int mm_key_verify(Key *, u_char *, u_int, u_char *, u_int);
int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *);
@@ -87,7 +89,7 @@
int mm_ssh1_session_key(BIGNUM *);
/* Key export functions */
-struct Newkeys *mm_newkeys_from_blob(u_char *, int);
+struct newkeys *mm_newkeys_from_blob(u_char *, int);
int mm_newkeys_to_blob(int, u_char **, u_int *);
void monitor_apply_keystate(struct monitor *);
@@ -103,9 +105,6 @@
int mm_skey_respond(void *, u_int, char **);
/* zlib allocation hooks */
-
-void *mm_zalloc(struct mm_master *, u_int, u_int);
-void mm_zfree(struct mm_master *, void *);
void mm_init_compression(struct mm_master *);
#endif /* _MM_WRAP_H_ */
Modified: trunk/crypto/openssh/msg.c
===================================================================
--- trunk/crypto/openssh/msg.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/msg.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: msg.c,v 1.15 2006/08/03 03:34:42 deraadt Exp $ */
+/* $OpenBSD: msg.c,v 1.16 2015/01/15 09:40:00 djm Exp $ */
/*
* Copyright (c) 2002 Markus Friedl. All rights reserved.
*
@@ -34,7 +34,8 @@
#include <unistd.h>
#include <stdarg.h>
-#include "buffer.h"
+#include "sshbuf.h"
+#include "ssherr.h"
#include "log.h"
#include "atomicio.h"
#include "msg.h"
@@ -41,10 +42,10 @@
#include "misc.h"
int
-ssh_msg_send(int fd, u_char type, Buffer *m)
+ssh_msg_send(int fd, u_char type, struct sshbuf *m)
{
u_char buf[5];
- u_int mlen = buffer_len(m);
+ u_int mlen = sshbuf_len(m);
debug3("ssh_msg_send: type %u", (unsigned int)type & 0xff);
@@ -54,7 +55,7 @@
error("ssh_msg_send: write");
return (-1);
}
- if (atomicio(vwrite, fd, buffer_ptr(m), mlen) != mlen) {
+ if (atomicio(vwrite, fd, (u_char *)sshbuf_ptr(m), mlen) != mlen) {
error("ssh_msg_send: write");
return (-1);
}
@@ -62,10 +63,11 @@
}
int
-ssh_msg_recv(int fd, Buffer *m)
+ssh_msg_recv(int fd, struct sshbuf *m)
{
- u_char buf[4];
+ u_char buf[4], *p;
u_int msg_len;
+ int r;
debug3("ssh_msg_recv entering");
@@ -79,9 +81,12 @@
error("ssh_msg_recv: read: bad msg_len %u", msg_len);
return (-1);
}
- buffer_clear(m);
- buffer_append_space(m, msg_len);
- if (atomicio(read, fd, buffer_ptr(m), msg_len) != msg_len) {
+ sshbuf_reset(m);
+ if ((r = sshbuf_reserve(m, msg_len, &p)) != 0) {
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ return -1;
+ }
+ if (atomicio(read, fd, p, msg_len) != msg_len) {
error("ssh_msg_recv: read: %s", strerror(errno));
return (-1);
}
Modified: trunk/crypto/openssh/msg.h
===================================================================
--- trunk/crypto/openssh/msg.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/msg.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: msg.h,v 1.4 2006/03/25 22:22:43 djm Exp $ */
+/* $OpenBSD: msg.h,v 1.5 2015/01/15 09:40:00 djm Exp $ */
/*
* Copyright (c) 2002 Markus Friedl. All rights reserved.
*
@@ -25,7 +25,8 @@
#ifndef SSH_MSG_H
#define SSH_MSG_H
-int ssh_msg_send(int, u_char, Buffer *);
-int ssh_msg_recv(int, Buffer *);
+struct sshbuf;
+int ssh_msg_send(int, u_char, struct sshbuf *);
+int ssh_msg_recv(int, struct sshbuf *);
#endif
Modified: trunk/crypto/openssh/mux.c
===================================================================
--- trunk/crypto/openssh/mux.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/mux.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: mux.c,v 1.44 2013/07/12 00:19:58 djm Exp $ */
+/* $OpenBSD: mux.c,v 1.60 2016/06/03 03:14:41 dtucker Exp $ */
/*
* Copyright (c) 2002-2008 Damien Miller <djm at openbsd.org>
*
@@ -33,7 +33,6 @@
#include "includes.h"
#include <sys/types.h>
-#include <sys/param.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/un.h>
@@ -89,8 +88,6 @@
extern int subsystem_flag;
extern Buffer command;
extern volatile sig_atomic_t quit_pending;
-extern char *stdio_forward_host;
-extern int stdio_forward_port;
/* Context for session open confirmation callback */
struct mux_session_confirm_ctx {
@@ -105,6 +102,11 @@
u_int rid;
};
+/* Context for stdio fwd open confirmation callback */
+struct mux_stdio_confirm_ctx {
+ u_int rid;
+};
+
/* Context for global channel callback */
struct mux_channel_confirm_ctx {
u_int cid; /* channel id */
@@ -157,6 +159,7 @@
#define MUX_FWD_DYNAMIC 3
static void mux_session_confirm(int, int, void *);
+static void mux_stdio_confirm(int, int, void *);
static int process_mux_master_hello(u_int, Channel *, Buffer *, Buffer *);
static int process_mux_new_session(u_int, Channel *, Buffer *, Buffer *);
@@ -345,7 +348,7 @@
free(cp);
continue;
}
- cctx->env = xrealloc(cctx->env, env_len + 2,
+ cctx->env = xreallocarray(cctx->env, env_len + 2,
sizeof(*cctx->env));
cctx->env[env_len++] = cp;
cctx->env[env_len] = NULL;
@@ -509,7 +512,7 @@
}
static char *
-format_forward(u_int ftype, Forward *fwd)
+format_forward(u_int ftype, struct Forward *fwd)
{
char *ret;
@@ -516,22 +519,26 @@
switch (ftype) {
case MUX_FWD_LOCAL:
xasprintf(&ret, "local forward %.200s:%d -> %.200s:%d",
+ (fwd->listen_path != NULL) ? fwd->listen_path :
(fwd->listen_host == NULL) ?
- (options.gateway_ports ? "*" : "LOCALHOST") :
+ (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
fwd->listen_host, fwd->listen_port,
+ (fwd->connect_path != NULL) ? fwd->connect_path :
fwd->connect_host, fwd->connect_port);
break;
case MUX_FWD_DYNAMIC:
xasprintf(&ret, "dynamic forward %.200s:%d -> *",
(fwd->listen_host == NULL) ?
- (options.gateway_ports ? "*" : "LOCALHOST") :
+ (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
fwd->listen_host, fwd->listen_port);
break;
case MUX_FWD_REMOTE:
xasprintf(&ret, "remote forward %.200s:%d -> %.200s:%d",
+ (fwd->listen_path != NULL) ? fwd->listen_path :
(fwd->listen_host == NULL) ?
"LOCALHOST" : fwd->listen_host,
fwd->listen_port,
+ (fwd->connect_path != NULL) ? fwd->connect_path :
fwd->connect_host, fwd->connect_port);
break;
default:
@@ -551,14 +558,18 @@
}
static int
-compare_forward(Forward *a, Forward *b)
+compare_forward(struct Forward *a, struct Forward *b)
{
if (!compare_host(a->listen_host, b->listen_host))
return 0;
+ if (!compare_host(a->listen_path, b->listen_path))
+ return 0;
if (a->listen_port != b->listen_port)
return 0;
if (!compare_host(a->connect_host, b->connect_host))
return 0;
+ if (!compare_host(a->connect_path, b->connect_path))
+ return 0;
if (a->connect_port != b->connect_port)
return 0;
@@ -570,7 +581,7 @@
{
struct mux_channel_confirm_ctx *fctx = ctxt;
char *failmsg = NULL;
- Forward *rfwd;
+ struct Forward *rfwd;
Channel *c;
Buffer out;
@@ -580,7 +591,9 @@
return;
}
buffer_init(&out);
- if (fctx->fid >= options.num_remote_forwards) {
+ if (fctx->fid >= options.num_remote_forwards ||
+ (options.remote_forwards[fctx->fid].connect_path == NULL &&
+ options.remote_forwards[fctx->fid].connect_host == NULL)) {
xasprintf(&failmsg, "unknown forwarding id %d", fctx->fid);
goto fail;
}
@@ -587,11 +600,12 @@
rfwd = &options.remote_forwards[fctx->fid];
debug("%s: %s for: listen %d, connect %s:%d", __func__,
type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
- rfwd->listen_port, rfwd->connect_host, rfwd->connect_port);
+ rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path :
+ rfwd->connect_host, rfwd->connect_port);
if (type == SSH2_MSG_REQUEST_SUCCESS) {
if (rfwd->listen_port == 0) {
rfwd->allocated_port = packet_get_int();
- logit("Allocated port %u for mux remote forward"
+ debug("Allocated port %u for mux remote forward"
" to %s:%d", rfwd->allocated_port,
rfwd->connect_host, rfwd->connect_port);
buffer_put_int(&out, MUX_S_REMOTE_PORT);
@@ -607,8 +621,23 @@
} else {
if (rfwd->listen_port == 0)
channel_update_permitted_opens(rfwd->handle, -1);
- xasprintf(&failmsg, "remote port forwarding failed for "
- "listen port %d", rfwd->listen_port);
+ if (rfwd->listen_path != NULL)
+ xasprintf(&failmsg, "remote port forwarding failed for "
+ "listen path %s", rfwd->listen_path);
+ else
+ xasprintf(&failmsg, "remote port forwarding failed for "
+ "listen port %d", rfwd->listen_port);
+
+ debug2("%s: clearing registered forwarding for listen %d, "
+ "connect %s:%d", __func__, rfwd->listen_port,
+ rfwd->connect_path ? rfwd->connect_path :
+ rfwd->connect_host, rfwd->connect_port);
+
+ free(rfwd->listen_host);
+ free(rfwd->listen_path);
+ free(rfwd->connect_host);
+ free(rfwd->connect_path);
+ memset(rfwd, 0, sizeof(*rfwd));
}
fail:
error("%s: %s", __func__, failmsg);
@@ -627,8 +656,9 @@
static int
process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
{
- Forward fwd;
+ struct Forward fwd;
char *fwd_desc = NULL;
+ char *listen_addr, *connect_addr;
u_int ftype;
u_int lport, cport;
int i, ret = 0, freefwd = 1;
@@ -635,27 +665,39 @@
memset(&fwd, 0, sizeof(fwd));
+ /* XXX - lport/cport check redundant */
if (buffer_get_int_ret(&ftype, m) != 0 ||
- (fwd.listen_host = buffer_get_string_ret(m, NULL)) == NULL ||
+ (listen_addr = buffer_get_string_ret(m, NULL)) == NULL ||
buffer_get_int_ret(&lport, m) != 0 ||
- (fwd.connect_host = buffer_get_string_ret(m, NULL)) == NULL ||
+ (connect_addr = buffer_get_string_ret(m, NULL)) == NULL ||
buffer_get_int_ret(&cport, m) != 0 ||
- lport > 65535 || cport > 65535) {
+ (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
+ (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
error("%s: malformed message", __func__);
ret = -1;
goto out;
}
- fwd.listen_port = lport;
- fwd.connect_port = cport;
- if (*fwd.listen_host == '\0') {
- free(fwd.listen_host);
- fwd.listen_host = NULL;
+ if (*listen_addr == '\0') {
+ free(listen_addr);
+ listen_addr = NULL;
}
- if (*fwd.connect_host == '\0') {
- free(fwd.connect_host);
- fwd.connect_host = NULL;
+ if (*connect_addr == '\0') {
+ free(connect_addr);
+ connect_addr = NULL;
}
+ memset(&fwd, 0, sizeof(fwd));
+ fwd.listen_port = lport;
+ if (fwd.listen_port == PORT_STREAMLOCAL)
+ fwd.listen_path = listen_addr;
+ else
+ fwd.listen_host = listen_addr;
+ fwd.connect_port = cport;
+ if (fwd.connect_port == PORT_STREAMLOCAL)
+ fwd.connect_path = connect_addr;
+ else
+ fwd.connect_host = connect_addr;
+
debug2("%s: channel %d: request %s", __func__, c->self,
(fwd_desc = format_forward(ftype, &fwd)));
@@ -663,25 +705,30 @@
ftype != MUX_FWD_DYNAMIC) {
logit("%s: invalid forwarding type %u", __func__, ftype);
invalid:
- free(fwd.listen_host);
- free(fwd.connect_host);
+ free(listen_addr);
+ free(connect_addr);
buffer_put_int(r, MUX_S_FAILURE);
buffer_put_int(r, rid);
buffer_put_cstring(r, "Invalid forwarding request");
return 0;
}
- if (fwd.listen_port >= 65536) {
+ if (ftype == MUX_FWD_DYNAMIC && fwd.listen_path) {
+ logit("%s: streamlocal and dynamic forwards "
+ "are mutually exclusive", __func__);
+ goto invalid;
+ }
+ if (fwd.listen_port != PORT_STREAMLOCAL && fwd.listen_port >= 65536) {
logit("%s: invalid listen port %u", __func__,
fwd.listen_port);
goto invalid;
}
- if (fwd.connect_port >= 65536 || (ftype != MUX_FWD_DYNAMIC &&
- ftype != MUX_FWD_REMOTE && fwd.connect_port == 0)) {
+ if ((fwd.connect_port != PORT_STREAMLOCAL && fwd.connect_port >= 65536)
+ || (ftype != MUX_FWD_DYNAMIC && ftype != MUX_FWD_REMOTE && fwd.connect_port == 0)) {
logit("%s: invalid connect port %u", __func__,
fwd.connect_port);
goto invalid;
}
- if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL) {
+ if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL && fwd.connect_path == NULL) {
logit("%s: missing connect host", __func__);
goto invalid;
}
@@ -732,9 +779,8 @@
}
if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) {
- if (!channel_setup_local_fwd_listener(fwd.listen_host,
- fwd.listen_port, fwd.connect_host, fwd.connect_port,
- options.gateway_ports)) {
+ if (!channel_setup_local_fwd_listener(&fwd,
+ &options.fwd_opts)) {
fail:
logit("slave-requested %s failed", fwd_desc);
buffer_put_int(r, MUX_S_FAILURE);
@@ -747,8 +793,7 @@
} else {
struct mux_channel_confirm_ctx *fctx;
- fwd.handle = channel_request_remote_forwarding(fwd.listen_host,
- fwd.listen_port, fwd.connect_host, fwd.connect_port);
+ fwd.handle = channel_request_remote_forwarding(&fwd);
if (fwd.handle < 0)
goto fail;
add_remote_forward(&options, &fwd);
@@ -769,7 +814,9 @@
free(fwd_desc);
if (freefwd) {
free(fwd.listen_host);
+ free(fwd.listen_path);
free(fwd.connect_host);
+ free(fwd.connect_path);
}
return ret;
}
@@ -777,37 +824,49 @@
static int
process_mux_close_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
{
- Forward fwd, *found_fwd;
+ struct Forward fwd, *found_fwd;
char *fwd_desc = NULL;
const char *error_reason = NULL;
+ char *listen_addr = NULL, *connect_addr = NULL;
u_int ftype;
- int i, listen_port, ret = 0;
+ int i, ret = 0;
u_int lport, cport;
memset(&fwd, 0, sizeof(fwd));
if (buffer_get_int_ret(&ftype, m) != 0 ||
- (fwd.listen_host = buffer_get_string_ret(m, NULL)) == NULL ||
+ (listen_addr = buffer_get_string_ret(m, NULL)) == NULL ||
buffer_get_int_ret(&lport, m) != 0 ||
- (fwd.connect_host = buffer_get_string_ret(m, NULL)) == NULL ||
+ (connect_addr = buffer_get_string_ret(m, NULL)) == NULL ||
buffer_get_int_ret(&cport, m) != 0 ||
- lport > 65535 || cport > 65535) {
+ (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
+ (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
error("%s: malformed message", __func__);
ret = -1;
goto out;
}
- fwd.listen_port = lport;
- fwd.connect_port = cport;
- if (*fwd.listen_host == '\0') {
- free(fwd.listen_host);
- fwd.listen_host = NULL;
+ if (*listen_addr == '\0') {
+ free(listen_addr);
+ listen_addr = NULL;
}
- if (*fwd.connect_host == '\0') {
- free(fwd.connect_host);
- fwd.connect_host = NULL;
+ if (*connect_addr == '\0') {
+ free(connect_addr);
+ connect_addr = NULL;
}
+ memset(&fwd, 0, sizeof(fwd));
+ fwd.listen_port = lport;
+ if (fwd.listen_port == PORT_STREAMLOCAL)
+ fwd.listen_path = listen_addr;
+ else
+ fwd.listen_host = listen_addr;
+ fwd.connect_port = cport;
+ if (fwd.connect_port == PORT_STREAMLOCAL)
+ fwd.connect_path = connect_addr;
+ else
+ fwd.connect_host = connect_addr;
+
debug2("%s: channel %d: request cancel %s", __func__, c->self,
(fwd_desc = format_forward(ftype, &fwd)));
@@ -842,18 +901,14 @@
* This shouldn't fail unless we confused the host/port
* between options.remote_forwards and permitted_opens.
* However, for dynamic allocated listen ports we need
- * to lookup the actual listen port.
+ * to use the actual listen port.
*/
- listen_port = (fwd.listen_port == 0) ?
- found_fwd->allocated_port : fwd.listen_port;
- if (channel_request_rforward_cancel(fwd.listen_host,
- listen_port) == -1)
+ if (channel_request_rforward_cancel(found_fwd) == -1)
error_reason = "port not in permitted opens";
} else { /* local and dynamic forwards */
/* Ditto */
- if (channel_cancel_lport_listener(fwd.listen_host,
- fwd.listen_port, fwd.connect_port,
- options.gateway_ports) == -1)
+ if (channel_cancel_lport_listener(&fwd, fwd.connect_port,
+ &options.fwd_opts) == -1)
error_reason = "port not found";
}
@@ -862,8 +917,11 @@
buffer_put_int(r, rid);
free(found_fwd->listen_host);
+ free(found_fwd->listen_path);
free(found_fwd->connect_host);
+ free(found_fwd->connect_path);
found_fwd->listen_host = found_fwd->connect_host = NULL;
+ found_fwd->listen_path = found_fwd->connect_path = NULL;
found_fwd->listen_port = found_fwd->connect_port = 0;
} else {
buffer_put_int(r, MUX_S_FAILURE);
@@ -872,8 +930,8 @@
}
out:
free(fwd_desc);
- free(fwd.listen_host);
- free(fwd.connect_host);
+ free(listen_addr);
+ free(connect_addr);
return ret;
}
@@ -885,6 +943,7 @@
char *reserved, *chost;
u_int cport, i, j;
int new_fd[2];
+ struct mux_stdio_confirm_ctx *cctx;
chost = reserved = NULL;
if ((reserved = buffer_get_string_ret(m, NULL)) == NULL ||
@@ -964,15 +1023,60 @@
channel_register_cleanup(nc->self, mux_master_session_cleanup_cb, 1);
- /* prepare reply */
- /* XXX defer until channel confirmed */
- buffer_put_int(r, MUX_S_SESSION_OPENED);
- buffer_put_int(r, rid);
- buffer_put_int(r, nc->self);
+ cctx = xcalloc(1, sizeof(*cctx));
+ cctx->rid = rid;
+ channel_register_open_confirm(nc->self, mux_stdio_confirm, cctx);
+ c->mux_pause = 1; /* stop handling messages until open_confirm done */
+ /* reply is deferred, sent by mux_session_confirm */
return 0;
}
+/* Callback on open confirmation in mux master for a mux stdio fwd session. */
+static void
+mux_stdio_confirm(int id, int success, void *arg)
+{
+ struct mux_stdio_confirm_ctx *cctx = arg;
+ Channel *c, *cc;
+ Buffer reply;
+
+ if (cctx == NULL)
+ fatal("%s: cctx == NULL", __func__);
+ if ((c = channel_by_id(id)) == NULL)
+ fatal("%s: no channel for id %d", __func__, id);
+ if ((cc = channel_by_id(c->ctl_chan)) == NULL)
+ fatal("%s: channel %d lacks control channel %d", __func__,
+ id, c->ctl_chan);
+
+ if (!success) {
+ debug3("%s: sending failure reply", __func__);
+ /* prepare reply */
+ buffer_init(&reply);
+ buffer_put_int(&reply, MUX_S_FAILURE);
+ buffer_put_int(&reply, cctx->rid);
+ buffer_put_cstring(&reply, "Session open refused by peer");
+ goto done;
+ }
+
+ debug3("%s: sending success reply", __func__);
+ /* prepare reply */
+ buffer_init(&reply);
+ buffer_put_int(&reply, MUX_S_SESSION_OPENED);
+ buffer_put_int(&reply, cctx->rid);
+ buffer_put_int(&reply, c->self);
+
+ done:
+ /* Send reply */
+ buffer_put_string(&cc->output, buffer_ptr(&reply), buffer_len(&reply));
+ buffer_free(&reply);
+
+ if (cc->mux_pause <= 0)
+ fatal("%s: mux_pause %d", __func__, cc->mux_pause);
+ cc->mux_pause = 0; /* start processing messages again */
+ c->open_confirm_ctx = NULL;
+ free(cctx);
+}
+
static int
process_mux_stop_listening(u_int rid, Channel *c, Buffer *m, Buffer *r)
{
@@ -1012,7 +1116,7 @@
{
struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
Buffer in, out;
- void *ptr;
+ const u_char *ptr;
u_int type, rid, have, i;
int ret = -1;
@@ -1135,12 +1239,11 @@
void
muxserver_listen(void)
{
- struct sockaddr_un addr;
- socklen_t sun_len;
mode_t old_umask;
char *orig_control_path = options.control_path;
char rbuf[16+1];
u_int i, r;
+ int oerrno;
if (options.control_path == NULL ||
options.control_master == SSHCTL_MASTER_NO)
@@ -1165,24 +1268,12 @@
xasprintf(&options.control_path, "%s.%s", orig_control_path, rbuf);
debug3("%s: temporary control path %s", __func__, options.control_path);
- memset(&addr, '\0', sizeof(addr));
- addr.sun_family = AF_UNIX;
- sun_len = offsetof(struct sockaddr_un, sun_path) +
- strlen(options.control_path) + 1;
-
- if (strlcpy(addr.sun_path, options.control_path,
- sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) {
- error("ControlPath \"%s\" too long for Unix domain socket",
- options.control_path);
- goto disable_mux_master;
- }
-
- if ((muxserver_sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
- fatal("%s socket(): %s", __func__, strerror(errno));
-
old_umask = umask(0177);
- if (bind(muxserver_sock, (struct sockaddr *)&addr, sun_len) == -1) {
- if (errno == EINVAL || errno == EADDRINUSE) {
+ muxserver_sock = unix_listener(options.control_path, 64, 0);
+ oerrno = errno;
+ umask(old_umask);
+ if (muxserver_sock < 0) {
+ if (oerrno == EINVAL || oerrno == EADDRINUSE) {
error("ControlSocket %s already exists, "
"disabling multiplexing", options.control_path);
disable_mux_master:
@@ -1195,18 +1286,16 @@
options.control_path = NULL;
options.control_master = SSHCTL_MASTER_NO;
return;
- } else
- fatal("%s bind(): %s", __func__, strerror(errno));
+ } else {
+ /* unix_listener() logs the error */
+ cleanup_exit(255);
+ }
}
- umask(old_umask);
- if (listen(muxserver_sock, 64) == -1)
- fatal("%s listen(): %s", __func__, strerror(errno));
-
/* Now atomically "move" the mux socket into position */
if (link(options.control_path, orig_control_path) != 0) {
if (errno != EEXIST) {
- fatal("%s: link mux listener %s => %s: %s", __func__,
+ fatal("%s: link mux listener %s => %s: %s", __func__,
options.control_path, orig_control_path,
strerror(errno));
}
@@ -1263,16 +1352,18 @@
char *proto, *data;
/* Get reasonable local authentication information. */
- client_x11_get_proto(display, options.xauth_location,
+ if (client_x11_get_proto(display, options.xauth_location,
options.forward_x11_trusted, options.forward_x11_timeout,
- &proto, &data);
- /* Request forwarding with authentication spoofing. */
- debug("Requesting X11 forwarding with authentication "
- "spoofing.");
- x11_request_forwarding_with_spoofing(id, display, proto,
- data, 1);
- client_expect_confirm(id, "X11 forwarding", CONFIRM_WARN);
- /* XXX exit_on_forward_failure */
+ &proto, &data) == 0) {
+ /* Request forwarding with authentication spoofing. */
+ debug("Requesting X11 forwarding with authentication "
+ "spoofing.");
+ x11_request_forwarding_with_spoofing(id, display, proto,
+ data, 1);
+ /* XXX exit_on_forward_failure */
+ client_expect_confirm(id, "X11 forwarding",
+ CONFIRM_WARN);
+ }
}
if (cctx->want_agent_fwd && options.forward_agent) {
@@ -1431,7 +1522,7 @@
{
Buffer queue;
u_int need, have;
- void *ptr;
+ const u_char *ptr;
int oerrno;
buffer_init(&queue);
@@ -1595,7 +1686,7 @@
}
static int
-mux_client_forward(int fd, int cancel_flag, u_int ftype, Forward *fwd)
+mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd)
{
Buffer m;
char *e, *fwd_desc;
@@ -1610,11 +1701,20 @@
buffer_put_int(&m, cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD);
buffer_put_int(&m, muxclient_request_id);
buffer_put_int(&m, ftype);
- buffer_put_cstring(&m,
- fwd->listen_host == NULL ? "" : fwd->listen_host);
+ if (fwd->listen_path != NULL) {
+ buffer_put_cstring(&m, fwd->listen_path);
+ } else {
+ buffer_put_cstring(&m,
+ fwd->listen_host == NULL ? "" :
+ (*fwd->listen_host == '\0' ? "*" : fwd->listen_host));
+ }
buffer_put_int(&m, fwd->listen_port);
- buffer_put_cstring(&m,
- fwd->connect_host == NULL ? "" : fwd->connect_host);
+ if (fwd->connect_path != NULL) {
+ buffer_put_cstring(&m, fwd->connect_path);
+ } else {
+ buffer_put_cstring(&m,
+ fwd->connect_host == NULL ? "" : fwd->connect_host);
+ }
buffer_put_int(&m, fwd->connect_port);
if (mux_client_write_packet(fd, &m) != 0)
@@ -1639,12 +1739,12 @@
if (cancel_flag)
fatal("%s: got MUX_S_REMOTE_PORT for cancel", __func__);
fwd->allocated_port = buffer_get_int(&m);
- logit("Allocated port %u for remote forward to %s:%d",
+ verbose("Allocated port %u for remote forward to %s:%d",
fwd->allocated_port,
fwd->connect_host ? fwd->connect_host : "",
fwd->connect_port);
if (muxclient_command == SSHMUX_COMMAND_FORWARD)
- fprintf(stdout, "%u\n", fwd->allocated_port);
+ fprintf(stdout, "%i\n", fwd->allocated_port);
break;
case MUX_S_PERMISSION_DENIED:
e = buffer_get_string(&m, NULL);
@@ -1789,6 +1889,10 @@
}
muxclient_request_id++;
+ if (pledge("stdio proc tty", NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+ platform_pledge_mux();
+
signal(SIGHUP, control_client_sighandler);
signal(SIGINT, control_client_sighandler);
signal(SIGTERM, control_client_sighandler);
@@ -1885,8 +1989,8 @@
buffer_put_int(&m, MUX_C_NEW_STDIO_FWD);
buffer_put_int(&m, muxclient_request_id);
buffer_put_cstring(&m, ""); /* reserved */
- buffer_put_cstring(&m, stdio_forward_host);
- buffer_put_int(&m, stdio_forward_port);
+ buffer_put_cstring(&m, options.stdio_forward_host);
+ buffer_put_int(&m, options.stdio_forward_port);
if (mux_client_write_packet(fd, &m) != 0)
fatal("%s: write packet: %s", __func__, strerror(errno));
@@ -1896,6 +2000,10 @@
mm_send_fd(fd, STDOUT_FILENO) == -1)
fatal("%s: send fds failed", __func__);
+ if (pledge("stdio proc tty", NULL) == -1)
+ fatal("%s pledge(): %s", __func__, strerror(errno));
+ platform_pledge_mux();
+
debug3("%s: stdio forward request sent", __func__);
/* Read their reply */
@@ -1924,7 +2032,7 @@
case MUX_S_FAILURE:
e = buffer_get_string(&m, NULL);
buffer_free(&m);
- fatal("%s: stdio forwarding request failed: %s", __func__, e);
+ fatal("Stdio forwarding request failed: %s", e);
default:
buffer_free(&m);
error("%s: unexpected response from master 0x%08x",
@@ -2006,7 +2114,7 @@
u_int pid;
if (muxclient_command == 0) {
- if (stdio_forward_host != NULL)
+ if (options.stdio_forward_host != NULL)
muxclient_command = SSHMUX_COMMAND_STDIO_FWD;
else
muxclient_command = SSHMUX_COMMAND_OPEN;
@@ -2069,7 +2177,7 @@
case SSHMUX_COMMAND_ALIVE_CHECK:
if ((pid = mux_client_request_alive(sock)) == 0)
fatal("%s: master alive check failed", __func__);
- fprintf(stderr, "Master running (pid=%d)\r\n", pid);
+ fprintf(stderr, "Master running (pid=%u)\r\n", pid);
exit(0);
case SSHMUX_COMMAND_TERMINATE:
mux_client_request_terminate(sock);
Modified: trunk/crypto/openssh/myproposal.h
===================================================================
--- trunk/crypto/openssh/myproposal.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/myproposal.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: myproposal.h,v 1.35 2013/12/06 13:39:49 markus Exp $ */
+/* $OpenBSD: myproposal.h,v 1.50 2016/02/09 05:30:04 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -61,88 +61,133 @@
#ifdef OPENSSL_HAVE_EVPGCM
# define AESGCM_CIPHER_MODES \
- "aes128-gcm at openssh.com,aes256-gcm at openssh.com,"
+ ",aes128-gcm at openssh.com,aes256-gcm at openssh.com"
#else
# define AESGCM_CIPHER_MODES
#endif
#ifdef HAVE_EVP_SHA256
-# define KEX_SHA256_METHODS \
- "diffie-hellman-group-exchange-sha256,"
-#define KEX_CURVE25519_METHODS \
- "curve25519-sha256 at libssh.org,"
+# define KEX_SHA2_METHODS \
+ "diffie-hellman-group-exchange-sha256," \
+ "diffie-hellman-group16-sha512," \
+ "diffie-hellman-group18-sha512,"
+# define KEX_SHA2_GROUP14 \
+ "diffie-hellman-group14-sha256,"
#define SHA2_HMAC_MODES \
"hmac-sha2-256," \
"hmac-sha2-512,"
#else
-# define KEX_SHA256_METHODS
-# define KEX_CURVE25519_METHODS
+# define KEX_SHA2_METHODS
+# define KEX_SHA2_GROUP14
# define SHA2_HMAC_MODES
#endif
-# define KEX_DEFAULT_KEX \
+#ifdef WITH_OPENSSL
+# ifdef HAVE_EVP_SHA256
+# define KEX_CURVE25519_METHODS "curve25519-sha256 at libssh.org,"
+# else
+# define KEX_CURVE25519_METHODS ""
+# endif
+#define KEX_COMMON_KEX \
KEX_CURVE25519_METHODS \
KEX_ECDH_METHODS \
- KEX_SHA256_METHODS \
+ KEX_SHA2_METHODS
+
+#define KEX_SERVER_KEX KEX_COMMON_KEX \
+ KEX_SHA2_GROUP14 \
+ "diffie-hellman-group14-sha1" \
+
+#define KEX_CLIENT_KEX KEX_COMMON_KEX \
"diffie-hellman-group-exchange-sha1," \
- "diffie-hellman-group14-sha1," \
- "diffie-hellman-group1-sha1"
+ KEX_SHA2_GROUP14 \
+ "diffie-hellman-group14-sha1"
#define KEX_DEFAULT_PK_ALG \
HOSTKEY_ECDSA_CERT_METHODS \
"ssh-ed25519-cert-v01 at openssh.com," \
"ssh-rsa-cert-v01 at openssh.com," \
- "ssh-dss-cert-v01 at openssh.com," \
- "ssh-rsa-cert-v00 at openssh.com," \
- "ssh-dss-cert-v00 at openssh.com," \
HOSTKEY_ECDSA_METHODS \
"ssh-ed25519," \
- "ssh-rsa," \
- "ssh-dss"
+ "rsa-sha2-512," \
+ "rsa-sha2-256," \
+ "ssh-rsa"
/* the actual algorithms */
-#define KEX_DEFAULT_ENCRYPT \
- "aes128-ctr,aes192-ctr,aes256-ctr," \
- "arcfour256,arcfour128," \
- AESGCM_CIPHER_MODES \
+#define KEX_SERVER_ENCRYPT \
"chacha20-poly1305 at openssh.com," \
- "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \
- "aes192-cbc,aes256-cbc,arcfour,rijndael-cbc at lysator.liu.se"
+ "aes128-ctr,aes192-ctr,aes256-ctr" \
+ AESGCM_CIPHER_MODES
-#define KEX_DEFAULT_MAC \
- "hmac-md5-etm at openssh.com," \
+#define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT "," \
+ "aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc"
+
+#define KEX_SERVER_MAC \
+ "umac-64-etm at openssh.com," \
+ "umac-128-etm at openssh.com," \
+ "hmac-sha2-256-etm at openssh.com," \
+ "hmac-sha2-512-etm at openssh.com," \
"hmac-sha1-etm at openssh.com," \
+ "umac-64 at openssh.com," \
+ "umac-128 at openssh.com," \
+ "hmac-sha2-256," \
+ "hmac-sha2-512," \
+ "hmac-sha1"
+
+#define KEX_CLIENT_MAC KEX_SERVER_MAC
+
+#else /* WITH_OPENSSL */
+
+#define KEX_SERVER_KEX \
+ "curve25519-sha256 at libssh.org"
+#define KEX_DEFAULT_PK_ALG \
+ "ssh-ed25519-cert-v01 at openssh.com," \
+ "ssh-ed25519"
+#define KEX_SERVER_ENCRYPT \
+ "chacha20-poly1305 at openssh.com," \
+ "aes128-ctr,aes192-ctr,aes256-ctr"
+#define KEX_SERVER_MAC \
"umac-64-etm at openssh.com," \
"umac-128-etm at openssh.com," \
"hmac-sha2-256-etm at openssh.com," \
"hmac-sha2-512-etm at openssh.com," \
- "hmac-ripemd160-etm at openssh.com," \
- "hmac-sha1-96-etm at openssh.com," \
- "hmac-md5-96-etm at openssh.com," \
- "hmac-md5," \
- "hmac-sha1," \
+ "hmac-sha1-etm at openssh.com," \
"umac-64 at openssh.com," \
"umac-128 at openssh.com," \
- SHA2_HMAC_MODES \
- "hmac-ripemd160," \
- "hmac-ripemd160 at openssh.com," \
- "hmac-sha1-96," \
- "hmac-md5-96"
+ "hmac-sha2-256," \
+ "hmac-sha2-512," \
+ "hmac-sha1"
+#define KEX_CLIENT_KEX KEX_SERVER_KEX
+#define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT
+#define KEX_CLIENT_MAC KEX_SERVER_MAC
+
+#endif /* WITH_OPENSSL */
+
#define KEX_DEFAULT_COMP "none,zlib at openssh.com,zlib"
#define KEX_DEFAULT_LANG ""
+#define KEX_CLIENT \
+ KEX_CLIENT_KEX, \
+ KEX_DEFAULT_PK_ALG, \
+ KEX_CLIENT_ENCRYPT, \
+ KEX_CLIENT_ENCRYPT, \
+ KEX_CLIENT_MAC, \
+ KEX_CLIENT_MAC, \
+ KEX_DEFAULT_COMP, \
+ KEX_DEFAULT_COMP, \
+ KEX_DEFAULT_LANG, \
+ KEX_DEFAULT_LANG
-static char *myproposal[PROPOSAL_MAX] = {
- KEX_DEFAULT_KEX,
- KEX_DEFAULT_PK_ALG,
- KEX_DEFAULT_ENCRYPT,
- KEX_DEFAULT_ENCRYPT,
- KEX_DEFAULT_MAC,
- KEX_DEFAULT_MAC,
- KEX_DEFAULT_COMP,
- KEX_DEFAULT_COMP,
- KEX_DEFAULT_LANG,
+#define KEX_SERVER \
+ KEX_SERVER_KEX, \
+ KEX_DEFAULT_PK_ALG, \
+ KEX_SERVER_ENCRYPT, \
+ KEX_SERVER_ENCRYPT, \
+ KEX_SERVER_MAC, \
+ KEX_SERVER_MAC, \
+ KEX_DEFAULT_COMP, \
+ KEX_DEFAULT_COMP, \
+ KEX_DEFAULT_LANG, \
KEX_DEFAULT_LANG
-};
+
Copied: trunk/crypto/openssh/opacket.c (from rev 9222, vendor-crypto/openssh/dist/opacket.c)
===================================================================
--- trunk/crypto/openssh/opacket.c (rev 0)
+++ trunk/crypto/openssh/opacket.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,337 @@
+/* Written by Markus Friedl. Placed in the public domain. */
+
+#include "includes.h"
+
+#include "ssherr.h"
+#include "packet.h"
+#include "log.h"
+
+struct ssh *active_state, *backup_state;
+
+/* Map old to new API */
+
+void
+ssh_packet_start(struct ssh *ssh, u_char type)
+{
+ int r;
+
+ if ((r = sshpkt_start(ssh, type)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+void
+ssh_packet_put_char(struct ssh *ssh, int value)
+{
+ u_char ch = value;
+ int r;
+
+ if ((r = sshpkt_put_u8(ssh, ch)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+void
+ssh_packet_put_int(struct ssh *ssh, u_int value)
+{
+ int r;
+
+ if ((r = sshpkt_put_u32(ssh, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+void
+ssh_packet_put_int64(struct ssh *ssh, u_int64_t value)
+{
+ int r;
+
+ if ((r = sshpkt_put_u64(ssh, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+void
+ssh_packet_put_string(struct ssh *ssh, const void *buf, u_int len)
+{
+ int r;
+
+ if ((r = sshpkt_put_string(ssh, buf, len)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+void
+ssh_packet_put_cstring(struct ssh *ssh, const char *str)
+{
+ int r;
+
+ if ((r = sshpkt_put_cstring(ssh, str)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+void
+ssh_packet_put_raw(struct ssh *ssh, const void *buf, u_int len)
+{
+ int r;
+
+ if ((r = sshpkt_put(ssh, buf, len)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+#ifdef WITH_SSH1
+void
+ssh_packet_put_bignum(struct ssh *ssh, BIGNUM * value)
+{
+ int r;
+
+ if ((r = sshpkt_put_bignum1(ssh, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+#endif
+
+#ifdef WITH_OPENSSL
+void
+ssh_packet_put_bignum2(struct ssh *ssh, BIGNUM * value)
+{
+ int r;
+
+ if ((r = sshpkt_put_bignum2(ssh, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+# ifdef OPENSSL_HAS_ECC
+void
+ssh_packet_put_ecpoint(struct ssh *ssh, const EC_GROUP *curve,
+ const EC_POINT *point)
+{
+ int r;
+
+ if ((r = sshpkt_put_ec(ssh, point, curve)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+# endif
+#endif /* WITH_OPENSSL */
+
+void
+ssh_packet_send(struct ssh *ssh)
+{
+ int r;
+
+ if ((r = sshpkt_send(ssh)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+u_int
+ssh_packet_get_char(struct ssh *ssh)
+{
+ u_char ch;
+ int r;
+
+ if ((r = sshpkt_get_u8(ssh, &ch)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+ return ch;
+}
+
+u_int
+ssh_packet_get_int(struct ssh *ssh)
+{
+ u_int val;
+ int r;
+
+ if ((r = sshpkt_get_u32(ssh, &val)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+ return val;
+}
+
+u_int64_t
+ssh_packet_get_int64(struct ssh *ssh)
+{
+ u_int64_t val;
+ int r;
+
+ if ((r = sshpkt_get_u64(ssh, &val)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+ return val;
+}
+
+#ifdef WITH_SSH1
+void
+ssh_packet_get_bignum(struct ssh *ssh, BIGNUM * value)
+{
+ int r;
+
+ if ((r = sshpkt_get_bignum1(ssh, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+#endif
+
+#ifdef WITH_OPENSSL
+void
+ssh_packet_get_bignum2(struct ssh *ssh, BIGNUM * value)
+{
+ int r;
+
+ if ((r = sshpkt_get_bignum2(ssh, value)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+
+# ifdef OPENSSL_HAS_ECC
+void
+ssh_packet_get_ecpoint(struct ssh *ssh, const EC_GROUP *curve, EC_POINT *point)
+{
+ int r;
+
+ if ((r = sshpkt_get_ec(ssh, point, curve)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+}
+# endif
+#endif /* WITH_OPENSSL */
+
+void *
+ssh_packet_get_string(struct ssh *ssh, u_int *length_ptr)
+{
+ int r;
+ size_t len;
+ u_char *val;
+
+ if ((r = sshpkt_get_string(ssh, &val, &len)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+ if (length_ptr != NULL)
+ *length_ptr = (u_int)len;
+ return val;
+}
+
+const void *
+ssh_packet_get_string_ptr(struct ssh *ssh, u_int *length_ptr)
+{
+ int r;
+ size_t len;
+ const u_char *val;
+
+ if ((r = sshpkt_get_string_direct(ssh, &val, &len)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+ if (length_ptr != NULL)
+ *length_ptr = (u_int)len;
+ return val;
+}
+
+char *
+ssh_packet_get_cstring(struct ssh *ssh, u_int *length_ptr)
+{
+ int r;
+ size_t len;
+ char *val;
+
+ if ((r = sshpkt_get_cstring(ssh, &val, &len)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+ if (length_ptr != NULL)
+ *length_ptr = (u_int)len;
+ return val;
+}
+
+/* Old API, that had to be reimplemented */
+
+void
+packet_set_connection(int fd_in, int fd_out)
+{
+ active_state = ssh_packet_set_connection(active_state, fd_in, fd_out);
+ if (active_state == NULL)
+ fatal("%s: ssh_packet_set_connection failed", __func__);
+}
+
+u_int
+packet_get_char(void)
+{
+ return (ssh_packet_get_char(active_state));
+}
+
+u_int
+packet_get_int(void)
+{
+ return (ssh_packet_get_int(active_state));
+}
+
+int
+packet_read_seqnr(u_int32_t *seqnr)
+{
+ u_char type;
+ int r;
+
+ if ((r = ssh_packet_read_seqnr(active_state, &type, seqnr)) != 0)
+ sshpkt_fatal(active_state, __func__, r);
+ return type;
+}
+
+int
+packet_read_poll_seqnr(u_int32_t *seqnr)
+{
+ u_char type;
+ int r;
+
+ if ((r = ssh_packet_read_poll_seqnr(active_state, &type, seqnr)))
+ sshpkt_fatal(active_state, __func__, r);
+ return type;
+}
+
+void
+packet_close(void)
+{
+ ssh_packet_close(active_state);
+ active_state = NULL;
+}
+
+void
+packet_process_incoming(const char *buf, u_int len)
+{
+ int r;
+
+ if ((r = ssh_packet_process_incoming(active_state, buf, len)) != 0)
+ sshpkt_fatal(active_state, __func__, r);
+}
+
+void
+packet_write_wait(void)
+{
+ int r;
+
+ if ((r = ssh_packet_write_wait(active_state)) != 0)
+ sshpkt_fatal(active_state, __func__, r);
+}
+
+void
+packet_write_poll(void)
+{
+ int r;
+
+ if ((r = ssh_packet_write_poll(active_state)) != 0)
+ sshpkt_fatal(active_state, __func__, r);
+}
+
+void
+packet_read_expect(int expected_type)
+{
+ int r;
+
+ if ((r = ssh_packet_read_expect(active_state, expected_type)) != 0)
+ sshpkt_fatal(active_state, __func__, r);
+}
+
+void
+packet_disconnect(const char *fmt, ...)
+{
+ char buf[1024];
+ va_list args;
+
+ va_start(args, fmt);
+ vsnprintf(buf, sizeof(buf), fmt, args);
+ va_end(args);
+ ssh_packet_disconnect(active_state, "%s", buf);
+}
+
+void
+packet_send_debug(const char *fmt, ...)
+{
+ char buf[1024];
+ va_list args;
+
+ va_start(args, fmt);
+ vsnprintf(buf, sizeof(buf), fmt, args);
+ va_end(args);
+ ssh_packet_send_debug(active_state, "%s", buf);
+}
Copied: trunk/crypto/openssh/opacket.h (from rev 9222, vendor-crypto/openssh/dist/opacket.h)
===================================================================
--- trunk/crypto/openssh/opacket.h (rev 0)
+++ trunk/crypto/openssh/opacket.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,160 @@
+#ifndef _OPACKET_H
+/* Written by Markus Friedl. Placed in the public domain. */
+
+/* Map old to new API */
+void ssh_packet_start(struct ssh *, u_char);
+void ssh_packet_put_char(struct ssh *, int ch);
+void ssh_packet_put_int(struct ssh *, u_int value);
+void ssh_packet_put_int64(struct ssh *, u_int64_t value);
+void ssh_packet_put_bignum(struct ssh *, BIGNUM * value);
+void ssh_packet_put_bignum2(struct ssh *, BIGNUM * value);
+void ssh_packet_put_ecpoint(struct ssh *, const EC_GROUP *, const EC_POINT *);
+void ssh_packet_put_string(struct ssh *, const void *buf, u_int len);
+void ssh_packet_put_cstring(struct ssh *, const char *str);
+void ssh_packet_put_raw(struct ssh *, const void *buf, u_int len);
+void ssh_packet_send(struct ssh *);
+
+u_int ssh_packet_get_char(struct ssh *);
+u_int ssh_packet_get_int(struct ssh *);
+u_int64_t ssh_packet_get_int64(struct ssh *);
+void ssh_packet_get_bignum(struct ssh *, BIGNUM * value);
+void ssh_packet_get_bignum2(struct ssh *, BIGNUM * value);
+void ssh_packet_get_ecpoint(struct ssh *, const EC_GROUP *, EC_POINT *);
+void *ssh_packet_get_string(struct ssh *, u_int *length_ptr);
+char *ssh_packet_get_cstring(struct ssh *, u_int *length_ptr);
+
+/* don't allow remaining bytes after the end of the message */
+#define ssh_packet_check_eom(ssh) \
+do { \
+ int _len = ssh_packet_remaining(ssh); \
+ if (_len > 0) { \
+ logit("Packet integrity error (%d bytes remaining) at %s:%d", \
+ _len ,__FILE__, __LINE__); \
+ ssh_packet_disconnect(ssh, \
+ "Packet integrity error."); \
+ } \
+} while (0)
+
+/* old API */
+void packet_close(void);
+u_int packet_get_char(void);
+u_int packet_get_int(void);
+void packet_set_connection(int, int);
+int packet_read_seqnr(u_int32_t *);
+int packet_read_poll_seqnr(u_int32_t *);
+void packet_process_incoming(const char *buf, u_int len);
+void packet_write_wait(void);
+void packet_write_poll(void);
+void packet_read_expect(int expected_type);
+#define packet_set_timeout(timeout, count) \
+ ssh_packet_set_timeout(active_state, (timeout), (count))
+#define packet_connection_is_on_socket() \
+ ssh_packet_connection_is_on_socket(active_state)
+#define packet_set_nonblocking() \
+ ssh_packet_set_nonblocking(active_state)
+#define packet_get_connection_in() \
+ ssh_packet_get_connection_in(active_state)
+#define packet_get_connection_out() \
+ ssh_packet_get_connection_out(active_state)
+#define packet_set_protocol_flags(protocol_flags) \
+ ssh_packet_set_protocol_flags(active_state, (protocol_flags))
+#define packet_get_protocol_flags() \
+ ssh_packet_get_protocol_flags(active_state)
+#define packet_start_compression(level) \
+ ssh_packet_start_compression(active_state, (level))
+#define packet_set_encryption_key(key, keylen, number) \
+ ssh_packet_set_encryption_key(active_state, (key), (keylen), (number))
+#define packet_start(type) \
+ ssh_packet_start(active_state, (type))
+#define packet_put_char(value) \
+ ssh_packet_put_char(active_state, (value))
+#define packet_put_int(value) \
+ ssh_packet_put_int(active_state, (value))
+#define packet_put_int64(value) \
+ ssh_packet_put_int64(active_state, (value))
+#define packet_put_string( buf, len) \
+ ssh_packet_put_string(active_state, (buf), (len))
+#define packet_put_cstring(str) \
+ ssh_packet_put_cstring(active_state, (str))
+#define packet_put_raw(buf, len) \
+ ssh_packet_put_raw(active_state, (buf), (len))
+#define packet_put_bignum(value) \
+ ssh_packet_put_bignum(active_state, (value))
+#define packet_put_bignum2(value) \
+ ssh_packet_put_bignum2(active_state, (value))
+#define packet_send() \
+ ssh_packet_send(active_state)
+#define packet_read() \
+ ssh_packet_read(active_state)
+#define packet_get_int64() \
+ ssh_packet_get_int64(active_state)
+#define packet_get_bignum(value) \
+ ssh_packet_get_bignum(active_state, (value))
+#define packet_get_bignum2(value) \
+ ssh_packet_get_bignum2(active_state, (value))
+#define packet_remaining() \
+ ssh_packet_remaining(active_state)
+#define packet_get_string(length_ptr) \
+ ssh_packet_get_string(active_state, (length_ptr))
+#define packet_get_string_ptr(length_ptr) \
+ ssh_packet_get_string_ptr(active_state, (length_ptr))
+#define packet_get_cstring(length_ptr) \
+ ssh_packet_get_cstring(active_state, (length_ptr))
+void packet_send_debug(const char *, ...)
+ __attribute__((format(printf, 1, 2)));
+void packet_disconnect(const char *, ...)
+ __attribute__((format(printf, 1, 2)))
+ __attribute__((noreturn));
+#define packet_have_data_to_write() \
+ ssh_packet_have_data_to_write(active_state)
+#define packet_not_very_much_data_to_write() \
+ ssh_packet_not_very_much_data_to_write(active_state)
+#define packet_set_interactive(interactive, qos_interactive, qos_bulk) \
+ ssh_packet_set_interactive(active_state, (interactive), (qos_interactive), (qos_bulk))
+#define packet_is_interactive() \
+ ssh_packet_is_interactive(active_state)
+#define packet_set_maxsize(s) \
+ ssh_packet_set_maxsize(active_state, (s))
+#define packet_inc_alive_timeouts() \
+ ssh_packet_inc_alive_timeouts(active_state)
+#define packet_set_alive_timeouts(ka) \
+ ssh_packet_set_alive_timeouts(active_state, (ka))
+#define packet_get_maxsize() \
+ ssh_packet_get_maxsize(active_state)
+#define packet_add_padding(pad) \
+ sshpkt_add_padding(active_state, (pad))
+#define packet_send_ignore(nbytes) \
+ ssh_packet_send_ignore(active_state, (nbytes))
+#define packet_set_server() \
+ ssh_packet_set_server(active_state)
+#define packet_set_authenticated() \
+ ssh_packet_set_authenticated(active_state)
+#define packet_get_input() \
+ ssh_packet_get_input(active_state)
+#define packet_get_output() \
+ ssh_packet_get_output(active_state)
+#define packet_set_compress_hooks(ctx, allocfunc, freefunc) \
+ ssh_packet_set_compress_hooks(active_state, ctx, \
+ allocfunc, freefunc);
+#define packet_check_eom() \
+ ssh_packet_check_eom(active_state)
+#define set_newkeys(mode) \
+ ssh_set_newkeys(active_state, (mode))
+#define packet_get_state(m) \
+ ssh_packet_get_state(active_state, m)
+#define packet_set_state(m) \
+ ssh_packet_set_state(active_state, m)
+#define packet_get_raw(lenp) \
+ sshpkt_ptr(active_state, lenp)
+#define packet_get_ecpoint(c,p) \
+ ssh_packet_get_ecpoint(active_state, c, p)
+#define packet_put_ecpoint(c,p) \
+ ssh_packet_put_ecpoint(active_state, c, p)
+#define packet_get_rekey_timeout() \
+ ssh_packet_get_rekey_timeout(active_state)
+#define packet_set_rekey_limits(x,y) \
+ ssh_packet_set_rekey_limits(active_state, x, y)
+#define packet_get_bytes(x,y) \
+ ssh_packet_get_bytes(active_state, x, y)
+
+#endif /* _OPACKET_H */
Modified: trunk/crypto/openssh/openbsd-compat/Makefile.in
===================================================================
--- trunk/crypto/openssh/openbsd-compat/Makefile.in 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/Makefile.in 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.55 2014/02/04 00:37:50 djm Exp $
+# $Id: Makefile.in,v 1.56 2014/09/30 23:43:08 djm Exp $
sysconfdir=@sysconfdir@
piddir=@piddir@
@@ -16,9 +16,9 @@
INSTALL=@INSTALL@
LDFLAGS=-L. @LDFLAGS@
-OPENBSD=base64.o basename.o bcrypt_pbkdf.o bindresvport.o blowfish.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt_long.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strnlen.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o strtoull.o timingsafe_bcmp.o vis.o blowfish.o bcrypt_pbkdf.o explicit_bzero.o
+OPENBSD=base64.o basename.o bcrypt_pbkdf.o bindresvport.o blowfish.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt_long.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o reallocarray.o realpath.o rresvport.o setenv.o setproctitle.o sha1.o sha2.o rmd160.o md5.o sigact.o strlcat.o strlcpy.o strmode.o strnlen.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o strtoull.o timingsafe_bcmp.o vis.o blowfish.o bcrypt_pbkdf.o explicit_bzero.o
-COMPAT=arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+COMPAT=arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-err.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o kludge-fd_set.o
PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
Modified: trunk/crypto/openssh/openbsd-compat/arc4random.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/arc4random.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/arc4random.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -26,15 +26,19 @@
#include "includes.h"
+#include <sys/types.h>
+
+#include <fcntl.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
-#include <sys/types.h>
#ifndef HAVE_ARC4RANDOM
+#ifdef WITH_OPENSSL
#include <openssl/rand.h>
#include <openssl/err.h>
+#endif
#include "log.h"
@@ -73,14 +77,44 @@
chacha_ivsetup(&rs, buf + KEYSZ);
}
+#ifndef WITH_OPENSSL
+#define SSH_RANDOM_DEV "/dev/urandom"
+/* XXX use getrandom() if supported on Linux */
static void
+getrnd(u_char *s, size_t len)
+{
+ int fd;
+ ssize_t r;
+ size_t o = 0;
+
+ if ((fd = open(SSH_RANDOM_DEV, O_RDONLY)) == -1)
+ fatal("Couldn't open %s: %s", SSH_RANDOM_DEV, strerror(errno));
+ while (o < len) {
+ r = read(fd, s + o, len - o);
+ if (r < 0) {
+ if (errno == EAGAIN || errno == EINTR ||
+ errno == EWOULDBLOCK)
+ continue;
+ fatal("read %s: %s", SSH_RANDOM_DEV, strerror(errno));
+ }
+ o += r;
+ }
+ close(fd);
+}
+#endif
+
+static void
_rs_stir(void)
{
u_char rnd[KEYSZ + IVSZ];
+#ifdef WITH_OPENSSL
if (RAND_bytes(rnd, sizeof(rnd)) <= 0)
- fatal("Couldn't obtain random bytes (error %ld)",
- ERR_get_error());
+ fatal("Couldn't obtain random bytes (error 0x%lx)",
+ (unsigned long)ERR_get_error());
+#else
+ getrnd(rnd, sizeof(rnd));
+#endif
if (!rs_initialized) {
rs_initialized = 1;
@@ -87,7 +121,7 @@
_rs_init(rnd, sizeof(rnd));
} else
_rs_rekey(rnd, sizeof(rnd));
- memset(rnd, 0, sizeof(rnd));
+ explicit_bzero(rnd, sizeof(rnd));
/* invalidate rs_buf */
rs_have = 0;
@@ -229,7 +263,7 @@
buf[i] = r & 0xff;
r >>= 8;
}
- i = r = 0;
+ explicit_bzero(&r, sizeof(r));
}
#endif /* !defined(HAVE_ARC4RANDOM_BUF) && defined(HAVE_ARC4RANDOM) */
Modified: trunk/crypto/openssh/openbsd-compat/bcrypt_pbkdf.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bcrypt_pbkdf.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bcrypt_pbkdf.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: bcrypt_pbkdf.c,v 1.4 2013/07/29 00:55:53 tedu Exp $ */
+/* $OpenBSD: bcrypt_pbkdf.c,v 1.13 2015/01/12 03:20:04 tedu Exp $ */
/*
* Copyright (c) 2013 Ted Unangst <tedu at openbsd.org>
*
@@ -32,8 +32,13 @@
#endif
#include "crypto_api.h"
+#ifdef SHA512_DIGEST_LENGTH
+# undef SHA512_DIGEST_LENGTH
+#endif
#define SHA512_DIGEST_LENGTH crypto_hash_sha512_BYTES
+#define MINIMUM(a,b) (((a) < (b)) ? (a) : (b))
+
/*
* pkcs #5 pbkdf2 implementation using the "bcrypt" hash
*
@@ -51,15 +56,15 @@
*
* One modification from official pbkdf2. Instead of outputting key material
* linearly, we mix it. pbkdf2 has a known weakness where if one uses it to
- * generate (i.e.) 512 bits of key material for use as two 256 bit keys, an
- * attacker can merely run once through the outer loop below, but the user
+ * generate (e.g.) 512 bits of key material for use as two 256 bit keys, an
+ * attacker can merely run once through the outer loop, but the user
* always runs it twice. Shuffling output bytes requires computing the
* entirety of the key material to assemble any subkey. This is something a
* wise caller could do; we just do it for you.
*/
-#define BCRYPT_BLOCKS 8
-#define BCRYPT_HASHSIZE (BCRYPT_BLOCKS * 4)
+#define BCRYPT_WORDS 8
+#define BCRYPT_HASHSIZE (BCRYPT_WORDS * 4)
static void
bcrypt_hash(u_int8_t *sha2pass, u_int8_t *sha2salt, u_int8_t *out)
@@ -67,7 +72,7 @@
blf_ctx state;
u_int8_t ciphertext[BCRYPT_HASHSIZE] =
"OxychromaticBlowfishSwatDynamite";
- uint32_t cdata[BCRYPT_BLOCKS];
+ uint32_t cdata[BCRYPT_WORDS];
int i;
uint16_t j;
size_t shalen = SHA512_DIGEST_LENGTH;
@@ -82,7 +87,7 @@
/* encryption */
j = 0;
- for (i = 0; i < BCRYPT_BLOCKS; i++)
+ for (i = 0; i < BCRYPT_WORDS; i++)
cdata[i] = Blowfish_stream2word(ciphertext, sizeof(ciphertext),
&j);
for (i = 0; i < 64; i++)
@@ -89,7 +94,7 @@
blf_enc(&state, cdata, sizeof(cdata) / sizeof(uint64_t));
/* copy out */
- for (i = 0; i < BCRYPT_BLOCKS; i++) {
+ for (i = 0; i < BCRYPT_WORDS; i++) {
out[4 * i + 3] = (cdata[i] >> 24) & 0xff;
out[4 * i + 2] = (cdata[i] >> 16) & 0xff;
out[4 * i + 1] = (cdata[i] >> 8) & 0xff;
@@ -97,9 +102,9 @@
}
/* zap */
- memset(ciphertext, 0, sizeof(ciphertext));
- memset(cdata, 0, sizeof(cdata));
- memset(&state, 0, sizeof(state));
+ explicit_bzero(ciphertext, sizeof(ciphertext));
+ explicit_bzero(cdata, sizeof(cdata));
+ explicit_bzero(&state, sizeof(state));
}
int
@@ -113,6 +118,7 @@
u_int8_t *countsalt;
size_t i, j, amt, stride;
uint32_t count;
+ size_t origkeylen = keylen;
/* nothing crazy */
if (rounds < 1)
@@ -152,17 +158,20 @@
}
/*
- * pbkdf2 deviation: ouput the key material non-linearly.
+ * pbkdf2 deviation: output the key material non-linearly.
*/
- amt = MIN(amt, keylen);
- for (i = 0; i < amt; i++)
- key[i * stride + (count - 1)] = out[i];
- keylen -= amt;
+ amt = MINIMUM(amt, keylen);
+ for (i = 0; i < amt; i++) {
+ size_t dest = i * stride + (count - 1);
+ if (dest >= origkeylen)
+ break;
+ key[dest] = out[i];
+ }
+ keylen -= i;
}
/* zap */
- memset(out, 0, sizeof(out));
- memset(countsalt, 0, saltlen + 4);
+ explicit_bzero(out, sizeof(out));
free(countsalt);
return 0;
Modified: trunk/crypto/openssh/openbsd-compat/bindresvport.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bindresvport.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bindresvport.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -64,6 +64,7 @@
if (sa == NULL) {
memset(&myaddr, 0, sizeof(myaddr));
sa = (struct sockaddr *)&myaddr;
+ salen = sizeof(myaddr);
if (getsockname(sd, sa, &salen) == -1)
return -1; /* errno is correctly set */
Modified: trunk/crypto/openssh/openbsd-compat/blowfish.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/blowfish.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/blowfish.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -50,7 +50,9 @@
#endif
#include <sys/types.h>
+#ifdef HAVE_BLF_H
#include <blf.h>
+#endif
#undef inline
#ifdef __GNUC__
Modified: trunk/crypto/openssh/openbsd-compat/bsd-asprintf.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bsd-asprintf.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bsd-asprintf.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -25,18 +25,6 @@
#include <stdarg.h>
#include <stdlib.h>
-#ifndef VA_COPY
-# ifdef HAVE_VA_COPY
-# define VA_COPY(dest, src) va_copy(dest, src)
-# else
-# ifdef HAVE___VA_COPY
-# define VA_COPY(dest, src) __va_copy(dest, src)
-# else
-# define VA_COPY(dest, src) (dest) = (src)
-# endif
-# endif
-#endif
-
#define INIT_SZ 128
int
Modified: trunk/crypto/openssh/openbsd-compat/bsd-cygwin_util.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bsd-cygwin_util.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bsd-cygwin_util.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -57,6 +57,22 @@
return (pathconf(filename, _PC_POSIX_PERMISSIONS));
}
+const char *
+cygwin_ssh_privsep_user()
+{
+ static char cyg_privsep_user[DNLEN + UNLEN + 2];
+
+ if (!cyg_privsep_user[0])
+ {
+#ifdef CW_CYGNAME_FROM_WINNAME
+ if (cygwin_internal (CW_CYGNAME_FROM_WINNAME, "sshd", cyg_privsep_user,
+ sizeof cyg_privsep_user) != 0)
+#endif
+ strlcpy(cyg_privsep_user, "sshd", sizeof(cyg_privsep_user));
+ }
+ return cyg_privsep_user;
+}
+
#define NL(x) x, (sizeof (x) - 1)
#define WENV_SIZ (sizeof (wenv_arr) / sizeof (wenv_arr[0]))
Modified: trunk/crypto/openssh/openbsd-compat/bsd-cygwin_util.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bsd-cygwin_util.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bsd-cygwin_util.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $Id: bsd-cygwin_util.h,v 1.17 2014/01/18 10:04:00 dtucker Exp $ */
+/* $Id: bsd-cygwin_util.h,v 1.18 2014/05/27 04:34:43 djm Exp $ */
/*
* Copyright (c) 2000, 2001, 2011, 2013 Corinna Vinschen <vinschen at redhat.com>
@@ -39,6 +39,8 @@
/* Avoid including windows headers. */
typedef void *HANDLE;
#define INVALID_HANDLE_VALUE ((HANDLE) -1)
+#define DNLEN 16
+#define UNLEN 256
/* Cygwin functions for which declarations are only available when including
windows headers, so we have to define them here explicitely. */
@@ -48,6 +50,8 @@
#include <sys/cygwin.h>
#include <io.h>
+#define CYGWIN_SSH_PRIVSEP_USER (cygwin_ssh_privsep_user())
+const char *cygwin_ssh_privsep_user();
int binary_open(const char *, int , ...);
int check_ntsec(const char *);
Copied: trunk/crypto/openssh/openbsd-compat/bsd-err.c (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/bsd-err.c)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bsd-err.c (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/bsd-err.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2015 Tim Rice <tim at multitalents.net>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+
+#ifndef HAVE_ERR
+void
+err(int r, const char *fmt, ...)
+{
+ va_list args;
+
+ va_start(args, fmt);
+ fprintf(stderr, "%s: ", strerror(errno));
+ vfprintf(stderr, fmt, args);
+ fputc('\n', stderr);
+ va_end(args);
+ exit(r);
+}
+#endif
+
+#ifndef HAVE_ERRX
+void
+errx(int r, const char *fmt, ...)
+{
+ va_list args;
+
+ va_start(args, fmt);
+ vfprintf(stderr, fmt, args);
+ fputc('\n', stderr);
+ va_end(args);
+ exit(r);
+}
+#endif
+
+#ifndef HAVE_WARN
+void
+warn(const char *fmt, ...)
+{
+ va_list args;
+
+ va_start(args, fmt);
+ fprintf(stderr, "%s: ", strerror(errno));
+ vfprintf(stderr, fmt, args);
+ fputc('\n', stderr);
+ va_end(args);
+}
+#endif
Modified: trunk/crypto/openssh/openbsd-compat/bsd-misc.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bsd-misc.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bsd-misc.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -31,8 +31,6 @@
#include <time.h>
#include <unistd.h>
-#include "xmalloc.h"
-
#ifndef HAVE___PROGNAME
char *__progname;
#endif
@@ -43,13 +41,12 @@
*/
char *ssh_get_progname(char *argv0)
{
+ char *p, *q;
#ifdef HAVE___PROGNAME
extern char *__progname;
- return xstrdup(__progname);
+ p = __progname;
#else
- char *p;
-
if (argv0 == NULL)
return ("unknown"); /* XXX */
p = strrchr(argv0, '/');
@@ -57,9 +54,12 @@
p = argv0;
else
p++;
-
- return (xstrdup(p));
#endif
+ if ((q = strdup(p)) == NULL) {
+ perror("strdup");
+ exit(1);
+ }
+ return q;
}
#ifndef HAVE_SETLOGIN
@@ -276,3 +276,28 @@
return -1;
}
#endif
+
+#ifndef HAVE_PLEDGE
+int
+pledge(const char *promises, const char *paths[])
+{
+ return 0;
+}
+#endif
+
+#ifndef HAVE_MBTOWC
+/* a mbtowc that only supports ASCII */
+int
+mbtowc(wchar_t *pwc, const char *s, size_t n)
+{
+ if (s == NULL || *s == '\0')
+ return 0; /* ASCII is not state-dependent */
+ if (*s < 0 || *s > 0x7f || n < 1) {
+ errno = EOPNOTSUPP;
+ return -1;
+ }
+ if (pwc != NULL)
+ *pwc = *s;
+ return 1;
+}
+#endif
Modified: trunk/crypto/openssh/openbsd-compat/bsd-misc.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bsd-misc.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bsd-misc.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -111,7 +111,7 @@
#endif
#ifndef HAVE_ENDGRENT
-# define endgrent() {}
+# define endgrent() do { } while(0)
#endif
#ifndef HAVE_KRB5_GET_ERROR_MESSAGE
@@ -119,7 +119,22 @@
#endif
#ifndef HAVE_KRB5_FREE_ERROR_MESSAGE
-# define krb5_free_error_message(a,b) while(0)
+# define krb5_free_error_message(a,b) do { } while(0)
#endif
+#ifndef HAVE_PLEDGE
+int pledge(const char *promises, const char *paths[]);
+#endif
+
+/* bsd-err.h */
+#ifndef HAVE_ERR
+void err(int, const char *, ...) __attribute__((format(printf, 2, 3)));
+#endif
+#ifndef HAVE_ERRX
+void errx(int, const char *, ...) __attribute__((format(printf, 2, 3)));
+#endif
+#ifndef HAVE_WARN
+void warn(const char *, ...) __attribute__((format(printf, 1, 2)));
+#endif
+
#endif /* _BSD_MISC_H */
Modified: trunk/crypto/openssh/openbsd-compat/bsd-poll.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bsd-poll.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bsd-poll.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -42,11 +42,11 @@
#define POLLIN 0x0001
#define POLLOUT 0x0004
#define POLLERR 0x0008
+#define POLLHUP 0x0010
+#define POLLNVAL 0x0020
#if 0
/* the following are currently not implemented */
#define POLLPRI 0x0002
-#define POLLHUP 0x0010
-#define POLLNVAL 0x0020
#define POLLRDNORM 0x0040
#define POLLNORM POLLRDNORM
#define POLLWRNORM POLLOUT
Modified: trunk/crypto/openssh/openbsd-compat/bsd-snprintf.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/bsd-snprintf.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/bsd-snprintf.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -99,18 +99,6 @@
# undef HAVE_VSNPRINTF
#endif
-#ifndef VA_COPY
-# ifdef HAVE_VA_COPY
-# define VA_COPY(dest, src) va_copy(dest, src)
-# else
-# ifdef HAVE___VA_COPY
-# define VA_COPY(dest, src) __va_copy(dest, src)
-# else
-# define VA_COPY(dest, src) (dest) = (src)
-# endif
-# endif
-#endif
-
#if !defined(HAVE_SNPRINTF) || !defined(HAVE_VSNPRINTF)
#include <ctype.h>
@@ -538,7 +526,7 @@
}
while (*value && (cnt < max)) {
DOPR_OUTCH(buffer, *currlen, maxlen, *value);
- *value++;
+ value++;
++cnt;
}
while ((padlen < 0) && (cnt < max)) {
@@ -553,7 +541,7 @@
static int
fmtint(char *buffer, size_t *currlen, size_t maxlen,
- LLONG value, int base, int min, int max, int flags)
+ intmax_t value, int base, int min, int max, int flags)
{
int signvalue = 0;
unsigned LLONG uvalue;
Modified: trunk/crypto/openssh/openbsd-compat/explicit_bzero.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/explicit_bzero.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/explicit_bzero.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -7,14 +7,34 @@
#include "includes.h"
+/*
+ * explicit_bzero - don't let the compiler optimize away bzero
+ */
+
#ifndef HAVE_EXPLICIT_BZERO
+#ifdef HAVE_MEMSET_S
+
+void
+explicit_bzero(void *p, size_t n)
+{
+ (void)memset_s(p, n, 0, n);
+}
+
+#else /* HAVE_MEMSET_S */
+
/*
- * explicit_bzero - don't let the compiler optimize away bzero
+ * Indirect bzero through a volatile pointer to hopefully avoid
+ * dead-store optimisation eliminating the call.
*/
+static void (* volatile ssh_bzero)(void *, size_t) = bzero;
+
void
explicit_bzero(void *p, size_t n)
{
- bzero(p, n);
+ ssh_bzero(p, n);
}
-#endif
+
+#endif /* HAVE_MEMSET_S */
+
+#endif /* HAVE_EXPLICIT_BZERO */
Modified: trunk/crypto/openssh/openbsd-compat/fake-rfc2553.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/fake-rfc2553.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/fake-rfc2553.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -109,6 +109,9 @@
#ifndef AI_NUMERICHOST
# define AI_NUMERICHOST (1<<2)
#endif
+#ifndef AI_NUMERICSERV
+# define AI_NUMERICSERV (1<<3)
+#endif
#ifndef NI_MAXSERV
# define NI_MAXSERV 32
Modified: trunk/crypto/openssh/openbsd-compat/getrrsetbyname-ldns.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/getrrsetbyname-ldns.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/getrrsetbyname-ldns.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -69,7 +69,7 @@
struct rrsetinfo *rrset = NULL;
struct rdatainfo *rdata;
size_t len;
- ldns_resolver *ldns_res;
+ ldns_resolver *ldns_res = NULL;
ldns_rdf *domain = NULL;
ldns_pkt *pkt = NULL;
ldns_rr_list *rrsigs = NULL, *rrdata = NULL;
Modified: trunk/crypto/openssh/openbsd-compat/glob.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/glob.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/glob.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -59,6 +59,7 @@
*/
#include "includes.h"
+#include "glob.h"
#include <sys/types.h>
#include <sys/stat.h>
Modified: trunk/crypto/openssh/openbsd-compat/glob.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/glob.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/glob.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -42,11 +42,15 @@
!defined(HAVE_DECL_GLOB_NOMATCH) || HAVE_DECL_GLOB_NOMATCH == 0 || \
defined(BROKEN_GLOB)
-#ifndef _GLOB_H_
-#define _GLOB_H_
+#ifndef _COMPAT_GLOB_H_
+#define _COMPAT_GLOB_H_
#include <sys/stat.h>
+# define glob_t _ssh_compat_glob_t
+# define glob(a, b, c, d) _ssh__compat_glob(a, b, c, d)
+# define globfree(a) _ssh__compat_globfree(a)
+
struct stat;
typedef struct {
int gl_pathc; /* Count of total paths so far. */
Modified: trunk/crypto/openssh/openbsd-compat/inet_aton.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/inet_aton.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/inet_aton.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -3,7 +3,7 @@
/*
* Copyright (c) 1983, 1990, 1993
* The Regents of the University of California. All rights reserved.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -15,7 +15,7 @@
* 3. Neither the name of the University nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
- *
+ *
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -29,7 +29,7 @@
* SUCH DAMAGE.
* -
* Portions Copyright (c) 1993 by Digital Equipment Corporation.
- *
+ *
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies, and that
@@ -36,7 +36,7 @@
* the name of Digital Equipment Corporation not be used in advertising or
* publicity pertaining to distribution of the document or software without
* specific, written prior permission.
- *
+ *
* THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
* WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT
@@ -77,7 +77,7 @@
}
#endif
-/*
+/*
* Check whether "cp" is a valid ascii representation
* of an Internet address and convert to a binary address.
* Returns 1 if the address is valid, 0 if not.
Copied: trunk/crypto/openssh/openbsd-compat/kludge-fd_set.c (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/kludge-fd_set.c)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/kludge-fd_set.c (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/kludge-fd_set.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,28 @@
+/* Placed in the public domain. */
+
+/*
+ * _FORTIFY_SOURCE includes a misguided check for FD_SET(n)/FD_ISSET(b)
+ * where n > FD_SETSIZE. This breaks OpenSSH and other programs that
+ * explicitly allocate fd_sets. To avoid this, we wrap FD_SET in a
+ * function compiled without _FORTIFY_SOURCE.
+ */
+
+#include "config.h"
+
+#if defined(HAVE_FEATURES_H) && defined(_FORTIFY_SOURCE)
+# include <features.h>
+# if defined(__GNU_LIBRARY__) && defined(__GLIBC_PREREQ)
+# if __GLIBC_PREREQ(2, 15) && (_FORTIFY_SOURCE > 0)
+# undef _FORTIFY_SOURCE
+# undef __USE_FORTIFY_LEVEL
+# include <sys/socket.h>
+void kludge_FD_SET(int n, fd_set *set) {
+ FD_SET(n, set);
+}
+int kludge_FD_ISSET(int n, fd_set *set) {
+ return FD_ISSET(n, set);
+}
+# endif /* __GLIBC_PREREQ(2, 15) && (_FORTIFY_SOURCE > 0) */
+# endif /* __GNU_LIBRARY__ && __GLIBC_PREREQ */
+#endif /* HAVE_FEATURES_H && _FORTIFY_SOURCE */
+
Copied: trunk/crypto/openssh/openbsd-compat/md5.c (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/md5.c)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/md5.c (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/md5.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,251 @@
+/* $OpenBSD: md5.c,v 1.9 2014/01/08 06:14:57 tedu Exp $ */
+
+/*
+ * This code implements the MD5 message-digest algorithm.
+ * The algorithm is due to Ron Rivest. This code was
+ * written by Colin Plumb in 1993, no copyright is claimed.
+ * This code is in the public domain; do with it what you wish.
+ *
+ * Equivalent code is available from RSA Data Security, Inc.
+ * This code has been tested against that, and is equivalent,
+ * except that you don't need to include two pages of legalese
+ * with every copy.
+ *
+ * To compute the message digest of a chunk of bytes, declare an
+ * MD5Context structure, pass it to MD5Init, call MD5Update as
+ * needed on buffers full of bytes, and then call MD5Final, which
+ * will fill a supplied 16-byte array with the digest.
+ */
+
+#include "includes.h"
+
+#ifndef WITH_OPENSSL
+
+#include <sys/types.h>
+#include <string.h>
+#include "md5.h"
+
+#define PUT_64BIT_LE(cp, value) do { \
+ (cp)[7] = (value) >> 56; \
+ (cp)[6] = (value) >> 48; \
+ (cp)[5] = (value) >> 40; \
+ (cp)[4] = (value) >> 32; \
+ (cp)[3] = (value) >> 24; \
+ (cp)[2] = (value) >> 16; \
+ (cp)[1] = (value) >> 8; \
+ (cp)[0] = (value); } while (0)
+
+#define PUT_32BIT_LE(cp, value) do { \
+ (cp)[3] = (value) >> 24; \
+ (cp)[2] = (value) >> 16; \
+ (cp)[1] = (value) >> 8; \
+ (cp)[0] = (value); } while (0)
+
+static u_int8_t PADDING[MD5_BLOCK_LENGTH] = {
+ 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+/*
+ * Start MD5 accumulation. Set bit count to 0 and buffer to mysterious
+ * initialization constants.
+ */
+void
+MD5Init(MD5_CTX *ctx)
+{
+ ctx->count = 0;
+ ctx->state[0] = 0x67452301;
+ ctx->state[1] = 0xefcdab89;
+ ctx->state[2] = 0x98badcfe;
+ ctx->state[3] = 0x10325476;
+}
+
+/*
+ * Update context to reflect the concatenation of another buffer full
+ * of bytes.
+ */
+void
+MD5Update(MD5_CTX *ctx, const unsigned char *input, size_t len)
+{
+ size_t have, need;
+
+ /* Check how many bytes we already have and how many more we need. */
+ have = (size_t)((ctx->count >> 3) & (MD5_BLOCK_LENGTH - 1));
+ need = MD5_BLOCK_LENGTH - have;
+
+ /* Update bitcount */
+ ctx->count += (u_int64_t)len << 3;
+
+ if (len >= need) {
+ if (have != 0) {
+ memcpy(ctx->buffer + have, input, need);
+ MD5Transform(ctx->state, ctx->buffer);
+ input += need;
+ len -= need;
+ have = 0;
+ }
+
+ /* Process data in MD5_BLOCK_LENGTH-byte chunks. */
+ while (len >= MD5_BLOCK_LENGTH) {
+ MD5Transform(ctx->state, input);
+ input += MD5_BLOCK_LENGTH;
+ len -= MD5_BLOCK_LENGTH;
+ }
+ }
+
+ /* Handle any remaining bytes of data. */
+ if (len != 0)
+ memcpy(ctx->buffer + have, input, len);
+}
+
+/*
+ * Pad pad to 64-byte boundary with the bit pattern
+ * 1 0* (64-bit count of bits processed, MSB-first)
+ */
+void
+MD5Pad(MD5_CTX *ctx)
+{
+ u_int8_t count[8];
+ size_t padlen;
+
+ /* Convert count to 8 bytes in little endian order. */
+ PUT_64BIT_LE(count, ctx->count);
+
+ /* Pad out to 56 mod 64. */
+ padlen = MD5_BLOCK_LENGTH -
+ ((ctx->count >> 3) & (MD5_BLOCK_LENGTH - 1));
+ if (padlen < 1 + 8)
+ padlen += MD5_BLOCK_LENGTH;
+ MD5Update(ctx, PADDING, padlen - 8); /* padlen - 8 <= 64 */
+ MD5Update(ctx, count, 8);
+}
+
+/*
+ * Final wrapup--call MD5Pad, fill in digest and zero out ctx.
+ */
+void
+MD5Final(unsigned char digest[MD5_DIGEST_LENGTH], MD5_CTX *ctx)
+{
+ int i;
+
+ MD5Pad(ctx);
+ for (i = 0; i < 4; i++)
+ PUT_32BIT_LE(digest + i * 4, ctx->state[i]);
+ memset(ctx, 0, sizeof(*ctx));
+}
+
+
+/* The four core functions - F1 is optimized somewhat */
+
+/* #define F1(x, y, z) (x & y | ~x & z) */
+#define F1(x, y, z) (z ^ (x & (y ^ z)))
+#define F2(x, y, z) F1(z, x, y)
+#define F3(x, y, z) (x ^ y ^ z)
+#define F4(x, y, z) (y ^ (x | ~z))
+
+/* This is the central step in the MD5 algorithm. */
+#define MD5STEP(f, w, x, y, z, data, s) \
+ ( w += f(x, y, z) + data, w = w<<s | w>>(32-s), w += x )
+
+/*
+ * The core of the MD5 algorithm, this alters an existing MD5 hash to
+ * reflect the addition of 16 longwords of new data. MD5Update blocks
+ * the data and converts bytes into longwords for this routine.
+ */
+void
+MD5Transform(u_int32_t state[4], const u_int8_t block[MD5_BLOCK_LENGTH])
+{
+ u_int32_t a, b, c, d, in[MD5_BLOCK_LENGTH / 4];
+
+#if BYTE_ORDER == LITTLE_ENDIAN
+ memcpy(in, block, sizeof(in));
+#else
+ for (a = 0; a < MD5_BLOCK_LENGTH / 4; a++) {
+ in[a] = (u_int32_t)(
+ (u_int32_t)(block[a * 4 + 0]) |
+ (u_int32_t)(block[a * 4 + 1]) << 8 |
+ (u_int32_t)(block[a * 4 + 2]) << 16 |
+ (u_int32_t)(block[a * 4 + 3]) << 24);
+ }
+#endif
+
+ a = state[0];
+ b = state[1];
+ c = state[2];
+ d = state[3];
+
+ MD5STEP(F1, a, b, c, d, in[ 0] + 0xd76aa478, 7);
+ MD5STEP(F1, d, a, b, c, in[ 1] + 0xe8c7b756, 12);
+ MD5STEP(F1, c, d, a, b, in[ 2] + 0x242070db, 17);
+ MD5STEP(F1, b, c, d, a, in[ 3] + 0xc1bdceee, 22);
+ MD5STEP(F1, a, b, c, d, in[ 4] + 0xf57c0faf, 7);
+ MD5STEP(F1, d, a, b, c, in[ 5] + 0x4787c62a, 12);
+ MD5STEP(F1, c, d, a, b, in[ 6] + 0xa8304613, 17);
+ MD5STEP(F1, b, c, d, a, in[ 7] + 0xfd469501, 22);
+ MD5STEP(F1, a, b, c, d, in[ 8] + 0x698098d8, 7);
+ MD5STEP(F1, d, a, b, c, in[ 9] + 0x8b44f7af, 12);
+ MD5STEP(F1, c, d, a, b, in[10] + 0xffff5bb1, 17);
+ MD5STEP(F1, b, c, d, a, in[11] + 0x895cd7be, 22);
+ MD5STEP(F1, a, b, c, d, in[12] + 0x6b901122, 7);
+ MD5STEP(F1, d, a, b, c, in[13] + 0xfd987193, 12);
+ MD5STEP(F1, c, d, a, b, in[14] + 0xa679438e, 17);
+ MD5STEP(F1, b, c, d, a, in[15] + 0x49b40821, 22);
+
+ MD5STEP(F2, a, b, c, d, in[ 1] + 0xf61e2562, 5);
+ MD5STEP(F2, d, a, b, c, in[ 6] + 0xc040b340, 9);
+ MD5STEP(F2, c, d, a, b, in[11] + 0x265e5a51, 14);
+ MD5STEP(F2, b, c, d, a, in[ 0] + 0xe9b6c7aa, 20);
+ MD5STEP(F2, a, b, c, d, in[ 5] + 0xd62f105d, 5);
+ MD5STEP(F2, d, a, b, c, in[10] + 0x02441453, 9);
+ MD5STEP(F2, c, d, a, b, in[15] + 0xd8a1e681, 14);
+ MD5STEP(F2, b, c, d, a, in[ 4] + 0xe7d3fbc8, 20);
+ MD5STEP(F2, a, b, c, d, in[ 9] + 0x21e1cde6, 5);
+ MD5STEP(F2, d, a, b, c, in[14] + 0xc33707d6, 9);
+ MD5STEP(F2, c, d, a, b, in[ 3] + 0xf4d50d87, 14);
+ MD5STEP(F2, b, c, d, a, in[ 8] + 0x455a14ed, 20);
+ MD5STEP(F2, a, b, c, d, in[13] + 0xa9e3e905, 5);
+ MD5STEP(F2, d, a, b, c, in[ 2] + 0xfcefa3f8, 9);
+ MD5STEP(F2, c, d, a, b, in[ 7] + 0x676f02d9, 14);
+ MD5STEP(F2, b, c, d, a, in[12] + 0x8d2a4c8a, 20);
+
+ MD5STEP(F3, a, b, c, d, in[ 5] + 0xfffa3942, 4);
+ MD5STEP(F3, d, a, b, c, in[ 8] + 0x8771f681, 11);
+ MD5STEP(F3, c, d, a, b, in[11] + 0x6d9d6122, 16);
+ MD5STEP(F3, b, c, d, a, in[14] + 0xfde5380c, 23);
+ MD5STEP(F3, a, b, c, d, in[ 1] + 0xa4beea44, 4);
+ MD5STEP(F3, d, a, b, c, in[ 4] + 0x4bdecfa9, 11);
+ MD5STEP(F3, c, d, a, b, in[ 7] + 0xf6bb4b60, 16);
+ MD5STEP(F3, b, c, d, a, in[10] + 0xbebfbc70, 23);
+ MD5STEP(F3, a, b, c, d, in[13] + 0x289b7ec6, 4);
+ MD5STEP(F3, d, a, b, c, in[ 0] + 0xeaa127fa, 11);
+ MD5STEP(F3, c, d, a, b, in[ 3] + 0xd4ef3085, 16);
+ MD5STEP(F3, b, c, d, a, in[ 6] + 0x04881d05, 23);
+ MD5STEP(F3, a, b, c, d, in[ 9] + 0xd9d4d039, 4);
+ MD5STEP(F3, d, a, b, c, in[12] + 0xe6db99e5, 11);
+ MD5STEP(F3, c, d, a, b, in[15] + 0x1fa27cf8, 16);
+ MD5STEP(F3, b, c, d, a, in[2 ] + 0xc4ac5665, 23);
+
+ MD5STEP(F4, a, b, c, d, in[ 0] + 0xf4292244, 6);
+ MD5STEP(F4, d, a, b, c, in[7 ] + 0x432aff97, 10);
+ MD5STEP(F4, c, d, a, b, in[14] + 0xab9423a7, 15);
+ MD5STEP(F4, b, c, d, a, in[5 ] + 0xfc93a039, 21);
+ MD5STEP(F4, a, b, c, d, in[12] + 0x655b59c3, 6);
+ MD5STEP(F4, d, a, b, c, in[3 ] + 0x8f0ccc92, 10);
+ MD5STEP(F4, c, d, a, b, in[10] + 0xffeff47d, 15);
+ MD5STEP(F4, b, c, d, a, in[1 ] + 0x85845dd1, 21);
+ MD5STEP(F4, a, b, c, d, in[8 ] + 0x6fa87e4f, 6);
+ MD5STEP(F4, d, a, b, c, in[15] + 0xfe2ce6e0, 10);
+ MD5STEP(F4, c, d, a, b, in[6 ] + 0xa3014314, 15);
+ MD5STEP(F4, b, c, d, a, in[13] + 0x4e0811a1, 21);
+ MD5STEP(F4, a, b, c, d, in[4 ] + 0xf7537e82, 6);
+ MD5STEP(F4, d, a, b, c, in[11] + 0xbd3af235, 10);
+ MD5STEP(F4, c, d, a, b, in[2 ] + 0x2ad7d2bb, 15);
+ MD5STEP(F4, b, c, d, a, in[9 ] + 0xeb86d391, 21);
+
+ state[0] += a;
+ state[1] += b;
+ state[2] += c;
+ state[3] += d;
+}
+#endif /* !WITH_OPENSSL */
Copied: trunk/crypto/openssh/openbsd-compat/md5.h (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/md5.h)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/md5.h (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/md5.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,51 @@
+/* $OpenBSD: md5.h,v 1.17 2012/12/05 23:19:57 deraadt Exp $ */
+
+/*
+ * This code implements the MD5 message-digest algorithm.
+ * The algorithm is due to Ron Rivest. This code was
+ * written by Colin Plumb in 1993, no copyright is claimed.
+ * This code is in the public domain; do with it what you wish.
+ *
+ * Equivalent code is available from RSA Data Security, Inc.
+ * This code has been tested against that, and is equivalent,
+ * except that you don't need to include two pages of legalese
+ * with every copy.
+ */
+
+#ifndef _MD5_H_
+#define _MD5_H_
+
+#ifndef WITH_OPENSSL
+
+#define MD5_BLOCK_LENGTH 64
+#define MD5_DIGEST_LENGTH 16
+#define MD5_DIGEST_STRING_LENGTH (MD5_DIGEST_LENGTH * 2 + 1)
+
+typedef struct MD5Context {
+ u_int32_t state[4]; /* state */
+ u_int64_t count; /* number of bits, mod 2^64 */
+ u_int8_t buffer[MD5_BLOCK_LENGTH]; /* input buffer */
+} MD5_CTX;
+
+void MD5Init(MD5_CTX *);
+void MD5Update(MD5_CTX *, const u_int8_t *, size_t)
+ __attribute__((__bounded__(__string__,2,3)));
+void MD5Pad(MD5_CTX *);
+void MD5Final(u_int8_t [MD5_DIGEST_LENGTH], MD5_CTX *)
+ __attribute__((__bounded__(__minbytes__,1,MD5_DIGEST_LENGTH)));
+void MD5Transform(u_int32_t [4], const u_int8_t [MD5_BLOCK_LENGTH])
+ __attribute__((__bounded__(__minbytes__,1,4)))
+ __attribute__((__bounded__(__minbytes__,2,MD5_BLOCK_LENGTH)));
+char *MD5End(MD5_CTX *, char *)
+ __attribute__((__bounded__(__minbytes__,2,MD5_DIGEST_STRING_LENGTH)));
+char *MD5File(const char *, char *)
+ __attribute__((__bounded__(__minbytes__,2,MD5_DIGEST_STRING_LENGTH)));
+char *MD5FileChunk(const char *, char *, off_t, off_t)
+ __attribute__((__bounded__(__minbytes__,2,MD5_DIGEST_STRING_LENGTH)));
+char *MD5Data(const u_int8_t *, size_t, char *)
+ __attribute__((__bounded__(__string__,1,2)))
+ __attribute__((__bounded__(__minbytes__,3,MD5_DIGEST_STRING_LENGTH)));
+
+#endif /* !WITH_OPENSSL */
+
+#endif /* _MD5_H_ */
Modified: trunk/crypto/openssh/openbsd-compat/openbsd-compat.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/openbsd-compat.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/openbsd-compat.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.61 2014/02/04 00:18:23 djm Exp $ */
+/* $Id: openbsd-compat.h,v 1.62 2014/09/30 23:43:08 djm Exp $ */
/*
* Copyright (c) 1999-2003 Damien Miller. All rights reserved.
@@ -36,14 +36,18 @@
#include <sys/socket.h>
+#include <stddef.h> /* for wchar_t */
+
/* OpenBSD function replacements */
#include "base64.h"
#include "sigact.h"
-#include "glob.h"
#include "readpassphrase.h"
#include "vis.h"
#include "getrrsetbyname.h"
+#include "sha1.h"
#include "sha2.h"
+#include "rmd160.h"
+#include "md5.h"
#include "blf.h"
#ifndef HAVE_BASENAME
@@ -62,9 +66,21 @@
char *getcwd(char *pt, size_t size);
#endif
+#ifndef HAVE_REALLOCARRAY
+void *reallocarray(void *, size_t, size_t);
+#endif
+
#if !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH)
+/*
+ * glibc's FORTIFY_SOURCE can redefine this and prevent us picking up the
+ * compat version.
+ */
+# ifdef BROKEN_REALPATH
+# define realpath(x, y) _ssh_compat_realpath(x, y)
+# endif
+
char *realpath(const char *path, char *resolved);
-#endif
+#endif
#ifndef HAVE_RRESVPORT_AF
int rresvport_af(int *alport, sa_family_t af);
@@ -214,13 +230,46 @@
/* multibyte character support */
#ifndef HAVE_MBLEN
-# define mblen(x, y) 1
+# define mblen(x, y) (1)
#endif
+#ifndef HAVE_WCWIDTH
+# define wcwidth(x) (((x) >= 0x20 && (x) <= 0x7e) ? 1 : -1)
+/* force our no-op nl_langinfo and mbtowc */
+# undef HAVE_NL_LANGINFO
+# undef HAVE_MBTOWC
+# undef HAVE_LANGINFO_H
+#endif
+
+#ifndef HAVE_NL_LANGINFO
+# define nl_langinfo(x) ""
+#endif
+
+#ifndef HAVE_MBTOWC
+int mbtowc(wchar_t *, const char*, size_t);
+#endif
+
#if !defined(HAVE_VASPRINTF) || !defined(HAVE_VSNPRINTF)
# include <stdarg.h>
#endif
+/*
+ * Some platforms unconditionally undefine va_copy() so we define VA_COPY()
+ * instead. This is known to be the case on at least some configurations of
+ * AIX with the xlc compiler.
+ */
+#ifndef VA_COPY
+# ifdef HAVE_VA_COPY
+# define VA_COPY(dest, src) va_copy(dest, src)
+# else
+# ifdef HAVE___VA_COPY
+# define VA_COPY(dest, src) __va_copy(dest, src)
+# else
+# define VA_COPY(dest, src) (dest) = (src)
+# endif
+# endif
+#endif
+
#ifndef HAVE_VASPRINTF
int vasprintf(char **, const char *, va_list);
#endif
@@ -268,4 +317,20 @@
#include "port-tun.h"
#include "port-uw.h"
+/* _FORTIFY_SOURCE breaks FD_ISSET(n)/FD_SET(n) for n > FD_SETSIZE. Avoid. */
+#if defined(HAVE_FEATURES_H) && defined(_FORTIFY_SOURCE)
+# include <features.h>
+# if defined(__GNU_LIBRARY__) && defined(__GLIBC_PREREQ)
+# if __GLIBC_PREREQ(2, 15) && (_FORTIFY_SOURCE > 0)
+# include <sys/socket.h> /* Ensure include guard is defined */
+# undef FD_SET
+# undef FD_ISSET
+# define FD_SET(n, set) kludge_FD_SET(n, set)
+# define FD_ISSET(n, set) kludge_FD_ISSET(n, set)
+void kludge_FD_SET(int, fd_set *);
+int kludge_FD_ISSET(int, fd_set *);
+# endif /* __GLIBC_PREREQ(2, 15) && (_FORTIFY_SOURCE > 0) */
+# endif /* __GNU_LIBRARY__ && __GLIBC_PREREQ */
+#endif /* HAVE_FEATURES_H && _FORTIFY_SOURCE */
+
#endif /* _OPENBSD_COMPAT_H */
Modified: trunk/crypto/openssh/openbsd-compat/openssl-compat.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/openssl-compat.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/openssl-compat.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $Id: openssl-compat.c,v 1.17 2014/02/13 05:38:33 dtucker Exp $ */
+/* $Id: openssl-compat.c,v 1.19 2014/07/02 05:28:07 djm Exp $ */
/*
* Copyright (c) 2005 Darren Tucker <dtucker at zip.com.au>
@@ -16,8 +16,11 @@
* OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
+#define SSH_DONT_OVERLOAD_OPENSSL_FUNCS
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <stdarg.h>
#include <string.h>
@@ -26,148 +29,45 @@
# include <openssl/conf.h>
#endif
-#ifndef HAVE_RSA_GET_DEFAULT_METHOD
-# include <openssl/rsa.h>
-#endif
-
#include "log.h"
-#define SSH_DONT_OVERLOAD_OPENSSL_FUNCS
#include "openssl-compat.h"
-#ifdef SSH_OLD_EVP
-int
-ssh_EVP_CipherInit(EVP_CIPHER_CTX *evp, const EVP_CIPHER *type,
- unsigned char *key, unsigned char *iv, int enc)
-{
- EVP_CipherInit(evp, type, key, iv, enc);
- return 1;
-}
+/*
+ * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
+ * We match major, minor, fix and status (not patch) for <1.0.0.
+ * After that, we acceptable compatible fix versions (so we
+ * allow 1.0.1 to work with 1.0.0). Going backwards is only allowed
+ * within a patch series.
+ */
int
-ssh_EVP_Cipher(EVP_CIPHER_CTX *evp, char *dst, char *src, int len)
+ssh_compatible_openssl(long headerver, long libver)
{
- EVP_Cipher(evp, dst, src, len);
- return 1;
-}
+ long mask, hfix, lfix;
-int
-ssh_EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *evp)
-{
- EVP_CIPHER_CTX_cleanup(evp);
- return 1;
-}
-#endif
+ /* exact match is always OK */
+ if (headerver == libver)
+ return 1;
-#ifndef HAVE_EVP_DIGESTINIT_EX
-int
-EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *md, void *engine)
-{
- if (engine != NULL)
- fatal("%s: ENGINE is not supported", __func__);
-# ifdef OPENSSL_EVP_DIGESTUPDATE_VOID
- EVP_DigestInit(ctx, md);
- return 1;
-# else
- return EVP_DigestInit(ctx, md);
-# endif
+ /* for versions < 1.0.0, major,minor,fix,status must match */
+ if (headerver < 0x1000000f) {
+ mask = 0xfffff00fL; /* major,minor,fix,status */
+ return (headerver & mask) == (libver & mask);
+ }
+
+ /*
+ * For versions >= 1.0.0, major,minor,status must match and library
+ * fix version must be equal to or newer than the header.
+ */
+ mask = 0xfff0000fL; /* major,minor,status */
+ hfix = (headerver & 0x000ff000) >> 12;
+ lfix = (libver & 0x000ff000) >> 12;
+ if ( (headerver & mask) == (libver & mask) && lfix >= hfix)
+ return 1;
+ return 0;
}
-#endif
-#ifndef HAVE_EVP_DIGESTFINAL_EX
-int
-EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s)
-{
-# ifdef OPENSSL_EVP_DIGESTUPDATE_VOID
- EVP_DigestFinal(ctx, md, s);
- return 1;
-# else
- return EVP_DigestFinal(ctx, md, s);
-# endif
-}
-#endif
-
-#ifdef OPENSSL_EVP_DIGESTUPDATE_VOID
-int
-ssh_EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, unsigned int cnt)
-{
- EVP_DigestUpdate(ctx, d, cnt);
- return 1;
-}
-#endif
-
-#ifndef HAVE_EVP_MD_CTX_COPY_EX
-int
-EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
-{
- return EVP_MD_CTX_copy(out, in);
-}
-#endif
-
-#ifndef HAVE_BN_IS_PRIME_EX
-int
-BN_is_prime_ex(const BIGNUM *p, int nchecks, BN_CTX *ctx, void *cb)
-{
- if (cb != NULL)
- fatal("%s: callback args not supported", __func__);
- return BN_is_prime(p, nchecks, NULL, ctx, NULL);
-}
-#endif
-
-#ifndef HAVE_RSA_GENERATE_KEY_EX
-int
-RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *bn_e, void *cb)
-{
- RSA *new_rsa, tmp_rsa;
- unsigned long e;
-
- if (cb != NULL)
- fatal("%s: callback args not supported", __func__);
- e = BN_get_word(bn_e);
- if (e == 0xffffffffL)
- fatal("%s: value of e too large", __func__);
- new_rsa = RSA_generate_key(bits, e, NULL, NULL);
- if (new_rsa == NULL)
- return 0;
- /* swap rsa/new_rsa then free new_rsa */
- tmp_rsa = *rsa;
- *rsa = *new_rsa;
- *new_rsa = tmp_rsa;
- RSA_free(new_rsa);
- return 1;
-}
-#endif
-
-#ifndef HAVE_DSA_GENERATE_PARAMETERS_EX
-int
-DSA_generate_parameters_ex(DSA *dsa, int bits, const unsigned char *seed,
- int seed_len, int *counter_ret, unsigned long *h_ret, void *cb)
-{
- DSA *new_dsa, tmp_dsa;
-
- if (cb != NULL)
- fatal("%s: callback args not supported", __func__);
- new_dsa = DSA_generate_parameters(bits, (unsigned char *)seed, seed_len,
- counter_ret, h_ret, NULL, NULL);
- if (new_dsa == NULL)
- return 0;
- /* swap dsa/new_dsa then free new_dsa */
- tmp_dsa = *dsa;
- *dsa = *new_dsa;
- *new_dsa = tmp_dsa;
- DSA_free(new_dsa);
- return 1;
-}
-#endif
-
-#ifndef HAVE_RSA_GET_DEFAULT_METHOD
-RSA_METHOD *
-RSA_get_default_method(void)
-{
- return RSA_PKCS1_SSLeay();
-}
-#endif
-
#ifdef USE_OPENSSL_ENGINE
void
ssh_OpenSSL_add_all_algorithms(void)
@@ -180,3 +80,5 @@
OPENSSL_config(NULL);
}
#endif
+
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/openbsd-compat/openssl-compat.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/openssl-compat.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/openssl-compat.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $Id: openssl-compat.h,v 1.26 2014/02/13 05:38:33 dtucker Exp $ */
+/* $Id: openssl-compat.h,v 1.31 2014/08/29 18:18:29 djm Exp $ */
/*
* Copyright (c) 2005 Darren Tucker <dtucker at zip.com.au>
@@ -16,30 +16,23 @@
* OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
+#ifndef _OPENSSL_COMPAT_H
+#define _OPENSSL_COMPAT_H
+
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <openssl/opensslv.h>
#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/dsa.h>
-/* Only in 0.9.8 */
-#ifndef OPENSSL_DSA_MAX_MODULUS_BITS
-# define OPENSSL_DSA_MAX_MODULUS_BITS 10000
-#endif
-#ifndef OPENSSL_RSA_MAX_MODULUS_BITS
-# define OPENSSL_RSA_MAX_MODULUS_BITS 16384
-#endif
+int ssh_compatible_openssl(long, long);
-/* OPENSSL_free() is Free() in versions before OpenSSL 0.9.6 */
-#if !defined(OPENSSL_VERSION_NUMBER) || (OPENSSL_VERSION_NUMBER < 0x0090600f)
-# define OPENSSL_free(x) Free(x)
+#if (OPENSSL_VERSION_NUMBER <= 0x0090805fL)
+# error OpenSSL 0.9.8f or greater is required
#endif
-#if OPENSSL_VERSION_NUMBER < 0x00906000L
-# define SSH_OLD_EVP
-# define EVP_CIPHER_CTX_get_app_data(e) ((e)->app_data)
-#endif
-
#if OPENSSL_VERSION_NUMBER < 0x10000001L
# define LIBCRYPTO_EVP_INL_TYPE unsigned int
#else
@@ -46,27 +39,17 @@
# define LIBCRYPTO_EVP_INL_TYPE size_t
#endif
-#if (OPENSSL_VERSION_NUMBER < 0x00907000L) || defined(OPENSSL_LOBOTOMISED_AES)
-# define USE_BUILTIN_RIJNDAEL
+#ifndef OPENSSL_RSA_MAX_MODULUS_BITS
+# define OPENSSL_RSA_MAX_MODULUS_BITS 16384
#endif
-
-#ifdef USE_BUILTIN_RIJNDAEL
-# include "rijndael.h"
-# define AES_KEY rijndael_ctx
-# define AES_BLOCK_SIZE 16
-# define AES_encrypt(a, b, c) rijndael_encrypt(c, a, b)
-# define AES_set_encrypt_key(a, b, c) rijndael_set_key(c, (char *)a, b, 1)
-# define EVP_aes_128_cbc evp_rijndael
-# define EVP_aes_192_cbc evp_rijndael
-# define EVP_aes_256_cbc evp_rijndael
-const EVP_CIPHER *evp_rijndael(void);
-void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
+#ifndef OPENSSL_DSA_MAX_MODULUS_BITS
+# define OPENSSL_DSA_MAX_MODULUS_BITS 10000
#endif
#ifndef OPENSSL_HAVE_EVPCTR
-#define EVP_aes_128_ctr evp_aes_128_ctr
-#define EVP_aes_192_ctr evp_aes_128_ctr
-#define EVP_aes_256_ctr evp_aes_128_ctr
+# define EVP_aes_128_ctr evp_aes_128_ctr
+# define EVP_aes_192_ctr evp_aes_128_ctr
+# define EVP_aes_256_ctr evp_aes_128_ctr
const EVP_CIPHER *evp_aes_128_ctr(void);
void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, size_t);
#endif
@@ -88,26 +71,9 @@
# endif
#endif
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-#define EVP_X_STATE(evp) &(evp).c
-#define EVP_X_STATE_LEN(evp) sizeof((evp).c)
-#else
-#define EVP_X_STATE(evp) (evp).cipher_data
-#define EVP_X_STATE_LEN(evp) (evp).cipher->ctx_size
-#endif
-
-/* OpenSSL 0.9.8e returns cipher key len not context key len */
-#if (OPENSSL_VERSION_NUMBER == 0x0090805fL)
-# define EVP_CIPHER_CTX_key_length(c) ((c)->key_len)
-#endif
-
-#ifndef HAVE_RSA_GET_DEFAULT_METHOD
-RSA_METHOD *RSA_get_default_method(void);
-#endif
-
/*
* We overload some of the OpenSSL crypto functions with ssh_* equivalents
- * which cater for older and/or less featureful OpenSSL version.
+ * to automatically handle OpenSSL engine initialisation.
*
* In order for the compat library to call the real functions, it must
* define SSH_DONT_OVERLOAD_OPENSSL_FUNCS before including this file and
@@ -115,19 +81,6 @@
*/
#ifndef SSH_DONT_OVERLOAD_OPENSSL_FUNCS
-# ifdef SSH_OLD_EVP
-# ifdef EVP_Cipher
-# undef EVP_Cipher
-# endif
-# define EVP_CipherInit(a,b,c,d,e) ssh_EVP_CipherInit((a),(b),(c),(d),(e))
-# define EVP_Cipher(a,b,c,d) ssh_EVP_Cipher((a),(b),(c),(d))
-# define EVP_CIPHER_CTX_cleanup(a) ssh_EVP_CIPHER_CTX_cleanup((a))
-# endif /* SSH_OLD_EVP */
-
-# ifdef OPENSSL_EVP_DIGESTUPDATE_VOID
-# define EVP_DigestUpdate(a,b,c) ssh_EVP_DigestUpdate((a),(b),(c))
-# endif
-
# ifdef USE_OPENSSL_ENGINE
# ifdef OpenSSL_add_all_algorithms
# undef OpenSSL_add_all_algorithms
@@ -135,48 +88,9 @@
# define OpenSSL_add_all_algorithms() ssh_OpenSSL_add_all_algorithms()
# endif
-# ifndef HAVE_BN_IS_PRIME_EX
-int BN_is_prime_ex(const BIGNUM *, int, BN_CTX *, void *);
-# endif
-
-# ifndef HAVE_DSA_GENERATE_PARAMETERS_EX
-int DSA_generate_parameters_ex(DSA *, int, const unsigned char *, int, int *,
- unsigned long *, void *);
-# endif
-
-# ifndef HAVE_RSA_GENERATE_KEY_EX
-int RSA_generate_key_ex(RSA *, int, BIGNUM *, void *);
-# endif
-
-# ifndef HAVE_EVP_DIGESTINIT_EX
-int EVP_DigestInit_ex(EVP_MD_CTX *, const EVP_MD *, void *);
-# endif
-
-# ifndef HAVE_EVP_DISESTFINAL_EX
-int EVP_DigestFinal_ex(EVP_MD_CTX *, unsigned char *, unsigned int *);
-# endif
-
-# ifndef EVP_MD_CTX_COPY_EX
-int EVP_MD_CTX_copy_ex(EVP_MD_CTX *, const EVP_MD_CTX *);
-# endif
-
-int ssh_EVP_CipherInit(EVP_CIPHER_CTX *, const EVP_CIPHER *, unsigned char *,
- unsigned char *, int);
-int ssh_EVP_Cipher(EVP_CIPHER_CTX *, char *, char *, int);
-int ssh_EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *);
void ssh_OpenSSL_add_all_algorithms(void);
-# ifndef HAVE_HMAC_CTX_INIT
-# define HMAC_CTX_init(a)
-# endif
-
-# ifndef HAVE_EVP_MD_CTX_INIT
-# define EVP_MD_CTX_init(a)
-# endif
-
-# ifndef HAVE_EVP_MD_CTX_CLEANUP
-# define EVP_MD_CTX_cleanup(a)
-# endif
-
#endif /* SSH_DONT_OVERLOAD_OPENSSL_FUNCS */
+#endif /* WITH_OPENSSL */
+#endif /* _OPENSSL_COMPAT_H */
Modified: trunk/crypto/openssh/openbsd-compat/port-linux.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/port-linux.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/port-linux.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -278,7 +278,7 @@
verbose("error writing %s: %s",
oom_adj_path, strerror(errno));
else
- verbose("Set %s from %d to %d",
+ debug("Set %s from %d to %d",
oom_adj_path, oom_adj_save, value);
}
fclose(fp);
@@ -302,7 +302,7 @@
if (fprintf(fp, "%d\n", oom_adj_save) <= 0)
verbose("error writing %s: %s", oom_adj_path, strerror(errno));
else
- verbose("Set %s to %d", oom_adj_path, oom_adj_save);
+ debug("Set %s to %d", oom_adj_path, oom_adj_save);
fclose(fp);
return;
Modified: trunk/crypto/openssh/openbsd-compat/port-solaris.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/port-solaris.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/port-solaris.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -227,3 +227,139 @@
}
}
#endif /* USE_SOLARIS_PROJECTS */
+
+#ifdef USE_SOLARIS_PRIVS
+# ifdef HAVE_PRIV_H
+# include <priv.h>
+# endif
+
+priv_set_t *
+solaris_basic_privset(void)
+{
+ priv_set_t *pset;
+
+#ifdef HAVE_PRIV_BASICSET
+ if ((pset = priv_allocset()) == NULL) {
+ error("priv_allocset: %s", strerror(errno));
+ return NULL;
+ }
+ priv_basicset(pset);
+#else
+ if ((pset = priv_str_to_set("basic", ",", NULL)) == NULL) {
+ error("priv_str_to_set: %s", strerror(errno));
+ return NULL;
+ }
+#endif
+ return pset;
+}
+
+void
+solaris_drop_privs_pinfo_net_fork_exec(void)
+{
+ priv_set_t *pset = NULL, *npset = NULL;
+
+ /*
+ * Note: this variant avoids dropping DAC filesystem rights, in case
+ * the process calling it is running as root and should have the
+ * ability to read/write/chown any file on the system.
+ *
+ * We start with the basic set, then *add* the DAC rights to it while
+ * taking away other parts of BASIC we don't need. Then we intersect
+ * this with our existing PERMITTED set. In this way we keep any
+ * DAC rights we had before, while otherwise reducing ourselves to
+ * the minimum set of privileges we need to proceed.
+ *
+ * This also means we drop any other parts of "root" that we don't
+ * need (e.g. the ability to kill any process, create new device nodes
+ * etc etc).
+ */
+
+ if ((pset = priv_allocset()) == NULL)
+ fatal("priv_allocset: %s", strerror(errno));
+ if ((npset = solaris_basic_privset()) == NULL)
+ fatal("solaris_basic_privset: %s", strerror(errno));
+
+ if (priv_addset(npset, PRIV_FILE_CHOWN) != 0 ||
+ priv_addset(npset, PRIV_FILE_DAC_READ) != 0 ||
+ priv_addset(npset, PRIV_FILE_DAC_SEARCH) != 0 ||
+ priv_addset(npset, PRIV_FILE_DAC_WRITE) != 0 ||
+ priv_addset(npset, PRIV_FILE_OWNER) != 0)
+ fatal("priv_addset: %s", strerror(errno));
+
+ if (priv_delset(npset, PRIV_FILE_LINK_ANY) != 0 ||
+#ifdef PRIV_NET_ACCESS
+ priv_delset(npset, PRIV_NET_ACCESS) != 0 ||
+#endif
+ priv_delset(npset, PRIV_PROC_EXEC) != 0 ||
+ priv_delset(npset, PRIV_PROC_FORK) != 0 ||
+ priv_delset(npset, PRIV_PROC_INFO) != 0 ||
+ priv_delset(npset, PRIV_PROC_SESSION) != 0)
+ fatal("priv_delset: %s", strerror(errno));
+
+ if (getppriv(PRIV_PERMITTED, pset) != 0)
+ fatal("getppriv: %s", strerror(errno));
+
+ priv_intersect(pset, npset);
+
+ if (setppriv(PRIV_SET, PRIV_PERMITTED, npset) != 0 ||
+ setppriv(PRIV_SET, PRIV_LIMIT, npset) != 0 ||
+ setppriv(PRIV_SET, PRIV_INHERITABLE, npset) != 0)
+ fatal("setppriv: %s", strerror(errno));
+
+ priv_freeset(pset);
+ priv_freeset(npset);
+}
+
+void
+solaris_drop_privs_root_pinfo_net(void)
+{
+ priv_set_t *pset = NULL;
+
+ /* Start with "basic" and drop everything we don't need. */
+ if ((pset = solaris_basic_privset()) == NULL)
+ fatal("solaris_basic_privset: %s", strerror(errno));
+
+ if (priv_delset(pset, PRIV_FILE_LINK_ANY) != 0 ||
+#ifdef PRIV_NET_ACCESS
+ priv_delset(pset, PRIV_NET_ACCESS) != 0 ||
+#endif
+ priv_delset(pset, PRIV_PROC_INFO) != 0 ||
+ priv_delset(pset, PRIV_PROC_SESSION) != 0)
+ fatal("priv_delset: %s", strerror(errno));
+
+ if (setppriv(PRIV_SET, PRIV_PERMITTED, pset) != 0 ||
+ setppriv(PRIV_SET, PRIV_LIMIT, pset) != 0 ||
+ setppriv(PRIV_SET, PRIV_INHERITABLE, pset) != 0)
+ fatal("setppriv: %s", strerror(errno));
+
+ priv_freeset(pset);
+}
+
+void
+solaris_drop_privs_root_pinfo_net_exec(void)
+{
+ priv_set_t *pset = NULL;
+
+
+ /* Start with "basic" and drop everything we don't need. */
+ if ((pset = solaris_basic_privset()) == NULL)
+ fatal("solaris_basic_privset: %s", strerror(errno));
+
+ if (priv_delset(pset, PRIV_FILE_LINK_ANY) != 0 ||
+#ifdef PRIV_NET_ACCESS
+ priv_delset(pset, PRIV_NET_ACCESS) != 0 ||
+#endif
+ priv_delset(pset, PRIV_PROC_EXEC) != 0 ||
+ priv_delset(pset, PRIV_PROC_INFO) != 0 ||
+ priv_delset(pset, PRIV_PROC_SESSION) != 0)
+ fatal("priv_delset: %s", strerror(errno));
+
+ if (setppriv(PRIV_SET, PRIV_PERMITTED, pset) != 0 ||
+ setppriv(PRIV_SET, PRIV_LIMIT, pset) != 0 ||
+ setppriv(PRIV_SET, PRIV_INHERITABLE, pset) != 0)
+ fatal("setppriv: %s", strerror(errno));
+
+ priv_freeset(pset);
+}
+
+#endif
Modified: trunk/crypto/openssh/openbsd-compat/port-solaris.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/port-solaris.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/port-solaris.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -26,5 +26,12 @@
void solaris_contract_post_fork_child(void);
void solaris_contract_post_fork_parent(pid_t pid);
void solaris_set_default_project(struct passwd *);
+# ifdef USE_SOLARIS_PRIVS
+#include <priv.h>
+priv_set_t *solaris_basic_privset(void);
+void solaris_drop_privs_pinfo_net_fork_exec(void);
+void solaris_drop_privs_root_pinfo_net(void);
+void solaris_drop_privs_root_pinfo_net_exec(void);
+# endif /* USE_SOLARIS_PRIVS */
#endif
Modified: trunk/crypto/openssh/openbsd-compat/port-tun.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/port-tun.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/port-tun.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -32,8 +32,9 @@
#include "openbsd-compat/sys-queue.h"
#include "log.h"
#include "misc.h"
-#include "buffer.h"
+#include "sshbuf.h"
#include "channels.h"
+#include "ssherr.h"
/*
* This is the portable version of the SSH tunnel forwarding, it
@@ -210,6 +211,7 @@
#endif
u_int32_t *af;
char *ptr = buf;
+ int r;
#if defined(SSH_TUN_PREPEND_AF)
if (len <= 0 || len > (int)(sizeof(rbuf) - sizeof(*af)))
@@ -242,7 +244,8 @@
*af = htonl(OPENBSD_AF_INET);
#endif
- buffer_put_string(&c->input, ptr, len);
+ if ((r = sshbuf_put_string(&c->input, ptr, len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
return (0);
}
@@ -251,8 +254,14 @@
{
u_char *buf;
u_int32_t *af;
+ int r;
+ size_t xxx_dlen;
- *data = buffer_get_string(&c->output, dlen);
+ /* XXX new API is incompatible with this signature. */
+ if ((r = sshbuf_get_string(&c->output, data, &xxx_dlen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (dlen != NULL)
+ *dlen = xxx_dlen;
if (*dlen < sizeof(*af))
return (NULL);
buf = *data;
Modified: trunk/crypto/openssh/openbsd-compat/port-uw.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/port-uw.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/port-uw.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -42,6 +42,7 @@
#include "key.h"
#include "auth-options.h"
#include "log.h"
+#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */
#include "servconf.h"
#include "hostfile.h"
#include "auth.h"
Modified: trunk/crypto/openssh/openbsd-compat/readpassphrase.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/readpassphrase.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/readpassphrase.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -46,6 +46,14 @@
# define _POSIX_VDISABLE VDISABLE
#endif
+#ifndef _NSIG
+# ifdef NSIG
+# define _NSIG NSIG
+# else
+# define _NSIG 128
+# endif
+#endif
+
static volatile sig_atomic_t signo[_NSIG];
static void handler(int);
Copied: trunk/crypto/openssh/openbsd-compat/reallocarray.c (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/reallocarray.c)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/reallocarray.c (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/reallocarray.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,46 @@
+/* $OpenBSD: reallocarray.c,v 1.2 2014/12/08 03:45:00 bcook Exp $ */
+/*
+ * Copyright (c) 2008 Otto Moerbeek <otto at drijf.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* OPENBSD ORIGINAL: lib/libc/stdlib/reallocarray.c */
+
+#include "includes.h"
+#ifndef HAVE_REALLOCARRAY
+
+#include <sys/types.h>
+#include <errno.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+
+/*
+ * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
+ * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW
+ */
+#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4))
+
+void *
+reallocarray(void *optr, size_t nmemb, size_t size)
+{
+ if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
+ nmemb > 0 && SIZE_MAX / nmemb < size) {
+ errno = ENOMEM;
+ return NULL;
+ }
+ return realloc(optr, size * nmemb);
+}
+#endif /* HAVE_REALLOCARRAY */
Modified: trunk/crypto/openssh/openbsd-compat/realpath.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/realpath.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/realpath.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: realpath.c,v 1.13 2005/08/08 08:05:37 espie Exp $ */
+/* $OpenBSD: realpath.c,v 1.20 2015/10/13 20:55:37 millert Exp $ */
/*
* Copyright (c) 2003 Constantin S. Svintsoff <kostik at iclub.nsu.ru>
*
@@ -33,14 +33,23 @@
#if !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH)
+#include <sys/types.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <errno.h>
#include <stdlib.h>
+#include <stddef.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
+#ifndef SYMLOOP_MAX
+# define SYMLOOP_MAX 32
+#endif
+
+/* A slightly modified copy of this file exists in libexec/ld.so */
+
/*
* char *realpath(const char *path, char resolved[PATH_MAX]);
*
@@ -49,16 +58,30 @@
* in which case the path which caused trouble is left in (resolved).
*/
char *
-realpath(const char *path, char resolved[PATH_MAX])
+realpath(const char *path, char *resolved)
{
struct stat sb;
char *p, *q, *s;
size_t left_len, resolved_len;
unsigned symlinks;
- int serrno, slen;
+ int serrno, slen, mem_allocated;
char left[PATH_MAX], next_token[PATH_MAX], symlink[PATH_MAX];
+ if (path[0] == '\0') {
+ errno = ENOENT;
+ return (NULL);
+ }
+
serrno = errno;
+
+ if (resolved == NULL) {
+ resolved = malloc(PATH_MAX);
+ if (resolved == NULL)
+ return (NULL);
+ mem_allocated = 1;
+ } else
+ mem_allocated = 0;
+
symlinks = 0;
if (path[0] == '/') {
resolved[0] = '/';
@@ -69,7 +92,10 @@
left_len = strlcpy(left, path + 1, sizeof(left));
} else {
if (getcwd(resolved, PATH_MAX) == NULL) {
- strlcpy(resolved, ".", PATH_MAX);
+ if (mem_allocated)
+ free(resolved);
+ else
+ strlcpy(resolved, ".", PATH_MAX);
return (NULL);
}
resolved_len = strlen(resolved);
@@ -77,7 +103,7 @@
}
if (left_len >= sizeof(left) || resolved_len >= PATH_MAX) {
errno = ENAMETOOLONG;
- return (NULL);
+ goto err;
}
/*
@@ -90,9 +116,9 @@
*/
p = strchr(left, '/');
s = p ? p : left + left_len;
- if (s - left >= sizeof(next_token)) {
+ if (s - left >= (ptrdiff_t)sizeof(next_token)) {
errno = ENAMETOOLONG;
- return (NULL);
+ goto err;
}
memcpy(next_token, left, s - left);
next_token[s - left] = '\0';
@@ -102,7 +128,7 @@
if (resolved[resolved_len - 1] != '/') {
if (resolved_len + 1 >= PATH_MAX) {
errno = ENAMETOOLONG;
- return (NULL);
+ goto err;
}
resolved[resolved_len++] = '/';
resolved[resolved_len] = '\0';
@@ -133,7 +159,7 @@
resolved_len = strlcat(resolved, next_token, PATH_MAX);
if (resolved_len >= PATH_MAX) {
errno = ENAMETOOLONG;
- return (NULL);
+ goto err;
}
if (lstat(resolved, &sb) != 0) {
if (errno == ENOENT && p == NULL) {
@@ -140,16 +166,16 @@
errno = serrno;
return (resolved);
}
- return (NULL);
+ goto err;
}
if (S_ISLNK(sb.st_mode)) {
- if (symlinks++ > MAXSYMLINKS) {
+ if (symlinks++ > SYMLOOP_MAX) {
errno = ELOOP;
- return (NULL);
+ goto err;
}
slen = readlink(resolved, symlink, sizeof(symlink) - 1);
if (slen < 0)
- return (NULL);
+ goto err;
symlink[slen] = '\0';
if (symlink[0] == '/') {
resolved[1] = 0;
@@ -169,17 +195,18 @@
*/
if (p != NULL) {
if (symlink[slen - 1] != '/') {
- if (slen + 1 >= sizeof(symlink)) {
+ if (slen + 1 >=
+ (ptrdiff_t)sizeof(symlink)) {
errno = ENAMETOOLONG;
- return (NULL);
+ goto err;
}
symlink[slen] = '/';
symlink[slen + 1] = 0;
}
- left_len = strlcat(symlink, left, sizeof(left));
- if (left_len >= sizeof(left)) {
+ left_len = strlcat(symlink, left, sizeof(symlink));
+ if (left_len >= sizeof(symlink)) {
errno = ENAMETOOLONG;
- return (NULL);
+ goto err;
}
}
left_len = strlcpy(left, symlink, sizeof(left));
@@ -193,5 +220,10 @@
if (resolved_len > 1 && resolved[resolved_len - 1] == '/')
resolved[resolved_len - 1] = '\0';
return (resolved);
+
+err:
+ if (mem_allocated)
+ free(resolved);
+ return (NULL);
}
#endif /* !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH) */
Copied: trunk/crypto/openssh/openbsd-compat/rmd160.c (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/rmd160.c)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/rmd160.c (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/rmd160.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,378 @@
+/*
+ * Copyright (c) 2001 Markus Friedl. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/*
+ * Preneel, Bosselaers, Dobbertin, "The Cryptographic Hash Function RIPEMD-160",
+ * RSA Laboratories, CryptoBytes, Volume 3, Number 2, Autumn 1997,
+ * ftp://ftp.rsasecurity.com/pub/cryptobytes/crypto3n2.pdf
+ */
+
+#include "includes.h"
+
+#ifndef WITH_OPENSSL
+
+#include <sys/types.h>
+#ifdef HAVE_ENDIAN_H
+#include <endian.h>
+#endif
+#include <string.h>
+#include <rmd160.h>
+
+#define PUT_64BIT_LE(cp, value) do { \
+ (cp)[7] = (value) >> 56; \
+ (cp)[6] = (value) >> 48; \
+ (cp)[5] = (value) >> 40; \
+ (cp)[4] = (value) >> 32; \
+ (cp)[3] = (value) >> 24; \
+ (cp)[2] = (value) >> 16; \
+ (cp)[1] = (value) >> 8; \
+ (cp)[0] = (value); } while (0)
+
+#define PUT_32BIT_LE(cp, value) do { \
+ (cp)[3] = (value) >> 24; \
+ (cp)[2] = (value) >> 16; \
+ (cp)[1] = (value) >> 8; \
+ (cp)[0] = (value); } while (0)
+
+#define H0 0x67452301U
+#define H1 0xEFCDAB89U
+#define H2 0x98BADCFEU
+#define H3 0x10325476U
+#define H4 0xC3D2E1F0U
+
+#define K0 0x00000000U
+#define K1 0x5A827999U
+#define K2 0x6ED9EBA1U
+#define K3 0x8F1BBCDCU
+#define K4 0xA953FD4EU
+
+#define KK0 0x50A28BE6U
+#define KK1 0x5C4DD124U
+#define KK2 0x6D703EF3U
+#define KK3 0x7A6D76E9U
+#define KK4 0x00000000U
+
+/* rotate x left n bits. */
+#define ROL(n, x) (((x) << (n)) | ((x) >> (32-(n))))
+
+#define F0(x, y, z) ((x) ^ (y) ^ (z))
+#define F1(x, y, z) (((x) & (y)) | ((~x) & (z)))
+#define F2(x, y, z) (((x) | (~y)) ^ (z))
+#define F3(x, y, z) (((x) & (z)) | ((y) & (~z)))
+#define F4(x, y, z) ((x) ^ ((y) | (~z)))
+
+#define R(a, b, c, d, e, Fj, Kj, sj, rj) \
+ do { \
+ a = ROL(sj, a + Fj(b,c,d) + X(rj) + Kj) + e; \
+ c = ROL(10, c); \
+ } while(0)
+
+#define X(i) x[i]
+
+static u_int8_t PADDING[RMD160_BLOCK_LENGTH] = {
+ 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+void
+RMD160Init(RMD160_CTX *ctx)
+{
+ ctx->count = 0;
+ ctx->state[0] = H0;
+ ctx->state[1] = H1;
+ ctx->state[2] = H2;
+ ctx->state[3] = H3;
+ ctx->state[4] = H4;
+}
+
+void
+RMD160Update(RMD160_CTX *ctx, const u_int8_t *input, size_t len)
+{
+ size_t have, off, need;
+
+ have = (ctx->count / 8) % RMD160_BLOCK_LENGTH;
+ need = RMD160_BLOCK_LENGTH - have;
+ ctx->count += 8 * len;
+ off = 0;
+
+ if (len >= need) {
+ if (have) {
+ memcpy(ctx->buffer + have, input, need);
+ RMD160Transform(ctx->state, ctx->buffer);
+ off = need;
+ have = 0;
+ }
+ /* now the buffer is empty */
+ while (off + RMD160_BLOCK_LENGTH <= len) {
+ RMD160Transform(ctx->state, input+off);
+ off += RMD160_BLOCK_LENGTH;
+ }
+ }
+ if (off < len)
+ memcpy(ctx->buffer + have, input+off, len-off);
+}
+
+void
+RMD160Pad(RMD160_CTX *ctx)
+{
+ u_int8_t size[8];
+ size_t padlen;
+
+ PUT_64BIT_LE(size, ctx->count);
+
+ /*
+ * pad to RMD160_BLOCK_LENGTH byte blocks, at least one byte from
+ * PADDING plus 8 bytes for the size
+ */
+ padlen = RMD160_BLOCK_LENGTH - ((ctx->count / 8) % RMD160_BLOCK_LENGTH);
+ if (padlen < 1 + 8)
+ padlen += RMD160_BLOCK_LENGTH;
+ RMD160Update(ctx, PADDING, padlen - 8); /* padlen - 8 <= 64 */
+ RMD160Update(ctx, size, 8);
+}
+
+void
+RMD160Final(u_int8_t digest[RMD160_DIGEST_LENGTH], RMD160_CTX *ctx)
+{
+ int i;
+
+ RMD160Pad(ctx);
+ for (i = 0; i < 5; i++)
+ PUT_32BIT_LE(digest + i*4, ctx->state[i]);
+ memset(ctx, 0, sizeof (*ctx));
+}
+
+void
+RMD160Transform(u_int32_t state[5], const u_int8_t block[RMD160_BLOCK_LENGTH])
+{
+ u_int32_t a, b, c, d, e, aa, bb, cc, dd, ee, t, x[16];
+
+#if BYTE_ORDER == LITTLE_ENDIAN
+ memcpy(x, block, RMD160_BLOCK_LENGTH);
+#else
+ int i;
+
+ for (i = 0; i < 16; i++)
+ x[i] = (u_int32_t)(
+ (u_int32_t)(block[i*4 + 0]) |
+ (u_int32_t)(block[i*4 + 1]) << 8 |
+ (u_int32_t)(block[i*4 + 2]) << 16 |
+ (u_int32_t)(block[i*4 + 3]) << 24);
+#endif
+
+ a = state[0];
+ b = state[1];
+ c = state[2];
+ d = state[3];
+ e = state[4];
+
+ /* Round 1 */
+ R(a, b, c, d, e, F0, K0, 11, 0);
+ R(e, a, b, c, d, F0, K0, 14, 1);
+ R(d, e, a, b, c, F0, K0, 15, 2);
+ R(c, d, e, a, b, F0, K0, 12, 3);
+ R(b, c, d, e, a, F0, K0, 5, 4);
+ R(a, b, c, d, e, F0, K0, 8, 5);
+ R(e, a, b, c, d, F0, K0, 7, 6);
+ R(d, e, a, b, c, F0, K0, 9, 7);
+ R(c, d, e, a, b, F0, K0, 11, 8);
+ R(b, c, d, e, a, F0, K0, 13, 9);
+ R(a, b, c, d, e, F0, K0, 14, 10);
+ R(e, a, b, c, d, F0, K0, 15, 11);
+ R(d, e, a, b, c, F0, K0, 6, 12);
+ R(c, d, e, a, b, F0, K0, 7, 13);
+ R(b, c, d, e, a, F0, K0, 9, 14);
+ R(a, b, c, d, e, F0, K0, 8, 15); /* #15 */
+ /* Round 2 */
+ R(e, a, b, c, d, F1, K1, 7, 7);
+ R(d, e, a, b, c, F1, K1, 6, 4);
+ R(c, d, e, a, b, F1, K1, 8, 13);
+ R(b, c, d, e, a, F1, K1, 13, 1);
+ R(a, b, c, d, e, F1, K1, 11, 10);
+ R(e, a, b, c, d, F1, K1, 9, 6);
+ R(d, e, a, b, c, F1, K1, 7, 15);
+ R(c, d, e, a, b, F1, K1, 15, 3);
+ R(b, c, d, e, a, F1, K1, 7, 12);
+ R(a, b, c, d, e, F1, K1, 12, 0);
+ R(e, a, b, c, d, F1, K1, 15, 9);
+ R(d, e, a, b, c, F1, K1, 9, 5);
+ R(c, d, e, a, b, F1, K1, 11, 2);
+ R(b, c, d, e, a, F1, K1, 7, 14);
+ R(a, b, c, d, e, F1, K1, 13, 11);
+ R(e, a, b, c, d, F1, K1, 12, 8); /* #31 */
+ /* Round 3 */
+ R(d, e, a, b, c, F2, K2, 11, 3);
+ R(c, d, e, a, b, F2, K2, 13, 10);
+ R(b, c, d, e, a, F2, K2, 6, 14);
+ R(a, b, c, d, e, F2, K2, 7, 4);
+ R(e, a, b, c, d, F2, K2, 14, 9);
+ R(d, e, a, b, c, F2, K2, 9, 15);
+ R(c, d, e, a, b, F2, K2, 13, 8);
+ R(b, c, d, e, a, F2, K2, 15, 1);
+ R(a, b, c, d, e, F2, K2, 14, 2);
+ R(e, a, b, c, d, F2, K2, 8, 7);
+ R(d, e, a, b, c, F2, K2, 13, 0);
+ R(c, d, e, a, b, F2, K2, 6, 6);
+ R(b, c, d, e, a, F2, K2, 5, 13);
+ R(a, b, c, d, e, F2, K2, 12, 11);
+ R(e, a, b, c, d, F2, K2, 7, 5);
+ R(d, e, a, b, c, F2, K2, 5, 12); /* #47 */
+ /* Round 4 */
+ R(c, d, e, a, b, F3, K3, 11, 1);
+ R(b, c, d, e, a, F3, K3, 12, 9);
+ R(a, b, c, d, e, F3, K3, 14, 11);
+ R(e, a, b, c, d, F3, K3, 15, 10);
+ R(d, e, a, b, c, F3, K3, 14, 0);
+ R(c, d, e, a, b, F3, K3, 15, 8);
+ R(b, c, d, e, a, F3, K3, 9, 12);
+ R(a, b, c, d, e, F3, K3, 8, 4);
+ R(e, a, b, c, d, F3, K3, 9, 13);
+ R(d, e, a, b, c, F3, K3, 14, 3);
+ R(c, d, e, a, b, F3, K3, 5, 7);
+ R(b, c, d, e, a, F3, K3, 6, 15);
+ R(a, b, c, d, e, F3, K3, 8, 14);
+ R(e, a, b, c, d, F3, K3, 6, 5);
+ R(d, e, a, b, c, F3, K3, 5, 6);
+ R(c, d, e, a, b, F3, K3, 12, 2); /* #63 */
+ /* Round 5 */
+ R(b, c, d, e, a, F4, K4, 9, 4);
+ R(a, b, c, d, e, F4, K4, 15, 0);
+ R(e, a, b, c, d, F4, K4, 5, 5);
+ R(d, e, a, b, c, F4, K4, 11, 9);
+ R(c, d, e, a, b, F4, K4, 6, 7);
+ R(b, c, d, e, a, F4, K4, 8, 12);
+ R(a, b, c, d, e, F4, K4, 13, 2);
+ R(e, a, b, c, d, F4, K4, 12, 10);
+ R(d, e, a, b, c, F4, K4, 5, 14);
+ R(c, d, e, a, b, F4, K4, 12, 1);
+ R(b, c, d, e, a, F4, K4, 13, 3);
+ R(a, b, c, d, e, F4, K4, 14, 8);
+ R(e, a, b, c, d, F4, K4, 11, 11);
+ R(d, e, a, b, c, F4, K4, 8, 6);
+ R(c, d, e, a, b, F4, K4, 5, 15);
+ R(b, c, d, e, a, F4, K4, 6, 13); /* #79 */
+
+ aa = a ; bb = b; cc = c; dd = d; ee = e;
+
+ a = state[0];
+ b = state[1];
+ c = state[2];
+ d = state[3];
+ e = state[4];
+
+ /* Parallel round 1 */
+ R(a, b, c, d, e, F4, KK0, 8, 5);
+ R(e, a, b, c, d, F4, KK0, 9, 14);
+ R(d, e, a, b, c, F4, KK0, 9, 7);
+ R(c, d, e, a, b, F4, KK0, 11, 0);
+ R(b, c, d, e, a, F4, KK0, 13, 9);
+ R(a, b, c, d, e, F4, KK0, 15, 2);
+ R(e, a, b, c, d, F4, KK0, 15, 11);
+ R(d, e, a, b, c, F4, KK0, 5, 4);
+ R(c, d, e, a, b, F4, KK0, 7, 13);
+ R(b, c, d, e, a, F4, KK0, 7, 6);
+ R(a, b, c, d, e, F4, KK0, 8, 15);
+ R(e, a, b, c, d, F4, KK0, 11, 8);
+ R(d, e, a, b, c, F4, KK0, 14, 1);
+ R(c, d, e, a, b, F4, KK0, 14, 10);
+ R(b, c, d, e, a, F4, KK0, 12, 3);
+ R(a, b, c, d, e, F4, KK0, 6, 12); /* #15 */
+ /* Parallel round 2 */
+ R(e, a, b, c, d, F3, KK1, 9, 6);
+ R(d, e, a, b, c, F3, KK1, 13, 11);
+ R(c, d, e, a, b, F3, KK1, 15, 3);
+ R(b, c, d, e, a, F3, KK1, 7, 7);
+ R(a, b, c, d, e, F3, KK1, 12, 0);
+ R(e, a, b, c, d, F3, KK1, 8, 13);
+ R(d, e, a, b, c, F3, KK1, 9, 5);
+ R(c, d, e, a, b, F3, KK1, 11, 10);
+ R(b, c, d, e, a, F3, KK1, 7, 14);
+ R(a, b, c, d, e, F3, KK1, 7, 15);
+ R(e, a, b, c, d, F3, KK1, 12, 8);
+ R(d, e, a, b, c, F3, KK1, 7, 12);
+ R(c, d, e, a, b, F3, KK1, 6, 4);
+ R(b, c, d, e, a, F3, KK1, 15, 9);
+ R(a, b, c, d, e, F3, KK1, 13, 1);
+ R(e, a, b, c, d, F3, KK1, 11, 2); /* #31 */
+ /* Parallel round 3 */
+ R(d, e, a, b, c, F2, KK2, 9, 15);
+ R(c, d, e, a, b, F2, KK2, 7, 5);
+ R(b, c, d, e, a, F2, KK2, 15, 1);
+ R(a, b, c, d, e, F2, KK2, 11, 3);
+ R(e, a, b, c, d, F2, KK2, 8, 7);
+ R(d, e, a, b, c, F2, KK2, 6, 14);
+ R(c, d, e, a, b, F2, KK2, 6, 6);
+ R(b, c, d, e, a, F2, KK2, 14, 9);
+ R(a, b, c, d, e, F2, KK2, 12, 11);
+ R(e, a, b, c, d, F2, KK2, 13, 8);
+ R(d, e, a, b, c, F2, KK2, 5, 12);
+ R(c, d, e, a, b, F2, KK2, 14, 2);
+ R(b, c, d, e, a, F2, KK2, 13, 10);
+ R(a, b, c, d, e, F2, KK2, 13, 0);
+ R(e, a, b, c, d, F2, KK2, 7, 4);
+ R(d, e, a, b, c, F2, KK2, 5, 13); /* #47 */
+ /* Parallel round 4 */
+ R(c, d, e, a, b, F1, KK3, 15, 8);
+ R(b, c, d, e, a, F1, KK3, 5, 6);
+ R(a, b, c, d, e, F1, KK3, 8, 4);
+ R(e, a, b, c, d, F1, KK3, 11, 1);
+ R(d, e, a, b, c, F1, KK3, 14, 3);
+ R(c, d, e, a, b, F1, KK3, 14, 11);
+ R(b, c, d, e, a, F1, KK3, 6, 15);
+ R(a, b, c, d, e, F1, KK3, 14, 0);
+ R(e, a, b, c, d, F1, KK3, 6, 5);
+ R(d, e, a, b, c, F1, KK3, 9, 12);
+ R(c, d, e, a, b, F1, KK3, 12, 2);
+ R(b, c, d, e, a, F1, KK3, 9, 13);
+ R(a, b, c, d, e, F1, KK3, 12, 9);
+ R(e, a, b, c, d, F1, KK3, 5, 7);
+ R(d, e, a, b, c, F1, KK3, 15, 10);
+ R(c, d, e, a, b, F1, KK3, 8, 14); /* #63 */
+ /* Parallel round 5 */
+ R(b, c, d, e, a, F0, KK4, 8, 12);
+ R(a, b, c, d, e, F0, KK4, 5, 15);
+ R(e, a, b, c, d, F0, KK4, 12, 10);
+ R(d, e, a, b, c, F0, KK4, 9, 4);
+ R(c, d, e, a, b, F0, KK4, 12, 1);
+ R(b, c, d, e, a, F0, KK4, 5, 5);
+ R(a, b, c, d, e, F0, KK4, 14, 8);
+ R(e, a, b, c, d, F0, KK4, 6, 7);
+ R(d, e, a, b, c, F0, KK4, 8, 6);
+ R(c, d, e, a, b, F0, KK4, 13, 2);
+ R(b, c, d, e, a, F0, KK4, 6, 13);
+ R(a, b, c, d, e, F0, KK4, 5, 14);
+ R(e, a, b, c, d, F0, KK4, 15, 0);
+ R(d, e, a, b, c, F0, KK4, 13, 3);
+ R(c, d, e, a, b, F0, KK4, 11, 9);
+ R(b, c, d, e, a, F0, KK4, 11, 11); /* #79 */
+
+ t = state[1] + cc + d;
+ state[1] = state[2] + dd + e;
+ state[2] = state[3] + ee + a;
+ state[3] = state[4] + aa + b;
+ state[4] = state[0] + bb + c;
+ state[0] = t;
+}
+
+#endif /* !WITH_OPENSSL */
Copied: trunk/crypto/openssh/openbsd-compat/rmd160.h (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/rmd160.h)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/rmd160.h (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/rmd160.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,61 @@
+/* $OpenBSD: rmd160.h,v 1.17 2012/12/05 23:19:57 deraadt Exp $ */
+/*
+ * Copyright (c) 2001 Markus Friedl. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef _RMD160_H
+#define _RMD160_H
+
+#ifndef WITH_OPENSSL
+
+#define RMD160_BLOCK_LENGTH 64
+#define RMD160_DIGEST_LENGTH 20
+#define RMD160_DIGEST_STRING_LENGTH (RMD160_DIGEST_LENGTH * 2 + 1)
+
+/* RMD160 context. */
+typedef struct RMD160Context {
+ u_int32_t state[5]; /* state */
+ u_int64_t count; /* number of bits, mod 2^64 */
+ u_int8_t buffer[RMD160_BLOCK_LENGTH]; /* input buffer */
+} RMD160_CTX;
+
+void RMD160Init(RMD160_CTX *);
+void RMD160Transform(u_int32_t [5], const u_int8_t [RMD160_BLOCK_LENGTH])
+ __attribute__((__bounded__(__minbytes__,1,5)))
+ __attribute__((__bounded__(__minbytes__,2,RMD160_BLOCK_LENGTH)));
+void RMD160Update(RMD160_CTX *, const u_int8_t *, size_t)
+ __attribute__((__bounded__(__string__,2,3)));
+void RMD160Pad(RMD160_CTX *);
+void RMD160Final(u_int8_t [RMD160_DIGEST_LENGTH], RMD160_CTX *)
+ __attribute__((__bounded__(__minbytes__,1,RMD160_DIGEST_LENGTH)));
+char *RMD160End(RMD160_CTX *, char *)
+ __attribute__((__bounded__(__minbytes__,2,RMD160_DIGEST_STRING_LENGTH)));
+char *RMD160File(const char *, char *)
+ __attribute__((__bounded__(__minbytes__,2,RMD160_DIGEST_STRING_LENGTH)));
+char *RMD160FileChunk(const char *, char *, off_t, off_t)
+ __attribute__((__bounded__(__minbytes__,2,RMD160_DIGEST_STRING_LENGTH)));
+char *RMD160Data(const u_int8_t *, size_t, char *)
+ __attribute__((__bounded__(__string__,1,2)))
+ __attribute__((__bounded__(__minbytes__,3,RMD160_DIGEST_STRING_LENGTH)));
+
+#endif /* !WITH_OPENSSL */
+#endif /* _RMD160_H */
Copied: trunk/crypto/openssh/openbsd-compat/sha1.c (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/sha1.c)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/sha1.c (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/sha1.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,177 @@
+/* $OpenBSD: sha1.c,v 1.23 2014/01/08 06:14:57 tedu Exp $ */
+
+/*
+ * SHA-1 in C
+ * By Steve Reid <steve at edmweb.com>
+ * 100% Public Domain
+ *
+ * Test Vectors (from FIPS PUB 180-1)
+ * "abc"
+ * A9993E36 4706816A BA3E2571 7850C26C 9CD0D89D
+ * "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
+ * 84983E44 1C3BD26E BAAE4AA1 F95129E5 E54670F1
+ * A million repetitions of "a"
+ * 34AA973C D4C4DAA4 F61EEB2B DBAD2731 6534016F
+ */
+
+#include "includes.h"
+
+#ifndef WITH_OPENSSL
+
+#include <sys/param.h>
+#include <string.h>
+
+#define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
+
+/*
+ * blk0() and blk() perform the initial expand.
+ * I got the idea of expanding during the round function from SSLeay
+ */
+#if BYTE_ORDER == LITTLE_ENDIAN
+# define blk0(i) (block->l[i] = (rol(block->l[i],24)&0xFF00FF00) \
+ |(rol(block->l[i],8)&0x00FF00FF))
+#else
+# define blk0(i) block->l[i]
+#endif
+#define blk(i) (block->l[i&15] = rol(block->l[(i+13)&15]^block->l[(i+8)&15] \
+ ^block->l[(i+2)&15]^block->l[i&15],1))
+
+/*
+ * (R0+R1), R2, R3, R4 are the different operations (rounds) used in SHA1
+ */
+#define R0(v,w,x,y,z,i) z+=((w&(x^y))^y)+blk0(i)+0x5A827999+rol(v,5);w=rol(w,30);
+#define R1(v,w,x,y,z,i) z+=((w&(x^y))^y)+blk(i)+0x5A827999+rol(v,5);w=rol(w,30);
+#define R2(v,w,x,y,z,i) z+=(w^x^y)+blk(i)+0x6ED9EBA1+rol(v,5);w=rol(w,30);
+#define R3(v,w,x,y,z,i) z+=(((w|x)&y)|(w&x))+blk(i)+0x8F1BBCDC+rol(v,5);w=rol(w,30);
+#define R4(v,w,x,y,z,i) z+=(w^x^y)+blk(i)+0xCA62C1D6+rol(v,5);w=rol(w,30);
+
+typedef union {
+ u_int8_t c[64];
+ u_int32_t l[16];
+} CHAR64LONG16;
+
+/*
+ * Hash a single 512-bit block. This is the core of the algorithm.
+ */
+void
+SHA1Transform(u_int32_t state[5], const u_int8_t buffer[SHA1_BLOCK_LENGTH])
+{
+ u_int32_t a, b, c, d, e;
+ u_int8_t workspace[SHA1_BLOCK_LENGTH];
+ CHAR64LONG16 *block = (CHAR64LONG16 *)workspace;
+
+ (void)memcpy(block, buffer, SHA1_BLOCK_LENGTH);
+
+ /* Copy context->state[] to working vars */
+ a = state[0];
+ b = state[1];
+ c = state[2];
+ d = state[3];
+ e = state[4];
+
+ /* 4 rounds of 20 operations each. Loop unrolled. */
+ R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
+ R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
+ R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
+ R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
+ R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
+ R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
+ R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
+ R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
+ R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
+ R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
+ R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
+ R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
+ R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
+ R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
+ R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
+ R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
+ R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
+ R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
+ R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
+ R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
+
+ /* Add the working vars back into context.state[] */
+ state[0] += a;
+ state[1] += b;
+ state[2] += c;
+ state[3] += d;
+ state[4] += e;
+
+ /* Wipe variables */
+ a = b = c = d = e = 0;
+}
+
+
+/*
+ * SHA1Init - Initialize new context
+ */
+void
+SHA1Init(SHA1_CTX *context)
+{
+
+ /* SHA1 initialization constants */
+ context->count = 0;
+ context->state[0] = 0x67452301;
+ context->state[1] = 0xEFCDAB89;
+ context->state[2] = 0x98BADCFE;
+ context->state[3] = 0x10325476;
+ context->state[4] = 0xC3D2E1F0;
+}
+
+
+/*
+ * Run your data through this.
+ */
+void
+SHA1Update(SHA1_CTX *context, const u_int8_t *data, size_t len)
+{
+ size_t i, j;
+
+ j = (size_t)((context->count >> 3) & 63);
+ context->count += (len << 3);
+ if ((j + len) > 63) {
+ (void)memcpy(&context->buffer[j], data, (i = 64-j));
+ SHA1Transform(context->state, context->buffer);
+ for ( ; i + 63 < len; i += 64)
+ SHA1Transform(context->state, (u_int8_t *)&data[i]);
+ j = 0;
+ } else {
+ i = 0;
+ }
+ (void)memcpy(&context->buffer[j], &data[i], len - i);
+}
+
+
+/*
+ * Add padding and return the message digest.
+ */
+void
+SHA1Pad(SHA1_CTX *context)
+{
+ u_int8_t finalcount[8];
+ u_int i;
+
+ for (i = 0; i < 8; i++) {
+ finalcount[i] = (u_int8_t)((context->count >>
+ ((7 - (i & 7)) * 8)) & 255); /* Endian independent */
+ }
+ SHA1Update(context, (u_int8_t *)"\200", 1);
+ while ((context->count & 504) != 448)
+ SHA1Update(context, (u_int8_t *)"\0", 1);
+ SHA1Update(context, finalcount, 8); /* Should cause a SHA1Transform() */
+}
+
+void
+SHA1Final(u_int8_t digest[SHA1_DIGEST_LENGTH], SHA1_CTX *context)
+{
+ u_int i;
+
+ SHA1Pad(context);
+ for (i = 0; i < SHA1_DIGEST_LENGTH; i++) {
+ digest[i] = (u_int8_t)
+ ((context->state[i>>2] >> ((3-(i & 3)) * 8) ) & 255);
+ }
+ memset(context, 0, sizeof(*context));
+}
+#endif /* !WITH_OPENSSL */
Copied: trunk/crypto/openssh/openbsd-compat/sha1.h (from rev 9222, vendor-crypto/openssh/dist/openbsd-compat/sha1.h)
===================================================================
--- trunk/crypto/openssh/openbsd-compat/sha1.h (rev 0)
+++ trunk/crypto/openssh/openbsd-compat/sha1.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,58 @@
+/* $OpenBSD: sha1.h,v 1.24 2012/12/05 23:19:57 deraadt Exp $ */
+
+/*
+ * SHA-1 in C
+ * By Steve Reid <steve at edmweb.com>
+ * 100% Public Domain
+ */
+
+#ifndef _SHA1_H
+#define _SHA1_H
+
+#ifndef WITH_OPENSSL
+
+#define SHA1_BLOCK_LENGTH 64
+#define SHA1_DIGEST_LENGTH 20
+#define SHA1_DIGEST_STRING_LENGTH (SHA1_DIGEST_LENGTH * 2 + 1)
+
+typedef struct {
+ u_int32_t state[5];
+ u_int64_t count;
+ u_int8_t buffer[SHA1_BLOCK_LENGTH];
+} SHA1_CTX;
+
+void SHA1Init(SHA1_CTX *);
+void SHA1Pad(SHA1_CTX *);
+void SHA1Transform(u_int32_t [5], const u_int8_t [SHA1_BLOCK_LENGTH])
+ __attribute__((__bounded__(__minbytes__,1,5)))
+ __attribute__((__bounded__(__minbytes__,2,SHA1_BLOCK_LENGTH)));
+void SHA1Update(SHA1_CTX *, const u_int8_t *, size_t)
+ __attribute__((__bounded__(__string__,2,3)));
+void SHA1Final(u_int8_t [SHA1_DIGEST_LENGTH], SHA1_CTX *)
+ __attribute__((__bounded__(__minbytes__,1,SHA1_DIGEST_LENGTH)));
+char *SHA1End(SHA1_CTX *, char *)
+ __attribute__((__bounded__(__minbytes__,2,SHA1_DIGEST_STRING_LENGTH)));
+char *SHA1File(const char *, char *)
+ __attribute__((__bounded__(__minbytes__,2,SHA1_DIGEST_STRING_LENGTH)));
+char *SHA1FileChunk(const char *, char *, off_t, off_t)
+ __attribute__((__bounded__(__minbytes__,2,SHA1_DIGEST_STRING_LENGTH)));
+char *SHA1Data(const u_int8_t *, size_t, char *)
+ __attribute__((__bounded__(__string__,1,2)))
+ __attribute__((__bounded__(__minbytes__,3,SHA1_DIGEST_STRING_LENGTH)));
+
+#define HTONDIGEST(x) do { \
+ x[0] = htonl(x[0]); \
+ x[1] = htonl(x[1]); \
+ x[2] = htonl(x[2]); \
+ x[3] = htonl(x[3]); \
+ x[4] = htonl(x[4]); } while (0)
+
+#define NTOHDIGEST(x) do { \
+ x[0] = ntohl(x[0]); \
+ x[1] = ntohl(x[1]); \
+ x[2] = ntohl(x[2]); \
+ x[3] = ntohl(x[3]); \
+ x[4] = ntohl(x[4]); } while (0)
+
+#endif /* !WITH_OPENSSL */
+#endif /* _SHA1_H */
Modified: trunk/crypto/openssh/openbsd-compat/sha2.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/sha2.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/sha2.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -38,13 +38,18 @@
#include "includes.h"
-#include <openssl/opensslv.h>
+#ifdef WITH_OPENSSL
+# include <openssl/opensslv.h>
+# if !defined(HAVE_EVP_SHA256) && (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+# define _NEED_SHA2 1
+# endif
+#else
+# define _NEED_SHA2 1
+#endif
-#if !defined(HAVE_EVP_SHA256) && !defined(HAVE_SHA256_UPDATE) && \
- (OPENSSL_VERSION_NUMBER >= 0x00907000L)
-#include <sys/types.h>
+#if defined(_NEED_SHA2) && !defined(HAVE_SHA256_UPDATE)
+
#include <string.h>
-#include "sha2.h"
/*
* UNROLLED TRANSFORM LOOP NOTE:
@@ -838,7 +843,6 @@
}
-#if 0
/*** SHA-384: *********************************************************/
void
SHA384_Init(SHA384_CTX *context)
@@ -851,11 +855,31 @@
context->bitcount[0] = context->bitcount[1] = 0;
}
+#if 0
__weak_alias(SHA384_Transform, SHA512_Transform);
__weak_alias(SHA384_Update, SHA512_Update);
__weak_alias(SHA384_Pad, SHA512_Pad);
+#endif
void
+SHA384_Transform(u_int64_t state[8], const u_int8_t data[SHA512_BLOCK_LENGTH])
+{
+ return SHA512_Transform(state, data);
+}
+
+void
+SHA384_Update(SHA512_CTX *context, const u_int8_t *data, size_t len)
+{
+ SHA512_Update(context, data, len);
+}
+
+void
+SHA384_Pad(SHA512_CTX *context)
+{
+ SHA512_Pad(context);
+}
+
+void
SHA384_Final(u_int8_t digest[SHA384_DIGEST_LENGTH], SHA384_CTX *context)
{
SHA384_Pad(context);
@@ -876,7 +900,5 @@
/* Zero out state data */
memset(context, 0, sizeof(*context));
}
-#endif
-#endif /* !defined(HAVE_EVP_SHA256) && !defined(HAVE_SHA256_UPDATE) && \
- (OPENSSL_VERSION_NUMBER >= 0x00907000L) */
+#endif /* defined(_NEED_SHA2) && !defined(HAVE_SHA256_UPDATE) */
Modified: trunk/crypto/openssh/openbsd-compat/sha2.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/sha2.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/sha2.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -41,10 +41,16 @@
#include "includes.h"
-#include <openssl/opensslv.h>
+#ifdef WITH_OPENSSL
+# include <openssl/opensslv.h>
+# if !defined(HAVE_EVP_SHA256) && (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+# define _NEED_SHA2 1
+# endif
+#else
+# define _NEED_SHA2 1
+#endif
-#if !defined(HAVE_EVP_SHA256) && !defined(HAVE_SHA256_UPDATE) && \
- (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+#if defined(_NEED_SHA2) && !defined(HAVE_SHA256_UPDATE)
/*** SHA-256/384/512 Various Length Definitions ***********************/
#define SHA256_BLOCK_LENGTH 64
@@ -70,9 +76,7 @@
u_int8_t buffer[SHA512_BLOCK_LENGTH];
} SHA512_CTX;
-#if 0
typedef SHA512_CTX SHA384_CTX;
-#endif
void SHA256_Init(SHA256_CTX *);
void SHA256_Transform(u_int32_t state[8], const u_int8_t [SHA256_BLOCK_LENGTH]);
@@ -91,7 +95,6 @@
__attribute__((__bounded__(__string__,1,2)))
__attribute__((__bounded__(__minbytes__,3,SHA256_DIGEST_STRING_LENGTH)));
-#if 0
void SHA384_Init(SHA384_CTX *);
void SHA384_Transform(u_int64_t state[8], const u_int8_t [SHA384_BLOCK_LENGTH]);
void SHA384_Update(SHA384_CTX *, const u_int8_t *, size_t)
@@ -108,7 +111,6 @@
char *SHA384_Data(const u_int8_t *, size_t, char *)
__attribute__((__bounded__(__string__,1,2)))
__attribute__((__bounded__(__minbytes__,3,SHA384_DIGEST_STRING_LENGTH)));
-#endif /* 0 */
void SHA512_Init(SHA512_CTX *);
void SHA512_Transform(u_int64_t state[8], const u_int8_t [SHA512_BLOCK_LENGTH]);
@@ -127,7 +129,6 @@
__attribute__((__bounded__(__string__,1,2)))
__attribute__((__bounded__(__minbytes__,3,SHA512_DIGEST_STRING_LENGTH)));
-#endif /* !defined(HAVE_EVP_SHA256) && !defined(HAVE_SHA256_UPDATE) && \
- (OPENSSL_VERSION_NUMBER >= 0x00907000L) */
+#endif /* defined(_NEED_SHA2) && !defined(HAVE_SHA256_UPDATE) */
#endif /* _SSHSHA2_H */
Modified: trunk/crypto/openssh/openbsd-compat/vis.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/vis.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/vis.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: vis.c,v 1.19 2005/09/01 17:15:49 millert Exp $ */
+/* $OpenBSD: vis.c,v 1.25 2015/09/13 11:32:51 guenther Exp $ */
/*-
* Copyright (c) 1989, 1993
* The Regents of the University of California. All rights reserved.
@@ -33,13 +33,24 @@
#include "includes.h"
#if !defined(HAVE_STRNVIS) || defined(BROKEN_STRNVIS)
+/*
+ * We want these to override in the BROKEN_STRNVIS case. TO avoid future sync
+ * problems no-op out the weak symbol definition rather than remove it.
+ */
+#define DEF_WEAK(x)
+
+#include <sys/types.h>
+#include <errno.h>
#include <ctype.h>
+#include <limits.h>
#include <string.h>
+#include <stdlib.h>
#include "vis.h"
#define isoctal(c) (((u_char)(c)) >= '0' && ((u_char)(c)) <= '7')
-#define isvisible(c) \
+#define isvisible(c,flag) \
+ (((c) == '\\' || (flag & VIS_ALL) == 0) && \
(((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \
(((c) != '*' && (c) != '?' && (c) != '[' && (c) != '#') || \
(flag & VIS_GLOB) == 0) && isgraph((u_char)(c))) || \
@@ -48,7 +59,7 @@
((flag & VIS_NL) == 0 && (c) == '\n') || \
((flag & VIS_SAFE) && ((c) == '\b' || \
(c) == '\007' || (c) == '\r' || \
- isgraph((u_char)(c)))))
+ isgraph((u_char)(c))))))
/*
* vis - visually encode characters
@@ -56,10 +67,11 @@
char *
vis(char *dst, int c, int flag, int nextc)
{
- if (isvisible(c)) {
+ if (isvisible(c, flag)) {
+ if ((c == '"' && (flag & VIS_DQ) != 0) ||
+ (c == '\\' && (flag & VIS_NOSLASH) == 0))
+ *dst++ = '\\';
*dst++ = c;
- if (c == '\\' && (flag & VIS_NOSLASH) == 0)
- *dst++ = '\\';
*dst = '\0';
return (dst);
}
@@ -136,6 +148,7 @@
*dst = '\0';
return (dst);
}
+DEF_WEAK(vis);
/*
* strvis, strnvis, strvisx - visually encode characters from src into dst
@@ -161,6 +174,7 @@
*dst = '\0';
return (dst - start);
}
+DEF_WEAK(strvis);
int
strnvis(char *dst, const char *src, size_t siz, int flag)
@@ -171,19 +185,18 @@
i = 0;
for (start = dst, end = start + siz - 1; (c = *src) && dst < end; ) {
- if (isvisible(c)) {
- i = 1;
- *dst++ = c;
- if (c == '\\' && (flag & VIS_NOSLASH) == 0) {
+ if (isvisible(c, flag)) {
+ if ((c == '"' && (flag & VIS_DQ) != 0) ||
+ (c == '\\' && (flag & VIS_NOSLASH) == 0)) {
/* need space for the extra '\\' */
- if (dst < end)
- *dst++ = '\\';
- else {
- dst--;
+ if (dst + 1 >= end) {
i = 2;
break;
}
+ *dst++ = '\\';
}
+ i = 1;
+ *dst++ = c;
src++;
} else {
i = vis(tbuf, c, flag, *++src) - tbuf;
@@ -207,6 +220,25 @@
}
int
+stravis(char **outp, const char *src, int flag)
+{
+ char *buf;
+ int len, serrno;
+
+ buf = reallocarray(NULL, 4, strlen(src) + 1);
+ if (buf == NULL)
+ return -1;
+ len = strvis(buf, src, flag);
+ serrno = errno;
+ *outp = realloc(buf, len + 1);
+ if (*outp == NULL) {
+ *outp = buf;
+ errno = serrno;
+ }
+ return (len);
+}
+
+int
strvisx(char *dst, const char *src, size_t len, int flag)
{
char c;
Modified: trunk/crypto/openssh/openbsd-compat/vis.h
===================================================================
--- trunk/crypto/openssh/openbsd-compat/vis.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/vis.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: vis.h,v 1.11 2005/08/09 19:38:31 millert Exp $ */
+/* $OpenBSD: vis.h,v 1.15 2015/07/20 01:52:27 millert Exp $ */
/* $NetBSD: vis.h,v 1.4 1994/10/26 00:56:41 cgd Exp $ */
/*-
@@ -58,6 +58,8 @@
#define VIS_NL 0x10 /* also encode newline */
#define VIS_WHITE (VIS_SP | VIS_TAB | VIS_NL)
#define VIS_SAFE 0x20 /* only encode "unsafe" characters */
+#define VIS_DQ 0x200 /* backslash-escape double quotes */
+#define VIS_ALL 0x400 /* encode all characters */
/*
* other
@@ -81,6 +83,7 @@
char *vis(char *, int, int, int);
int strvis(char *, const char *, int);
+int stravis(char **, const char *, int);
int strnvis(char *, const char *, size_t, int)
__attribute__ ((__bounded__(__string__,1,3)));
int strvisx(char *, const char *, size_t, int)
Modified: trunk/crypto/openssh/openbsd-compat/xcrypt.c
===================================================================
--- trunk/crypto/openssh/openbsd-compat/xcrypt.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/openbsd-compat/xcrypt.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -25,6 +25,7 @@
#include "includes.h"
#include <sys/types.h>
+#include <string.h>
#include <unistd.h>
#include <pwd.h>
@@ -57,16 +58,55 @@
# include "md5crypt.h"
# endif
-# if !defined(HAVE_CRYPT) && defined(HAVE_DES_CRYPT)
+# if defined(WITH_OPENSSL) && !defined(HAVE_CRYPT) && defined(HAVE_DES_CRYPT)
# include <openssl/des.h>
# define crypt DES_crypt
# endif
+/*
+ * Pick an appropriate password encryption type and salt for the running
+ * system by searching through accounts until we find one that has a valid
+ * salt. Usually this will be root unless the root account is locked out.
+ * If we don't find one we return a traditional DES-based salt.
+ */
+static const char *
+pick_salt(void)
+{
+ struct passwd *pw;
+ char *passwd, *p;
+ size_t typelen;
+ static char salt[32];
+
+ if (salt[0] != '\0')
+ return salt;
+ strlcpy(salt, "xx", sizeof(salt));
+ setpwent();
+ while ((pw = getpwent()) != NULL) {
+ passwd = shadow_pw(pw);
+ if (passwd[0] == '$' && (p = strrchr(passwd+1, '$')) != NULL) {
+ typelen = p - passwd + 1;
+ strlcpy(salt, passwd, MIN(typelen, sizeof(salt)));
+ explicit_bzero(passwd, strlen(passwd));
+ goto out;
+ }
+ }
+ out:
+ endpwent();
+ return salt;
+}
+
char *
xcrypt(const char *password, const char *salt)
{
char *crypted;
+ /*
+ * If we don't have a salt we are encrypting a fake password for
+ * for timing purposes. Pick an appropriate salt.
+ */
+ if (salt == NULL)
+ salt = pick_salt();
+
# ifdef HAVE_MD5_PASSWORDS
if (is_md5_salt(salt))
crypted = md5_crypt(password, salt);
Modified: trunk/crypto/openssh/opensshd.init.in
===================================================================
--- trunk/crypto/openssh/opensshd.init.in 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/opensshd.init.in 2016-11-05 20:36:34 UTC (rev 9223)
@@ -21,6 +21,7 @@
HOST_KEY_DSA=$sysconfdir/ssh_host_dsa_key
HOST_KEY_RSA=$sysconfdir/ssh_host_rsa_key
@COMMENT_OUT_ECC at HOST_KEY_ECDSA=$sysconfdir/ssh_host_ecdsa_key
+HOST_KEY_ED25519=$sysconfdir/ssh_host_ed25519_key
checkkeys() {
@@ -36,6 +37,9 @@
@COMMENT_OUT_ECC@ if [ ! -f $HOST_KEY_ECDSA ]; then
@COMMENT_OUT_ECC@ ${SSH_KEYGEN} -t ecdsa -f ${HOST_KEY_ECDSA} -N ""
@COMMENT_OUT_ECC@ fi
+ if [ ! -f $HOST_KEY_ED25519 ]; then
+ ${SSH_KEYGEN} -t ed25519 -f ${HOST_KEY_ED25519} -N ""
+ fi
}
stop_service() {
Modified: trunk/crypto/openssh/packet.c
===================================================================
--- trunk/crypto/openssh/packet.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/packet.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.192 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: packet.c,v 1.234 2016/07/18 11:35:33 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -39,9 +39,9 @@
#include "includes.h"
+#include <sys/param.h> /* MIN roundup */
#include <sys/types.h>
#include "openbsd-compat/sys-queue.h"
-#include <sys/param.h>
#include <sys/socket.h>
#ifdef HAVE_SYS_TIME_H
# include <sys/time.h>
@@ -52,33 +52,40 @@
#include <arpa/inet.h>
#include <errno.h>
+#include <netdb.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
#include <signal.h>
#include <time.h>
+#include <zlib.h>
+
+#include "buffer.h" /* typedefs XXX */
+#include "key.h" /* typedefs XXX */
+
#include "xmalloc.h"
-#include "buffer.h"
-#include "packet.h"
#include "crc32.h"
-#include "compress.h"
#include "deattack.h"
-#include "channels.h"
#include "compat.h"
#include "ssh1.h"
#include "ssh2.h"
#include "cipher.h"
-#include "key.h"
+#include "sshkey.h"
#include "kex.h"
+#include "digest.h"
#include "mac.h"
#include "log.h"
#include "canohost.h"
#include "misc.h"
+#include "channels.h"
#include "ssh.h"
-#include "roaming.h"
+#include "packet.h"
+#include "ssherr.h"
+#include "sshbuf.h"
#ifdef PACKET_DEBUG
#define DBG(x) x
@@ -98,7 +105,7 @@
struct packet {
TAILQ_ENTRY(packet) next;
u_char type;
- Buffer payload;
+ struct sshbuf *payload;
};
struct session_state {
@@ -115,27 +122,34 @@
u_int remote_protocol_flags;
/* Encryption context for receiving data. Only used for decryption. */
- CipherContext receive_context;
+ struct sshcipher_ctx receive_context;
/* Encryption context for sending data. Only used for encryption. */
- CipherContext send_context;
+ struct sshcipher_ctx send_context;
/* Buffer for raw input data from the socket. */
- Buffer input;
+ struct sshbuf *input;
/* Buffer for raw output data going to the socket. */
- Buffer output;
+ struct sshbuf *output;
/* Buffer for the partial outgoing packet being constructed. */
- Buffer outgoing_packet;
+ struct sshbuf *outgoing_packet;
/* Buffer for the incoming packet currently being processed. */
- Buffer incoming_packet;
+ struct sshbuf *incoming_packet;
/* Scratch buffer for packet compression/decompression. */
- Buffer compression_buffer;
- int compression_buffer_ready;
+ struct sshbuf *compression_buffer;
+ /* Incoming/outgoing compression dictionaries */
+ z_stream compression_in_stream;
+ z_stream compression_out_stream;
+ int compression_in_started;
+ int compression_out_started;
+ int compression_in_failures;
+ int compression_out_failures;
+
/*
* Flag indicating whether packet compression/decompression is
* enabled.
@@ -163,15 +177,14 @@
int packet_timeout_ms;
/* Session key information for Encryption and MAC */
- Newkeys *newkeys[MODE_MAX];
+ struct newkeys *newkeys[MODE_MAX];
struct packet_state p_read, p_send;
/* Volume-based rekeying */
- u_int64_t max_blocks_in, max_blocks_out;
- u_int32_t rekey_limit;
+ u_int64_t max_blocks_in, max_blocks_out, rekey_limit;
/* Time-based rekeying */
- time_t rekey_interval; /* how often in seconds */
+ u_int32_t rekey_interval; /* how often in seconds */
time_t rekey_time; /* time of last rekeying */
/* Session key for protocol v1 */
@@ -183,7 +196,8 @@
/* XXX discard incoming data after MAC error */
u_int packet_discard;
- Mac *packet_discard_mac;
+ size_t packet_discard_mac_already;
+ struct sshmac *packet_discard_mac;
/* Used in packet_read_poll2() */
u_int packlen;
@@ -197,119 +211,197 @@
/* Used in packet_set_maxsize */
int set_maxsize_called;
+ /* One-off warning about weak ciphers */
+ int cipher_warning_done;
+
+ /* SSH1 CRC compensation attack detector */
+ struct deattack_ctx deattack;
+
TAILQ_HEAD(, packet) outgoing;
};
-static struct session_state *active_state, *backup_state;
-
-static struct session_state *
-alloc_session_state(void)
+struct ssh *
+ssh_alloc_session_state(void)
{
- struct session_state *s = xcalloc(1, sizeof(*s));
+ struct ssh *ssh = NULL;
+ struct session_state *state = NULL;
- s->connection_in = -1;
- s->connection_out = -1;
- s->max_packet_size = 32768;
- s->packet_timeout_ms = -1;
- return s;
+ if ((ssh = calloc(1, sizeof(*ssh))) == NULL ||
+ (state = calloc(1, sizeof(*state))) == NULL ||
+ (state->input = sshbuf_new()) == NULL ||
+ (state->output = sshbuf_new()) == NULL ||
+ (state->outgoing_packet = sshbuf_new()) == NULL ||
+ (state->incoming_packet = sshbuf_new()) == NULL)
+ goto fail;
+ TAILQ_INIT(&state->outgoing);
+ TAILQ_INIT(&ssh->private_keys);
+ TAILQ_INIT(&ssh->public_keys);
+ state->connection_in = -1;
+ state->connection_out = -1;
+ state->max_packet_size = 32768;
+ state->packet_timeout_ms = -1;
+ state->p_send.packets = state->p_read.packets = 0;
+ state->initialized = 1;
+ /*
+ * ssh_packet_send2() needs to queue packets until
+ * we've done the initial key exchange.
+ */
+ state->rekeying = 1;
+ ssh->state = state;
+ return ssh;
+ fail:
+ if (state) {
+ sshbuf_free(state->input);
+ sshbuf_free(state->output);
+ sshbuf_free(state->incoming_packet);
+ sshbuf_free(state->outgoing_packet);
+ free(state);
+ }
+ free(ssh);
+ return NULL;
}
+/* Returns nonzero if rekeying is in progress */
+int
+ssh_packet_is_rekeying(struct ssh *ssh)
+{
+ return compat20 &&
+ (ssh->state->rekeying || (ssh->kex != NULL && ssh->kex->done == 0));
+}
+
/*
* Sets the descriptors used for communication. Disables encryption until
* packet_set_encryption_key is called.
*/
-void
-packet_set_connection(int fd_in, int fd_out)
+struct ssh *
+ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
{
- const Cipher *none = cipher_by_name("none");
+ struct session_state *state;
+ const struct sshcipher *none = cipher_by_name("none");
+ int r;
- if (none == NULL)
- fatal("packet_set_connection: cannot load cipher 'none'");
- if (active_state == NULL)
- active_state = alloc_session_state();
- active_state->connection_in = fd_in;
- active_state->connection_out = fd_out;
- cipher_init(&active_state->send_context, none, (const u_char *)"",
- 0, NULL, 0, CIPHER_ENCRYPT);
- cipher_init(&active_state->receive_context, none, (const u_char *)"",
- 0, NULL, 0, CIPHER_DECRYPT);
- active_state->newkeys[MODE_IN] = active_state->newkeys[MODE_OUT] = NULL;
- if (!active_state->initialized) {
- active_state->initialized = 1;
- buffer_init(&active_state->input);
- buffer_init(&active_state->output);
- buffer_init(&active_state->outgoing_packet);
- buffer_init(&active_state->incoming_packet);
- TAILQ_INIT(&active_state->outgoing);
- active_state->p_send.packets = active_state->p_read.packets = 0;
+ if (none == NULL) {
+ error("%s: cannot load cipher 'none'", __func__);
+ return NULL;
}
+ if (ssh == NULL)
+ ssh = ssh_alloc_session_state();
+ if (ssh == NULL) {
+ error("%s: cound not allocate state", __func__);
+ return NULL;
+ }
+ state = ssh->state;
+ state->connection_in = fd_in;
+ state->connection_out = fd_out;
+ if ((r = cipher_init(&state->send_context, none,
+ (const u_char *)"", 0, NULL, 0, CIPHER_ENCRYPT)) != 0 ||
+ (r = cipher_init(&state->receive_context, none,
+ (const u_char *)"", 0, NULL, 0, CIPHER_DECRYPT)) != 0) {
+ error("%s: cipher_init failed: %s", __func__, ssh_err(r));
+ free(ssh); /* XXX need ssh_free_session_state? */
+ return NULL;
+ }
+ state->newkeys[MODE_IN] = state->newkeys[MODE_OUT] = NULL;
+ deattack_init(&state->deattack);
+ /*
+ * Cache the IP address of the remote connection for use in error
+ * messages that might be generated after the connection has closed.
+ */
+ (void)ssh_remote_ipaddr(ssh);
+ return ssh;
}
void
-packet_set_timeout(int timeout, int count)
+ssh_packet_set_timeout(struct ssh *ssh, int timeout, int count)
{
+ struct session_state *state = ssh->state;
+
if (timeout <= 0 || count <= 0) {
- active_state->packet_timeout_ms = -1;
+ state->packet_timeout_ms = -1;
return;
}
if ((INT_MAX / 1000) / count < timeout)
- active_state->packet_timeout_ms = INT_MAX;
+ state->packet_timeout_ms = INT_MAX;
else
- active_state->packet_timeout_ms = timeout * count * 1000;
+ state->packet_timeout_ms = timeout * count * 1000;
}
-static void
-packet_stop_discard(void)
+int
+ssh_packet_stop_discard(struct ssh *ssh)
{
- if (active_state->packet_discard_mac) {
+ struct session_state *state = ssh->state;
+ int r;
+
+ if (state->packet_discard_mac) {
char buf[1024];
-
+ size_t dlen = PACKET_MAX_SIZE;
+
+ if (dlen > state->packet_discard_mac_already)
+ dlen -= state->packet_discard_mac_already;
memset(buf, 'a', sizeof(buf));
- while (buffer_len(&active_state->incoming_packet) <
- PACKET_MAX_SIZE)
- buffer_append(&active_state->incoming_packet, buf,
- sizeof(buf));
- (void) mac_compute(active_state->packet_discard_mac,
- active_state->p_read.seqnr,
- buffer_ptr(&active_state->incoming_packet),
- PACKET_MAX_SIZE);
+ while (sshbuf_len(state->incoming_packet) < dlen)
+ if ((r = sshbuf_put(state->incoming_packet, buf,
+ sizeof(buf))) != 0)
+ return r;
+ (void) mac_compute(state->packet_discard_mac,
+ state->p_read.seqnr,
+ sshbuf_ptr(state->incoming_packet), dlen,
+ NULL, 0);
}
- logit("Finished discarding for %.200s", get_remote_ipaddr());
- cleanup_exit(255);
+ logit("Finished discarding for %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ return SSH_ERR_MAC_INVALID;
}
-static void
-packet_start_discard(Enc *enc, Mac *mac, u_int packet_length, u_int discard)
+static int
+ssh_packet_start_discard(struct ssh *ssh, struct sshenc *enc,
+ struct sshmac *mac, size_t mac_already, u_int discard)
{
- if (enc == NULL || !cipher_is_cbc(enc->cipher) || (mac && mac->etm))
- packet_disconnect("Packet corrupt");
- if (packet_length != PACKET_MAX_SIZE && mac && mac->enabled)
- active_state->packet_discard_mac = mac;
- if (buffer_len(&active_state->input) >= discard)
- packet_stop_discard();
- active_state->packet_discard = discard -
- buffer_len(&active_state->input);
+ struct session_state *state = ssh->state;
+ int r;
+
+ if (enc == NULL || !cipher_is_cbc(enc->cipher) || (mac && mac->etm)) {
+ if ((r = sshpkt_disconnect(ssh, "Packet corrupt")) != 0)
+ return r;
+ return SSH_ERR_MAC_INVALID;
+ }
+ /*
+ * Record number of bytes over which the mac has already
+ * been computed in order to minimize timing attacks.
+ */
+ if (mac && mac->enabled) {
+ state->packet_discard_mac = mac;
+ state->packet_discard_mac_already = mac_already;
+ }
+ if (sshbuf_len(state->input) >= discard)
+ return ssh_packet_stop_discard(ssh);
+ state->packet_discard = discard - sshbuf_len(state->input);
+ return 0;
}
/* Returns 1 if remote host is connected via socket, 0 if not. */
int
-packet_connection_is_on_socket(void)
+ssh_packet_connection_is_on_socket(struct ssh *ssh)
{
+ struct session_state *state = ssh->state;
struct sockaddr_storage from, to;
socklen_t fromlen, tolen;
+ if (state->connection_in == -1 || state->connection_out == -1)
+ return 0;
+
/* filedescriptors in and out are the same, so it's a socket */
- if (active_state->connection_in == active_state->connection_out)
+ if (state->connection_in == state->connection_out)
return 1;
fromlen = sizeof(from);
memset(&from, 0, sizeof(from));
- if (getpeername(active_state->connection_in, (struct sockaddr *)&from,
+ if (getpeername(state->connection_in, (struct sockaddr *)&from,
&fromlen) < 0)
return 0;
tolen = sizeof(to);
memset(&to, 0, sizeof(to));
- if (getpeername(active_state->connection_out, (struct sockaddr *)&to,
+ if (getpeername(state->connection_out, (struct sockaddr *)&to,
&tolen) < 0)
return 0;
if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
@@ -319,202 +411,192 @@
return 1;
}
-/*
- * Exports an IV from the CipherContext required to export the key
- * state back from the unprivileged child to the privileged parent
- * process.
- */
-
void
-packet_get_keyiv(int mode, u_char *iv, u_int len)
+ssh_packet_get_bytes(struct ssh *ssh, u_int64_t *ibytes, u_int64_t *obytes)
{
- CipherContext *cc;
-
- if (mode == MODE_OUT)
- cc = &active_state->send_context;
- else
- cc = &active_state->receive_context;
-
- cipher_get_keyiv(cc, iv, len);
+ if (ibytes)
+ *ibytes = ssh->state->p_read.bytes;
+ if (obytes)
+ *obytes = ssh->state->p_send.bytes;
}
int
-packet_get_keycontext(int mode, u_char *dat)
+ssh_packet_connection_af(struct ssh *ssh)
{
- CipherContext *cc;
+ struct sockaddr_storage to;
+ socklen_t tolen = sizeof(to);
- if (mode == MODE_OUT)
- cc = &active_state->send_context;
- else
- cc = &active_state->receive_context;
-
- return (cipher_get_keycontext(cc, dat));
+ memset(&to, 0, sizeof(to));
+ if (getsockname(ssh->state->connection_out, (struct sockaddr *)&to,
+ &tolen) < 0)
+ return 0;
+#ifdef IPV4_IN_IPV6
+ if (to.ss_family == AF_INET6 &&
+ IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&to)->sin6_addr))
+ return AF_INET;
+#endif
+ return to.ss_family;
}
+/* Sets the connection into non-blocking mode. */
+
void
-packet_set_keycontext(int mode, u_char *dat)
+ssh_packet_set_nonblocking(struct ssh *ssh)
{
- CipherContext *cc;
+ /* Set the socket into non-blocking mode. */
+ set_nonblock(ssh->state->connection_in);
- if (mode == MODE_OUT)
- cc = &active_state->send_context;
- else
- cc = &active_state->receive_context;
-
- cipher_set_keycontext(cc, dat);
+ if (ssh->state->connection_out != ssh->state->connection_in)
+ set_nonblock(ssh->state->connection_out);
}
+/* Returns the socket used for reading. */
+
int
-packet_get_keyiv_len(int mode)
+ssh_packet_get_connection_in(struct ssh *ssh)
{
- CipherContext *cc;
-
- if (mode == MODE_OUT)
- cc = &active_state->send_context;
- else
- cc = &active_state->receive_context;
-
- return (cipher_get_keyiv_len(cc));
+ return ssh->state->connection_in;
}
-void
-packet_set_iv(int mode, u_char *dat)
-{
- CipherContext *cc;
+/* Returns the descriptor used for writing. */
- if (mode == MODE_OUT)
- cc = &active_state->send_context;
- else
- cc = &active_state->receive_context;
-
- cipher_set_keyiv(cc, dat);
-}
-
int
-packet_get_ssh1_cipher(void)
+ssh_packet_get_connection_out(struct ssh *ssh)
{
- return (cipher_get_number(active_state->receive_context.cipher));
+ return ssh->state->connection_out;
}
-void
-packet_get_state(int mode, u_int32_t *seqnr, u_int64_t *blocks,
- u_int32_t *packets, u_int64_t *bytes)
-{
- struct packet_state *state;
+/*
+ * Returns the IP-address of the remote host as a string. The returned
+ * string must not be freed.
+ */
- state = (mode == MODE_IN) ?
- &active_state->p_read : &active_state->p_send;
- if (seqnr)
- *seqnr = state->seqnr;
- if (blocks)
- *blocks = state->blocks;
- if (packets)
- *packets = state->packets;
- if (bytes)
- *bytes = state->bytes;
-}
-
-void
-packet_set_state(int mode, u_int32_t seqnr, u_int64_t blocks, u_int32_t packets,
- u_int64_t bytes)
+const char *
+ssh_remote_ipaddr(struct ssh *ssh)
{
- struct packet_state *state;
+ const int sock = ssh->state->connection_in;
- state = (mode == MODE_IN) ?
- &active_state->p_read : &active_state->p_send;
- state->seqnr = seqnr;
- state->blocks = blocks;
- state->packets = packets;
- state->bytes = bytes;
+ /* Check whether we have cached the ipaddr. */
+ if (ssh->remote_ipaddr == NULL) {
+ if (ssh_packet_connection_is_on_socket(ssh)) {
+ ssh->remote_ipaddr = get_peer_ipaddr(sock);
+ ssh->remote_port = get_peer_port(sock);
+ ssh->local_ipaddr = get_local_ipaddr(sock);
+ ssh->local_port = get_local_port(sock);
+ } else {
+ ssh->remote_ipaddr = strdup("UNKNOWN");
+ ssh->remote_port = 65535;
+ ssh->local_ipaddr = strdup("UNKNOWN");
+ ssh->local_port = 65535;
+ }
+ }
+ return ssh->remote_ipaddr;
}
-static int
-packet_connection_af(void)
-{
- struct sockaddr_storage to;
- socklen_t tolen = sizeof(to);
+/* Returns the port number of the remote host. */
- memset(&to, 0, sizeof(to));
- if (getsockname(active_state->connection_out, (struct sockaddr *)&to,
- &tolen) < 0)
- return 0;
-#ifdef IPV4_IN_IPV6
- if (to.ss_family == AF_INET6 &&
- IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&to)->sin6_addr))
- return AF_INET;
-#endif
- return to.ss_family;
-}
-
-/* Sets the connection into non-blocking mode. */
-
-void
-packet_set_nonblocking(void)
+int
+ssh_remote_port(struct ssh *ssh)
{
- /* Set the socket into non-blocking mode. */
- set_nonblock(active_state->connection_in);
-
- if (active_state->connection_out != active_state->connection_in)
- set_nonblock(active_state->connection_out);
+ (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
+ return ssh->remote_port;
}
-/* Returns the socket used for reading. */
+/*
+ * Returns the IP-address of the local host as a string. The returned
+ * string must not be freed.
+ */
-int
-packet_get_connection_in(void)
+const char *
+ssh_local_ipaddr(struct ssh *ssh)
{
- return active_state->connection_in;
+ (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
+ return ssh->local_ipaddr;
}
-/* Returns the descriptor used for writing. */
+/* Returns the port number of the local host. */
int
-packet_get_connection_out(void)
+ssh_local_port(struct ssh *ssh)
{
- return active_state->connection_out;
+ (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
+ return ssh->local_port;
}
/* Closes the connection and clears and frees internal data structures. */
void
-packet_close(void)
+ssh_packet_close(struct ssh *ssh)
{
- if (!active_state->initialized)
+ struct session_state *state = ssh->state;
+ int r;
+ u_int mode;
+
+ if (!state->initialized)
return;
- active_state->initialized = 0;
- if (active_state->connection_in == active_state->connection_out) {
- shutdown(active_state->connection_out, SHUT_RDWR);
- close(active_state->connection_out);
+ state->initialized = 0;
+ if (state->connection_in == state->connection_out) {
+ shutdown(state->connection_out, SHUT_RDWR);
+ close(state->connection_out);
} else {
- close(active_state->connection_in);
- close(active_state->connection_out);
+ close(state->connection_in);
+ close(state->connection_out);
}
- buffer_free(&active_state->input);
- buffer_free(&active_state->output);
- buffer_free(&active_state->outgoing_packet);
- buffer_free(&active_state->incoming_packet);
- if (active_state->compression_buffer_ready) {
- buffer_free(&active_state->compression_buffer);
- buffer_compress_uninit();
+ sshbuf_free(state->input);
+ sshbuf_free(state->output);
+ sshbuf_free(state->outgoing_packet);
+ sshbuf_free(state->incoming_packet);
+ for (mode = 0; mode < MODE_MAX; mode++)
+ kex_free_newkeys(state->newkeys[mode]);
+ if (state->compression_buffer) {
+ sshbuf_free(state->compression_buffer);
+ if (state->compression_out_started) {
+ z_streamp stream = &state->compression_out_stream;
+ debug("compress outgoing: "
+ "raw data %llu, compressed %llu, factor %.2f",
+ (unsigned long long)stream->total_in,
+ (unsigned long long)stream->total_out,
+ stream->total_in == 0 ? 0.0 :
+ (double) stream->total_out / stream->total_in);
+ if (state->compression_out_failures == 0)
+ deflateEnd(stream);
+ }
+ if (state->compression_in_started) {
+ z_streamp stream = &state->compression_out_stream;
+ debug("compress incoming: "
+ "raw data %llu, compressed %llu, factor %.2f",
+ (unsigned long long)stream->total_out,
+ (unsigned long long)stream->total_in,
+ stream->total_out == 0 ? 0.0 :
+ (double) stream->total_in / stream->total_out);
+ if (state->compression_in_failures == 0)
+ inflateEnd(stream);
+ }
}
- cipher_cleanup(&active_state->send_context);
- cipher_cleanup(&active_state->receive_context);
+ if ((r = cipher_cleanup(&state->send_context)) != 0)
+ error("%s: cipher_cleanup failed: %s", __func__, ssh_err(r));
+ if ((r = cipher_cleanup(&state->receive_context)) != 0)
+ error("%s: cipher_cleanup failed: %s", __func__, ssh_err(r));
+ free(ssh->remote_ipaddr);
+ ssh->remote_ipaddr = NULL;
+ free(ssh->state);
+ ssh->state = NULL;
}
/* Sets remote side protocol flags. */
void
-packet_set_protocol_flags(u_int protocol_flags)
+ssh_packet_set_protocol_flags(struct ssh *ssh, u_int protocol_flags)
{
- active_state->remote_protocol_flags = protocol_flags;
+ ssh->state->remote_protocol_flags = protocol_flags;
}
/* Returns the remote protocol flags set earlier by the above function. */
u_int
-packet_get_protocol_flags(void)
+ssh_packet_get_protocol_flags(struct ssh *ssh)
{
- return active_state->remote_protocol_flags;
+ return ssh->state->remote_protocol_flags;
}
/*
@@ -522,133 +604,279 @@
* Level is compression level 1 (fastest) - 9 (slow, best) as in gzip.
*/
-static void
-packet_init_compression(void)
+static int
+ssh_packet_init_compression(struct ssh *ssh)
{
- if (active_state->compression_buffer_ready == 1)
- return;
- active_state->compression_buffer_ready = 1;
- buffer_init(&active_state->compression_buffer);
+ if (!ssh->state->compression_buffer &&
+ ((ssh->state->compression_buffer = sshbuf_new()) == NULL))
+ return SSH_ERR_ALLOC_FAIL;
+ return 0;
}
-void
-packet_start_compression(int level)
+static int
+start_compression_out(struct ssh *ssh, int level)
{
- if (active_state->packet_compression && !compat20)
- fatal("Compression already enabled.");
- active_state->packet_compression = 1;
- packet_init_compression();
- buffer_compress_init_send(level);
- buffer_compress_init_recv();
+ if (level < 1 || level > 9)
+ return SSH_ERR_INVALID_ARGUMENT;
+ debug("Enabling compression at level %d.", level);
+ if (ssh->state->compression_out_started == 1)
+ deflateEnd(&ssh->state->compression_out_stream);
+ switch (deflateInit(&ssh->state->compression_out_stream, level)) {
+ case Z_OK:
+ ssh->state->compression_out_started = 1;
+ break;
+ case Z_MEM_ERROR:
+ return SSH_ERR_ALLOC_FAIL;
+ default:
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ return 0;
}
-/*
- * Causes any further packets to be encrypted using the given key. The same
- * key is used for both sending and reception. However, both directions are
- * encrypted independently of each other.
- */
-
-void
-packet_set_encryption_key(const u_char *key, u_int keylen, int number)
+static int
+start_compression_in(struct ssh *ssh)
{
- const Cipher *cipher = cipher_by_number(number);
-
- if (cipher == NULL)
- fatal("packet_set_encryption_key: unknown cipher number %d", number);
- if (keylen < 20)
- fatal("packet_set_encryption_key: keylen too small: %d", keylen);
- if (keylen > SSH_SESSION_KEY_LENGTH)
- fatal("packet_set_encryption_key: keylen too big: %d", keylen);
- memcpy(active_state->ssh1_key, key, keylen);
- active_state->ssh1_keylen = keylen;
- cipher_init(&active_state->send_context, cipher, key, keylen, NULL,
- 0, CIPHER_ENCRYPT);
- cipher_init(&active_state->receive_context, cipher, key, keylen, NULL,
- 0, CIPHER_DECRYPT);
+ if (ssh->state->compression_in_started == 1)
+ inflateEnd(&ssh->state->compression_in_stream);
+ switch (inflateInit(&ssh->state->compression_in_stream)) {
+ case Z_OK:
+ ssh->state->compression_in_started = 1;
+ break;
+ case Z_MEM_ERROR:
+ return SSH_ERR_ALLOC_FAIL;
+ default:
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ return 0;
}
-u_int
-packet_get_encryption_key(u_char *key)
+int
+ssh_packet_start_compression(struct ssh *ssh, int level)
{
- if (key == NULL)
- return (active_state->ssh1_keylen);
- memcpy(key, active_state->ssh1_key, active_state->ssh1_keylen);
- return (active_state->ssh1_keylen);
+ int r;
+
+ if (ssh->state->packet_compression && !compat20)
+ return SSH_ERR_INTERNAL_ERROR;
+ ssh->state->packet_compression = 1;
+ if ((r = ssh_packet_init_compression(ssh)) != 0 ||
+ (r = start_compression_in(ssh)) != 0 ||
+ (r = start_compression_out(ssh, level)) != 0)
+ return r;
+ return 0;
}
-/* Start constructing a packet to send. */
-void
-packet_start(u_char type)
+/* XXX remove need for separate compression buffer */
+static int
+compress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
{
- u_char buf[9];
- int len;
+ u_char buf[4096];
+ int r, status;
- DBG(debug("packet_start[%d]", type));
- len = compat20 ? 6 : 9;
- memset(buf, 0, len - 1);
- buf[len - 1] = type;
- buffer_clear(&active_state->outgoing_packet);
- buffer_append(&active_state->outgoing_packet, buf, len);
+ if (ssh->state->compression_out_started != 1)
+ return SSH_ERR_INTERNAL_ERROR;
+
+ /* This case is not handled below. */
+ if (sshbuf_len(in) == 0)
+ return 0;
+
+ /* Input is the contents of the input buffer. */
+ if ((ssh->state->compression_out_stream.next_in =
+ sshbuf_mutable_ptr(in)) == NULL)
+ return SSH_ERR_INTERNAL_ERROR;
+ ssh->state->compression_out_stream.avail_in = sshbuf_len(in);
+
+ /* Loop compressing until deflate() returns with avail_out != 0. */
+ do {
+ /* Set up fixed-size output buffer. */
+ ssh->state->compression_out_stream.next_out = buf;
+ ssh->state->compression_out_stream.avail_out = sizeof(buf);
+
+ /* Compress as much data into the buffer as possible. */
+ status = deflate(&ssh->state->compression_out_stream,
+ Z_PARTIAL_FLUSH);
+ switch (status) {
+ case Z_MEM_ERROR:
+ return SSH_ERR_ALLOC_FAIL;
+ case Z_OK:
+ /* Append compressed data to output_buffer. */
+ if ((r = sshbuf_put(out, buf, sizeof(buf) -
+ ssh->state->compression_out_stream.avail_out)) != 0)
+ return r;
+ break;
+ case Z_STREAM_ERROR:
+ default:
+ ssh->state->compression_out_failures++;
+ return SSH_ERR_INVALID_FORMAT;
+ }
+ } while (ssh->state->compression_out_stream.avail_out == 0);
+ return 0;
}
-/* Append payload. */
-void
-packet_put_char(int value)
+static int
+uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
{
- char ch = value;
+ u_char buf[4096];
+ int r, status;
- buffer_append(&active_state->outgoing_packet, &ch, 1);
-}
+ if (ssh->state->compression_in_started != 1)
+ return SSH_ERR_INTERNAL_ERROR;
-void
-packet_put_int(u_int value)
-{
- buffer_put_int(&active_state->outgoing_packet, value);
+ if ((ssh->state->compression_in_stream.next_in =
+ sshbuf_mutable_ptr(in)) == NULL)
+ return SSH_ERR_INTERNAL_ERROR;
+ ssh->state->compression_in_stream.avail_in = sshbuf_len(in);
+
+ for (;;) {
+ /* Set up fixed-size output buffer. */
+ ssh->state->compression_in_stream.next_out = buf;
+ ssh->state->compression_in_stream.avail_out = sizeof(buf);
+
+ status = inflate(&ssh->state->compression_in_stream,
+ Z_PARTIAL_FLUSH);
+ switch (status) {
+ case Z_OK:
+ if ((r = sshbuf_put(out, buf, sizeof(buf) -
+ ssh->state->compression_in_stream.avail_out)) != 0)
+ return r;
+ break;
+ case Z_BUF_ERROR:
+ /*
+ * Comments in zlib.h say that we should keep calling
+ * inflate() until we get an error. This appears to
+ * be the error that we get.
+ */
+ return 0;
+ case Z_DATA_ERROR:
+ return SSH_ERR_INVALID_FORMAT;
+ case Z_MEM_ERROR:
+ return SSH_ERR_ALLOC_FAIL;
+ case Z_STREAM_ERROR:
+ default:
+ ssh->state->compression_in_failures++;
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ }
+ /* NOTREACHED */
}
-void
-packet_put_int64(u_int64_t value)
+/* Serialise compression state into a blob for privsep */
+static int
+ssh_packet_get_compress_state(struct sshbuf *m, struct ssh *ssh)
{
- buffer_put_int64(&active_state->outgoing_packet, value);
-}
+ struct session_state *state = ssh->state;
+ struct sshbuf *b;
+ int r;
-void
-packet_put_string(const void *buf, u_int len)
-{
- buffer_put_string(&active_state->outgoing_packet, buf, len);
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (state->compression_in_started) {
+ if ((r = sshbuf_put_string(b, &state->compression_in_stream,
+ sizeof(state->compression_in_stream))) != 0)
+ goto out;
+ } else if ((r = sshbuf_put_string(b, NULL, 0)) != 0)
+ goto out;
+ if (state->compression_out_started) {
+ if ((r = sshbuf_put_string(b, &state->compression_out_stream,
+ sizeof(state->compression_out_stream))) != 0)
+ goto out;
+ } else if ((r = sshbuf_put_string(b, NULL, 0)) != 0)
+ goto out;
+ r = sshbuf_put_stringb(m, b);
+ out:
+ sshbuf_free(b);
+ return r;
}
-void
-packet_put_cstring(const char *str)
+/* Deserialise compression state from a blob for privsep */
+static int
+ssh_packet_set_compress_state(struct ssh *ssh, struct sshbuf *m)
{
- buffer_put_cstring(&active_state->outgoing_packet, str);
-}
+ struct session_state *state = ssh->state;
+ struct sshbuf *b = NULL;
+ int r;
+ const u_char *inblob, *outblob;
+ size_t inl, outl;
-void
-packet_put_raw(const void *buf, u_int len)
-{
- buffer_append(&active_state->outgoing_packet, buf, len);
+ if ((r = sshbuf_froms(m, &b)) != 0)
+ goto out;
+ if ((r = sshbuf_get_string_direct(b, &inblob, &inl)) != 0 ||
+ (r = sshbuf_get_string_direct(b, &outblob, &outl)) != 0)
+ goto out;
+ if (inl == 0)
+ state->compression_in_started = 0;
+ else if (inl != sizeof(state->compression_in_stream)) {
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
+ } else {
+ state->compression_in_started = 1;
+ memcpy(&state->compression_in_stream, inblob, inl);
+ }
+ if (outl == 0)
+ state->compression_out_started = 0;
+ else if (outl != sizeof(state->compression_out_stream)) {
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
+ } else {
+ state->compression_out_started = 1;
+ memcpy(&state->compression_out_stream, outblob, outl);
+ }
+ r = 0;
+ out:
+ sshbuf_free(b);
+ return r;
}
void
-packet_put_bignum(BIGNUM * value)
+ssh_packet_set_compress_hooks(struct ssh *ssh, void *ctx,
+ void *(*allocfunc)(void *, u_int, u_int),
+ void (*freefunc)(void *, void *))
{
- buffer_put_bignum(&active_state->outgoing_packet, value);
+ ssh->state->compression_out_stream.zalloc = (alloc_func)allocfunc;
+ ssh->state->compression_out_stream.zfree = (free_func)freefunc;
+ ssh->state->compression_out_stream.opaque = ctx;
+ ssh->state->compression_in_stream.zalloc = (alloc_func)allocfunc;
+ ssh->state->compression_in_stream.zfree = (free_func)freefunc;
+ ssh->state->compression_in_stream.opaque = ctx;
}
+/*
+ * Causes any further packets to be encrypted using the given key. The same
+ * key is used for both sending and reception. However, both directions are
+ * encrypted independently of each other.
+ */
+
void
-packet_put_bignum2(BIGNUM * value)
+ssh_packet_set_encryption_key(struct ssh *ssh, const u_char *key, u_int keylen, int number)
{
- buffer_put_bignum2(&active_state->outgoing_packet, value);
-}
+#ifndef WITH_SSH1
+ fatal("no SSH protocol 1 support");
+#else /* WITH_SSH1 */
+ struct session_state *state = ssh->state;
+ const struct sshcipher *cipher = cipher_by_number(number);
+ int r;
+ const char *wmsg;
-#ifdef OPENSSL_HAS_ECC
-void
-packet_put_ecpoint(const EC_GROUP *curve, const EC_POINT *point)
-{
- buffer_put_ecpoint(&active_state->outgoing_packet, curve, point);
+ if (cipher == NULL)
+ fatal("%s: unknown cipher number %d", __func__, number);
+ if (keylen < 20)
+ fatal("%s: keylen too small: %d", __func__, keylen);
+ if (keylen > SSH_SESSION_KEY_LENGTH)
+ fatal("%s: keylen too big: %d", __func__, keylen);
+ memcpy(state->ssh1_key, key, keylen);
+ state->ssh1_keylen = keylen;
+ if ((r = cipher_init(&state->send_context, cipher, key, keylen,
+ NULL, 0, CIPHER_ENCRYPT)) != 0 ||
+ (r = cipher_init(&state->receive_context, cipher, key, keylen,
+ NULL, 0, CIPHER_DECRYPT) != 0))
+ fatal("%s: cipher_init failed: %s", __func__, ssh_err(r));
+ if (!state->cipher_warning_done &&
+ ((wmsg = cipher_warning_message(&state->send_context)) != NULL ||
+ (wmsg = cipher_warning_message(&state->send_context)) != NULL)) {
+ error("Warning: %s", wmsg);
+ state->cipher_warning_done = 1;
+ }
+#endif /* WITH_SSH1 */
}
-#endif
/*
* Finalizes and sends the packet. If the encryption key has been set,
@@ -655,114 +883,131 @@
* encrypts the packet before sending.
*/
-static void
-packet_send1(void)
+int
+ssh_packet_send1(struct ssh *ssh)
{
+ struct session_state *state = ssh->state;
u_char buf[8], *cp;
- int i, padding, len;
+ int r, padding, len;
u_int checksum;
- u_int32_t rnd = 0;
/*
* If using packet compression, compress the payload of the outgoing
* packet.
*/
- if (active_state->packet_compression) {
- buffer_clear(&active_state->compression_buffer);
+ if (state->packet_compression) {
+ sshbuf_reset(state->compression_buffer);
/* Skip padding. */
- buffer_consume(&active_state->outgoing_packet, 8);
+ if ((r = sshbuf_consume(state->outgoing_packet, 8)) != 0)
+ goto out;
/* padding */
- buffer_append(&active_state->compression_buffer,
- "\0\0\0\0\0\0\0\0", 8);
- buffer_compress(&active_state->outgoing_packet,
- &active_state->compression_buffer);
- buffer_clear(&active_state->outgoing_packet);
- buffer_append(&active_state->outgoing_packet,
- buffer_ptr(&active_state->compression_buffer),
- buffer_len(&active_state->compression_buffer));
+ if ((r = sshbuf_put(state->compression_buffer,
+ "\0\0\0\0\0\0\0\0", 8)) != 0)
+ goto out;
+ if ((r = compress_buffer(ssh, state->outgoing_packet,
+ state->compression_buffer)) != 0)
+ goto out;
+ sshbuf_reset(state->outgoing_packet);
+ if ((r = sshbuf_putb(state->outgoing_packet,
+ state->compression_buffer)) != 0)
+ goto out;
}
/* Compute packet length without padding (add checksum, remove padding). */
- len = buffer_len(&active_state->outgoing_packet) + 4 - 8;
+ len = sshbuf_len(state->outgoing_packet) + 4 - 8;
/* Insert padding. Initialized to zero in packet_start1() */
padding = 8 - len % 8;
- if (!active_state->send_context.plaintext) {
- cp = buffer_ptr(&active_state->outgoing_packet);
- for (i = 0; i < padding; i++) {
- if (i % 4 == 0)
- rnd = arc4random();
- cp[7 - i] = rnd & 0xff;
- rnd >>= 8;
+ if (!state->send_context.plaintext) {
+ cp = sshbuf_mutable_ptr(state->outgoing_packet);
+ if (cp == NULL) {
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
}
+ arc4random_buf(cp + 8 - padding, padding);
}
- buffer_consume(&active_state->outgoing_packet, 8 - padding);
+ if ((r = sshbuf_consume(state->outgoing_packet, 8 - padding)) != 0)
+ goto out;
/* Add check bytes. */
- checksum = ssh_crc32(buffer_ptr(&active_state->outgoing_packet),
- buffer_len(&active_state->outgoing_packet));
- put_u32(buf, checksum);
- buffer_append(&active_state->outgoing_packet, buf, 4);
+ checksum = ssh_crc32(sshbuf_ptr(state->outgoing_packet),
+ sshbuf_len(state->outgoing_packet));
+ POKE_U32(buf, checksum);
+ if ((r = sshbuf_put(state->outgoing_packet, buf, 4)) != 0)
+ goto out;
#ifdef PACKET_DEBUG
fprintf(stderr, "packet_send plain: ");
- buffer_dump(&active_state->outgoing_packet);
+ sshbuf_dump(state->outgoing_packet, stderr);
#endif
/* Append to output. */
- put_u32(buf, len);
- buffer_append(&active_state->output, buf, 4);
- cp = buffer_append_space(&active_state->output,
- buffer_len(&active_state->outgoing_packet));
- if (cipher_crypt(&active_state->send_context, 0, cp,
- buffer_ptr(&active_state->outgoing_packet),
- buffer_len(&active_state->outgoing_packet), 0, 0) != 0)
- fatal("%s: cipher_crypt failed", __func__);
+ POKE_U32(buf, len);
+ if ((r = sshbuf_put(state->output, buf, 4)) != 0)
+ goto out;
+ if ((r = sshbuf_reserve(state->output,
+ sshbuf_len(state->outgoing_packet), &cp)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&state->send_context, 0, cp,
+ sshbuf_ptr(state->outgoing_packet),
+ sshbuf_len(state->outgoing_packet), 0, 0)) != 0)
+ goto out;
#ifdef PACKET_DEBUG
fprintf(stderr, "encrypted: ");
- buffer_dump(&active_state->output);
+ sshbuf_dump(state->output, stderr);
#endif
- active_state->p_send.packets++;
- active_state->p_send.bytes += len +
- buffer_len(&active_state->outgoing_packet);
- buffer_clear(&active_state->outgoing_packet);
+ state->p_send.packets++;
+ state->p_send.bytes += len +
+ sshbuf_len(state->outgoing_packet);
+ sshbuf_reset(state->outgoing_packet);
/*
* Note that the packet is now only buffered in output. It won't be
- * actually sent until packet_write_wait or packet_write_poll is
- * called.
+ * actually sent until ssh_packet_write_wait or ssh_packet_write_poll
+ * is called.
*/
+ r = 0;
+ out:
+ return r;
}
-void
-set_newkeys(int mode)
+int
+ssh_set_newkeys(struct ssh *ssh, int mode)
{
- Enc *enc;
- Mac *mac;
- Comp *comp;
- CipherContext *cc;
+ struct session_state *state = ssh->state;
+ struct sshenc *enc;
+ struct sshmac *mac;
+ struct sshcomp *comp;
+ struct sshcipher_ctx *cc;
u_int64_t *max_blocks;
- int crypt_type;
+ const char *wmsg;
+ int r, crypt_type;
debug2("set_newkeys: mode %d", mode);
if (mode == MODE_OUT) {
- cc = &active_state->send_context;
+ cc = &state->send_context;
crypt_type = CIPHER_ENCRYPT;
- active_state->p_send.packets = active_state->p_send.blocks = 0;
- max_blocks = &active_state->max_blocks_out;
+ state->p_send.packets = state->p_send.blocks = 0;
+ max_blocks = &state->max_blocks_out;
} else {
- cc = &active_state->receive_context;
+ cc = &state->receive_context;
crypt_type = CIPHER_DECRYPT;
- active_state->p_read.packets = active_state->p_read.blocks = 0;
- max_blocks = &active_state->max_blocks_in;
+ state->p_read.packets = state->p_read.blocks = 0;
+ max_blocks = &state->max_blocks_in;
}
- if (active_state->newkeys[mode] != NULL) {
- debug("set_newkeys: rekeying");
- cipher_cleanup(cc);
- enc = &active_state->newkeys[mode]->enc;
- mac = &active_state->newkeys[mode]->mac;
- comp = &active_state->newkeys[mode]->comp;
+ if (state->newkeys[mode] != NULL) {
+ debug("set_newkeys: rekeying, input %llu bytes %llu blocks, "
+ "output %llu bytes %llu blocks",
+ (unsigned long long)state->p_read.bytes,
+ (unsigned long long)state->p_read.blocks,
+ (unsigned long long)state->p_send.bytes,
+ (unsigned long long)state->p_send.blocks);
+ if ((r = cipher_cleanup(cc)) != 0)
+ return r;
+ enc = &state->newkeys[mode]->enc;
+ mac = &state->newkeys[mode]->mac;
+ comp = &state->newkeys[mode]->comp;
mac_clear(mac);
explicit_bzero(enc->iv, enc->iv_len);
explicit_bzero(enc->key, enc->key_len);
@@ -773,19 +1018,29 @@
free(mac->name);
free(mac->key);
free(comp->name);
- free(active_state->newkeys[mode]);
+ free(state->newkeys[mode]);
}
- active_state->newkeys[mode] = kex_get_newkeys(mode);
- if (active_state->newkeys[mode] == NULL)
- fatal("newkeys: no keys for mode %d", mode);
- enc = &active_state->newkeys[mode]->enc;
- mac = &active_state->newkeys[mode]->mac;
- comp = &active_state->newkeys[mode]->comp;
- if (cipher_authlen(enc->cipher) == 0 && mac_init(mac) == 0)
- mac->enabled = 1;
+ /* move newkeys from kex to state */
+ if ((state->newkeys[mode] = ssh->kex->newkeys[mode]) == NULL)
+ return SSH_ERR_INTERNAL_ERROR;
+ ssh->kex->newkeys[mode] = NULL;
+ enc = &state->newkeys[mode]->enc;
+ mac = &state->newkeys[mode]->mac;
+ comp = &state->newkeys[mode]->comp;
+ if (cipher_authlen(enc->cipher) == 0) {
+ if ((r = mac_init(mac)) != 0)
+ return r;
+ }
+ mac->enabled = 1;
DBG(debug("cipher_init_context: %d", mode));
- cipher_init(cc, enc->cipher, enc->key, enc->key_len,
- enc->iv, enc->iv_len, crypt_type);
+ if ((r = cipher_init(cc, enc->cipher, enc->key, enc->key_len,
+ enc->iv, enc->iv_len, crypt_type)) != 0)
+ return r;
+ if (!state->cipher_warning_done &&
+ (wmsg = cipher_warning_message(cc)) != NULL) {
+ error("Warning: %s", wmsg);
+ state->cipher_warning_done = 1;
+ }
/* Deleting the keys does not gain extra security */
/* explicit_bzero(enc->iv, enc->block_size);
explicit_bzero(enc->key, enc->key_len);
@@ -792,12 +1047,16 @@
explicit_bzero(mac->key, mac->key_len); */
if ((comp->type == COMP_ZLIB ||
(comp->type == COMP_DELAYED &&
- active_state->after_authentication)) && comp->enabled == 0) {
- packet_init_compression();
- if (mode == MODE_OUT)
- buffer_compress_init_send(6);
- else
- buffer_compress_init_recv();
+ state->after_authentication)) && comp->enabled == 0) {
+ if ((r = ssh_packet_init_compression(ssh)) < 0)
+ return r;
+ if (mode == MODE_OUT) {
+ if ((r = start_compression_out(ssh, 6)) != 0)
+ return r;
+ } else {
+ if ((r = start_compression_in(ssh)) != 0)
+ return r;
+ }
comp->enabled = 1;
}
/*
@@ -808,62 +1067,130 @@
*max_blocks = (u_int64_t)1 << (enc->block_size*2);
else
*max_blocks = ((u_int64_t)1 << 30) / enc->block_size;
- if (active_state->rekey_limit)
+ if (state->rekey_limit)
*max_blocks = MIN(*max_blocks,
- active_state->rekey_limit / enc->block_size);
+ state->rekey_limit / enc->block_size);
+ debug("rekey after %llu blocks", (unsigned long long)*max_blocks);
+ return 0;
}
+#define MAX_PACKETS (1U<<31)
+static int
+ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
+{
+ struct session_state *state = ssh->state;
+ u_int32_t out_blocks;
+
+ /* XXX client can't cope with rekeying pre-auth */
+ if (!state->after_authentication)
+ return 0;
+
+ /* Haven't keyed yet or KEX in progress. */
+ if (ssh->kex == NULL || ssh_packet_is_rekeying(ssh))
+ return 0;
+
+ /* Peer can't rekey */
+ if (ssh->compat & SSH_BUG_NOREKEY)
+ return 0;
+
+ /*
+ * Permit one packet in or out per rekey - this allows us to
+ * make progress when rekey limits are very small.
+ */
+ if (state->p_send.packets == 0 && state->p_read.packets == 0)
+ return 0;
+
+ /* Time-based rekeying */
+ if (state->rekey_interval != 0 &&
+ state->rekey_time + state->rekey_interval <= monotime())
+ return 1;
+
+ /* Always rekey when MAX_PACKETS sent in either direction */
+ if (state->p_send.packets > MAX_PACKETS ||
+ state->p_read.packets > MAX_PACKETS)
+ return 1;
+
+ /* Rekey after (cipher-specific) maxiumum blocks */
+ out_blocks = roundup(outbound_packet_len,
+ state->newkeys[MODE_OUT]->enc.block_size);
+ return (state->max_blocks_out &&
+ (state->p_send.blocks + out_blocks > state->max_blocks_out)) ||
+ (state->max_blocks_in &&
+ (state->p_read.blocks > state->max_blocks_in));
+}
+
/*
* Delayed compression for SSH2 is enabled after authentication:
* This happens on the server side after a SSH2_MSG_USERAUTH_SUCCESS is sent,
* and on the client side after a SSH2_MSG_USERAUTH_SUCCESS is received.
*/
-static void
-packet_enable_delayed_compress(void)
+static int
+ssh_packet_enable_delayed_compress(struct ssh *ssh)
{
- Comp *comp = NULL;
- int mode;
+ struct session_state *state = ssh->state;
+ struct sshcomp *comp = NULL;
+ int r, mode;
/*
* Remember that we are past the authentication step, so rekeying
* with COMP_DELAYED will turn on compression immediately.
*/
- active_state->after_authentication = 1;
+ state->after_authentication = 1;
for (mode = 0; mode < MODE_MAX; mode++) {
/* protocol error: USERAUTH_SUCCESS received before NEWKEYS */
- if (active_state->newkeys[mode] == NULL)
+ if (state->newkeys[mode] == NULL)
continue;
- comp = &active_state->newkeys[mode]->comp;
+ comp = &state->newkeys[mode]->comp;
if (comp && !comp->enabled && comp->type == COMP_DELAYED) {
- packet_init_compression();
- if (mode == MODE_OUT)
- buffer_compress_init_send(6);
- else
- buffer_compress_init_recv();
+ if ((r = ssh_packet_init_compression(ssh)) != 0)
+ return r;
+ if (mode == MODE_OUT) {
+ if ((r = start_compression_out(ssh, 6)) != 0)
+ return r;
+ } else {
+ if ((r = start_compression_in(ssh)) != 0)
+ return r;
+ }
comp->enabled = 1;
}
}
+ return 0;
}
+/* Used to mute debug logging for noisy packet types */
+static int
+ssh_packet_log_type(u_char type)
+{
+ switch (type) {
+ case SSH2_MSG_CHANNEL_DATA:
+ case SSH2_MSG_CHANNEL_EXTENDED_DATA:
+ case SSH2_MSG_CHANNEL_WINDOW_ADJUST:
+ return 0;
+ default:
+ return 1;
+ }
+}
+
/*
* Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
*/
-static void
-packet_send2_wrapped(void)
+int
+ssh_packet_send2_wrapped(struct ssh *ssh)
{
- u_char type, *cp, *macbuf = NULL;
- u_char padlen, pad = 0;
- u_int i, len, authlen = 0, aadlen = 0;
- u_int32_t rnd = 0;
- Enc *enc = NULL;
- Mac *mac = NULL;
- Comp *comp = NULL;
- int block_size;
+ struct session_state *state = ssh->state;
+ u_char type, *cp, macbuf[SSH_DIGEST_MAX_LENGTH];
+ u_char tmp, padlen, pad = 0;
+ u_int authlen = 0, aadlen = 0;
+ u_int len;
+ struct sshenc *enc = NULL;
+ struct sshmac *mac = NULL;
+ struct sshcomp *comp = NULL;
+ int r, block_size;
- if (active_state->newkeys[MODE_OUT] != NULL) {
- enc = &active_state->newkeys[MODE_OUT]->enc;
- mac = &active_state->newkeys[MODE_OUT]->mac;
- comp = &active_state->newkeys[MODE_OUT]->comp;
+ if (state->newkeys[MODE_OUT] != NULL) {
+ enc = &state->newkeys[MODE_OUT]->enc;
+ mac = &state->newkeys[MODE_OUT]->mac;
+ comp = &state->newkeys[MODE_OUT]->comp;
/* disable mac for authenticated encryption */
if ((authlen = cipher_authlen(enc->cipher)) != 0)
mac = NULL;
@@ -871,32 +1198,35 @@
block_size = enc ? enc->block_size : 8;
aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
- cp = buffer_ptr(&active_state->outgoing_packet);
- type = cp[5];
-
+ type = (sshbuf_ptr(state->outgoing_packet))[5];
+ if (ssh_packet_log_type(type))
+ debug3("send packet: type %u", type);
#ifdef PACKET_DEBUG
fprintf(stderr, "plain: ");
- buffer_dump(&active_state->outgoing_packet);
+ sshbuf_dump(state->outgoing_packet, stderr);
#endif
if (comp && comp->enabled) {
- len = buffer_len(&active_state->outgoing_packet);
+ len = sshbuf_len(state->outgoing_packet);
/* skip header, compress only payload */
- buffer_consume(&active_state->outgoing_packet, 5);
- buffer_clear(&active_state->compression_buffer);
- buffer_compress(&active_state->outgoing_packet,
- &active_state->compression_buffer);
- buffer_clear(&active_state->outgoing_packet);
- buffer_append(&active_state->outgoing_packet, "\0\0\0\0\0", 5);
- buffer_append(&active_state->outgoing_packet,
- buffer_ptr(&active_state->compression_buffer),
- buffer_len(&active_state->compression_buffer));
- DBG(debug("compression: raw %d compressed %d", len,
- buffer_len(&active_state->outgoing_packet)));
+ if ((r = sshbuf_consume(state->outgoing_packet, 5)) != 0)
+ goto out;
+ sshbuf_reset(state->compression_buffer);
+ if ((r = compress_buffer(ssh, state->outgoing_packet,
+ state->compression_buffer)) != 0)
+ goto out;
+ sshbuf_reset(state->outgoing_packet);
+ if ((r = sshbuf_put(state->outgoing_packet,
+ "\0\0\0\0\0", 5)) != 0 ||
+ (r = sshbuf_putb(state->outgoing_packet,
+ state->compression_buffer)) != 0)
+ goto out;
+ DBG(debug("compression: raw %d compressed %zd", len,
+ sshbuf_len(state->outgoing_packet)));
}
/* sizeof (packet_len + pad_len + payload) */
- len = buffer_len(&active_state->outgoing_packet);
+ len = sshbuf_len(state->outgoing_packet);
/*
* calc size of padding, alloc space, get random data,
@@ -906,35 +1236,45 @@
padlen = block_size - (len % block_size);
if (padlen < 4)
padlen += block_size;
- if (active_state->extra_pad) {
- /* will wrap if extra_pad+padlen > 255 */
- active_state->extra_pad =
- roundup(active_state->extra_pad, block_size);
- pad = active_state->extra_pad -
- ((len + padlen) % active_state->extra_pad);
- debug3("packet_send2: adding %d (len %d padlen %d extra_pad %d)",
- pad, len, padlen, active_state->extra_pad);
+ if (state->extra_pad) {
+ tmp = state->extra_pad;
+ state->extra_pad =
+ roundup(state->extra_pad, block_size);
+ /* check if roundup overflowed */
+ if (state->extra_pad < tmp)
+ return SSH_ERR_INVALID_ARGUMENT;
+ tmp = (len + padlen) % state->extra_pad;
+ /* Check whether pad calculation below will underflow */
+ if (tmp > state->extra_pad)
+ return SSH_ERR_INVALID_ARGUMENT;
+ pad = state->extra_pad - tmp;
+ DBG(debug3("%s: adding %d (len %d padlen %d extra_pad %d)",
+ __func__, pad, len, padlen, state->extra_pad));
+ tmp = padlen;
padlen += pad;
- active_state->extra_pad = 0;
+ /* Check whether padlen calculation overflowed */
+ if (padlen < tmp)
+ return SSH_ERR_INVALID_ARGUMENT; /* overflow */
+ state->extra_pad = 0;
}
- cp = buffer_append_space(&active_state->outgoing_packet, padlen);
- if (enc && !active_state->send_context.plaintext) {
+ if ((r = sshbuf_reserve(state->outgoing_packet, padlen, &cp)) != 0)
+ goto out;
+ if (enc && !state->send_context.plaintext) {
/* random padding */
- for (i = 0; i < padlen; i++) {
- if (i % 4 == 0)
- rnd = arc4random();
- cp[i] = rnd & 0xff;
- rnd >>= 8;
- }
+ arc4random_buf(cp, padlen);
} else {
/* clear padding */
explicit_bzero(cp, padlen);
}
/* sizeof (packet_len + pad_len + payload + padding) */
- len = buffer_len(&active_state->outgoing_packet);
- cp = buffer_ptr(&active_state->outgoing_packet);
+ len = sshbuf_len(state->outgoing_packet);
+ cp = sshbuf_mutable_ptr(state->outgoing_packet);
+ if (cp == NULL) {
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
+ }
/* packet_length includes payload, padding and padding length field */
- put_u32(cp, len - 4);
+ POKE_U32(cp, len - 4);
cp[4] = padlen;
DBG(debug("send: len %d (includes padlen %d, aadlen %d)",
len, padlen, aadlen));
@@ -941,106 +1281,148 @@
/* compute MAC over seqnr and packet(length fields, payload, padding) */
if (mac && mac->enabled && !mac->etm) {
- macbuf = mac_compute(mac, active_state->p_send.seqnr,
- buffer_ptr(&active_state->outgoing_packet), len);
- DBG(debug("done calc MAC out #%d", active_state->p_send.seqnr));
+ if ((r = mac_compute(mac, state->p_send.seqnr,
+ sshbuf_ptr(state->outgoing_packet), len,
+ macbuf, sizeof(macbuf))) != 0)
+ goto out;
+ DBG(debug("done calc MAC out #%d", state->p_send.seqnr));
}
/* encrypt packet and append to output buffer. */
- cp = buffer_append_space(&active_state->output, len + authlen);
- if (cipher_crypt(&active_state->send_context, active_state->p_send.seqnr,
- cp, buffer_ptr(&active_state->outgoing_packet),
- len - aadlen, aadlen, authlen) != 0)
- fatal("%s: cipher_crypt failed", __func__);
+ if ((r = sshbuf_reserve(state->output,
+ sshbuf_len(state->outgoing_packet) + authlen, &cp)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&state->send_context, state->p_send.seqnr, cp,
+ sshbuf_ptr(state->outgoing_packet),
+ len - aadlen, aadlen, authlen)) != 0)
+ goto out;
/* append unencrypted MAC */
if (mac && mac->enabled) {
if (mac->etm) {
/* EtM: compute mac over aadlen + cipher text */
- macbuf = mac_compute(mac,
- active_state->p_send.seqnr, cp, len);
+ if ((r = mac_compute(mac, state->p_send.seqnr,
+ cp, len, macbuf, sizeof(macbuf))) != 0)
+ goto out;
DBG(debug("done calc MAC(EtM) out #%d",
- active_state->p_send.seqnr));
+ state->p_send.seqnr));
}
- buffer_append(&active_state->output, macbuf, mac->mac_len);
+ if ((r = sshbuf_put(state->output, macbuf, mac->mac_len)) != 0)
+ goto out;
}
#ifdef PACKET_DEBUG
fprintf(stderr, "encrypted: ");
- buffer_dump(&active_state->output);
+ sshbuf_dump(state->output, stderr);
#endif
/* increment sequence number for outgoing packets */
- if (++active_state->p_send.seqnr == 0)
+ if (++state->p_send.seqnr == 0)
logit("outgoing seqnr wraps around");
- if (++active_state->p_send.packets == 0)
- if (!(datafellows & SSH_BUG_NOREKEY))
- fatal("XXX too many packets with same key");
- active_state->p_send.blocks += len / block_size;
- active_state->p_send.bytes += len;
- buffer_clear(&active_state->outgoing_packet);
+ if (++state->p_send.packets == 0)
+ if (!(ssh->compat & SSH_BUG_NOREKEY))
+ return SSH_ERR_NEED_REKEY;
+ state->p_send.blocks += len / block_size;
+ state->p_send.bytes += len;
+ sshbuf_reset(state->outgoing_packet);
if (type == SSH2_MSG_NEWKEYS)
- set_newkeys(MODE_OUT);
- else if (type == SSH2_MSG_USERAUTH_SUCCESS && active_state->server_side)
- packet_enable_delayed_compress();
+ r = ssh_set_newkeys(ssh, MODE_OUT);
+ else if (type == SSH2_MSG_USERAUTH_SUCCESS && state->server_side)
+ r = ssh_packet_enable_delayed_compress(ssh);
+ else
+ r = 0;
+ out:
+ return r;
}
-static void
-packet_send2(void)
+/* returns non-zero if the specified packet type is usec by KEX */
+static int
+ssh_packet_type_is_kex(u_char type)
{
+ return
+ type >= SSH2_MSG_TRANSPORT_MIN &&
+ type <= SSH2_MSG_TRANSPORT_MAX &&
+ type != SSH2_MSG_SERVICE_REQUEST &&
+ type != SSH2_MSG_SERVICE_ACCEPT &&
+ type != SSH2_MSG_EXT_INFO;
+}
+
+int
+ssh_packet_send2(struct ssh *ssh)
+{
+ struct session_state *state = ssh->state;
struct packet *p;
- u_char type, *cp;
+ u_char type;
+ int r, need_rekey;
- cp = buffer_ptr(&active_state->outgoing_packet);
- type = cp[5];
+ if (sshbuf_len(state->outgoing_packet) < 6)
+ return SSH_ERR_INTERNAL_ERROR;
+ type = sshbuf_ptr(state->outgoing_packet)[5];
+ need_rekey = !ssh_packet_type_is_kex(type) &&
+ ssh_packet_need_rekeying(ssh, sshbuf_len(state->outgoing_packet));
- /* during rekeying we can only send key exchange messages */
- if (active_state->rekeying) {
- if ((type < SSH2_MSG_TRANSPORT_MIN) ||
- (type > SSH2_MSG_TRANSPORT_MAX) ||
- (type == SSH2_MSG_SERVICE_REQUEST) ||
- (type == SSH2_MSG_SERVICE_ACCEPT)) {
- debug("enqueue packet: %u", type);
- p = xcalloc(1, sizeof(*p));
- p->type = type;
- memcpy(&p->payload, &active_state->outgoing_packet,
- sizeof(Buffer));
- buffer_init(&active_state->outgoing_packet);
- TAILQ_INSERT_TAIL(&active_state->outgoing, p, next);
- return;
+ /*
+ * During rekeying we can only send key exchange messages.
+ * Queue everything else.
+ */
+ if ((need_rekey || state->rekeying) && !ssh_packet_type_is_kex(type)) {
+ if (need_rekey)
+ debug3("%s: rekex triggered", __func__);
+ debug("enqueue packet: %u", type);
+ p = calloc(1, sizeof(*p));
+ if (p == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ p->type = type;
+ p->payload = state->outgoing_packet;
+ TAILQ_INSERT_TAIL(&state->outgoing, p, next);
+ state->outgoing_packet = sshbuf_new();
+ if (state->outgoing_packet == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (need_rekey) {
+ /*
+ * This packet triggered a rekey, so send the
+ * KEXINIT now.
+ * NB. reenters this function via kex_start_rekex().
+ */
+ return kex_start_rekex(ssh);
}
+ return 0;
}
/* rekeying starts with sending KEXINIT */
if (type == SSH2_MSG_KEXINIT)
- active_state->rekeying = 1;
+ state->rekeying = 1;
- packet_send2_wrapped();
+ if ((r = ssh_packet_send2_wrapped(ssh)) != 0)
+ return r;
/* after a NEWKEYS message we can send the complete queue */
if (type == SSH2_MSG_NEWKEYS) {
- active_state->rekeying = 0;
- active_state->rekey_time = monotime();
- while ((p = TAILQ_FIRST(&active_state->outgoing))) {
+ state->rekeying = 0;
+ state->rekey_time = monotime();
+ while ((p = TAILQ_FIRST(&state->outgoing))) {
type = p->type;
+ /*
+ * If this packet triggers a rekex, then skip the
+ * remaining packets in the queue for now.
+ * NB. re-enters this function via kex_start_rekex.
+ */
+ if (ssh_packet_need_rekeying(ssh,
+ sshbuf_len(p->payload))) {
+ debug3("%s: queued packet triggered rekex",
+ __func__);
+ return kex_start_rekex(ssh);
+ }
debug("dequeue packet: %u", type);
- buffer_free(&active_state->outgoing_packet);
- memcpy(&active_state->outgoing_packet, &p->payload,
- sizeof(Buffer));
- TAILQ_REMOVE(&active_state->outgoing, p, next);
+ sshbuf_free(state->outgoing_packet);
+ state->outgoing_packet = p->payload;
+ TAILQ_REMOVE(&state->outgoing, p, next);
+ memset(p, 0, sizeof(*p));
free(p);
- packet_send2_wrapped();
+ if ((r = ssh_packet_send2_wrapped(ssh)) != 0)
+ return r;
}
}
+ return 0;
}
-void
-packet_send(void)
-{
- if (compat20)
- packet_send2();
- else
- packet_send1();
- DBG(debug("packet_send done"));
-}
-
/*
* Waits until a packet has been received, and returns its type. Note that
* no other data is processed until this returns, so this function should not
@@ -1048,9 +1430,10 @@
*/
int
-packet_read_seqnr(u_int32_t *seqnr_p)
+ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
{
- int type, len, ret, cont, ms_remain = 0;
+ struct session_state *state = ssh->state;
+ int len, r, ms_remain;
fd_set *setp;
char buf[8192];
struct timeval timeout, start, *timeoutp = NULL;
@@ -1057,86 +1440,97 @@
DBG(debug("packet_read()"));
- setp = (fd_set *)xcalloc(howmany(active_state->connection_in + 1,
+ setp = calloc(howmany(state->connection_in + 1,
NFDBITS), sizeof(fd_mask));
+ if (setp == NULL)
+ return SSH_ERR_ALLOC_FAIL;
- /* Since we are blocking, ensure that all written packets have been sent. */
- packet_write_wait();
+ /*
+ * Since we are blocking, ensure that all written packets have
+ * been sent.
+ */
+ if ((r = ssh_packet_write_wait(ssh)) != 0)
+ goto out;
/* Stay in the loop until we have received a complete packet. */
for (;;) {
/* Try to read a packet from the buffer. */
- type = packet_read_poll_seqnr(seqnr_p);
+ r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p);
+ if (r != 0)
+ break;
if (!compat20 && (
- type == SSH_SMSG_SUCCESS
- || type == SSH_SMSG_FAILURE
- || type == SSH_CMSG_EOF
- || type == SSH_CMSG_EXIT_CONFIRMATION))
- packet_check_eom();
+ *typep == SSH_SMSG_SUCCESS
+ || *typep == SSH_SMSG_FAILURE
+ || *typep == SSH_CMSG_EOF
+ || *typep == SSH_CMSG_EXIT_CONFIRMATION))
+ if ((r = sshpkt_get_end(ssh)) != 0)
+ break;
/* If we got a packet, return it. */
- if (type != SSH_MSG_NONE) {
- free(setp);
- return type;
- }
+ if (*typep != SSH_MSG_NONE)
+ break;
/*
* Otherwise, wait for some data to arrive, add it to the
* buffer, and try again.
*/
- memset(setp, 0, howmany(active_state->connection_in + 1,
+ memset(setp, 0, howmany(state->connection_in + 1,
NFDBITS) * sizeof(fd_mask));
- FD_SET(active_state->connection_in, setp);
+ FD_SET(state->connection_in, setp);
- if (active_state->packet_timeout_ms > 0) {
- ms_remain = active_state->packet_timeout_ms;
+ if (state->packet_timeout_ms > 0) {
+ ms_remain = state->packet_timeout_ms;
timeoutp = &timeout;
}
/* Wait for some data to arrive. */
for (;;) {
- if (active_state->packet_timeout_ms != -1) {
+ if (state->packet_timeout_ms != -1) {
ms_to_timeval(&timeout, ms_remain);
gettimeofday(&start, NULL);
}
- if ((ret = select(active_state->connection_in + 1, setp,
+ if ((r = select(state->connection_in + 1, setp,
NULL, NULL, timeoutp)) >= 0)
break;
if (errno != EAGAIN && errno != EINTR &&
errno != EWOULDBLOCK)
break;
- if (active_state->packet_timeout_ms == -1)
+ if (state->packet_timeout_ms == -1)
continue;
ms_subtract_diff(&start, &ms_remain);
if (ms_remain <= 0) {
- ret = 0;
+ r = 0;
break;
}
}
- if (ret == 0) {
- logit("Connection to %.200s timed out while "
- "waiting to read", get_remote_ipaddr());
- cleanup_exit(255);
- }
+ if (r == 0)
+ return SSH_ERR_CONN_TIMEOUT;
/* Read data from the socket. */
- do {
- cont = 0;
- len = roaming_read(active_state->connection_in, buf,
- sizeof(buf), &cont);
- } while (len == 0 && cont);
+ len = read(state->connection_in, buf, sizeof(buf));
if (len == 0) {
- logit("Connection closed by %.200s", get_remote_ipaddr());
- cleanup_exit(255);
+ r = SSH_ERR_CONN_CLOSED;
+ goto out;
}
- if (len < 0)
- fatal("Read from socket failed: %.100s", strerror(errno));
+ if (len < 0) {
+ r = SSH_ERR_SYSTEM_ERROR;
+ goto out;
+ }
+
/* Append it to the buffer. */
- packet_process_incoming(buf, len);
+ if ((r = ssh_packet_process_incoming(ssh, buf, len)) != 0)
+ goto out;
}
- /* NOTREACHED */
+ out:
+ free(setp);
+ return r;
}
int
-packet_read(void)
+ssh_packet_read(struct ssh *ssh)
{
- return packet_read_seqnr(NULL);
+ u_char type;
+ int r;
+
+ if ((r = ssh_packet_read_seqnr(ssh, &type, NULL)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
+ return type;
}
/*
@@ -1144,15 +1538,22 @@
* that given, and gives a fatal error and exits if there is a mismatch.
*/
-void
-packet_read_expect(int expected_type)
+int
+ssh_packet_read_expect(struct ssh *ssh, u_int expected_type)
{
- int type;
+ int r;
+ u_char type;
- type = packet_read();
- if (type != expected_type)
- packet_disconnect("Protocol error: expected packet type %d, got %d",
- expected_type, type);
+ if ((r = ssh_packet_read_seqnr(ssh, &type, NULL)) != 0)
+ return r;
+ if (type != expected_type) {
+ if ((r = sshpkt_disconnect(ssh,
+ "Protocol error: expected packet type %d, got %d",
+ expected_type, type)) != 0)
+ return r;
+ return SSH_ERR_PROTOCOL_ERROR;
+ }
+ return 0;
}
/* Checks if a full packet is available in the data received so far via
@@ -1164,31 +1565,41 @@
* to higher levels.
*/
-static int
-packet_read_poll1(void)
+int
+ssh_packet_read_poll1(struct ssh *ssh, u_char *typep)
{
+ struct session_state *state = ssh->state;
u_int len, padded_len;
- u_char *cp, type;
+ const char *emsg;
+ const u_char *cp;
+ u_char *p;
u_int checksum, stored_checksum;
+ int r;
+ *typep = SSH_MSG_NONE;
+
/* Check if input size is less than minimum packet size. */
- if (buffer_len(&active_state->input) < 4 + 8)
- return SSH_MSG_NONE;
+ if (sshbuf_len(state->input) < 4 + 8)
+ return 0;
/* Get length of incoming packet. */
- cp = buffer_ptr(&active_state->input);
- len = get_u32(cp);
- if (len < 1 + 2 + 2 || len > 256 * 1024)
- packet_disconnect("Bad packet length %u.", len);
+ len = PEEK_U32(sshbuf_ptr(state->input));
+ if (len < 1 + 2 + 2 || len > 256 * 1024) {
+ if ((r = sshpkt_disconnect(ssh, "Bad packet length %u",
+ len)) != 0)
+ return r;
+ return SSH_ERR_CONN_CORRUPT;
+ }
padded_len = (len + 8) & ~7;
/* Check if the packet has been entirely received. */
- if (buffer_len(&active_state->input) < 4 + padded_len)
- return SSH_MSG_NONE;
+ if (sshbuf_len(state->input) < 4 + padded_len)
+ return 0;
/* The entire packet is in buffer. */
/* Consume packet length. */
- buffer_consume(&active_state->input, 4);
+ if ((r = sshbuf_consume(state->input, 4)) != 0)
+ goto out;
/*
* Cryptographic attack detector for ssh
@@ -1195,84 +1606,124 @@
* (C)1998 CORE-SDI, Buenos Aires Argentina
* Ariel Futoransky(futo at core-sdi.com)
*/
- if (!active_state->receive_context.plaintext) {
- switch (detect_attack(buffer_ptr(&active_state->input),
- padded_len)) {
+ if (!state->receive_context.plaintext) {
+ emsg = NULL;
+ switch (detect_attack(&state->deattack,
+ sshbuf_ptr(state->input), padded_len)) {
+ case DEATTACK_OK:
+ break;
case DEATTACK_DETECTED:
- packet_disconnect("crc32 compensation attack: "
- "network attack detected");
+ emsg = "crc32 compensation attack detected";
+ break;
case DEATTACK_DOS_DETECTED:
- packet_disconnect("deattack denial of "
- "service detected");
+ emsg = "deattack denial of service detected";
+ break;
+ default:
+ emsg = "deattack error";
+ break;
}
+ if (emsg != NULL) {
+ error("%s", emsg);
+ if ((r = sshpkt_disconnect(ssh, "%s", emsg)) != 0 ||
+ (r = ssh_packet_write_wait(ssh)) != 0)
+ return r;
+ return SSH_ERR_CONN_CORRUPT;
+ }
}
/* Decrypt data to incoming_packet. */
- buffer_clear(&active_state->incoming_packet);
- cp = buffer_append_space(&active_state->incoming_packet, padded_len);
- if (cipher_crypt(&active_state->receive_context, 0, cp,
- buffer_ptr(&active_state->input), padded_len, 0, 0) != 0)
- fatal("%s: cipher_crypt failed", __func__);
+ sshbuf_reset(state->incoming_packet);
+ if ((r = sshbuf_reserve(state->incoming_packet, padded_len, &p)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&state->receive_context, 0, p,
+ sshbuf_ptr(state->input), padded_len, 0, 0)) != 0)
+ goto out;
- buffer_consume(&active_state->input, padded_len);
+ if ((r = sshbuf_consume(state->input, padded_len)) != 0)
+ goto out;
#ifdef PACKET_DEBUG
fprintf(stderr, "read_poll plain: ");
- buffer_dump(&active_state->incoming_packet);
+ sshbuf_dump(state->incoming_packet, stderr);
#endif
/* Compute packet checksum. */
- checksum = ssh_crc32(buffer_ptr(&active_state->incoming_packet),
- buffer_len(&active_state->incoming_packet) - 4);
+ checksum = ssh_crc32(sshbuf_ptr(state->incoming_packet),
+ sshbuf_len(state->incoming_packet) - 4);
/* Skip padding. */
- buffer_consume(&active_state->incoming_packet, 8 - len % 8);
+ if ((r = sshbuf_consume(state->incoming_packet, 8 - len % 8)) != 0)
+ goto out;
/* Test check bytes. */
- if (len != buffer_len(&active_state->incoming_packet))
- packet_disconnect("packet_read_poll1: len %d != buffer_len %d.",
- len, buffer_len(&active_state->incoming_packet));
+ if (len != sshbuf_len(state->incoming_packet)) {
+ error("%s: len %d != sshbuf_len %zd", __func__,
+ len, sshbuf_len(state->incoming_packet));
+ if ((r = sshpkt_disconnect(ssh, "invalid packet length")) != 0 ||
+ (r = ssh_packet_write_wait(ssh)) != 0)
+ return r;
+ return SSH_ERR_CONN_CORRUPT;
+ }
- cp = (u_char *)buffer_ptr(&active_state->incoming_packet) + len - 4;
- stored_checksum = get_u32(cp);
- if (checksum != stored_checksum)
- packet_disconnect("Corrupted check bytes on input.");
- buffer_consume_end(&active_state->incoming_packet, 4);
+ cp = sshbuf_ptr(state->incoming_packet) + len - 4;
+ stored_checksum = PEEK_U32(cp);
+ if (checksum != stored_checksum) {
+ error("Corrupted check bytes on input");
+ if ((r = sshpkt_disconnect(ssh, "connection corrupted")) != 0 ||
+ (r = ssh_packet_write_wait(ssh)) != 0)
+ return r;
+ return SSH_ERR_CONN_CORRUPT;
+ }
+ if ((r = sshbuf_consume_end(state->incoming_packet, 4)) < 0)
+ goto out;
- if (active_state->packet_compression) {
- buffer_clear(&active_state->compression_buffer);
- buffer_uncompress(&active_state->incoming_packet,
- &active_state->compression_buffer);
- buffer_clear(&active_state->incoming_packet);
- buffer_append(&active_state->incoming_packet,
- buffer_ptr(&active_state->compression_buffer),
- buffer_len(&active_state->compression_buffer));
+ if (state->packet_compression) {
+ sshbuf_reset(state->compression_buffer);
+ if ((r = uncompress_buffer(ssh, state->incoming_packet,
+ state->compression_buffer)) != 0)
+ goto out;
+ sshbuf_reset(state->incoming_packet);
+ if ((r = sshbuf_putb(state->incoming_packet,
+ state->compression_buffer)) != 0)
+ goto out;
}
- active_state->p_read.packets++;
- active_state->p_read.bytes += padded_len + 4;
- type = buffer_get_char(&active_state->incoming_packet);
- if (type < SSH_MSG_MIN || type > SSH_MSG_MAX)
- packet_disconnect("Invalid ssh1 packet type: %d", type);
- return type;
+ state->p_read.packets++;
+ state->p_read.bytes += padded_len + 4;
+ if ((r = sshbuf_get_u8(state->incoming_packet, typep)) != 0)
+ goto out;
+ if (*typep < SSH_MSG_MIN || *typep > SSH_MSG_MAX) {
+ error("Invalid ssh1 packet type: %d", *typep);
+ if ((r = sshpkt_disconnect(ssh, "invalid packet type")) != 0 ||
+ (r = ssh_packet_write_wait(ssh)) != 0)
+ return r;
+ return SSH_ERR_PROTOCOL_ERROR;
+ }
+ r = 0;
+ out:
+ return r;
}
-static int
-packet_read_poll2(u_int32_t *seqnr_p)
+int
+ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
{
+ struct session_state *state = ssh->state;
u_int padlen, need;
- u_char *macbuf = NULL, *cp, type;
- u_int maclen, authlen = 0, aadlen = 0, block_size;
- Enc *enc = NULL;
- Mac *mac = NULL;
- Comp *comp = NULL;
+ u_char *cp;
+ u_int maclen, aadlen = 0, authlen = 0, block_size;
+ struct sshenc *enc = NULL;
+ struct sshmac *mac = NULL;
+ struct sshcomp *comp = NULL;
+ int r;
- if (active_state->packet_discard)
- return SSH_MSG_NONE;
+ *typep = SSH_MSG_NONE;
- if (active_state->newkeys[MODE_IN] != NULL) {
- enc = &active_state->newkeys[MODE_IN]->enc;
- mac = &active_state->newkeys[MODE_IN]->mac;
- comp = &active_state->newkeys[MODE_IN]->comp;
+ if (state->packet_discard)
+ return 0;
+
+ if (state->newkeys[MODE_IN] != NULL) {
+ enc = &state->newkeys[MODE_IN]->enc;
+ mac = &state->newkeys[MODE_IN]->mac;
+ comp = &state->newkeys[MODE_IN]->comp;
/* disable mac for authenticated encryption */
if ((authlen = cipher_authlen(enc->cipher)) != 0)
mac = NULL;
@@ -1281,60 +1732,64 @@
block_size = enc ? enc->block_size : 8;
aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
- if (aadlen && active_state->packlen == 0) {
- if (cipher_get_length(&active_state->receive_context,
- &active_state->packlen,
- active_state->p_read.seqnr,
- buffer_ptr(&active_state->input),
- buffer_len(&active_state->input)) != 0)
- return SSH_MSG_NONE;
- if (active_state->packlen < 1 + 4 ||
- active_state->packlen > PACKET_MAX_SIZE) {
+ if (aadlen && state->packlen == 0) {
+ if (cipher_get_length(&state->receive_context,
+ &state->packlen, state->p_read.seqnr,
+ sshbuf_ptr(state->input), sshbuf_len(state->input)) != 0)
+ return 0;
+ if (state->packlen < 1 + 4 ||
+ state->packlen > PACKET_MAX_SIZE) {
#ifdef PACKET_DEBUG
- buffer_dump(&active_state->input);
+ sshbuf_dump(state->input, stderr);
#endif
- logit("Bad packet length %u.", active_state->packlen);
- packet_disconnect("Packet corrupt");
+ logit("Bad packet length %u.", state->packlen);
+ if ((r = sshpkt_disconnect(ssh, "Packet corrupt")) != 0)
+ return r;
+ return SSH_ERR_CONN_CORRUPT;
}
- buffer_clear(&active_state->incoming_packet);
- } else if (active_state->packlen == 0) {
+ sshbuf_reset(state->incoming_packet);
+ } else if (state->packlen == 0) {
/*
* check if input size is less than the cipher block size,
* decrypt first block and extract length of incoming packet
*/
- if (buffer_len(&active_state->input) < block_size)
- return SSH_MSG_NONE;
- buffer_clear(&active_state->incoming_packet);
- cp = buffer_append_space(&active_state->incoming_packet,
- block_size);
- if (cipher_crypt(&active_state->receive_context,
- active_state->p_read.seqnr, cp,
- buffer_ptr(&active_state->input), block_size, 0, 0) != 0)
- fatal("Decryption integrity check failed");
- cp = buffer_ptr(&active_state->incoming_packet);
- active_state->packlen = get_u32(cp);
- if (active_state->packlen < 1 + 4 ||
- active_state->packlen > PACKET_MAX_SIZE) {
+ if (sshbuf_len(state->input) < block_size)
+ return 0;
+ sshbuf_reset(state->incoming_packet);
+ if ((r = sshbuf_reserve(state->incoming_packet, block_size,
+ &cp)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&state->receive_context,
+ state->p_send.seqnr, cp, sshbuf_ptr(state->input),
+ block_size, 0, 0)) != 0)
+ goto out;
+ state->packlen = PEEK_U32(sshbuf_ptr(state->incoming_packet));
+ if (state->packlen < 1 + 4 ||
+ state->packlen > PACKET_MAX_SIZE) {
#ifdef PACKET_DEBUG
- buffer_dump(&active_state->incoming_packet);
+ fprintf(stderr, "input: \n");
+ sshbuf_dump(state->input, stderr);
+ fprintf(stderr, "incoming_packet: \n");
+ sshbuf_dump(state->incoming_packet, stderr);
#endif
- logit("Bad packet length %u.", active_state->packlen);
- packet_start_discard(enc, mac, active_state->packlen,
+ logit("Bad packet length %u.", state->packlen);
+ return ssh_packet_start_discard(ssh, enc, mac, 0,
PACKET_MAX_SIZE);
- return SSH_MSG_NONE;
}
- buffer_consume(&active_state->input, block_size);
+ if ((r = sshbuf_consume(state->input, block_size)) != 0)
+ goto out;
}
- DBG(debug("input: packet len %u", active_state->packlen+4));
+ DBG(debug("input: packet len %u", state->packlen+4));
+
if (aadlen) {
/* only the payload is encrypted */
- need = active_state->packlen;
+ need = state->packlen;
} else {
/*
* the payload size and the payload are encrypted, but we
* have a partial packet of block_size bytes
*/
- need = 4 + active_state->packlen - block_size;
+ need = 4 + state->packlen - block_size;
}
DBG(debug("partial packet: block %d, need %d, maclen %d, authlen %d,"
" aadlen %d", block_size, need, maclen, authlen, aadlen));
@@ -1341,9 +1796,8 @@
if (need % block_size != 0) {
logit("padding error: need %d block %d mod %d",
need, block_size, need % block_size);
- packet_start_discard(enc, mac, active_state->packlen,
+ return ssh_packet_start_discard(ssh, enc, mac, 0,
PACKET_MAX_SIZE - block_size);
- return SSH_MSG_NONE;
}
/*
* check if the entire packet has been received and
@@ -1353,167 +1807,207 @@
* 'authlen' bytes of authentication tag or
* 'maclen' bytes of message authentication code.
*/
- if (buffer_len(&active_state->input) < aadlen + need + authlen + maclen)
- return SSH_MSG_NONE;
+ if (sshbuf_len(state->input) < aadlen + need + authlen + maclen)
+ return 0; /* packet is incomplete */
#ifdef PACKET_DEBUG
fprintf(stderr, "read_poll enc/full: ");
- buffer_dump(&active_state->input);
+ sshbuf_dump(state->input, stderr);
#endif
- /* EtM: compute mac over encrypted input */
- if (mac && mac->enabled && mac->etm)
- macbuf = mac_compute(mac, active_state->p_read.seqnr,
- buffer_ptr(&active_state->input), aadlen + need);
- cp = buffer_append_space(&active_state->incoming_packet, aadlen + need);
- if (cipher_crypt(&active_state->receive_context,
- active_state->p_read.seqnr, cp,
- buffer_ptr(&active_state->input), need, aadlen, authlen) != 0)
- fatal("Decryption integrity check failed");
- buffer_consume(&active_state->input, aadlen + need + authlen);
- /*
- * compute MAC over seqnr and packet,
- * increment sequence number for incoming packet
- */
+ /* EtM: check mac over encrypted input */
+ if (mac && mac->enabled && mac->etm) {
+ if ((r = mac_check(mac, state->p_read.seqnr,
+ sshbuf_ptr(state->input), aadlen + need,
+ sshbuf_ptr(state->input) + aadlen + need + authlen,
+ maclen)) != 0) {
+ if (r == SSH_ERR_MAC_INVALID)
+ logit("Corrupted MAC on input.");
+ goto out;
+ }
+ }
+ if ((r = sshbuf_reserve(state->incoming_packet, aadlen + need,
+ &cp)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&state->receive_context, state->p_read.seqnr, cp,
+ sshbuf_ptr(state->input), need, aadlen, authlen)) != 0)
+ goto out;
+ if ((r = sshbuf_consume(state->input, aadlen + need + authlen)) != 0)
+ goto out;
if (mac && mac->enabled) {
- if (!mac->etm)
- macbuf = mac_compute(mac, active_state->p_read.seqnr,
- buffer_ptr(&active_state->incoming_packet),
- buffer_len(&active_state->incoming_packet));
- if (timingsafe_bcmp(macbuf, buffer_ptr(&active_state->input),
- mac->mac_len) != 0) {
+ /* Not EtM: check MAC over cleartext */
+ if (!mac->etm && (r = mac_check(mac, state->p_read.seqnr,
+ sshbuf_ptr(state->incoming_packet),
+ sshbuf_len(state->incoming_packet),
+ sshbuf_ptr(state->input), maclen)) != 0) {
+ if (r != SSH_ERR_MAC_INVALID)
+ goto out;
logit("Corrupted MAC on input.");
if (need > PACKET_MAX_SIZE)
- fatal("internal error need %d", need);
- packet_start_discard(enc, mac, active_state->packlen,
+ return SSH_ERR_INTERNAL_ERROR;
+ return ssh_packet_start_discard(ssh, enc, mac,
+ sshbuf_len(state->incoming_packet),
PACKET_MAX_SIZE - need);
- return SSH_MSG_NONE;
}
-
- DBG(debug("MAC #%d ok", active_state->p_read.seqnr));
- buffer_consume(&active_state->input, mac->mac_len);
+ /* Remove MAC from input buffer */
+ DBG(debug("MAC #%d ok", state->p_read.seqnr));
+ if ((r = sshbuf_consume(state->input, mac->mac_len)) != 0)
+ goto out;
}
- /* XXX now it's safe to use fatal/packet_disconnect */
if (seqnr_p != NULL)
- *seqnr_p = active_state->p_read.seqnr;
- if (++active_state->p_read.seqnr == 0)
+ *seqnr_p = state->p_read.seqnr;
+ if (++state->p_read.seqnr == 0)
logit("incoming seqnr wraps around");
- if (++active_state->p_read.packets == 0)
- if (!(datafellows & SSH_BUG_NOREKEY))
- fatal("XXX too many packets with same key");
- active_state->p_read.blocks += (active_state->packlen + 4) / block_size;
- active_state->p_read.bytes += active_state->packlen + 4;
+ if (++state->p_read.packets == 0)
+ if (!(ssh->compat & SSH_BUG_NOREKEY))
+ return SSH_ERR_NEED_REKEY;
+ state->p_read.blocks += (state->packlen + 4) / block_size;
+ state->p_read.bytes += state->packlen + 4;
/* get padlen */
- cp = buffer_ptr(&active_state->incoming_packet);
- padlen = cp[4];
+ padlen = sshbuf_ptr(state->incoming_packet)[4];
DBG(debug("input: padlen %d", padlen));
- if (padlen < 4)
- packet_disconnect("Corrupted padlen %d on input.", padlen);
+ if (padlen < 4) {
+ if ((r = sshpkt_disconnect(ssh,
+ "Corrupted padlen %d on input.", padlen)) != 0 ||
+ (r = ssh_packet_write_wait(ssh)) != 0)
+ return r;
+ return SSH_ERR_CONN_CORRUPT;
+ }
/* skip packet size + padlen, discard padding */
- buffer_consume(&active_state->incoming_packet, 4 + 1);
- buffer_consume_end(&active_state->incoming_packet, padlen);
+ if ((r = sshbuf_consume(state->incoming_packet, 4 + 1)) != 0 ||
+ ((r = sshbuf_consume_end(state->incoming_packet, padlen)) != 0))
+ goto out;
- DBG(debug("input: len before de-compress %d",
- buffer_len(&active_state->incoming_packet)));
+ DBG(debug("input: len before de-compress %zd",
+ sshbuf_len(state->incoming_packet)));
if (comp && comp->enabled) {
- buffer_clear(&active_state->compression_buffer);
- buffer_uncompress(&active_state->incoming_packet,
- &active_state->compression_buffer);
- buffer_clear(&active_state->incoming_packet);
- buffer_append(&active_state->incoming_packet,
- buffer_ptr(&active_state->compression_buffer),
- buffer_len(&active_state->compression_buffer));
- DBG(debug("input: len after de-compress %d",
- buffer_len(&active_state->incoming_packet)));
+ sshbuf_reset(state->compression_buffer);
+ if ((r = uncompress_buffer(ssh, state->incoming_packet,
+ state->compression_buffer)) != 0)
+ goto out;
+ sshbuf_reset(state->incoming_packet);
+ if ((r = sshbuf_putb(state->incoming_packet,
+ state->compression_buffer)) != 0)
+ goto out;
+ DBG(debug("input: len after de-compress %zd",
+ sshbuf_len(state->incoming_packet)));
}
/*
* get packet type, implies consume.
* return length of payload (without type field)
*/
- type = buffer_get_char(&active_state->incoming_packet);
- if (type < SSH2_MSG_MIN || type >= SSH2_MSG_LOCAL_MIN)
- packet_disconnect("Invalid ssh2 packet type: %d", type);
- if (type == SSH2_MSG_NEWKEYS)
- set_newkeys(MODE_IN);
- else if (type == SSH2_MSG_USERAUTH_SUCCESS &&
- !active_state->server_side)
- packet_enable_delayed_compress();
+ if ((r = sshbuf_get_u8(state->incoming_packet, typep)) != 0)
+ goto out;
+ if (ssh_packet_log_type(*typep))
+ debug3("receive packet: type %u", *typep);
+ if (*typep < SSH2_MSG_MIN || *typep >= SSH2_MSG_LOCAL_MIN) {
+ if ((r = sshpkt_disconnect(ssh,
+ "Invalid ssh2 packet type: %d", *typep)) != 0 ||
+ (r = ssh_packet_write_wait(ssh)) != 0)
+ return r;
+ return SSH_ERR_PROTOCOL_ERROR;
+ }
+ if (*typep == SSH2_MSG_NEWKEYS)
+ r = ssh_set_newkeys(ssh, MODE_IN);
+ else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
+ r = ssh_packet_enable_delayed_compress(ssh);
+ else
+ r = 0;
#ifdef PACKET_DEBUG
- fprintf(stderr, "read/plain[%d]:\r\n", type);
- buffer_dump(&active_state->incoming_packet);
+ fprintf(stderr, "read/plain[%d]:\r\n", *typep);
+ sshbuf_dump(state->incoming_packet, stderr);
#endif
/* reset for next packet */
- active_state->packlen = 0;
- return type;
+ state->packlen = 0;
+
+ /* do we need to rekey? */
+ if (ssh_packet_need_rekeying(ssh, 0)) {
+ debug3("%s: rekex triggered", __func__);
+ if ((r = kex_start_rekex(ssh)) != 0)
+ return r;
+ }
+ out:
+ return r;
}
int
-packet_read_poll_seqnr(u_int32_t *seqnr_p)
+ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
{
+ struct session_state *state = ssh->state;
u_int reason, seqnr;
- u_char type;
- char *msg;
+ int r;
+ u_char *msg;
for (;;) {
+ msg = NULL;
if (compat20) {
- type = packet_read_poll2(seqnr_p);
- if (type) {
- active_state->keep_alive_timeouts = 0;
- DBG(debug("received packet type %d", type));
+ r = ssh_packet_read_poll2(ssh, typep, seqnr_p);
+ if (r != 0)
+ return r;
+ if (*typep) {
+ state->keep_alive_timeouts = 0;
+ DBG(debug("received packet type %d", *typep));
}
- switch (type) {
+ switch (*typep) {
case SSH2_MSG_IGNORE:
debug3("Received SSH2_MSG_IGNORE");
break;
case SSH2_MSG_DEBUG:
- packet_get_char();
- msg = packet_get_string(NULL);
+ if ((r = sshpkt_get_u8(ssh, NULL)) != 0 ||
+ (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
+ (r = sshpkt_get_string(ssh, NULL, NULL)) != 0) {
+ free(msg);
+ return r;
+ }
debug("Remote: %.900s", msg);
free(msg);
- msg = packet_get_string(NULL);
- free(msg);
break;
case SSH2_MSG_DISCONNECT:
- reason = packet_get_int();
- msg = packet_get_string(NULL);
+ if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
+ (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
+ return r;
/* Ignore normal client exit notifications */
- do_log2(active_state->server_side &&
+ do_log2(ssh->state->server_side &&
reason == SSH2_DISCONNECT_BY_APPLICATION ?
SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
- "Received disconnect from %s: %u: %.400s",
- get_remote_ipaddr(), reason, msg);
+ "Received disconnect from %s port %d:"
+ "%u: %.400s", ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh), reason, msg);
free(msg);
- cleanup_exit(255);
- break;
+ return SSH_ERR_DISCONNECTED;
case SSH2_MSG_UNIMPLEMENTED:
- seqnr = packet_get_int();
+ if ((r = sshpkt_get_u32(ssh, &seqnr)) != 0)
+ return r;
debug("Received SSH2_MSG_UNIMPLEMENTED for %u",
seqnr);
break;
default:
- return type;
+ return 0;
}
} else {
- type = packet_read_poll1();
- switch (type) {
+ r = ssh_packet_read_poll1(ssh, typep);
+ switch (*typep) {
case SSH_MSG_NONE:
return SSH_MSG_NONE;
case SSH_MSG_IGNORE:
break;
case SSH_MSG_DEBUG:
- msg = packet_get_string(NULL);
+ if ((r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
+ return r;
debug("Remote: %.900s", msg);
free(msg);
break;
case SSH_MSG_DISCONNECT:
- msg = packet_get_string(NULL);
- error("Received disconnect from %s: %.400s",
- get_remote_ipaddr(), msg);
- cleanup_exit(255);
- break;
+ if ((r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
+ return r;
+ error("Received disconnect from %s port %d: "
+ "%.400s", ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh), msg);
+ free(msg);
+ return SSH_ERR_DISCONNECTED;
default:
- DBG(debug("received packet type %d", type));
- return type;
+ DBG(debug("received packet type %d", *typep));
+ return 0;
}
}
}
@@ -1524,129 +2018,49 @@
* together with packet_read_poll.
*/
-void
-packet_process_incoming(const char *buf, u_int len)
+int
+ssh_packet_process_incoming(struct ssh *ssh, const char *buf, u_int len)
{
- if (active_state->packet_discard) {
- active_state->keep_alive_timeouts = 0; /* ?? */
- if (len >= active_state->packet_discard)
- packet_stop_discard();
- active_state->packet_discard -= len;
- return;
+ struct session_state *state = ssh->state;
+ int r;
+
+ if (state->packet_discard) {
+ state->keep_alive_timeouts = 0; /* ?? */
+ if (len >= state->packet_discard) {
+ if ((r = ssh_packet_stop_discard(ssh)) != 0)
+ return r;
+ }
+ state->packet_discard -= len;
+ return 0;
}
- buffer_append(&active_state->input, buf, len);
-}
+ if ((r = sshbuf_put(ssh->state->input, buf, len)) != 0)
+ return r;
-/* Returns a character from the packet. */
-
-u_int
-packet_get_char(void)
-{
- char ch;
-
- buffer_get(&active_state->incoming_packet, &ch, 1);
- return (u_char) ch;
+ return 0;
}
-/* Returns an integer from the packet data. */
-
-u_int
-packet_get_int(void)
-{
- return buffer_get_int(&active_state->incoming_packet);
-}
-
-/* Returns an 64 bit integer from the packet data. */
-
-u_int64_t
-packet_get_int64(void)
-{
- return buffer_get_int64(&active_state->incoming_packet);
-}
-
-/*
- * Returns an arbitrary precision integer from the packet data. The integer
- * must have been initialized before this call.
- */
-
-void
-packet_get_bignum(BIGNUM * value)
-{
- buffer_get_bignum(&active_state->incoming_packet, value);
-}
-
-void
-packet_get_bignum2(BIGNUM * value)
-{
- buffer_get_bignum2(&active_state->incoming_packet, value);
-}
-
-#ifdef OPENSSL_HAS_ECC
-void
-packet_get_ecpoint(const EC_GROUP *curve, EC_POINT *point)
-{
- buffer_get_ecpoint(&active_state->incoming_packet, curve, point);
-}
-#endif
-
-void *
-packet_get_raw(u_int *length_ptr)
-{
- u_int bytes = buffer_len(&active_state->incoming_packet);
-
- if (length_ptr != NULL)
- *length_ptr = bytes;
- return buffer_ptr(&active_state->incoming_packet);
-}
-
int
-packet_remaining(void)
+ssh_packet_remaining(struct ssh *ssh)
{
- return buffer_len(&active_state->incoming_packet);
+ return sshbuf_len(ssh->state->incoming_packet);
}
/*
- * Returns a string from the packet data. The string is allocated using
- * xmalloc; it is the responsibility of the calling program to free it when
- * no longer needed. The length_ptr argument may be NULL, or point to an
- * integer into which the length of the string is stored.
- */
-
-void *
-packet_get_string(u_int *length_ptr)
-{
- return buffer_get_string(&active_state->incoming_packet, length_ptr);
-}
-
-void *
-packet_get_string_ptr(u_int *length_ptr)
-{
- return buffer_get_string_ptr(&active_state->incoming_packet, length_ptr);
-}
-
-/* Ensures the returned string has no embedded \0 characters in it. */
-char *
-packet_get_cstring(u_int *length_ptr)
-{
- return buffer_get_cstring(&active_state->incoming_packet, length_ptr);
-}
-
-/*
* Sends a diagnostic message from the server to the client. This message
* can be sent at any time (but not while constructing another message). The
* message is printed immediately, but only if the client is being executed
* in verbose mode. These messages are primarily intended to ease debugging
* authentication problems. The length of the formatted message must not
- * exceed 1024 bytes. This will automatically call packet_write_wait.
+ * exceed 1024 bytes. This will automatically call ssh_packet_write_wait.
*/
-
void
-packet_send_debug(const char *fmt,...)
+ssh_packet_send_debug(struct ssh *ssh, const char *fmt,...)
{
char buf[1024];
va_list args;
+ int r;
- if (compat20 && (datafellows & SSH_BUG_DEBUG))
+ if (compat20 && (ssh->compat & SSH_BUG_DEBUG))
return;
va_start(args, fmt);
@@ -1654,31 +2068,77 @@
va_end(args);
if (compat20) {
- packet_start(SSH2_MSG_DEBUG);
- packet_put_char(0); /* bool: always display */
- packet_put_cstring(buf);
- packet_put_cstring("");
+ if ((r = sshpkt_start(ssh, SSH2_MSG_DEBUG)) != 0 ||
+ (r = sshpkt_put_u8(ssh, 0)) != 0 || /* always display */
+ (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, "")) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
} else {
- packet_start(SSH_MSG_DEBUG);
- packet_put_cstring(buf);
+ if ((r = sshpkt_start(ssh, SSH_MSG_DEBUG)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
}
- packet_send();
- packet_write_wait();
+ if ((r = ssh_packet_write_wait(ssh)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
}
/*
+ * Pretty-print connection-terminating errors and exit.
+ */
+void
+sshpkt_fatal(struct ssh *ssh, const char *tag, int r)
+{
+ switch (r) {
+ case SSH_ERR_CONN_CLOSED:
+ logdie("Connection closed by %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ case SSH_ERR_CONN_TIMEOUT:
+ logdie("Connection %s %.200s port %d timed out",
+ ssh->state->server_side ? "from" : "to",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ case SSH_ERR_DISCONNECTED:
+ logdie("Disconnected from %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ case SSH_ERR_SYSTEM_ERROR:
+ if (errno == ECONNRESET)
+ logdie("Connection reset by %.200s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ /* FALLTHROUGH */
+ case SSH_ERR_NO_CIPHER_ALG_MATCH:
+ case SSH_ERR_NO_MAC_ALG_MATCH:
+ case SSH_ERR_NO_COMPRESS_ALG_MATCH:
+ case SSH_ERR_NO_KEX_ALG_MATCH:
+ case SSH_ERR_NO_HOSTKEY_ALG_MATCH:
+ if (ssh && ssh->kex && ssh->kex->failed_choice) {
+ logdie("Unable to negotiate with %.200s port %d: %s. "
+ "Their offer: %s", ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh), ssh_err(r),
+ ssh->kex->failed_choice);
+ }
+ /* FALLTHROUGH */
+ default:
+ logdie("%s%sConnection %s %.200s port %d: %s",
+ tag != NULL ? tag : "", tag != NULL ? ": " : "",
+ ssh->state->server_side ? "from" : "to",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), ssh_err(r));
+ }
+}
+
+/*
* Logs the error plus constructs and sends a disconnect packet, closes the
* connection, and exits. This function never returns. The error message
* should not contain a newline. The length of the formatted message must
* not exceed 1024 bytes.
*/
-
void
-packet_disconnect(const char *fmt,...)
+ssh_packet_disconnect(struct ssh *ssh, const char *fmt,...)
{
char buf[1024];
va_list args;
static int disconnecting = 0;
+ int r;
if (disconnecting) /* Guard against recursive invocations. */
fatal("packet_disconnect called recursively.");
@@ -1695,49 +2155,47 @@
/* Display the error locally */
logit("Disconnecting: %.100s", buf);
- /* Send the disconnect message to the other side, and wait for it to get sent. */
- if (compat20) {
- packet_start(SSH2_MSG_DISCONNECT);
- packet_put_int(SSH2_DISCONNECT_PROTOCOL_ERROR);
- packet_put_cstring(buf);
- packet_put_cstring("");
- } else {
- packet_start(SSH_MSG_DISCONNECT);
- packet_put_cstring(buf);
- }
- packet_send();
- packet_write_wait();
+ /*
+ * Send the disconnect message to the other side, and wait
+ * for it to get sent.
+ */
+ if ((r = sshpkt_disconnect(ssh, "%s", buf)) != 0)
+ sshpkt_fatal(ssh, __func__, r);
- /* Stop listening for connections. */
- channel_close_all();
+ if ((r = ssh_packet_write_wait(ssh)) != 0)
+ sshpkt_fatal(ssh, __func__, r);
/* Close the connection. */
- packet_close();
+ ssh_packet_close(ssh);
cleanup_exit(255);
}
-/* Checks if there is any buffered output, and tries to write some of the output. */
-
-void
-packet_write_poll(void)
+/*
+ * Checks if there is any buffered output, and tries to write some of
+ * the output.
+ */
+int
+ssh_packet_write_poll(struct ssh *ssh)
{
- int len = buffer_len(&active_state->output);
- int cont;
+ struct session_state *state = ssh->state;
+ int len = sshbuf_len(state->output);
+ int r;
if (len > 0) {
- cont = 0;
- len = roaming_write(active_state->connection_out,
- buffer_ptr(&active_state->output), len, &cont);
+ len = write(state->connection_out,
+ sshbuf_ptr(state->output), len);
if (len == -1) {
if (errno == EINTR || errno == EAGAIN ||
errno == EWOULDBLOCK)
- return;
- fatal("Write failed: %.100s", strerror(errno));
+ return 0;
+ return SSH_ERR_SYSTEM_ERROR;
}
- if (len == 0 && !cont)
- fatal("Write connection closed");
- buffer_consume(&active_state->output, len);
+ if (len == 0)
+ return SSH_ERR_CONN_CLOSED;
+ if ((r = sshbuf_consume(state->output, len)) != 0)
+ return r;
}
+ return 0;
}
/*
@@ -1744,38 +2202,43 @@
* Calls packet_write_poll repeatedly until all pending output data has been
* written.
*/
-
-void
-packet_write_wait(void)
+int
+ssh_packet_write_wait(struct ssh *ssh)
{
fd_set *setp;
- int ret, ms_remain = 0;
+ int ret, r, ms_remain = 0;
struct timeval start, timeout, *timeoutp = NULL;
+ struct session_state *state = ssh->state;
- setp = (fd_set *)xcalloc(howmany(active_state->connection_out + 1,
+ setp = calloc(howmany(state->connection_out + 1,
NFDBITS), sizeof(fd_mask));
- packet_write_poll();
- while (packet_have_data_to_write()) {
- memset(setp, 0, howmany(active_state->connection_out + 1,
+ if (setp == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = ssh_packet_write_poll(ssh)) != 0) {
+ free(setp);
+ return r;
+ }
+ while (ssh_packet_have_data_to_write(ssh)) {
+ memset(setp, 0, howmany(state->connection_out + 1,
NFDBITS) * sizeof(fd_mask));
- FD_SET(active_state->connection_out, setp);
+ FD_SET(state->connection_out, setp);
- if (active_state->packet_timeout_ms > 0) {
- ms_remain = active_state->packet_timeout_ms;
+ if (state->packet_timeout_ms > 0) {
+ ms_remain = state->packet_timeout_ms;
timeoutp = &timeout;
}
for (;;) {
- if (active_state->packet_timeout_ms != -1) {
+ if (state->packet_timeout_ms != -1) {
ms_to_timeval(&timeout, ms_remain);
gettimeofday(&start, NULL);
}
- if ((ret = select(active_state->connection_out + 1,
+ if ((ret = select(state->connection_out + 1,
NULL, setp, NULL, timeoutp)) >= 0)
break;
if (errno != EAGAIN && errno != EINTR &&
errno != EWOULDBLOCK)
break;
- if (active_state->packet_timeout_ms == -1)
+ if (state->packet_timeout_ms == -1)
continue;
ms_subtract_diff(&start, &ms_remain);
if (ms_remain <= 0) {
@@ -1784,45 +2247,48 @@
}
}
if (ret == 0) {
- logit("Connection to %.200s timed out while "
- "waiting to write", get_remote_ipaddr());
- cleanup_exit(255);
+ free(setp);
+ return SSH_ERR_CONN_TIMEOUT;
}
- packet_write_poll();
+ if ((r = ssh_packet_write_poll(ssh)) != 0) {
+ free(setp);
+ return r;
+ }
}
free(setp);
+ return 0;
}
/* Returns true if there is buffered data to write to the connection. */
int
-packet_have_data_to_write(void)
+ssh_packet_have_data_to_write(struct ssh *ssh)
{
- return buffer_len(&active_state->output) != 0;
+ return sshbuf_len(ssh->state->output) != 0;
}
/* Returns true if there is not too much data to write to the connection. */
int
-packet_not_very_much_data_to_write(void)
+ssh_packet_not_very_much_data_to_write(struct ssh *ssh)
{
- if (active_state->interactive_mode)
- return buffer_len(&active_state->output) < 16384;
+ if (ssh->state->interactive_mode)
+ return sshbuf_len(ssh->state->output) < 16384;
else
- return buffer_len(&active_state->output) < 128 * 1024;
+ return sshbuf_len(ssh->state->output) < 128 * 1024;
}
-static void
-packet_set_tos(int tos)
+void
+ssh_packet_set_tos(struct ssh *ssh, int tos)
{
#ifndef IP_TOS_IS_BROKEN
- if (!packet_connection_is_on_socket())
+ if (!ssh_packet_connection_is_on_socket(ssh))
return;
- switch (packet_connection_af()) {
+ switch (ssh_packet_connection_af(ssh)) {
# ifdef IP_TOS
case AF_INET:
debug3("%s: set IP_TOS 0x%02x", __func__, tos);
- if (setsockopt(active_state->connection_in,
+ if (setsockopt(ssh->state->connection_in,
IPPROTO_IP, IP_TOS, &tos, sizeof(tos)) < 0)
error("setsockopt IP_TOS %d: %.100s:",
tos, strerror(errno));
@@ -1831,7 +2297,7 @@
# ifdef IPV6_TCLASS
case AF_INET6:
debug3("%s: set IPV6_TCLASS 0x%02x", __func__, tos);
- if (setsockopt(active_state->connection_in,
+ if (setsockopt(ssh->state->connection_in,
IPPROTO_IPV6, IPV6_TCLASS, &tos, sizeof(tos)) < 0)
error("setsockopt IPV6_TCLASS %d: %.100s:",
tos, strerror(errno));
@@ -1844,36 +2310,41 @@
/* Informs that the current session is interactive. Sets IP flags for that. */
void
-packet_set_interactive(int interactive, int qos_interactive, int qos_bulk)
+ssh_packet_set_interactive(struct ssh *ssh, int interactive, int qos_interactive, int qos_bulk)
{
- if (active_state->set_interactive_called)
+ struct session_state *state = ssh->state;
+
+ if (state->set_interactive_called)
return;
- active_state->set_interactive_called = 1;
+ state->set_interactive_called = 1;
/* Record that we are in interactive mode. */
- active_state->interactive_mode = interactive;
+ state->interactive_mode = interactive;
/* Only set socket options if using a socket. */
- if (!packet_connection_is_on_socket())
+ if (!ssh_packet_connection_is_on_socket(ssh))
return;
- set_nodelay(active_state->connection_in);
- packet_set_tos(interactive ? qos_interactive : qos_bulk);
+ set_nodelay(state->connection_in);
+ ssh_packet_set_tos(ssh, interactive ? qos_interactive :
+ qos_bulk);
}
/* Returns true if the current connection is interactive. */
int
-packet_is_interactive(void)
+ssh_packet_is_interactive(struct ssh *ssh)
{
- return active_state->interactive_mode;
+ return ssh->state->interactive_mode;
}
int
-packet_set_maxsize(u_int s)
+ssh_packet_set_maxsize(struct ssh *ssh, u_int s)
{
- if (active_state->set_maxsize_called) {
+ struct session_state *state = ssh->state;
+
+ if (state->set_maxsize_called) {
logit("packet_set_maxsize: called twice: old %d new %d",
- active_state->max_packet_size, s);
+ state->max_packet_size, s);
return -1;
}
if (s < 4 * 1024 || s > 1024 * 1024) {
@@ -1880,37 +2351,30 @@
logit("packet_set_maxsize: bad size %d", s);
return -1;
}
- active_state->set_maxsize_called = 1;
+ state->set_maxsize_called = 1;
debug("packet_set_maxsize: setting to %d", s);
- active_state->max_packet_size = s;
+ state->max_packet_size = s;
return s;
}
int
-packet_inc_alive_timeouts(void)
+ssh_packet_inc_alive_timeouts(struct ssh *ssh)
{
- return ++active_state->keep_alive_timeouts;
+ return ++ssh->state->keep_alive_timeouts;
}
void
-packet_set_alive_timeouts(int ka)
+ssh_packet_set_alive_timeouts(struct ssh *ssh, int ka)
{
- active_state->keep_alive_timeouts = ka;
+ ssh->state->keep_alive_timeouts = ka;
}
u_int
-packet_get_maxsize(void)
+ssh_packet_get_maxsize(struct ssh *ssh)
{
- return active_state->max_packet_size;
+ return ssh->state->max_packet_size;
}
-/* roundup current message to pad bytes */
-void
-packet_add_padding(u_char pad)
-{
- active_state->extra_pad = pad;
-}
-
/*
* 9.2. Ignored Data Message
*
@@ -1923,135 +2387,630 @@
* protection measure against advanced traffic analysis techniques.
*/
void
-packet_send_ignore(int nbytes)
+ssh_packet_send_ignore(struct ssh *ssh, int nbytes)
{
u_int32_t rnd = 0;
- int i;
+ int r, i;
- packet_start(compat20 ? SSH2_MSG_IGNORE : SSH_MSG_IGNORE);
- packet_put_int(nbytes);
+ if ((r = sshpkt_start(ssh, compat20 ?
+ SSH2_MSG_IGNORE : SSH_MSG_IGNORE)) != 0 ||
+ (r = sshpkt_put_u32(ssh, nbytes)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
for (i = 0; i < nbytes; i++) {
if (i % 4 == 0)
rnd = arc4random();
- packet_put_char((u_char)rnd & 0xff);
+ if ((r = sshpkt_put_u8(ssh, (u_char)rnd & 0xff)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
rnd >>= 8;
}
}
-#define MAX_PACKETS (1U<<31)
-int
-packet_need_rekeying(void)
-{
- if (datafellows & SSH_BUG_NOREKEY)
- return 0;
- return
- (active_state->p_send.packets > MAX_PACKETS) ||
- (active_state->p_read.packets > MAX_PACKETS) ||
- (active_state->max_blocks_out &&
- (active_state->p_send.blocks > active_state->max_blocks_out)) ||
- (active_state->max_blocks_in &&
- (active_state->p_read.blocks > active_state->max_blocks_in)) ||
- (active_state->rekey_interval != 0 && active_state->rekey_time +
- active_state->rekey_interval <= monotime());
-}
-
void
-packet_set_rekey_limits(u_int32_t bytes, time_t seconds)
+ssh_packet_set_rekey_limits(struct ssh *ssh, u_int64_t bytes, time_t seconds)
{
- debug3("rekey after %lld bytes, %d seconds", (long long)bytes,
+ debug3("rekey after %llu bytes, %d seconds", (unsigned long long)bytes,
(int)seconds);
- active_state->rekey_limit = bytes;
- active_state->rekey_interval = seconds;
- /*
- * We set the time here so that in post-auth privsep slave we count
- * from the completion of the authentication.
- */
- active_state->rekey_time = monotime();
+ ssh->state->rekey_limit = bytes;
+ ssh->state->rekey_interval = seconds;
}
time_t
-packet_get_rekey_timeout(void)
+ssh_packet_get_rekey_timeout(struct ssh *ssh)
{
time_t seconds;
- seconds = active_state->rekey_time + active_state->rekey_interval -
+ seconds = ssh->state->rekey_time + ssh->state->rekey_interval -
monotime();
return (seconds <= 0 ? 1 : seconds);
}
void
-packet_set_server(void)
+ssh_packet_set_server(struct ssh *ssh)
{
- active_state->server_side = 1;
+ ssh->state->server_side = 1;
}
void
-packet_set_authenticated(void)
+ssh_packet_set_authenticated(struct ssh *ssh)
{
- active_state->after_authentication = 1;
+ ssh->state->after_authentication = 1;
}
void *
-packet_get_input(void)
+ssh_packet_get_input(struct ssh *ssh)
{
- return (void *)&active_state->input;
+ return (void *)ssh->state->input;
}
void *
-packet_get_output(void)
+ssh_packet_get_output(struct ssh *ssh)
{
- return (void *)&active_state->output;
+ return (void *)ssh->state->output;
}
-void *
-packet_get_newkeys(int mode)
+/* Reset after_authentication and reset compression in post-auth privsep */
+static int
+ssh_packet_set_postauth(struct ssh *ssh)
{
- return (void *)active_state->newkeys[mode];
+ struct sshcomp *comp;
+ int r, mode;
+
+ debug("%s: called", __func__);
+ /* This was set in net child, but is not visible in user child */
+ ssh->state->after_authentication = 1;
+ ssh->state->rekeying = 0;
+ for (mode = 0; mode < MODE_MAX; mode++) {
+ if (ssh->state->newkeys[mode] == NULL)
+ continue;
+ comp = &ssh->state->newkeys[mode]->comp;
+ if (comp && comp->enabled &&
+ (r = ssh_packet_init_compression(ssh)) != 0)
+ return r;
+ }
+ return 0;
}
+/* Packet state (de-)serialization for privsep */
+
+/* turn kex into a blob for packet state serialization */
+static int
+kex_to_blob(struct sshbuf *m, struct kex *kex)
+{
+ int r;
+
+ if ((r = sshbuf_put_string(m, kex->session_id,
+ kex->session_id_len)) != 0 ||
+ (r = sshbuf_put_u32(m, kex->we_need)) != 0 ||
+ (r = sshbuf_put_u32(m, kex->hostkey_type)) != 0 ||
+ (r = sshbuf_put_u32(m, kex->kex_type)) != 0 ||
+ (r = sshbuf_put_stringb(m, kex->my)) != 0 ||
+ (r = sshbuf_put_stringb(m, kex->peer)) != 0 ||
+ (r = sshbuf_put_u32(m, kex->flags)) != 0 ||
+ (r = sshbuf_put_cstring(m, kex->client_version_string)) != 0 ||
+ (r = sshbuf_put_cstring(m, kex->server_version_string)) != 0)
+ return r;
+ return 0;
+}
+
+/* turn key exchange results into a blob for packet state serialization */
+static int
+newkeys_to_blob(struct sshbuf *m, struct ssh *ssh, int mode)
+{
+ struct sshbuf *b;
+ struct sshcipher_ctx *cc;
+ struct sshcomp *comp;
+ struct sshenc *enc;
+ struct sshmac *mac;
+ struct newkeys *newkey;
+ int r;
+
+ if ((newkey = ssh->state->newkeys[mode]) == NULL)
+ return SSH_ERR_INTERNAL_ERROR;
+ enc = &newkey->enc;
+ mac = &newkey->mac;
+ comp = &newkey->comp;
+ cc = (mode == MODE_OUT) ? &ssh->state->send_context :
+ &ssh->state->receive_context;
+ if ((r = cipher_get_keyiv(cc, enc->iv, enc->iv_len)) != 0)
+ return r;
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ /* The cipher struct is constant and shared, you export pointer */
+ if ((r = sshbuf_put_cstring(b, enc->name)) != 0 ||
+ (r = sshbuf_put(b, &enc->cipher, sizeof(enc->cipher))) != 0 ||
+ (r = sshbuf_put_u32(b, enc->enabled)) != 0 ||
+ (r = sshbuf_put_u32(b, enc->block_size)) != 0 ||
+ (r = sshbuf_put_string(b, enc->key, enc->key_len)) != 0 ||
+ (r = sshbuf_put_string(b, enc->iv, enc->iv_len)) != 0)
+ goto out;
+ if (cipher_authlen(enc->cipher) == 0) {
+ if ((r = sshbuf_put_cstring(b, mac->name)) != 0 ||
+ (r = sshbuf_put_u32(b, mac->enabled)) != 0 ||
+ (r = sshbuf_put_string(b, mac->key, mac->key_len)) != 0)
+ goto out;
+ }
+ if ((r = sshbuf_put_u32(b, comp->type)) != 0 ||
+ (r = sshbuf_put_u32(b, comp->enabled)) != 0 ||
+ (r = sshbuf_put_cstring(b, comp->name)) != 0)
+ goto out;
+ r = sshbuf_put_stringb(m, b);
+ out:
+ sshbuf_free(b);
+ return r;
+}
+
+/* serialize packet state into a blob */
+int
+ssh_packet_get_state(struct ssh *ssh, struct sshbuf *m)
+{
+ struct session_state *state = ssh->state;
+ u_char *p;
+ size_t slen, rlen;
+ int r, ssh1cipher;
+
+ if (!compat20) {
+ ssh1cipher = cipher_get_number(state->receive_context.cipher);
+ slen = cipher_get_keyiv_len(&state->send_context);
+ rlen = cipher_get_keyiv_len(&state->receive_context);
+ if ((r = sshbuf_put_u32(m, state->remote_protocol_flags)) != 0 ||
+ (r = sshbuf_put_u32(m, ssh1cipher)) != 0 ||
+ (r = sshbuf_put_string(m, state->ssh1_key, state->ssh1_keylen)) != 0 ||
+ (r = sshbuf_put_u32(m, slen)) != 0 ||
+ (r = sshbuf_reserve(m, slen, &p)) != 0 ||
+ (r = cipher_get_keyiv(&state->send_context, p, slen)) != 0 ||
+ (r = sshbuf_put_u32(m, rlen)) != 0 ||
+ (r = sshbuf_reserve(m, rlen, &p)) != 0 ||
+ (r = cipher_get_keyiv(&state->receive_context, p, rlen)) != 0)
+ return r;
+ } else {
+ if ((r = kex_to_blob(m, ssh->kex)) != 0 ||
+ (r = newkeys_to_blob(m, ssh, MODE_OUT)) != 0 ||
+ (r = newkeys_to_blob(m, ssh, MODE_IN)) != 0 ||
+ (r = sshbuf_put_u64(m, state->rekey_limit)) != 0 ||
+ (r = sshbuf_put_u32(m, state->rekey_interval)) != 0 ||
+ (r = sshbuf_put_u32(m, state->p_send.seqnr)) != 0 ||
+ (r = sshbuf_put_u64(m, state->p_send.blocks)) != 0 ||
+ (r = sshbuf_put_u32(m, state->p_send.packets)) != 0 ||
+ (r = sshbuf_put_u64(m, state->p_send.bytes)) != 0 ||
+ (r = sshbuf_put_u32(m, state->p_read.seqnr)) != 0 ||
+ (r = sshbuf_put_u64(m, state->p_read.blocks)) != 0 ||
+ (r = sshbuf_put_u32(m, state->p_read.packets)) != 0 ||
+ (r = sshbuf_put_u64(m, state->p_read.bytes)) != 0)
+ return r;
+ }
+
+ slen = cipher_get_keycontext(&state->send_context, NULL);
+ rlen = cipher_get_keycontext(&state->receive_context, NULL);
+ if ((r = sshbuf_put_u32(m, slen)) != 0 ||
+ (r = sshbuf_reserve(m, slen, &p)) != 0)
+ return r;
+ if (cipher_get_keycontext(&state->send_context, p) != (int)slen)
+ return SSH_ERR_INTERNAL_ERROR;
+ if ((r = sshbuf_put_u32(m, rlen)) != 0 ||
+ (r = sshbuf_reserve(m, rlen, &p)) != 0)
+ return r;
+ if (cipher_get_keycontext(&state->receive_context, p) != (int)rlen)
+ return SSH_ERR_INTERNAL_ERROR;
+
+ if ((r = ssh_packet_get_compress_state(m, ssh)) != 0 ||
+ (r = sshbuf_put_stringb(m, state->input)) != 0 ||
+ (r = sshbuf_put_stringb(m, state->output)) != 0)
+ return r;
+
+ return 0;
+}
+
+/* restore key exchange results from blob for packet state de-serialization */
+static int
+newkeys_from_blob(struct sshbuf *m, struct ssh *ssh, int mode)
+{
+ struct sshbuf *b = NULL;
+ struct sshcomp *comp;
+ struct sshenc *enc;
+ struct sshmac *mac;
+ struct newkeys *newkey = NULL;
+ size_t keylen, ivlen, maclen;
+ int r;
+
+ if ((newkey = calloc(1, sizeof(*newkey))) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_froms(m, &b)) != 0)
+ goto out;
+#ifdef DEBUG_PK
+ sshbuf_dump(b, stderr);
+#endif
+ enc = &newkey->enc;
+ mac = &newkey->mac;
+ comp = &newkey->comp;
+
+ if ((r = sshbuf_get_cstring(b, &enc->name, NULL)) != 0 ||
+ (r = sshbuf_get(b, &enc->cipher, sizeof(enc->cipher))) != 0 ||
+ (r = sshbuf_get_u32(b, (u_int *)&enc->enabled)) != 0 ||
+ (r = sshbuf_get_u32(b, &enc->block_size)) != 0 ||
+ (r = sshbuf_get_string(b, &enc->key, &keylen)) != 0 ||
+ (r = sshbuf_get_string(b, &enc->iv, &ivlen)) != 0)
+ goto out;
+ if (cipher_authlen(enc->cipher) == 0) {
+ if ((r = sshbuf_get_cstring(b, &mac->name, NULL)) != 0)
+ goto out;
+ if ((r = mac_setup(mac, mac->name)) != 0)
+ goto out;
+ if ((r = sshbuf_get_u32(b, (u_int *)&mac->enabled)) != 0 ||
+ (r = sshbuf_get_string(b, &mac->key, &maclen)) != 0)
+ goto out;
+ if (maclen > mac->key_len) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ mac->key_len = maclen;
+ }
+ if ((r = sshbuf_get_u32(b, &comp->type)) != 0 ||
+ (r = sshbuf_get_u32(b, (u_int *)&comp->enabled)) != 0 ||
+ (r = sshbuf_get_cstring(b, &comp->name, NULL)) != 0)
+ goto out;
+ if (enc->name == NULL ||
+ cipher_by_name(enc->name) != enc->cipher) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if (sshbuf_len(b) != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ enc->key_len = keylen;
+ enc->iv_len = ivlen;
+ ssh->kex->newkeys[mode] = newkey;
+ newkey = NULL;
+ r = 0;
+ out:
+ free(newkey);
+ sshbuf_free(b);
+ return r;
+}
+
+/* restore kex from blob for packet state de-serialization */
+static int
+kex_from_blob(struct sshbuf *m, struct kex **kexp)
+{
+ struct kex *kex;
+ int r;
+
+ if ((kex = calloc(1, sizeof(struct kex))) == NULL ||
+ (kex->my = sshbuf_new()) == NULL ||
+ (kex->peer = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_get_string(m, &kex->session_id, &kex->session_id_len)) != 0 ||
+ (r = sshbuf_get_u32(m, &kex->we_need)) != 0 ||
+ (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_type)) != 0 ||
+ (r = sshbuf_get_u32(m, &kex->kex_type)) != 0 ||
+ (r = sshbuf_get_stringb(m, kex->my)) != 0 ||
+ (r = sshbuf_get_stringb(m, kex->peer)) != 0 ||
+ (r = sshbuf_get_u32(m, &kex->flags)) != 0 ||
+ (r = sshbuf_get_cstring(m, &kex->client_version_string, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(m, &kex->server_version_string, NULL)) != 0)
+ goto out;
+ kex->server = 1;
+ kex->done = 1;
+ r = 0;
+ out:
+ if (r != 0 || kexp == NULL) {
+ if (kex != NULL) {
+ sshbuf_free(kex->my);
+ sshbuf_free(kex->peer);
+ free(kex);
+ }
+ if (kexp != NULL)
+ *kexp = NULL;
+ } else {
+ *kexp = kex;
+ }
+ return r;
+}
+
/*
- * Save the state for the real connection, and use a separate state when
- * resuming a suspended connection.
+ * Restore packet state from content of blob 'm' (de-serialization).
+ * Note that 'm' will be partially consumed on parsing or any other errors.
*/
-void
-packet_backup_state(void)
+int
+ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m)
{
- struct session_state *tmp;
+ struct session_state *state = ssh->state;
+ const u_char *ssh1key, *ivin, *ivout, *keyin, *keyout, *input, *output;
+ size_t ssh1keylen, rlen, slen, ilen, olen;
+ int r;
+ u_int ssh1cipher = 0;
- close(active_state->connection_in);
- active_state->connection_in = -1;
- close(active_state->connection_out);
- active_state->connection_out = -1;
- if (backup_state)
- tmp = backup_state;
+ if (!compat20) {
+ if ((r = sshbuf_get_u32(m, &state->remote_protocol_flags)) != 0 ||
+ (r = sshbuf_get_u32(m, &ssh1cipher)) != 0 ||
+ (r = sshbuf_get_string_direct(m, &ssh1key, &ssh1keylen)) != 0 ||
+ (r = sshbuf_get_string_direct(m, &ivout, &slen)) != 0 ||
+ (r = sshbuf_get_string_direct(m, &ivin, &rlen)) != 0)
+ return r;
+ if (ssh1cipher > INT_MAX)
+ return SSH_ERR_KEY_UNKNOWN_CIPHER;
+ ssh_packet_set_encryption_key(ssh, ssh1key, ssh1keylen,
+ (int)ssh1cipher);
+ if (cipher_get_keyiv_len(&state->send_context) != (int)slen ||
+ cipher_get_keyiv_len(&state->receive_context) != (int)rlen)
+ return SSH_ERR_INVALID_FORMAT;
+ if ((r = cipher_set_keyiv(&state->send_context, ivout)) != 0 ||
+ (r = cipher_set_keyiv(&state->receive_context, ivin)) != 0)
+ return r;
+ } else {
+ if ((r = kex_from_blob(m, &ssh->kex)) != 0 ||
+ (r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 ||
+ (r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 ||
+ (r = sshbuf_get_u64(m, &state->rekey_limit)) != 0 ||
+ (r = sshbuf_get_u32(m, &state->rekey_interval)) != 0 ||
+ (r = sshbuf_get_u32(m, &state->p_send.seqnr)) != 0 ||
+ (r = sshbuf_get_u64(m, &state->p_send.blocks)) != 0 ||
+ (r = sshbuf_get_u32(m, &state->p_send.packets)) != 0 ||
+ (r = sshbuf_get_u64(m, &state->p_send.bytes)) != 0 ||
+ (r = sshbuf_get_u32(m, &state->p_read.seqnr)) != 0 ||
+ (r = sshbuf_get_u64(m, &state->p_read.blocks)) != 0 ||
+ (r = sshbuf_get_u32(m, &state->p_read.packets)) != 0 ||
+ (r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0)
+ return r;
+ /*
+ * We set the time here so that in post-auth privsep slave we
+ * count from the completion of the authentication.
+ */
+ state->rekey_time = monotime();
+ /* XXX ssh_set_newkeys overrides p_read.packets? XXX */
+ if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0 ||
+ (r = ssh_set_newkeys(ssh, MODE_OUT)) != 0)
+ return r;
+ }
+ if ((r = sshbuf_get_string_direct(m, &keyout, &slen)) != 0 ||
+ (r = sshbuf_get_string_direct(m, &keyin, &rlen)) != 0)
+ return r;
+ if (cipher_get_keycontext(&state->send_context, NULL) != (int)slen ||
+ cipher_get_keycontext(&state->receive_context, NULL) != (int)rlen)
+ return SSH_ERR_INVALID_FORMAT;
+ cipher_set_keycontext(&state->send_context, keyout);
+ cipher_set_keycontext(&state->receive_context, keyin);
+
+ if ((r = ssh_packet_set_compress_state(ssh, m)) != 0 ||
+ (r = ssh_packet_set_postauth(ssh)) != 0)
+ return r;
+
+ sshbuf_reset(state->input);
+ sshbuf_reset(state->output);
+ if ((r = sshbuf_get_string_direct(m, &input, &ilen)) != 0 ||
+ (r = sshbuf_get_string_direct(m, &output, &olen)) != 0 ||
+ (r = sshbuf_put(state->input, input, ilen)) != 0 ||
+ (r = sshbuf_put(state->output, output, olen)) != 0)
+ return r;
+
+ if (sshbuf_len(m))
+ return SSH_ERR_INVALID_FORMAT;
+ debug3("%s: done", __func__);
+ return 0;
+}
+
+/* NEW API */
+
+/* put data to the outgoing packet */
+
+int
+sshpkt_put(struct ssh *ssh, const void *v, size_t len)
+{
+ return sshbuf_put(ssh->state->outgoing_packet, v, len);
+}
+
+int
+sshpkt_putb(struct ssh *ssh, const struct sshbuf *b)
+{
+ return sshbuf_putb(ssh->state->outgoing_packet, b);
+}
+
+int
+sshpkt_put_u8(struct ssh *ssh, u_char val)
+{
+ return sshbuf_put_u8(ssh->state->outgoing_packet, val);
+}
+
+int
+sshpkt_put_u32(struct ssh *ssh, u_int32_t val)
+{
+ return sshbuf_put_u32(ssh->state->outgoing_packet, val);
+}
+
+int
+sshpkt_put_u64(struct ssh *ssh, u_int64_t val)
+{
+ return sshbuf_put_u64(ssh->state->outgoing_packet, val);
+}
+
+int
+sshpkt_put_string(struct ssh *ssh, const void *v, size_t len)
+{
+ return sshbuf_put_string(ssh->state->outgoing_packet, v, len);
+}
+
+int
+sshpkt_put_cstring(struct ssh *ssh, const void *v)
+{
+ return sshbuf_put_cstring(ssh->state->outgoing_packet, v);
+}
+
+int
+sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v)
+{
+ return sshbuf_put_stringb(ssh->state->outgoing_packet, v);
+}
+
+#ifdef WITH_OPENSSL
+#ifdef OPENSSL_HAS_ECC
+int
+sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g)
+{
+ return sshbuf_put_ec(ssh->state->outgoing_packet, v, g);
+}
+#endif /* OPENSSL_HAS_ECC */
+
+#ifdef WITH_SSH1
+int
+sshpkt_put_bignum1(struct ssh *ssh, const BIGNUM *v)
+{
+ return sshbuf_put_bignum1(ssh->state->outgoing_packet, v);
+}
+#endif /* WITH_SSH1 */
+
+int
+sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v)
+{
+ return sshbuf_put_bignum2(ssh->state->outgoing_packet, v);
+}
+#endif /* WITH_OPENSSL */
+
+/* fetch data from the incoming packet */
+
+int
+sshpkt_get(struct ssh *ssh, void *valp, size_t len)
+{
+ return sshbuf_get(ssh->state->incoming_packet, valp, len);
+}
+
+int
+sshpkt_get_u8(struct ssh *ssh, u_char *valp)
+{
+ return sshbuf_get_u8(ssh->state->incoming_packet, valp);
+}
+
+int
+sshpkt_get_u32(struct ssh *ssh, u_int32_t *valp)
+{
+ return sshbuf_get_u32(ssh->state->incoming_packet, valp);
+}
+
+int
+sshpkt_get_u64(struct ssh *ssh, u_int64_t *valp)
+{
+ return sshbuf_get_u64(ssh->state->incoming_packet, valp);
+}
+
+int
+sshpkt_get_string(struct ssh *ssh, u_char **valp, size_t *lenp)
+{
+ return sshbuf_get_string(ssh->state->incoming_packet, valp, lenp);
+}
+
+int
+sshpkt_get_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp)
+{
+ return sshbuf_get_string_direct(ssh->state->incoming_packet, valp, lenp);
+}
+
+int
+sshpkt_get_cstring(struct ssh *ssh, char **valp, size_t *lenp)
+{
+ return sshbuf_get_cstring(ssh->state->incoming_packet, valp, lenp);
+}
+
+#ifdef WITH_OPENSSL
+#ifdef OPENSSL_HAS_ECC
+int
+sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g)
+{
+ return sshbuf_get_ec(ssh->state->incoming_packet, v, g);
+}
+#endif /* OPENSSL_HAS_ECC */
+
+#ifdef WITH_SSH1
+int
+sshpkt_get_bignum1(struct ssh *ssh, BIGNUM *v)
+{
+ return sshbuf_get_bignum1(ssh->state->incoming_packet, v);
+}
+#endif /* WITH_SSH1 */
+
+int
+sshpkt_get_bignum2(struct ssh *ssh, BIGNUM *v)
+{
+ return sshbuf_get_bignum2(ssh->state->incoming_packet, v);
+}
+#endif /* WITH_OPENSSL */
+
+int
+sshpkt_get_end(struct ssh *ssh)
+{
+ if (sshbuf_len(ssh->state->incoming_packet) > 0)
+ return SSH_ERR_UNEXPECTED_TRAILING_DATA;
+ return 0;
+}
+
+const u_char *
+sshpkt_ptr(struct ssh *ssh, size_t *lenp)
+{
+ if (lenp != NULL)
+ *lenp = sshbuf_len(ssh->state->incoming_packet);
+ return sshbuf_ptr(ssh->state->incoming_packet);
+}
+
+/* start a new packet */
+
+int
+sshpkt_start(struct ssh *ssh, u_char type)
+{
+ u_char buf[9];
+ int len;
+
+ DBG(debug("packet_start[%d]", type));
+ len = compat20 ? 6 : 9;
+ memset(buf, 0, len - 1);
+ buf[len - 1] = type;
+ sshbuf_reset(ssh->state->outgoing_packet);
+ return sshbuf_put(ssh->state->outgoing_packet, buf, len);
+}
+
+/* send it */
+
+int
+sshpkt_send(struct ssh *ssh)
+{
+ if (compat20)
+ return ssh_packet_send2(ssh);
else
- tmp = alloc_session_state();
- backup_state = active_state;
- active_state = tmp;
+ return ssh_packet_send1(ssh);
}
-/*
- * Swap in the old state when resuming a connecion.
- */
-void
-packet_restore_state(void)
+int
+sshpkt_disconnect(struct ssh *ssh, const char *fmt,...)
{
- struct session_state *tmp;
- void *buf;
- u_int len;
+ char buf[1024];
+ va_list args;
+ int r;
- tmp = backup_state;
- backup_state = active_state;
- active_state = tmp;
- active_state->connection_in = backup_state->connection_in;
- backup_state->connection_in = -1;
- active_state->connection_out = backup_state->connection_out;
- backup_state->connection_out = -1;
- len = buffer_len(&backup_state->input);
- if (len > 0) {
- buf = buffer_ptr(&backup_state->input);
- buffer_append(&active_state->input, buf, len);
- buffer_clear(&backup_state->input);
- add_recv_bytes(len);
+ va_start(args, fmt);
+ vsnprintf(buf, sizeof(buf), fmt, args);
+ va_end(args);
+
+ if (compat20) {
+ if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
+ (r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_PROTOCOL_ERROR)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, "")) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
+ } else {
+ if ((r = sshpkt_start(ssh, SSH_MSG_DISCONNECT)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
}
+ return 0;
}
+
+/* roundup current message to pad bytes */
+int
+sshpkt_add_padding(struct ssh *ssh, u_char pad)
+{
+ ssh->state->extra_pad = pad;
+ return 0;
+}
Modified: trunk/crypto/openssh/packet.h
===================================================================
--- trunk/crypto/openssh/packet.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/packet.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.h,v 1.59 2013/07/12 00:19:59 djm Exp $ */
+/* $OpenBSD: packet.h,v 1.71 2016/03/07 19:02:43 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -18,110 +18,190 @@
#include <termios.h>
-#include <openssl/bn.h>
-#ifdef OPENSSL_HAS_ECC
-#include <openssl/ec.h>
-#endif
+#ifdef WITH_OPENSSL
+# include <openssl/bn.h>
+# ifdef OPENSSL_HAS_ECC
+# include <openssl/ec.h>
+# else /* OPENSSL_HAS_ECC */
+# define EC_KEY void
+# define EC_GROUP void
+# define EC_POINT void
+# endif /* OPENSSL_HAS_ECC */
+#else /* WITH_OPENSSL */
+# define BIGNUM void
+# define EC_KEY void
+# define EC_GROUP void
+# define EC_POINT void
+#endif /* WITH_OPENSSL */
-void packet_set_connection(int, int);
-void packet_set_timeout(int, int);
-void packet_set_nonblocking(void);
-int packet_get_connection_in(void);
-int packet_get_connection_out(void);
-void packet_close(void);
-void packet_set_encryption_key(const u_char *, u_int, int);
-u_int packet_get_encryption_key(u_char *);
-void packet_set_protocol_flags(u_int);
-u_int packet_get_protocol_flags(void);
-void packet_start_compression(int);
-void packet_set_interactive(int, int, int);
-int packet_is_interactive(void);
-void packet_set_server(void);
-void packet_set_authenticated(void);
+#include <signal.h>
+#include "openbsd-compat/sys-queue.h"
-void packet_start(u_char);
-void packet_put_char(int ch);
-void packet_put_int(u_int value);
-void packet_put_int64(u_int64_t value);
-void packet_put_bignum(BIGNUM * value);
-void packet_put_bignum2(BIGNUM * value);
-#ifdef OPENSSL_HAS_ECC
-void packet_put_ecpoint(const EC_GROUP *, const EC_POINT *);
-#endif
-void packet_put_string(const void *buf, u_int len);
-void packet_put_cstring(const char *str);
-void packet_put_raw(const void *buf, u_int len);
-void packet_send(void);
+struct kex;
+struct sshkey;
+struct sshbuf;
+struct session_state; /* private session data */
-int packet_read(void);
-void packet_read_expect(int type);
-void packet_process_incoming(const char *buf, u_int len);
-int packet_read_seqnr(u_int32_t *seqnr_p);
-int packet_read_poll_seqnr(u_int32_t *seqnr_p);
+#include "dispatch.h" /* typedef, DISPATCH_MAX */
-u_int packet_get_char(void);
-u_int packet_get_int(void);
-u_int64_t packet_get_int64(void);
-void packet_get_bignum(BIGNUM * value);
-void packet_get_bignum2(BIGNUM * value);
-#ifdef OPENSSL_HAS_ECC
-void packet_get_ecpoint(const EC_GROUP *, EC_POINT *);
-#endif
-void *packet_get_raw(u_int *length_ptr);
-void *packet_get_string(u_int *length_ptr);
-char *packet_get_cstring(u_int *length_ptr);
-void *packet_get_string_ptr(u_int *length_ptr);
-void packet_disconnect(const char *fmt,...) __attribute__((noreturn)) __attribute__((format(printf, 1, 2)));
-void packet_send_debug(const char *fmt,...) __attribute__((format(printf, 1, 2)));
+struct key_entry {
+ TAILQ_ENTRY(key_entry) next;
+ struct sshkey *key;
+};
-void set_newkeys(int mode);
-int packet_get_keyiv_len(int);
-void packet_get_keyiv(int, u_char *, u_int);
-int packet_get_keycontext(int, u_char *);
-void packet_set_keycontext(int, u_char *);
-void packet_get_state(int, u_int32_t *, u_int64_t *, u_int32_t *, u_int64_t *);
-void packet_set_state(int, u_int32_t, u_int64_t, u_int32_t, u_int64_t);
-int packet_get_ssh1_cipher(void);
-void packet_set_iv(int, u_char *);
-void *packet_get_newkeys(int);
+struct ssh {
+ /* Session state */
+ struct session_state *state;
-void packet_write_poll(void);
-void packet_write_wait(void);
-int packet_have_data_to_write(void);
-int packet_not_very_much_data_to_write(void);
+ /* Key exchange */
+ struct kex *kex;
-int packet_connection_is_on_socket(void);
-int packet_remaining(void);
-void packet_send_ignore(int);
-void packet_add_padding(u_char);
+ /* cached local and remote ip addresses and ports */
+ char *remote_ipaddr;
+ int remote_port;
+ char *local_ipaddr;
+ int local_port;
+ /* Dispatcher table */
+ dispatch_fn *dispatch[DISPATCH_MAX];
+ /* number of packets to ignore in the dispatcher */
+ int dispatch_skip_packets;
+
+ /* datafellows */
+ int compat;
+
+ /* Lists for private and public keys */
+ TAILQ_HEAD(, key_entry) private_keys;
+ TAILQ_HEAD(, key_entry) public_keys;
+
+ /* APP data */
+ void *app_data;
+};
+
+struct ssh *ssh_alloc_session_state(void);
+struct ssh *ssh_packet_set_connection(struct ssh *, int, int);
+void ssh_packet_set_timeout(struct ssh *, int, int);
+int ssh_packet_stop_discard(struct ssh *);
+int ssh_packet_connection_af(struct ssh *);
+void ssh_packet_set_nonblocking(struct ssh *);
+int ssh_packet_get_connection_in(struct ssh *);
+int ssh_packet_get_connection_out(struct ssh *);
+void ssh_packet_close(struct ssh *);
+void ssh_packet_set_encryption_key(struct ssh *, const u_char *, u_int, int);
+int ssh_packet_is_rekeying(struct ssh *);
+void ssh_packet_set_protocol_flags(struct ssh *, u_int);
+u_int ssh_packet_get_protocol_flags(struct ssh *);
+int ssh_packet_start_compression(struct ssh *, int);
+void ssh_packet_set_tos(struct ssh *, int);
+void ssh_packet_set_interactive(struct ssh *, int, int, int);
+int ssh_packet_is_interactive(struct ssh *);
+void ssh_packet_set_server(struct ssh *);
+void ssh_packet_set_authenticated(struct ssh *);
+
+int ssh_packet_send1(struct ssh *);
+int ssh_packet_send2_wrapped(struct ssh *);
+int ssh_packet_send2(struct ssh *);
+
+int ssh_packet_read(struct ssh *);
+int ssh_packet_read_expect(struct ssh *, u_int type);
+int ssh_packet_read_poll(struct ssh *);
+int ssh_packet_read_poll1(struct ssh *, u_char *);
+int ssh_packet_read_poll2(struct ssh *, u_char *, u_int32_t *seqnr_p);
+int ssh_packet_process_incoming(struct ssh *, const char *buf, u_int len);
+int ssh_packet_read_seqnr(struct ssh *, u_char *, u_int32_t *seqnr_p);
+int ssh_packet_read_poll_seqnr(struct ssh *, u_char *, u_int32_t *seqnr_p);
+
+const void *ssh_packet_get_string_ptr(struct ssh *, u_int *length_ptr);
+void ssh_packet_disconnect(struct ssh *, const char *fmt, ...)
+ __attribute__((format(printf, 2, 3)))
+ __attribute__((noreturn));
+void ssh_packet_send_debug(struct ssh *, const char *fmt, ...) __attribute__((format(printf, 2, 3)));
+
+int ssh_set_newkeys(struct ssh *, int mode);
+void ssh_packet_get_bytes(struct ssh *, u_int64_t *, u_int64_t *);
+
+typedef void *(ssh_packet_comp_alloc_func)(void *, u_int, u_int);
+typedef void (ssh_packet_comp_free_func)(void *, void *);
+void ssh_packet_set_compress_hooks(struct ssh *, void *,
+ ssh_packet_comp_alloc_func *, ssh_packet_comp_free_func *);
+
+int ssh_packet_write_poll(struct ssh *);
+int ssh_packet_write_wait(struct ssh *);
+int ssh_packet_have_data_to_write(struct ssh *);
+int ssh_packet_not_very_much_data_to_write(struct ssh *);
+
+int ssh_packet_connection_is_on_socket(struct ssh *);
+int ssh_packet_remaining(struct ssh *);
+void ssh_packet_send_ignore(struct ssh *, int);
+
void tty_make_modes(int, struct termios *);
void tty_parse_modes(int, int *);
-void packet_set_alive_timeouts(int);
-int packet_inc_alive_timeouts(void);
-int packet_set_maxsize(u_int);
-u_int packet_get_maxsize(void);
+void ssh_packet_set_alive_timeouts(struct ssh *, int);
+int ssh_packet_inc_alive_timeouts(struct ssh *);
+int ssh_packet_set_maxsize(struct ssh *, u_int);
+u_int ssh_packet_get_maxsize(struct ssh *);
-/* don't allow remaining bytes after the end of the message */
-#define packet_check_eom() \
-do { \
- int _len = packet_remaining(); \
- if (_len > 0) { \
- logit("Packet integrity error (%d bytes remaining) at %s:%d", \
- _len ,__FILE__, __LINE__); \
- packet_disconnect("Packet integrity error."); \
- } \
-} while (0)
+int ssh_packet_get_state(struct ssh *, struct sshbuf *);
+int ssh_packet_set_state(struct ssh *, struct sshbuf *);
-int packet_need_rekeying(void);
-void packet_set_rekey_limits(u_int32_t, time_t);
-time_t packet_get_rekey_timeout(void);
+const char *ssh_remote_ipaddr(struct ssh *);
+int ssh_remote_port(struct ssh *);
+const char *ssh_local_ipaddr(struct ssh *);
+int ssh_local_port(struct ssh *);
-void packet_backup_state(void);
-void packet_restore_state(void);
+void ssh_packet_set_rekey_limits(struct ssh *, u_int64_t, time_t);
+time_t ssh_packet_get_rekey_timeout(struct ssh *);
-void *packet_get_input(void);
-void *packet_get_output(void);
+void *ssh_packet_get_input(struct ssh *);
+void *ssh_packet_get_output(struct ssh *);
+/* new API */
+int sshpkt_start(struct ssh *ssh, u_char type);
+int sshpkt_send(struct ssh *ssh);
+int sshpkt_disconnect(struct ssh *, const char *fmt, ...)
+ __attribute__((format(printf, 2, 3)));
+int sshpkt_add_padding(struct ssh *, u_char);
+void sshpkt_fatal(struct ssh *ssh, const char *tag, int r);
+
+int sshpkt_put(struct ssh *ssh, const void *v, size_t len);
+int sshpkt_putb(struct ssh *ssh, const struct sshbuf *b);
+int sshpkt_put_u8(struct ssh *ssh, u_char val);
+int sshpkt_put_u32(struct ssh *ssh, u_int32_t val);
+int sshpkt_put_u64(struct ssh *ssh, u_int64_t val);
+int sshpkt_put_string(struct ssh *ssh, const void *v, size_t len);
+int sshpkt_put_cstring(struct ssh *ssh, const void *v);
+int sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v);
+int sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g);
+int sshpkt_put_bignum1(struct ssh *ssh, const BIGNUM *v);
+int sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v);
+
+int sshpkt_get(struct ssh *ssh, void *valp, size_t len);
+int sshpkt_get_u8(struct ssh *ssh, u_char *valp);
+int sshpkt_get_u32(struct ssh *ssh, u_int32_t *valp);
+int sshpkt_get_u64(struct ssh *ssh, u_int64_t *valp);
+int sshpkt_get_string(struct ssh *ssh, u_char **valp, size_t *lenp);
+int sshpkt_get_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp);
+int sshpkt_get_cstring(struct ssh *ssh, char **valp, size_t *lenp);
+int sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g);
+int sshpkt_get_bignum1(struct ssh *ssh, BIGNUM *v);
+int sshpkt_get_bignum2(struct ssh *ssh, BIGNUM *v);
+int sshpkt_get_end(struct ssh *ssh);
+const u_char *sshpkt_ptr(struct ssh *, size_t *lenp);
+
+/* OLD API */
+extern struct ssh *active_state;
+#include "opacket.h"
+
+#if !defined(WITH_OPENSSL)
+# undef BIGNUM
+# undef EC_KEY
+# undef EC_GROUP
+# undef EC_POINT
+#elif !defined(OPENSSL_HAS_ECC)
+# undef EC_KEY
+# undef EC_GROUP
+# undef EC_POINT
+#endif
+
#endif /* PACKET_H */
Modified: trunk/crypto/openssh/pathnames.h
===================================================================
--- trunk/crypto/openssh/pathnames.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/pathnames.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: pathnames.h,v 1.24 2013/12/06 13:39:49 markus Exp $ */
+/* $OpenBSD: pathnames.h,v 1.25 2016/03/31 05:24:06 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -42,8 +42,6 @@
#define _PATH_HOST_ED25519_KEY_FILE SSHDIR "/ssh_host_ed25519_key"
#define _PATH_HOST_RSA_KEY_FILE SSHDIR "/ssh_host_rsa_key"
#define _PATH_DH_MODULI SSHDIR "/moduli"
-/* Backwards compatibility */
-#define _PATH_DH_PRIMES SSHDIR "/primes"
#ifndef _PATH_SSH_PROGRAM
#define _PATH_SSH_PROGRAM "/usr/bin/ssh"
Copied: trunk/crypto/openssh/platform-pledge.c (from rev 9222, vendor-crypto/openssh/dist/platform-pledge.c)
===================================================================
--- trunk/crypto/openssh/platform-pledge.c (rev 0)
+++ trunk/crypto/openssh/platform-pledge.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2015 Joyent, Inc
+ * Author: Alex Wilson <alex.wilson at joyent.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+
+#include <stdarg.h>
+#include <unistd.h>
+
+#include "platform.h"
+
+#include "openbsd-compat/openbsd-compat.h"
+
+/*
+ * Drop any fine-grained privileges that are not needed for post-startup
+ * operation of ssh-agent
+ *
+ * Should be as close as possible to pledge("stdio cpath unix id proc exec", ...)
+ */
+void
+platform_pledge_agent(void)
+{
+#ifdef USE_SOLARIS_PRIVS
+ /*
+ * Note: Solaris priv dropping is closer to tame() than pledge(), but
+ * we will use what we have.
+ */
+ solaris_drop_privs_root_pinfo_net();
+#endif
+}
+
+/*
+ * Drop any fine-grained privileges that are not needed for post-startup
+ * operation of sftp-server
+ */
+void
+platform_pledge_sftp_server(void)
+{
+#ifdef USE_SOLARIS_PRIVS
+ solaris_drop_privs_pinfo_net_fork_exec();
+#endif
+}
+
+/*
+ * Drop any fine-grained privileges that are not needed for the post-startup
+ * operation of the SSH client mux
+ *
+ * Should be as close as possible to pledge("stdio proc tty", ...)
+ */
+void
+platform_pledge_mux(void)
+{
+#ifdef USE_SOLARIS_PRIVS
+ solaris_drop_privs_root_pinfo_net_exec();
+#endif
+}
Copied: trunk/crypto/openssh/platform-tracing.c (from rev 9222, vendor-crypto/openssh/dist/platform-tracing.c)
===================================================================
--- trunk/crypto/openssh/platform-tracing.c (rev 0)
+++ trunk/crypto/openssh/platform-tracing.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2016 Darren Tucker. All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#if defined(HAVE_SYS_PRCTL_H)
+#include <sys/prctl.h> /* For prctl() and PR_SET_DUMPABLE */
+#endif
+#ifdef HAVE_PRIV_H
+#include <priv.h> /* For setpflags() and __PROC_PROTECT */
+#endif
+#include <stdarg.h>
+
+#include "log.h"
+
+void
+platform_disable_tracing(int strict)
+{
+#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
+ /* Disable ptrace on Linux without sgid bit */
+ if (prctl(PR_SET_DUMPABLE, 0) != 0 && strict)
+ fatal("unable to make the process undumpable");
+#endif
+#if defined(HAVE_SETPFLAGS) && defined(__PROC_PROTECT)
+ /* On Solaris, we should make this process untraceable */
+ if (setpflags(__PROC_PROTECT, 1) != 0 && strict)
+ fatal("unable to make the process untraceable");
+#endif
+}
Modified: trunk/crypto/openssh/platform.c
===================================================================
--- trunk/crypto/openssh/platform.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/platform.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $Id: platform.c,v 1.21 2014/01/21 01:59:29 tim Exp $ */
+/* $Id: platform.c,v 1.22 2014/07/18 04:11:26 djm Exp $ */
/*
* Copyright (c) 2006 Darren Tucker. All rights reserved.
@@ -18,13 +18,12 @@
#include "includes.h"
-#include <sys/types.h>
-
#include <stdarg.h>
#include <unistd.h>
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
#include "key.h"
#include "hostfile.h"
@@ -106,8 +105,12 @@
#endif
#ifdef USE_SOLARIS_PROJECTS
- /* if solaris projects were detected, set the default now */
- if (getuid() == 0 || geteuid() == 0)
+ /*
+ * If solaris projects were detected, set the default now, unless
+ * we are using PAM in which case it is the responsibility of the
+ * PAM stack.
+ */
+ if (!options.use_pam && (getuid() == 0 || geteuid() == 0))
solaris_set_default_project(pw);
#endif
Modified: trunk/crypto/openssh/platform.h
===================================================================
--- trunk/crypto/openssh/platform.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/platform.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -31,3 +31,9 @@
char *platform_get_krb5_client(const char *);
char *platform_krb5_get_principal_name(const char *);
int platform_sys_dir_uid(uid_t);
+void platform_disable_tracing(int);
+
+/* in platform-pledge.c */
+void platform_pledge_agent(void);
+void platform_pledge_sftp_server(void);
+void platform_pledge_mux(void);
Modified: trunk/crypto/openssh/poly1305.h
===================================================================
--- trunk/crypto/openssh/poly1305.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/poly1305.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: poly1305.h,v 1.2 2013/12/19 22:57:13 djm Exp $ */
+/* $OpenBSD: poly1305.h,v 1.4 2014/05/02 03:27:54 djm Exp $ */
/*
* Public Domain poly1305 from Andrew Moon
Modified: trunk/crypto/openssh/progressmeter.c
===================================================================
--- trunk/crypto/openssh/progressmeter.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/progressmeter.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: progressmeter.c,v 1.40 2013/09/19 00:24:52 djm Exp $ */
+/* $OpenBSD: progressmeter.c,v 1.45 2016/06/30 05:17:05 dtucker Exp $ */
/*
* Copyright (c) 2003 Nils Nordman. All rights reserved.
*
@@ -63,9 +63,9 @@
/* signal handler for updating the progress meter */
static void update_progress_meter(int);
-static time_t start; /* start progress */
-static time_t last_update; /* last progress update */
-static char *file; /* name of the file being transferred */
+static double start; /* start progress */
+static double last_update; /* last progress update */
+static const char *file; /* name of the file being transferred */
static off_t start_pos; /* initial position of transfer */
static off_t end_pos; /* ending position of transfer */
static off_t cur_pos; /* transfer position as of last refresh */
@@ -120,9 +120,8 @@
refresh_progress_meter(void)
{
char buf[MAX_WINSIZE + 1];
- time_t now;
off_t transferred;
- double elapsed;
+ double elapsed, now;
int percent;
off_t bytes_left;
int cur_speed;
@@ -132,7 +131,7 @@
transferred = *counter - (cur_pos ? cur_pos : start_pos);
cur_pos = *counter;
- now = monotime();
+ now = monotime_double();
bytes_left = end_pos - cur_pos;
if (bytes_left > 0)
@@ -172,10 +171,10 @@
}
/* percent of transfer done */
- if (end_pos != 0)
+ if (end_pos == 0 || cur_pos == end_pos)
+ percent = 100;
+ else
percent = ((float)cur_pos / end_pos) * 100;
- else
- percent = 100;
snprintf(buf + strlen(buf), win_size - strlen(buf),
" %3d%% ", percent);
@@ -248,9 +247,9 @@
}
void
-start_progress_meter(char *f, off_t filesize, off_t *ctr)
+start_progress_meter(const char *f, off_t filesize, off_t *ctr)
{
- start = last_update = monotime();
+ start = last_update = monotime_double();
file = f;
start_pos = *ctr;
end_pos = filesize;
Modified: trunk/crypto/openssh/progressmeter.h
===================================================================
--- trunk/crypto/openssh/progressmeter.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/progressmeter.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: progressmeter.h,v 1.2 2006/03/25 22:22:43 djm Exp $ */
+/* $OpenBSD: progressmeter.h,v 1.3 2015/01/14 13:54:13 djm Exp $ */
/*
* Copyright (c) 2002 Nils Nordman. All rights reserved.
*
@@ -23,5 +23,5 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
-void start_progress_meter(char *, off_t, off_t *);
+void start_progress_meter(const char *, off_t, off_t *);
void stop_progress_meter(void);
Modified: trunk/crypto/openssh/readconf.c
===================================================================
--- trunk/crypto/openssh/readconf.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/readconf.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.218 2014/02/23 20:11:36 djm Exp $ */
+/* $OpenBSD: readconf.c,v 1.259 2016/07/22 03:35:11 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -18,6 +18,7 @@
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/wait.h>
+#include <sys/un.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
@@ -27,6 +28,7 @@
#include <ctype.h>
#include <errno.h>
#include <fcntl.h>
+#include <limits.h>
#include <netdb.h>
#ifdef HAVE_PATHS_H
# include <paths.h>
@@ -37,9 +39,17 @@
#include <stdio.h>
#include <string.h>
#include <unistd.h>
+#ifdef USE_SYSTEM_GLOB
+# include <glob.h>
+#else
+# include "openbsd-compat/glob.h"
+#endif
#ifdef HAVE_UTIL_H
#include <util.h>
#endif
+#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
+# include <vis.h>
+#endif
#include "xmalloc.h"
#include "ssh.h"
@@ -47,14 +57,15 @@
#include "cipher.h"
#include "pathnames.h"
#include "log.h"
-#include "key.h"
+#include "sshkey.h"
+#include "misc.h"
#include "readconf.h"
#include "match.h"
-#include "misc.h"
-#include "buffer.h"
#include "kex.h"
#include "mac.h"
#include "uidswap.h"
+#include "myproposal.h"
+#include "digest.h"
/* Format of the configuration file:
@@ -119,22 +130,30 @@
*/
+static int read_config_file_depth(const char *filename, struct passwd *pw,
+ const char *host, const char *original_host, Options *options,
+ int flags, int *activep, int depth);
+static int process_config_line_depth(Options *options, struct passwd *pw,
+ const char *host, const char *original_host, char *line,
+ const char *filename, int linenum, int *activep, int flags, int depth);
+
/* Keyword tokens. */
typedef enum {
oBadOption,
- oHost, oMatch,
+ oHost, oMatch, oInclude,
oForwardAgent, oForwardX11, oForwardX11Trusted, oForwardX11Timeout,
oGatewayPorts, oExitOnForwardFailure,
oPasswordAuthentication, oRSAAuthentication,
oChallengeResponseAuthentication, oXAuthLocation,
oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
+ oCertificateFile, oAddKeysToAgent, oIdentityAgent,
oUser, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
- oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
+ oPubkeyAuthentication,
oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
@@ -145,10 +164,13 @@
oSendEnv, oControlPath, oControlMaster, oControlPersist,
oHashKnownHosts,
oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
- oVisualHostKey, oUseRoaming,
+ oVisualHostKey,
oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
+ oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
+ oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
+ oPubkeyAcceptedKeyTypes, oProxyJump,
oIgnoredUnknownOption, oDeprecated, oUnsupported
} OpCodes;
@@ -193,6 +215,9 @@
{ "identityfile", oIdentityFile },
{ "identityfile2", oIdentityFile }, /* obsolete */
{ "identitiesonly", oIdentitiesOnly },
+ { "certificatefile", oCertificateFile },
+ { "addkeystoagent", oAddKeysToAgent },
+ { "identityagent", oIdentityAgent },
{ "hostname", oHostName },
{ "hostkeyalias", oHostKeyAlias },
{ "proxycommand", oProxyCommand },
@@ -210,7 +235,7 @@
{ "globalknownhostsfile", oGlobalKnownHostsFile },
{ "globalknownhostsfile2", oDeprecated },
{ "userknownhostsfile", oUserKnownHostsFile },
- { "userknownhostsfile2", oDeprecated },
+ { "userknownhostsfile2", oDeprecated },
{ "connectionattempts", oConnectionAttempts },
{ "batchmode", oBatchMode },
{ "checkhostip", oCheckHostIP },
@@ -246,12 +271,13 @@
{ "controlmaster", oControlMaster },
{ "controlpersist", oControlPersist },
{ "hashknownhosts", oHashKnownHosts },
+ { "include", oInclude },
{ "tunnel", oTunnel },
{ "tunneldevice", oTunnelDevice },
{ "localcommand", oLocalCommand },
{ "permitlocalcommand", oPermitLocalCommand },
{ "visualhostkey", oVisualHostKey },
- { "useroaming", oUseRoaming },
+ { "useroaming", oDeprecated },
{ "kexalgorithms", oKexAlgorithms },
{ "ipqos", oIPQoS },
{ "requesttty", oRequestTTY },
@@ -261,7 +287,15 @@
{ "canonicalizehostname", oCanonicalizeHostname },
{ "canonicalizemaxdots", oCanonicalizeMaxDots },
{ "canonicalizepermittedcnames", oCanonicalizePermittedCNAMEs },
+ { "streamlocalbindmask", oStreamLocalBindMask },
+ { "streamlocalbindunlink", oStreamLocalBindUnlink },
+ { "revokedhostkeys", oRevokedHostKeys },
+ { "fingerprinthash", oFingerprintHash },
+ { "updatehostkeys", oUpdateHostkeys },
+ { "hostbasedkeytypes", oHostbasedKeyTypes },
+ { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
{ "ignoreunknown", oIgnoreUnknown },
+ { "proxyjump", oProxyJump },
{ NULL, oBadOption }
};
@@ -272,15 +306,21 @@
*/
void
-add_local_forward(Options *options, const Forward *newfwd)
+add_local_forward(Options *options, const struct Forward *newfwd)
{
- Forward *fwd;
-#ifndef NO_IPPORT_RESERVED_CONCEPT
+ struct Forward *fwd;
extern uid_t original_real_uid;
- if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
+ int i;
+
+ if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0 &&
+ newfwd->listen_path == NULL)
fatal("Privileged ports can only be forwarded by root.");
-#endif
- options->local_forwards = xrealloc(options->local_forwards,
+ /* Don't add duplicates */
+ for (i = 0; i < options->num_local_forwards; i++) {
+ if (forward_equals(newfwd, options->local_forwards + i))
+ return;
+ }
+ options->local_forwards = xreallocarray(options->local_forwards,
options->num_local_forwards + 1,
sizeof(*options->local_forwards));
fwd = &options->local_forwards[options->num_local_forwards++];
@@ -287,8 +327,10 @@
fwd->listen_host = newfwd->listen_host;
fwd->listen_port = newfwd->listen_port;
+ fwd->listen_path = newfwd->listen_path;
fwd->connect_host = newfwd->connect_host;
fwd->connect_port = newfwd->connect_port;
+ fwd->connect_path = newfwd->connect_path;
}
/*
@@ -297,11 +339,17 @@
*/
void
-add_remote_forward(Options *options, const Forward *newfwd)
+add_remote_forward(Options *options, const struct Forward *newfwd)
{
- Forward *fwd;
+ struct Forward *fwd;
+ int i;
- options->remote_forwards = xrealloc(options->remote_forwards,
+ /* Don't add duplicates */
+ for (i = 0; i < options->num_remote_forwards; i++) {
+ if (forward_equals(newfwd, options->remote_forwards + i))
+ return;
+ }
+ options->remote_forwards = xreallocarray(options->remote_forwards,
options->num_remote_forwards + 1,
sizeof(*options->remote_forwards));
fwd = &options->remote_forwards[options->num_remote_forwards++];
@@ -308,8 +356,10 @@
fwd->listen_host = newfwd->listen_host;
fwd->listen_port = newfwd->listen_port;
+ fwd->listen_path = newfwd->listen_path;
fwd->connect_host = newfwd->connect_host;
fwd->connect_port = newfwd->connect_port;
+ fwd->connect_path = newfwd->connect_path;
fwd->handle = newfwd->handle;
fwd->allocated_port = 0;
}
@@ -321,7 +371,9 @@
for (i = 0; i < options->num_local_forwards; i++) {
free(options->local_forwards[i].listen_host);
+ free(options->local_forwards[i].listen_path);
free(options->local_forwards[i].connect_host);
+ free(options->local_forwards[i].connect_path);
}
if (options->num_local_forwards > 0) {
free(options->local_forwards);
@@ -330,7 +382,9 @@
options->num_local_forwards = 0;
for (i = 0; i < options->num_remote_forwards; i++) {
free(options->remote_forwards[i].listen_host);
+ free(options->remote_forwards[i].listen_path);
free(options->remote_forwards[i].connect_host);
+ free(options->remote_forwards[i].connect_path);
}
if (options->num_remote_forwards > 0) {
free(options->remote_forwards);
@@ -341,10 +395,35 @@
}
void
+add_certificate_file(Options *options, const char *path, int userprovided)
+{
+ int i;
+
+ if (options->num_certificate_files >= SSH_MAX_CERTIFICATE_FILES)
+ fatal("Too many certificate files specified (max %d)",
+ SSH_MAX_CERTIFICATE_FILES);
+
+ /* Avoid registering duplicates */
+ for (i = 0; i < options->num_certificate_files; i++) {
+ if (options->certificate_file_userprovided[i] == userprovided &&
+ strcmp(options->certificate_files[i], path) == 0) {
+ debug2("%s: ignoring duplicate key %s", __func__, path);
+ return;
+ }
+ }
+
+ options->certificate_file_userprovided[options->num_certificate_files] =
+ userprovided;
+ options->certificate_files[options->num_certificate_files++] =
+ xstrdup(path);
+}
+
+void
add_identity_file(Options *options, const char *dir, const char *filename,
int userprovided)
{
char *path;
+ int i;
if (options->num_identity_files >= SSH_MAX_IDENTITY_FILES)
fatal("Too many identity files specified (max %d)",
@@ -355,6 +434,16 @@
else
(void)xasprintf(&path, "%.100s%.100s", dir, filename);
+ /* Avoid registering duplicates */
+ for (i = 0; i < options->num_identity_files; i++) {
+ if (options->identity_file_userprovided[i] == userprovided &&
+ strcmp(options->identity_files[i], path) == 0) {
+ debug2("%s: ignoring duplicate key %s", __func__, path);
+ free(path);
+ return;
+ }
+ }
+
options->identity_file_userprovided[options->num_identity_files] =
userprovided;
options->identity_files[options->num_identity_files++] = path;
@@ -380,7 +469,7 @@
static int
execute_in_shell(const char *cmd)
{
- char *shell, *command_string;
+ char *shell;
pid_t pid;
int devnull, status;
extern uid_t original_real_uid;
@@ -388,12 +477,6 @@
if ((shell = getenv("SHELL")) == NULL)
shell = _PATH_BSHELL;
- /*
- * Use "exec" to avoid "sh -c" processes on some platforms
- * (e.g. Solaris)
- */
- xasprintf(&command_string, "exec %s", cmd);
-
/* Need this to redirect subprocess stdin/out */
if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1)
fatal("open(/dev/null): %s", strerror(errno));
@@ -418,7 +501,7 @@
argv[0] = shell;
argv[1] = "-c";
- argv[2] = command_string;
+ argv[2] = xstrdup(cmd);
argv[3] = NULL;
execv(argv[0], argv);
@@ -433,7 +516,6 @@
fatal("%s: fork: %.100s", __func__, strerror(errno));
close(devnull);
- free(command_string);
while (waitpid(pid, &status, 0) == -1) {
if (errno != EINTR && errno != EAGAIN)
@@ -442,7 +524,7 @@
if (!WIFEXITED(status)) {
error("command '%.100s' exited abnormally", cmd);
return -1;
- }
+ }
debug3("command returned status %d", WEXITSTATUS(status));
return WEXITSTATUS(status);
}
@@ -452,12 +534,12 @@
*/
static int
match_cfg_line(Options *options, char **condition, struct passwd *pw,
- const char *host_arg, const char *filename, int linenum)
+ const char *host_arg, const char *original_host, int post_canon,
+ const char *filename, int linenum)
{
- char *arg, *attrib, *cmd, *cp = *condition, *host;
+ char *arg, *oattrib, *attrib, *cmd, *cp = *condition, *host, *criteria;
const char *ruser;
- int r, port, result = 1, attributes = 0;
- size_t len;
+ int r, port, this_result, result = 1, attributes = 0, negate;
char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV];
/*
@@ -466,60 +548,73 @@
*/
port = options->port <= 0 ? default_ssh_port() : options->port;
ruser = options->user == NULL ? pw->pw_name : options->user;
- if (options->hostname != NULL) {
+ if (post_canon) {
+ host = xstrdup(options->hostname);
+ } else if (options->hostname != NULL) {
/* NB. Please keep in sync with ssh.c:main() */
host = percent_expand(options->hostname,
"h", host_arg, (char *)NULL);
- } else
+ } else {
host = xstrdup(host_arg);
+ }
- debug3("checking match for '%s' host %s", cp, host);
- while ((attrib = strdelim(&cp)) && *attrib != '\0') {
- attributes++;
+ debug2("checking match for '%s' host %s originally %s",
+ cp, host, original_host);
+ while ((oattrib = attrib = strdelim(&cp)) && *attrib != '\0') {
+ criteria = NULL;
+ this_result = 1;
+ if ((negate = attrib[0] == '!'))
+ attrib++;
+ /* criteria "all" and "canonical" have no argument */
if (strcasecmp(attrib, "all") == 0) {
- if (attributes != 1 ||
+ if (attributes > 1 ||
((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
- error("'all' cannot be combined with other "
- "Match attributes");
+ error("%.200s line %d: '%s' cannot be combined "
+ "with other Match attributes",
+ filename, linenum, oattrib);
result = -1;
goto out;
}
- *condition = cp;
- result = 1;
+ if (result)
+ result = negate ? 0 : 1;
goto out;
}
+ attributes++;
+ if (strcasecmp(attrib, "canonical") == 0) {
+ r = !!post_canon; /* force bitmask member to boolean */
+ if (r == (negate ? 1 : 0))
+ this_result = result = 0;
+ debug3("%.200s line %d: %smatched '%s'",
+ filename, linenum,
+ this_result ? "" : "not ", oattrib);
+ continue;
+ }
+ /* All other criteria require an argument */
if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
error("Missing Match criteria for %s", attrib);
result = -1;
goto out;
}
- len = strlen(arg);
if (strcasecmp(attrib, "host") == 0) {
- if (match_hostname(host, arg, len) != 1)
- result = 0;
- else
- debug("%.200s line %d: matched 'Host %.100s' ",
- filename, linenum, host);
+ criteria = xstrdup(host);
+ r = match_hostname(host, arg) == 1;
+ if (r == (negate ? 1 : 0))
+ this_result = result = 0;
} else if (strcasecmp(attrib, "originalhost") == 0) {
- if (match_hostname(host_arg, arg, len) != 1)
- result = 0;
- else
- debug("%.200s line %d: matched "
- "'OriginalHost %.100s' ",
- filename, linenum, host_arg);
+ criteria = xstrdup(original_host);
+ r = match_hostname(original_host, arg) == 1;
+ if (r == (negate ? 1 : 0))
+ this_result = result = 0;
} else if (strcasecmp(attrib, "user") == 0) {
- if (match_pattern_list(ruser, arg, len, 0) != 1)
- result = 0;
- else
- debug("%.200s line %d: matched 'User %.100s' ",
- filename, linenum, ruser);
+ criteria = xstrdup(ruser);
+ r = match_pattern_list(ruser, arg, 0) == 1;
+ if (r == (negate ? 1 : 0))
+ this_result = result = 0;
} else if (strcasecmp(attrib, "localuser") == 0) {
- if (match_pattern_list(pw->pw_name, arg, len, 0) != 1)
- result = 0;
- else
- debug("%.200s line %d: matched "
- "'LocalUser %.100s' ",
- filename, linenum, pw->pw_name);
+ criteria = xstrdup(pw->pw_name);
+ r = match_pattern_list(pw->pw_name, arg, 0) == 1;
+ if (r == (negate ? 1 : 0))
+ this_result = result = 0;
} else if (strcasecmp(attrib, "exec") == 0) {
if (gethostname(thishost, sizeof(thishost)) == -1)
fatal("gethostname: %s", strerror(errno));
@@ -532,7 +627,7 @@
"d", pw->pw_dir,
"h", host,
"l", thishost,
- "n", host_arg,
+ "n", original_host,
"p", portstr,
"r", ruser,
"u", pw->pw_name,
@@ -539,31 +634,32 @@
(char *)NULL);
if (result != 1) {
/* skip execution if prior predicate failed */
- debug("%.200s line %d: skipped exec \"%.100s\"",
- filename, linenum, cmd);
- } else {
- r = execute_in_shell(cmd);
- if (r == -1) {
- fatal("%.200s line %d: match exec "
- "'%.100s' error", filename,
- linenum, cmd);
- } else if (r == 0) {
- debug("%.200s line %d: matched "
- "'exec \"%.100s\"'", filename,
- linenum, cmd);
- } else {
- debug("%.200s line %d: no match "
- "'exec \"%.100s\"'", filename,
- linenum, cmd);
- result = 0;
- }
+ debug3("%.200s line %d: skipped exec "
+ "\"%.100s\"", filename, linenum, cmd);
+ free(cmd);
+ continue;
}
+ r = execute_in_shell(cmd);
+ if (r == -1) {
+ fatal("%.200s line %d: match exec "
+ "'%.100s' error", filename,
+ linenum, cmd);
+ }
+ criteria = xstrdup(cmd);
free(cmd);
+ /* Force exit status to boolean */
+ r = r == 0;
+ if (r == (negate ? 1 : 0))
+ this_result = result = 0;
} else {
error("Unsupported Match attribute %s", attrib);
result = -1;
goto out;
}
+ debug3("%.200s line %d: %smatched '%s \"%.100s\"' ",
+ filename, linenum, this_result ? "": "not ",
+ oattrib, criteria);
+ free(criteria);
}
if (attributes == 0) {
error("One or more attributes required for Match");
@@ -570,9 +666,10 @@
result = -1;
goto out;
}
- debug3("match %sfound", result ? "" : "not ");
+ out:
+ if (result != -1)
+ debug2("match %sfound", result ? "" : "not ");
*condition = cp;
- out:
free(host);
return result;
}
@@ -617,8 +714,8 @@
for (i = 0; keywords[i].name; i++)
if (strcmp(cp, keywords[i].name) == 0)
return keywords[i].opcode;
- if (ignored_unknown != NULL && match_pattern_list(cp, ignored_unknown,
- strlen(ignored_unknown), 1) == 1)
+ if (ignored_unknown != NULL &&
+ match_pattern_list(cp, ignored_unknown, 1) == 1)
return oIgnoredUnknownOption;
error("%s: line %d: Bad configuration option: %s",
filename, linenum, cp);
@@ -645,6 +742,15 @@
{ "ask", 2 },
{ NULL, -1 }
};
+static const struct multistate multistate_yesnoaskconfirm[] = {
+ { "true", 1 },
+ { "false", 0 },
+ { "yes", 1 },
+ { "no", 0 },
+ { "ask", 2 },
+ { "confirm", 3 },
+ { NULL, -1 }
+};
static const struct multistate multistate_addressfamily[] = {
{ "inet", AF_INET },
{ "inet6", AF_INET6 },
@@ -692,21 +798,32 @@
* Processes a single option line as used in the configuration files. This
* only sets those values that have not already been set.
*/
-#define WHITESPACE " \t\r\n"
int
process_config_line(Options *options, struct passwd *pw, const char *host,
- char *line, const char *filename, int linenum, int *activep, int userconfig)
+ const char *original_host, char *line, const char *filename,
+ int linenum, int *activep, int flags)
{
+ return process_config_line_depth(options, pw, host, original_host,
+ line, filename, linenum, activep, flags, 0);
+}
+
+#define WHITESPACE " \t\r\n"
+static int
+process_config_line_depth(Options *options, struct passwd *pw, const char *host,
+ const char *original_host, char *line, const char *filename,
+ int linenum, int *activep, int flags, int depth)
+{
char *s, **charptr, *endofnumber, *keyword, *arg, *arg2;
char **cpptr, fwdarg[256];
u_int i, *uintptr, max_entries = 0;
- int negated, opcode, *intptr, value, value2, cmdline = 0;
+ int r, oactive, negated, opcode, *intptr, value, value2, cmdline = 0;
LogLevel *log_level_ptr;
long long val64;
size_t len;
- Forward fwd;
+ struct Forward fwd;
const struct multistate *multistate_ptr;
struct allowed_cname *cname;
+ glob_t gl;
if (activep == NULL) { /* We are processing a command line directive */
cmdline = 1;
@@ -714,7 +831,9 @@
}
/* Strip trailing whitespace */
- for (len = strlen(line) - 1; len > 0; len--) {
+ if ((len = strlen(line)) == 0)
+ return 0;
+ for (len--; len > 0; len--) {
if (strchr(WHITESPACE, line[len]) == NULL)
break;
line[len] = '\0';
@@ -751,7 +870,9 @@
if (!arg || *arg == '\0')
fatal("%s line %d: missing time value.",
filename, linenum);
- if ((value = convtime(arg)) == -1)
+ if (strcmp(arg, "none") == 0)
+ value = -1;
+ else if ((value = convtime(arg)) == -1)
fatal("%s line %d: invalid time value.",
filename, linenum);
if (*activep && *intptr == -1)
@@ -788,13 +909,13 @@
case oForwardX11Trusted:
intptr = &options->forward_x11_trusted;
goto parse_flag;
-
+
case oForwardX11Timeout:
intptr = &options->forward_x11_timeout;
goto parse_time;
case oGatewayPorts:
- intptr = &options->gateway_ports;
+ intptr = &options->fwd_opts.gateway_ports;
goto parse_flag;
case oExitOnForwardFailure:
@@ -894,16 +1015,12 @@
if (scan_scaled(arg, &val64) == -1)
fatal("%.200s line %d: Bad number '%s': %s",
filename, linenum, arg, strerror(errno));
- /* check for too-large or too-small limits */
- if (val64 > UINT_MAX)
- fatal("%.200s line %d: RekeyLimit too large",
- filename, linenum);
if (val64 != 0 && val64 < 16)
fatal("%.200s line %d: RekeyLimit too small",
filename, linenum);
}
if (*activep && options->rekey_limit == -1)
- options->rekey_limit = (u_int32_t)val64;
+ options->rekey_limit = val64;
if (s != NULL) { /* optional rekey interval present */
if (strcmp(s, "none") == 0) {
(void)strdelim(&s); /* discard */
@@ -923,10 +1040,29 @@
if (*intptr >= SSH_MAX_IDENTITY_FILES)
fatal("%.200s line %d: Too many identity files specified (max %d).",
filename, linenum, SSH_MAX_IDENTITY_FILES);
- add_identity_file(options, NULL, arg, userconfig);
+ add_identity_file(options, NULL,
+ arg, flags & SSHCONF_USERCONF);
}
break;
+ case oCertificateFile:
+ arg = strdelim(&s);
+ if (!arg || *arg == '\0')
+ fatal("%.200s line %d: Missing argument.",
+ filename, linenum);
+ if (*activep) {
+ intptr = &options->num_certificate_files;
+ if (*intptr >= SSH_MAX_CERTIFICATE_FILES) {
+ fatal("%.200s line %d: Too many certificate "
+ "files specified (max %d).",
+ filename, linenum,
+ SSH_MAX_CERTIFICATE_FILES);
+ }
+ add_certificate_file(options, arg,
+ flags & SSHCONF_USERCONF);
+ }
+ break;
+
case oXAuthLocation:
charptr=&options->xauth_location;
goto parse_string;
@@ -986,6 +1122,9 @@
case oProxyCommand:
charptr = &options->proxy_command;
+ /* Ignore ProxyCommand if ProxyJump already specified */
+ if (options->jump_host != NULL)
+ charptr = &options->jump_host; /* Skip below */
parse_command:
if (s == NULL)
fatal("%.200s line %d: Missing argument.", filename, linenum);
@@ -994,6 +1133,18 @@
*charptr = xstrdup(s + len);
return 0;
+ case oProxyJump:
+ if (s == NULL) {
+ fatal("%.200s line %d: Missing argument.",
+ filename, linenum);
+ }
+ len = strspn(s, WHITESPACE "=");
+ if (parse_jump(s + len, options, *activep) == -1) {
+ fatal("%.200s line %d: Invalid ProxyJump \"%s\"",
+ filename, linenum, s + len);
+ }
+ return 0;
+
case oPort:
intptr = &options->port;
parse_int:
@@ -1032,7 +1183,7 @@
arg = strdelim(&s);
if (!arg || *arg == '\0')
fatal("%.200s line %d: Missing argument.", filename, linenum);
- if (!ciphers_valid(arg))
+ if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (*activep && options->ciphers == NULL)
@@ -1043,7 +1194,7 @@
arg = strdelim(&s);
if (!arg || *arg == '\0')
fatal("%.200s line %d: Missing argument.", filename, linenum);
- if (!mac_valid(arg))
+ if (!mac_valid(*arg == '+' ? arg + 1 : arg))
fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (*activep && options->macs == NULL)
@@ -1055,7 +1206,7 @@
if (!arg || *arg == '\0')
fatal("%.200s line %d: Missing argument.",
filename, linenum);
- if (!kex_names_valid(arg))
+ if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (*activep && options->kex_algorithms == NULL)
@@ -1063,14 +1214,17 @@
break;
case oHostKeyAlgorithms:
+ charptr = &options->hostkeyalgorithms;
+parse_keytypes:
arg = strdelim(&s);
if (!arg || *arg == '\0')
- fatal("%.200s line %d: Missing argument.", filename, linenum);
- if (!key_names_valid2(arg))
- fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
- filename, linenum, arg ? arg : "<NONE>");
- if (*activep && options->hostkeyalgorithms == NULL)
- options->hostkeyalgorithms = xstrdup(arg);
+ fatal("%.200s line %d: Missing argument.",
+ filename, linenum);
+ if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
+ fatal("%s line %d: Bad key types '%s'.",
+ filename, linenum, arg ? arg : "<NONE>");
+ if (*activep && *charptr == NULL)
+ *charptr = xstrdup(arg);
break;
case oProtocol:
@@ -1144,6 +1298,8 @@
*activep = 0;
arg2 = NULL;
while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
+ if ((flags & SSHCONF_NEVERMATCH) != 0)
+ break;
negated = *arg == '!';
if (negated)
arg++;
@@ -1171,12 +1327,12 @@
if (cmdline)
fatal("Host directive not supported as a command-line "
"option");
- value = match_cfg_line(options, &s, pw, host,
- filename, linenum);
+ value = match_cfg_line(options, &s, pw, host, original_host,
+ flags & SSHCONF_POSTCANON, filename, linenum);
if (value < 0)
fatal("%.200s line %d: Bad Match condition", filename,
linenum);
- *activep = value;
+ *activep = (flags & SSHCONF_NEVERMATCH) ? 0 : value;
break;
case oEscapeChar:
@@ -1184,13 +1340,13 @@
arg = strdelim(&s);
if (!arg || *arg == '\0')
fatal("%.200s line %d: Missing argument.", filename, linenum);
- if (arg[0] == '^' && arg[2] == 0 &&
+ if (strcmp(arg, "none") == 0)
+ value = SSH_ESCAPECHAR_NONE;
+ else if (arg[1] == '\0')
+ value = (u_char) arg[0];
+ else if (arg[0] == '^' && arg[2] == 0 &&
(u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
value = (u_char) arg[1] & 31;
- else if (strlen(arg) == 1)
- value = (u_char) arg[0];
- else if (strcmp(arg, "none") == 0)
- value = SSH_ESCAPECHAR_NONE;
else {
fatal("%.200s line %d: Bad escape character.",
filename, linenum);
@@ -1304,6 +1460,63 @@
intptr = &options->visual_host_key;
goto parse_flag;
+ case oInclude:
+ if (cmdline)
+ fatal("Include directive not supported as a "
+ "command-line option");
+ value = 0;
+ while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
+ /*
+ * Ensure all paths are anchored. User configuration
+ * files may begin with '~/' but system configurations
+ * must not. If the path is relative, then treat it
+ * as living in ~/.ssh for user configurations or
+ * /etc/ssh for system ones.
+ */
+ if (*arg == '~' && (flags & SSHCONF_USERCONF) == 0)
+ fatal("%.200s line %d: bad include path %s.",
+ filename, linenum, arg);
+ if (*arg != '/' && *arg != '~') {
+ xasprintf(&arg2, "%s/%s",
+ (flags & SSHCONF_USERCONF) ?
+ "~/" _PATH_SSH_USER_DIR : SSHDIR, arg);
+ } else
+ arg2 = xstrdup(arg);
+ memset(&gl, 0, sizeof(gl));
+ r = glob(arg2, GLOB_TILDE, NULL, &gl);
+ if (r == GLOB_NOMATCH) {
+ debug("%.200s line %d: include %s matched no "
+ "files",filename, linenum, arg2);
+ continue;
+ } else if (r != 0 || gl.gl_pathc < 0)
+ fatal("%.200s line %d: glob failed for %s.",
+ filename, linenum, arg2);
+ free(arg2);
+ oactive = *activep;
+ for (i = 0; i < (u_int)gl.gl_pathc; i++) {
+ debug3("%.200s line %d: Including file %s "
+ "depth %d%s", filename, linenum,
+ gl.gl_pathv[i], depth,
+ oactive ? "" : " (parse only)");
+ r = read_config_file_depth(gl.gl_pathv[i],
+ pw, host, original_host, options,
+ flags | SSHCONF_CHECKPERM |
+ (oactive ? 0 : SSHCONF_NEVERMATCH),
+ activep, depth + 1);
+ /*
+ * don't let Match in includes clobber the
+ * containing file's Match state.
+ */
+ *activep = oactive;
+ if (r != 1)
+ value = -1;
+ }
+ globfree(&gl);
+ }
+ if (value != 0)
+ return value;
+ break;
+
case oIPQoS:
arg = strdelim(&s);
if ((value = parse_ipqos(arg)) == -1)
@@ -1321,10 +1534,6 @@
}
break;
- case oUseRoaming:
- intptr = &options->use_roaming;
- goto parse_flag;
-
case oRequestTTY:
intptr = &options->request_tty;
multistate_ptr = multistate_requesttty;
@@ -1394,6 +1603,60 @@
intptr = &options->canonicalize_fallback_local;
goto parse_flag;
+ case oStreamLocalBindMask:
+ arg = strdelim(&s);
+ if (!arg || *arg == '\0')
+ fatal("%.200s line %d: Missing StreamLocalBindMask argument.", filename, linenum);
+ /* Parse mode in octal format */
+ value = strtol(arg, &endofnumber, 8);
+ if (arg == endofnumber || value < 0 || value > 0777)
+ fatal("%.200s line %d: Bad mask.", filename, linenum);
+ options->fwd_opts.streamlocal_bind_mask = (mode_t)value;
+ break;
+
+ case oStreamLocalBindUnlink:
+ intptr = &options->fwd_opts.streamlocal_bind_unlink;
+ goto parse_flag;
+
+ case oRevokedHostKeys:
+ charptr = &options->revoked_host_keys;
+ goto parse_string;
+
+ case oFingerprintHash:
+ intptr = &options->fingerprint_hash;
+ arg = strdelim(&s);
+ if (!arg || *arg == '\0')
+ fatal("%.200s line %d: Missing argument.",
+ filename, linenum);
+ if ((value = ssh_digest_alg_by_name(arg)) == -1)
+ fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
+ filename, linenum, arg);
+ if (*activep && *intptr == -1)
+ *intptr = value;
+ break;
+
+ case oUpdateHostkeys:
+ intptr = &options->update_hostkeys;
+ multistate_ptr = multistate_yesnoask;
+ goto parse_multistate;
+
+ case oHostbasedKeyTypes:
+ charptr = &options->hostbased_key_types;
+ goto parse_keytypes;
+
+ case oPubkeyAcceptedKeyTypes:
+ charptr = &options->pubkey_key_types;
+ goto parse_keytypes;
+
+ case oAddKeysToAgent:
+ intptr = &options->add_keys_to_agent;
+ multistate_ptr = multistate_yesnoaskconfirm;
+ goto parse_multistate;
+
+ case oIdentityAgent:
+ charptr = &options->identity_agent;
+ goto parse_string;
+
case oDeprecated:
debug("%s line %d: Deprecated option \"%s\"",
filename, linenum, keyword);
@@ -1405,7 +1668,7 @@
return 0;
default:
- fatal("process_config_line: Unimplemented opcode %d", opcode);
+ fatal("%s: Unimplemented opcode %d", __func__, opcode);
}
/* Check that there is no garbage at end of line. */
@@ -1416,22 +1679,35 @@
return 0;
}
-
/*
* Reads the config file and modifies the options accordingly. Options
* should already be initialized before this call. This never returns if
* there is an error. If the file does not exist, this returns 0.
*/
-
int
read_config_file(const char *filename, struct passwd *pw, const char *host,
- Options *options, int flags)
+ const char *original_host, Options *options, int flags)
{
+ int active = 1;
+
+ return read_config_file_depth(filename, pw, host, original_host,
+ options, flags, &active, 0);
+}
+
+#define READCONF_MAX_DEPTH 16
+static int
+read_config_file_depth(const char *filename, struct passwd *pw,
+ const char *host, const char *original_host, Options *options,
+ int flags, int *activep, int depth)
+{
FILE *f;
char line[1024];
- int active, linenum;
+ int linenum;
int bad_options = 0;
+ if (depth < 0 || depth > READCONF_MAX_DEPTH)
+ fatal("Too many recursive configuration includes");
+
if ((f = fopen(filename, "r")) == NULL)
return 0;
@@ -1451,13 +1727,12 @@
* Mark that we are now processing the options. This flag is turned
* on/off by Host specifications.
*/
- active = 1;
linenum = 0;
while (fgets(line, sizeof(line), f)) {
/* Update line number counter. */
linenum++;
- if (process_config_line(options, pw, host, line, filename,
- linenum, &active, flags & SSHCONF_USERCONF) != 0)
+ if (process_config_line_depth(options, pw, host, original_host,
+ line, filename, linenum, activep, flags, depth) != 0)
bad_options++;
}
fclose(f);
@@ -1489,9 +1764,14 @@
options->forward_x11 = -1;
options->forward_x11_trusted = -1;
options->forward_x11_timeout = -1;
+ options->stdio_forward_host = NULL;
+ options->stdio_forward_port = 0;
+ options->clear_forwardings = -1;
options->exit_on_forward_failure = -1;
options->xauth_location = NULL;
- options->gateway_ports = -1;
+ options->fwd_opts.gateway_ports = -1;
+ options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
+ options->fwd_opts.streamlocal_bind_unlink = -1;
options->use_privileged_port = -1;
options->rsa_authentication = -1;
options->pubkey_authentication = -1;
@@ -1521,9 +1801,14 @@
options->hostkeyalgorithms = NULL;
options->protocol = SSH_PROTO_UNKNOWN;
options->num_identity_files = 0;
+ options->num_certificate_files = 0;
options->hostname = NULL;
options->host_key_alias = NULL;
options->proxy_command = NULL;
+ options->jump_user = NULL;
+ options->jump_host = NULL;
+ options->jump_port = -1;
+ options->jump_extra = NULL;
options->user = NULL;
options->escape_char = -1;
options->num_system_hostfiles = 0;
@@ -1532,7 +1817,6 @@
options->num_local_forwards = 0;
options->remote_forwards = NULL;
options->num_remote_forwards = 0;
- options->clear_forwardings = -1;
options->log_level = SYSLOG_LEVEL_NOT_SET;
options->preferred_authentications = NULL;
options->bind_address = NULL;
@@ -1556,7 +1840,8 @@
options->tun_remote = -1;
options->local_command = NULL;
options->permit_local_command = -1;
- options->use_roaming = -1;
+ options->add_keys_to_agent = -1;
+ options->identity_agent = NULL;
options->visual_host_key = -1;
options->ip_qos_interactive = -1;
options->ip_qos_bulk = -1;
@@ -1568,6 +1853,11 @@
options->canonicalize_max_dots = -1;
options->canonicalize_fallback_local = -1;
options->canonicalize_hostname = -1;
+ options->revoked_host_keys = NULL;
+ options->fingerprint_hash = -1;
+ options->update_hostkeys = -1;
+ options->hostbased_key_types = NULL;
+ options->pubkey_key_types = NULL;
}
/*
@@ -1600,12 +1890,27 @@
options->forward_x11_trusted = 0;
if (options->forward_x11_timeout == -1)
options->forward_x11_timeout = 1200;
+ /*
+ * stdio forwarding (-W) changes the default for these but we defer
+ * setting the values so they can be overridden.
+ */
if (options->exit_on_forward_failure == -1)
- options->exit_on_forward_failure = 0;
+ options->exit_on_forward_failure =
+ options->stdio_forward_host != NULL ? 1 : 0;
+ if (options->clear_forwardings == -1)
+ options->clear_forwardings =
+ options->stdio_forward_host != NULL ? 1 : 0;
+ if (options->clear_forwardings == 1)
+ clear_forwardings(options);
+
if (options->xauth_location == NULL)
options->xauth_location = _PATH_XAUTH;
- if (options->gateway_ports == -1)
- options->gateway_ports = 0;
+ if (options->fwd_opts.gateway_ports == -1)
+ options->fwd_opts.gateway_ports = 0;
+ if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
+ options->fwd_opts.streamlocal_bind_mask = 0177;
+ if (options->fwd_opts.streamlocal_bind_unlink == -1)
+ options->fwd_opts.streamlocal_bind_unlink = 0;
if (options->use_privileged_port == -1)
options->use_privileged_port = 0;
if (options->rsa_authentication == -1)
@@ -1649,12 +1954,11 @@
/* Selected in ssh_login(). */
if (options->cipher == -1)
options->cipher = SSH_CIPHER_NOT_SET;
- /* options->ciphers, default set in myproposals.h */
- /* options->macs, default set in myproposals.h */
- /* options->kex_algorithms, default set in myproposals.h */
/* options->hostkeyalgorithms, default set in myproposals.h */
if (options->protocol == SSH_PROTO_UNKNOWN)
options->protocol = SSH_PROTO_2;
+ if (options->add_keys_to_agent == -1)
+ options->add_keys_to_agent = 0;
if (options->num_identity_files == 0) {
if (options->protocol & SSH_PROTO_1) {
add_identity_file(options, "~/",
@@ -1689,8 +1993,6 @@
}
if (options->log_level == SYSLOG_LEVEL_NOT_SET)
options->log_level = SYSLOG_LEVEL_INFO;
- if (options->clear_forwardings == 1)
- clear_forwardings(options);
if (options->no_host_authentication_for_localhost == - 1)
options->no_host_authentication_for_localhost = 0;
if (options->identities_only == -1)
@@ -1723,7 +2025,6 @@
options->tun_remote = SSH_TUNID_ANY;
if (options->permit_local_command == -1)
options->permit_local_command = 0;
- options->use_roaming = 0;
if (options->visual_host_key == -1)
options->visual_host_key = 0;
if (options->ip_qos_interactive == -1)
@@ -1740,6 +2041,19 @@
options->canonicalize_fallback_local = 1;
if (options->canonicalize_hostname == -1)
options->canonicalize_hostname = SSH_CANONICALISE_NO;
+ if (options->fingerprint_hash == -1)
+ options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
+ if (options->update_hostkeys == -1)
+ options->update_hostkeys = 0;
+ if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
+ kex_assemble_names(KEX_CLIENT_MAC, &options->macs) != 0 ||
+ kex_assemble_names(KEX_CLIENT_KEX, &options->kex_algorithms) != 0 ||
+ kex_assemble_names(KEX_DEFAULT_PK_ALG,
+ &options->hostbased_key_types) != 0 ||
+ kex_assemble_names(KEX_DEFAULT_PK_ALG,
+ &options->pubkey_key_types) != 0)
+ fatal("%s: kex_assemble_names failed", __func__);
+
#define CLEAR_ON_NONE(v) \
do { \
if (option_clear_or_none(v)) { \
@@ -1750,6 +2064,8 @@
CLEAR_ON_NONE(options->local_command);
CLEAR_ON_NONE(options->proxy_command);
CLEAR_ON_NONE(options->control_path);
+ CLEAR_ON_NONE(options->revoked_host_keys);
+ /* options->identity_agent distinguishes NULL from 'none' */
/* options->user will be set in the main program if appropriate */
/* options->hostname will be set in the main program if appropriate */
/* options->host_key_alias should not be set by default */
@@ -1756,22 +2072,93 @@
/* options->preferred_authentications will be set in ssh */
}
+struct fwdarg {
+ char *arg;
+ int ispath;
+};
+
/*
+ * parse_fwd_field
+ * parses the next field in a port forwarding specification.
+ * sets fwd to the parsed field and advances p past the colon
+ * or sets it to NULL at end of string.
+ * returns 0 on success, else non-zero.
+ */
+static int
+parse_fwd_field(char **p, struct fwdarg *fwd)
+{
+ char *ep, *cp = *p;
+ int ispath = 0;
+
+ if (*cp == '\0') {
+ *p = NULL;
+ return -1; /* end of string */
+ }
+
+ /*
+ * A field escaped with square brackets is used literally.
+ * XXX - allow ']' to be escaped via backslash?
+ */
+ if (*cp == '[') {
+ /* find matching ']' */
+ for (ep = cp + 1; *ep != ']' && *ep != '\0'; ep++) {
+ if (*ep == '/')
+ ispath = 1;
+ }
+ /* no matching ']' or not at end of field. */
+ if (ep[0] != ']' || (ep[1] != ':' && ep[1] != '\0'))
+ return -1;
+ /* NUL terminate the field and advance p past the colon */
+ *ep++ = '\0';
+ if (*ep != '\0')
+ *ep++ = '\0';
+ fwd->arg = cp + 1;
+ fwd->ispath = ispath;
+ *p = ep;
+ return 0;
+ }
+
+ for (cp = *p; *cp != '\0'; cp++) {
+ switch (*cp) {
+ case '\\':
+ memmove(cp, cp + 1, strlen(cp + 1) + 1);
+ if (*cp == '\0')
+ return -1;
+ break;
+ case '/':
+ ispath = 1;
+ break;
+ case ':':
+ *cp++ = '\0';
+ goto done;
+ }
+ }
+done:
+ fwd->arg = *p;
+ fwd->ispath = ispath;
+ *p = cp;
+ return 0;
+}
+
+/*
* parse_forward
* parses a string containing a port forwarding specification of the form:
* dynamicfwd == 0
- * [listenhost:]listenport:connecthost:connectport
+ * [listenhost:]listenport|listenpath:connecthost:connectport|connectpath
+ * listenpath:connectpath
* dynamicfwd == 1
* [listenhost:]listenport
* returns number of arguments parsed or zero on error
*/
int
-parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
+parse_forward(struct Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
{
+ struct fwdarg fwdargs[4];
+ char *p, *cp;
int i;
- char *p, *cp, *fwdarg[4];
- memset(fwd, '\0', sizeof(*fwd));
+ memset(fwd, 0, sizeof(*fwd));
+ memset(fwdargs, 0, sizeof(fwdargs));
cp = p = xstrdup(fwdspec);
@@ -1779,39 +2166,70 @@
while (isspace((u_char)*cp))
cp++;
- for (i = 0; i < 4; ++i)
- if ((fwdarg[i] = hpdelim(&cp)) == NULL)
+ for (i = 0; i < 4; ++i) {
+ if (parse_fwd_field(&cp, &fwdargs[i]) != 0)
break;
+ }
/* Check for trailing garbage */
- if (cp != NULL)
+ if (cp != NULL && *cp != '\0') {
i = 0; /* failure */
+ }
switch (i) {
case 1:
- fwd->listen_host = NULL;
- fwd->listen_port = a2port(fwdarg[0]);
+ if (fwdargs[0].ispath) {
+ fwd->listen_path = xstrdup(fwdargs[0].arg);
+ fwd->listen_port = PORT_STREAMLOCAL;
+ } else {
+ fwd->listen_host = NULL;
+ fwd->listen_port = a2port(fwdargs[0].arg);
+ }
fwd->connect_host = xstrdup("socks");
break;
case 2:
- fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
- fwd->listen_port = a2port(fwdarg[1]);
- fwd->connect_host = xstrdup("socks");
+ if (fwdargs[0].ispath && fwdargs[1].ispath) {
+ fwd->listen_path = xstrdup(fwdargs[0].arg);
+ fwd->listen_port = PORT_STREAMLOCAL;
+ fwd->connect_path = xstrdup(fwdargs[1].arg);
+ fwd->connect_port = PORT_STREAMLOCAL;
+ } else if (fwdargs[1].ispath) {
+ fwd->listen_host = NULL;
+ fwd->listen_port = a2port(fwdargs[0].arg);
+ fwd->connect_path = xstrdup(fwdargs[1].arg);
+ fwd->connect_port = PORT_STREAMLOCAL;
+ } else {
+ fwd->listen_host = xstrdup(fwdargs[0].arg);
+ fwd->listen_port = a2port(fwdargs[1].arg);
+ fwd->connect_host = xstrdup("socks");
+ }
break;
case 3:
- fwd->listen_host = NULL;
- fwd->listen_port = a2port(fwdarg[0]);
- fwd->connect_host = xstrdup(cleanhostname(fwdarg[1]));
- fwd->connect_port = a2port(fwdarg[2]);
+ if (fwdargs[0].ispath) {
+ fwd->listen_path = xstrdup(fwdargs[0].arg);
+ fwd->listen_port = PORT_STREAMLOCAL;
+ fwd->connect_host = xstrdup(fwdargs[1].arg);
+ fwd->connect_port = a2port(fwdargs[2].arg);
+ } else if (fwdargs[2].ispath) {
+ fwd->listen_host = xstrdup(fwdargs[0].arg);
+ fwd->listen_port = a2port(fwdargs[1].arg);
+ fwd->connect_path = xstrdup(fwdargs[2].arg);
+ fwd->connect_port = PORT_STREAMLOCAL;
+ } else {
+ fwd->listen_host = NULL;
+ fwd->listen_port = a2port(fwdargs[0].arg);
+ fwd->connect_host = xstrdup(fwdargs[1].arg);
+ fwd->connect_port = a2port(fwdargs[2].arg);
+ }
break;
case 4:
- fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
- fwd->listen_port = a2port(fwdarg[1]);
- fwd->connect_host = xstrdup(cleanhostname(fwdarg[2]));
- fwd->connect_port = a2port(fwdarg[3]);
+ fwd->listen_host = xstrdup(fwdargs[0].arg);
+ fwd->listen_port = a2port(fwdargs[1].arg);
+ fwd->connect_host = xstrdup(fwdargs[2].arg);
+ fwd->connect_port = a2port(fwdargs[3].arg);
break;
default:
i = 0; /* failure */
@@ -1823,29 +2241,422 @@
if (!(i == 1 || i == 2))
goto fail_free;
} else {
- if (!(i == 3 || i == 4))
+ if (!(i == 3 || i == 4)) {
+ if (fwd->connect_path == NULL &&
+ fwd->listen_path == NULL)
+ goto fail_free;
+ }
+ if (fwd->connect_port <= 0 && fwd->connect_path == NULL)
goto fail_free;
- if (fwd->connect_port <= 0)
- goto fail_free;
}
- if (fwd->listen_port < 0 || (!remotefwd && fwd->listen_port == 0))
+ if ((fwd->listen_port < 0 && fwd->listen_path == NULL) ||
+ (!remotefwd && fwd->listen_port == 0))
goto fail_free;
-
if (fwd->connect_host != NULL &&
strlen(fwd->connect_host) >= NI_MAXHOST)
goto fail_free;
+ /* XXX - if connecting to a remote socket, max sun len may not match this host */
+ if (fwd->connect_path != NULL &&
+ strlen(fwd->connect_path) >= PATH_MAX_SUN)
+ goto fail_free;
if (fwd->listen_host != NULL &&
strlen(fwd->listen_host) >= NI_MAXHOST)
goto fail_free;
+ if (fwd->listen_path != NULL &&
+ strlen(fwd->listen_path) >= PATH_MAX_SUN)
+ goto fail_free;
-
return (i);
fail_free:
free(fwd->connect_host);
fwd->connect_host = NULL;
+ free(fwd->connect_path);
+ fwd->connect_path = NULL;
free(fwd->listen_host);
fwd->listen_host = NULL;
+ free(fwd->listen_path);
+ fwd->listen_path = NULL;
return (0);
}
+
+int
+parse_jump(const char *s, Options *o, int active)
+{
+ char *orig, *sdup, *cp;
+ char *host = NULL, *user = NULL;
+ int ret = -1, port = -1, first;
+
+ active &= o->proxy_command == NULL && o->jump_host == NULL;
+
+ orig = sdup = xstrdup(s);
+ first = active;
+ do {
+ if ((cp = strrchr(sdup, ',')) == NULL)
+ cp = sdup; /* last */
+ else
+ *cp++ = '\0';
+
+ if (first) {
+ /* First argument and configuration is active */
+ if (parse_user_host_port(cp, &user, &host, &port) != 0)
+ goto out;
+ } else {
+ /* Subsequent argument or inactive configuration */
+ if (parse_user_host_port(cp, NULL, NULL, NULL) != 0)
+ goto out;
+ }
+ first = 0; /* only check syntax for subsequent hosts */
+ } while (cp != sdup);
+ /* success */
+ if (active) {
+ o->jump_user = user;
+ o->jump_host = host;
+ o->jump_port = port;
+ o->proxy_command = xstrdup("none");
+ user = host = NULL;
+ if ((cp = strrchr(s, ',')) != NULL && cp != s) {
+ o->jump_extra = xstrdup(s);
+ o->jump_extra[cp - s] = '\0';
+ }
+ }
+ ret = 0;
+ out:
+ free(orig);
+ free(user);
+ free(host);
+ return ret;
+}
+
+/* XXX the following is a near-vebatim copy from servconf.c; refactor */
+static const char *
+fmt_multistate_int(int val, const struct multistate *m)
+{
+ u_int i;
+
+ for (i = 0; m[i].key != NULL; i++) {
+ if (m[i].value == val)
+ return m[i].key;
+ }
+ return "UNKNOWN";
+}
+
+static const char *
+fmt_intarg(OpCodes code, int val)
+{
+ if (val == -1)
+ return "unset";
+ switch (code) {
+ case oAddressFamily:
+ return fmt_multistate_int(val, multistate_addressfamily);
+ case oVerifyHostKeyDNS:
+ case oStrictHostKeyChecking:
+ case oUpdateHostkeys:
+ return fmt_multistate_int(val, multistate_yesnoask);
+ case oControlMaster:
+ return fmt_multistate_int(val, multistate_controlmaster);
+ case oTunnel:
+ return fmt_multistate_int(val, multistate_tunnel);
+ case oRequestTTY:
+ return fmt_multistate_int(val, multistate_requesttty);
+ case oCanonicalizeHostname:
+ return fmt_multistate_int(val, multistate_canonicalizehostname);
+ case oFingerprintHash:
+ return ssh_digest_alg_name(val);
+ case oProtocol:
+ switch (val) {
+ case SSH_PROTO_1:
+ return "1";
+ case SSH_PROTO_2:
+ return "2";
+ case (SSH_PROTO_1|SSH_PROTO_2):
+ return "2,1";
+ default:
+ return "UNKNOWN";
+ }
+ default:
+ switch (val) {
+ case 0:
+ return "no";
+ case 1:
+ return "yes";
+ default:
+ return "UNKNOWN";
+ }
+ }
+}
+
+static const char *
+lookup_opcode_name(OpCodes code)
+{
+ u_int i;
+
+ for (i = 0; keywords[i].name != NULL; i++)
+ if (keywords[i].opcode == code)
+ return(keywords[i].name);
+ return "UNKNOWN";
+}
+
+static void
+dump_cfg_int(OpCodes code, int val)
+{
+ printf("%s %d\n", lookup_opcode_name(code), val);
+}
+
+static void
+dump_cfg_fmtint(OpCodes code, int val)
+{
+ printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
+}
+
+static void
+dump_cfg_string(OpCodes code, const char *val)
+{
+ if (val == NULL)
+ return;
+ printf("%s %s\n", lookup_opcode_name(code), val);
+}
+
+static void
+dump_cfg_strarray(OpCodes code, u_int count, char **vals)
+{
+ u_int i;
+
+ for (i = 0; i < count; i++)
+ printf("%s %s\n", lookup_opcode_name(code), vals[i]);
+}
+
+static void
+dump_cfg_strarray_oneline(OpCodes code, u_int count, char **vals)
+{
+ u_int i;
+
+ printf("%s", lookup_opcode_name(code));
+ for (i = 0; i < count; i++)
+ printf(" %s", vals[i]);
+ printf("\n");
+}
+
+static void
+dump_cfg_forwards(OpCodes code, u_int count, const struct Forward *fwds)
+{
+ const struct Forward *fwd;
+ u_int i;
+
+ /* oDynamicForward */
+ for (i = 0; i < count; i++) {
+ fwd = &fwds[i];
+ if (code == oDynamicForward &&
+ strcmp(fwd->connect_host, "socks") != 0)
+ continue;
+ if (code == oLocalForward &&
+ strcmp(fwd->connect_host, "socks") == 0)
+ continue;
+ printf("%s", lookup_opcode_name(code));
+ if (fwd->listen_port == PORT_STREAMLOCAL)
+ printf(" %s", fwd->listen_path);
+ else if (fwd->listen_host == NULL)
+ printf(" %d", fwd->listen_port);
+ else {
+ printf(" [%s]:%d",
+ fwd->listen_host, fwd->listen_port);
+ }
+ if (code != oDynamicForward) {
+ if (fwd->connect_port == PORT_STREAMLOCAL)
+ printf(" %s", fwd->connect_path);
+ else if (fwd->connect_host == NULL)
+ printf(" %d", fwd->connect_port);
+ else {
+ printf(" [%s]:%d",
+ fwd->connect_host, fwd->connect_port);
+ }
+ }
+ printf("\n");
+ }
+}
+
+void
+dump_client_config(Options *o, const char *host)
+{
+ int i;
+ char buf[8];
+
+ /* This is normally prepared in ssh_kex2 */
+ if (kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->hostkeyalgorithms) != 0)
+ fatal("%s: kex_assemble_names failed", __func__);
+
+ /* Most interesting options first: user, host, port */
+ dump_cfg_string(oUser, o->user);
+ dump_cfg_string(oHostName, host);
+ dump_cfg_int(oPort, o->port);
+
+ /* Flag options */
+ dump_cfg_fmtint(oAddressFamily, o->address_family);
+ dump_cfg_fmtint(oBatchMode, o->batch_mode);
+ dump_cfg_fmtint(oCanonicalizeFallbackLocal, o->canonicalize_fallback_local);
+ dump_cfg_fmtint(oCanonicalizeHostname, o->canonicalize_hostname);
+ dump_cfg_fmtint(oChallengeResponseAuthentication, o->challenge_response_authentication);
+ dump_cfg_fmtint(oCheckHostIP, o->check_host_ip);
+ dump_cfg_fmtint(oCompression, o->compression);
+ dump_cfg_fmtint(oControlMaster, o->control_master);
+ dump_cfg_fmtint(oEnableSSHKeysign, o->enable_ssh_keysign);
+ dump_cfg_fmtint(oClearAllForwardings, o->clear_forwardings);
+ dump_cfg_fmtint(oExitOnForwardFailure, o->exit_on_forward_failure);
+ dump_cfg_fmtint(oFingerprintHash, o->fingerprint_hash);
+ dump_cfg_fmtint(oForwardAgent, o->forward_agent);
+ dump_cfg_fmtint(oForwardX11, o->forward_x11);
+ dump_cfg_fmtint(oForwardX11Trusted, o->forward_x11_trusted);
+ dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
+#ifdef GSSAPI
+ dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
+ dump_cfg_fmtint(oGssDelegateCreds, o->gss_deleg_creds);
+#endif /* GSSAPI */
+ dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
+ dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
+ dump_cfg_fmtint(oIdentitiesOnly, o->identities_only);
+ dump_cfg_fmtint(oKbdInteractiveAuthentication, o->kbd_interactive_authentication);
+ dump_cfg_fmtint(oNoHostAuthenticationForLocalhost, o->no_host_authentication_for_localhost);
+ dump_cfg_fmtint(oPasswordAuthentication, o->password_authentication);
+ dump_cfg_fmtint(oPermitLocalCommand, o->permit_local_command);
+ dump_cfg_fmtint(oProtocol, o->protocol);
+ dump_cfg_fmtint(oProxyUseFdpass, o->proxy_use_fdpass);
+ dump_cfg_fmtint(oPubkeyAuthentication, o->pubkey_authentication);
+ dump_cfg_fmtint(oRequestTTY, o->request_tty);
+ dump_cfg_fmtint(oRhostsRSAAuthentication, o->rhosts_rsa_authentication);
+ dump_cfg_fmtint(oRSAAuthentication, o->rsa_authentication);
+ dump_cfg_fmtint(oStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
+ dump_cfg_fmtint(oStrictHostKeyChecking, o->strict_host_key_checking);
+ dump_cfg_fmtint(oTCPKeepAlive, o->tcp_keep_alive);
+ dump_cfg_fmtint(oTunnel, o->tun_open);
+ dump_cfg_fmtint(oUsePrivilegedPort, o->use_privileged_port);
+ dump_cfg_fmtint(oVerifyHostKeyDNS, o->verify_host_key_dns);
+ dump_cfg_fmtint(oVisualHostKey, o->visual_host_key);
+ dump_cfg_fmtint(oUpdateHostkeys, o->update_hostkeys);
+
+ /* Integer options */
+ dump_cfg_int(oCanonicalizeMaxDots, o->canonicalize_max_dots);
+ dump_cfg_int(oCompressionLevel, o->compression_level);
+ dump_cfg_int(oConnectionAttempts, o->connection_attempts);
+ dump_cfg_int(oForwardX11Timeout, o->forward_x11_timeout);
+ dump_cfg_int(oNumberOfPasswordPrompts, o->number_of_password_prompts);
+ dump_cfg_int(oServerAliveCountMax, o->server_alive_count_max);
+ dump_cfg_int(oServerAliveInterval, o->server_alive_interval);
+
+ /* String options */
+ dump_cfg_string(oBindAddress, o->bind_address);
+ dump_cfg_string(oCiphers, o->ciphers ? o->ciphers : KEX_CLIENT_ENCRYPT);
+ dump_cfg_string(oControlPath, o->control_path);
+ dump_cfg_string(oHostKeyAlgorithms, o->hostkeyalgorithms);
+ dump_cfg_string(oHostKeyAlias, o->host_key_alias);
+ dump_cfg_string(oHostbasedKeyTypes, o->hostbased_key_types);
+ dump_cfg_string(oIdentityAgent, o->identity_agent);
+ dump_cfg_string(oKbdInteractiveDevices, o->kbd_interactive_devices);
+ dump_cfg_string(oKexAlgorithms, o->kex_algorithms ? o->kex_algorithms : KEX_CLIENT_KEX);
+ dump_cfg_string(oLocalCommand, o->local_command);
+ dump_cfg_string(oLogLevel, log_level_name(o->log_level));
+ dump_cfg_string(oMacs, o->macs ? o->macs : KEX_CLIENT_MAC);
+ dump_cfg_string(oPKCS11Provider, o->pkcs11_provider);
+ dump_cfg_string(oPreferredAuthentications, o->preferred_authentications);
+ dump_cfg_string(oPubkeyAcceptedKeyTypes, o->pubkey_key_types);
+ dump_cfg_string(oRevokedHostKeys, o->revoked_host_keys);
+ dump_cfg_string(oXAuthLocation, o->xauth_location);
+
+ /* Forwards */
+ dump_cfg_forwards(oDynamicForward, o->num_local_forwards, o->local_forwards);
+ dump_cfg_forwards(oLocalForward, o->num_local_forwards, o->local_forwards);
+ dump_cfg_forwards(oRemoteForward, o->num_remote_forwards, o->remote_forwards);
+
+ /* String array options */
+ dump_cfg_strarray(oIdentityFile, o->num_identity_files, o->identity_files);
+ dump_cfg_strarray_oneline(oCanonicalDomains, o->num_canonical_domains, o->canonical_domains);
+ dump_cfg_strarray_oneline(oGlobalKnownHostsFile, o->num_system_hostfiles, o->system_hostfiles);
+ dump_cfg_strarray_oneline(oUserKnownHostsFile, o->num_user_hostfiles, o->user_hostfiles);
+ dump_cfg_strarray(oSendEnv, o->num_send_env, o->send_env);
+
+ /* Special cases */
+
+ /* oConnectTimeout */
+ if (o->connection_timeout == -1)
+ printf("connecttimeout none\n");
+ else
+ dump_cfg_int(oConnectTimeout, o->connection_timeout);
+
+ /* oTunnelDevice */
+ printf("tunneldevice");
+ if (o->tun_local == SSH_TUNID_ANY)
+ printf(" any");
+ else
+ printf(" %d", o->tun_local);
+ if (o->tun_remote == SSH_TUNID_ANY)
+ printf(":any");
+ else
+ printf(":%d", o->tun_remote);
+ printf("\n");
+
+ /* oCanonicalizePermittedCNAMEs */
+ if ( o->num_permitted_cnames > 0) {
+ printf("canonicalizePermittedcnames");
+ for (i = 0; i < o->num_permitted_cnames; i++) {
+ printf(" %s:%s", o->permitted_cnames[i].source_list,
+ o->permitted_cnames[i].target_list);
+ }
+ printf("\n");
+ }
+
+ /* oCipher */
+ if (o->cipher != SSH_CIPHER_NOT_SET)
+ printf("Cipher %s\n", cipher_name(o->cipher));
+
+ /* oControlPersist */
+ if (o->control_persist == 0 || o->control_persist_timeout == 0)
+ dump_cfg_fmtint(oControlPersist, o->control_persist);
+ else
+ dump_cfg_int(oControlPersist, o->control_persist_timeout);
+
+ /* oEscapeChar */
+ if (o->escape_char == SSH_ESCAPECHAR_NONE)
+ printf("escapechar none\n");
+ else {
+ vis(buf, o->escape_char, VIS_WHITE, 0);
+ printf("escapechar %s\n", buf);
+ }
+
+ /* oIPQoS */
+ printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
+ printf("%s\n", iptos2str(o->ip_qos_bulk));
+
+ /* oRekeyLimit */
+ printf("rekeylimit %llu %d\n",
+ (unsigned long long)o->rekey_limit, o->rekey_interval);
+
+ /* oStreamLocalBindMask */
+ printf("streamlocalbindmask 0%o\n",
+ o->fwd_opts.streamlocal_bind_mask);
+
+ /* oProxyCommand / oProxyJump */
+ if (o->jump_host == NULL)
+ dump_cfg_string(oProxyCommand, o->proxy_command);
+ else {
+ /* Check for numeric addresses */
+ i = strchr(o->jump_host, ':') != NULL ||
+ strspn(o->jump_host, "1234567890.") == strlen(o->jump_host);
+ snprintf(buf, sizeof(buf), "%d", o->jump_port);
+ printf("proxyjump %s%s%s%s%s%s%s%s%s\n",
+ /* optional additional jump spec */
+ o->jump_extra == NULL ? "" : o->jump_extra,
+ o->jump_extra == NULL ? "" : ",",
+ /* optional user */
+ o->jump_user == NULL ? "" : o->jump_user,
+ o->jump_user == NULL ? "" : "@",
+ /* opening [ if hostname is numeric */
+ i ? "[" : "",
+ /* mandatory hostname */
+ o->jump_host,
+ /* closing ] if hostname is numeric */
+ i ? "]" : "",
+ /* optional port number */
+ o->jump_port <= 0 ? "" : ":",
+ o->jump_port <= 0 ? "" : buf);
+ }
+}
Modified: trunk/crypto/openssh/readconf.h
===================================================================
--- trunk/crypto/openssh/readconf.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/readconf.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.h,v 1.101 2014/02/23 20:11:36 djm Exp $ */
+/* $OpenBSD: readconf.h,v 1.117 2016/07/15 00:24:30 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -16,21 +16,12 @@
#ifndef READCONF_H
#define READCONF_H
-/* Data structure for representing a forwarding request. */
-
-typedef struct {
- char *listen_host; /* Host (address) to listen on. */
- int listen_port; /* Port to forward. */
- char *connect_host; /* Host to connect. */
- int connect_port; /* Port to connect on connect_host. */
- int allocated_port; /* Dynamically allocated listen port */
- int handle; /* Handle for dynamic listen ports */
-} Forward;
/* Data structure for representing option data. */
#define MAX_SEND_ENV 256
#define SSH_MAX_HOSTS_FILES 32
#define MAX_CANON_DOMAINS 32
+#define PATH_MAX_SUN (sizeof((struct sockaddr_un *)0)->sun_path)
struct allowed_cname {
char *source_list;
@@ -44,7 +35,7 @@
int forward_x11_trusted; /* Trust Forward X11 display. */
int exit_on_forward_failure; /* Exit if bind(2) fails for -L/-R */
char *xauth_location; /* Location for xauth program */
- int gateway_ports; /* Allow remote connects to forwarded ports. */
+ struct ForwardOptions fwd_opts; /* forwarding options */
int use_privileged_port; /* Don't use privileged port if false. */
int rhosts_rsa_authentication; /* Try rhosts with RSA
* authentication. */
@@ -102,17 +93,29 @@
int num_identity_files; /* Number of files for RSA/DSA identities. */
char *identity_files[SSH_MAX_IDENTITY_FILES];
int identity_file_userprovided[SSH_MAX_IDENTITY_FILES];
- Key *identity_keys[SSH_MAX_IDENTITY_FILES];
+ struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES];
+ int num_certificate_files; /* Number of extra certificates for ssh. */
+ char *certificate_files[SSH_MAX_CERTIFICATE_FILES];
+ int certificate_file_userprovided[SSH_MAX_CERTIFICATE_FILES];
+ struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES];
+
+ int add_keys_to_agent;
+ char *identity_agent; /* Optional path to ssh-agent socket */
+
/* Local TCP/IP forward requests. */
int num_local_forwards;
- Forward *local_forwards;
+ struct Forward *local_forwards;
/* Remote TCP/IP forward requests. */
int num_remote_forwards;
- Forward *remote_forwards;
+ struct Forward *remote_forwards;
int clear_forwardings;
+ /* stdio forwarding (-W) host and port */
+ char *stdio_forward_host;
+ int stdio_forward_port;
+
int enable_ssh_keysign;
int64_t rekey_limit;
int rekey_interval;
@@ -139,8 +142,6 @@
int permit_local_command;
int visual_host_key;
- int use_roaming;
-
int request_tty;
int proxy_use_fdpass;
@@ -153,6 +154,20 @@
int num_permitted_cnames;
struct allowed_cname permitted_cnames[MAX_CANON_DOMAINS];
+ char *revoked_host_keys;
+
+ int fingerprint_hash;
+
+ int update_hostkeys; /* one of SSH_UPDATE_HOSTKEYS_* */
+
+ char *hostbased_key_types;
+ char *pubkey_key_types;
+
+ char *jump_user;
+ char *jump_host;
+ int jump_port;
+ char *jump_extra;
+
char *ignored_unknown; /* Pattern list of unknown tokens to ignore */
} Options;
@@ -173,20 +188,29 @@
#define SSHCONF_CHECKPERM 1 /* check permissions on config file */
#define SSHCONF_USERCONF 2 /* user provided config file not system */
+#define SSHCONF_POSTCANON 4 /* After hostname canonicalisation */
+#define SSHCONF_NEVERMATCH 8 /* Match/Host never matches; internal only */
+#define SSH_UPDATE_HOSTKEYS_NO 0
+#define SSH_UPDATE_HOSTKEYS_YES 1
+#define SSH_UPDATE_HOSTKEYS_ASK 2
+
void initialize_options(Options *);
void fill_default_options(Options *);
void fill_default_options_for_canonicalization(Options *);
-int process_config_line(Options *, struct passwd *, const char *, char *,
- const char *, int, int *, int);
+int process_config_line(Options *, struct passwd *, const char *,
+ const char *, char *, const char *, int, int *, int);
int read_config_file(const char *, struct passwd *, const char *,
- Options *, int);
-int parse_forward(Forward *, const char *, int, int);
+ const char *, Options *, int);
+int parse_forward(struct Forward *, const char *, int, int);
+int parse_jump(const char *, Options *, int);
int default_ssh_port(void);
int option_clear_or_none(const char *);
+void dump_client_config(Options *o, const char *host);
-void add_local_forward(Options *, const Forward *);
-void add_remote_forward(Options *, const Forward *);
+void add_local_forward(Options *, const struct Forward *);
+void add_remote_forward(Options *, const struct Forward *);
void add_identity_file(Options *, const char *, const char *, int);
+void add_certificate_file(Options *, const char *, int);
#endif /* READCONF_H */
Modified: trunk/crypto/openssh/readpass.c
===================================================================
--- trunk/crypto/openssh/readpass.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/readpass.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: readpass.c,v 1.50 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: readpass.c,v 1.51 2015/12/11 00:20:04 mmcc Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -76,7 +76,7 @@
close(p[0]);
if (dup2(p[1], STDOUT_FILENO) < 0)
fatal("ssh_askpass: dup2: %s", strerror(errno));
- execlp(askpass, askpass, msg, (char *) 0);
+ execlp(askpass, askpass, msg, (char *)NULL);
fatal("ssh_askpass: exec(%s): %s", askpass, strerror(errno));
}
close(p[1]);
Modified: trunk/crypto/openssh/regress/agent-pkcs11.sh
===================================================================
--- trunk/crypto/openssh/regress/agent-pkcs11.sh 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/regress/agent-pkcs11.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $OpenBSD: agent-pkcs11.sh,v 1.1 2010/02/08 10:52:47 markus Exp $
+# $OpenBSD: agent-pkcs11.sh,v 1.2 2015/01/12 11:46:32 djm Exp $
# Placed in the Public Domain.
tid="pkcs11 agent test"
@@ -6,6 +6,8 @@
TEST_SSH_PIN=""
TEST_SSH_PKCS11=/usr/local/lib/soft-pkcs11.so.0.0
+test -f "$TEST_SSH_PKCS11" || fatal "$TEST_SSH_PKCS11 does not exist"
+
# setup environment for soft-pkcs11 token
SOFTPKCS11RC=$OBJ/pkcs11.info
export SOFTPKCS11RC
Copied: trunk/crypto/openssh/regress/cert-file.sh (from rev 9222, vendor-crypto/openssh/dist/regress/cert-file.sh)
===================================================================
--- trunk/crypto/openssh/regress/cert-file.sh (rev 0)
+++ trunk/crypto/openssh/regress/cert-file.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,138 @@
+# $OpenBSD: cert-file.sh,v 1.2 2015/09/24 07:15:39 djm Exp $
+# Placed in the Public Domain.
+
+tid="ssh with certificates"
+
+rm -f $OBJ/user_ca_key* $OBJ/user_key*
+rm -f $OBJ/cert_user_key*
+
+# Create a CA key
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key1 ||\
+ fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key2 ||\
+ fatal "ssh-keygen failed"
+
+# Make some keys and certificates.
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key1 || \
+ fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key2 || \
+ fatal "ssh-keygen failed"
+# Move the certificate to a different address to better control
+# when it is offered.
+${SSHKEYGEN} -q -s $OBJ/user_ca_key1 -I "regress user key for $USER" \
+ -z $$ -n ${USER} $OBJ/user_key1 ||
+ fail "couldn't sign user_key1 with user_ca_key1"
+mv $OBJ/user_key1-cert.pub $OBJ/cert_user_key1_1.pub
+${SSHKEYGEN} -q -s $OBJ/user_ca_key2 -I "regress user key for $USER" \
+ -z $$ -n ${USER} $OBJ/user_key1 ||
+ fail "couldn't sign user_key1 with user_ca_key2"
+mv $OBJ/user_key1-cert.pub $OBJ/cert_user_key1_2.pub
+
+trace 'try with identity files'
+opts="-F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
+opts2="$opts -i $OBJ/user_key1 -i $OBJ/user_key2"
+echo "cert-authority $(cat $OBJ/user_ca_key1.pub)" > $OBJ/authorized_keys_$USER
+
+for p in ${SSH_PROTOCOLS}; do
+ # Just keys should fail
+ ${SSH} $opts2 somehost exit 5$p
+ r=$?
+ if [ $r -eq 5$p ]; then
+ fail "ssh succeeded with no certs in protocol $p"
+ fi
+
+ # Keys with untrusted cert should fail.
+ opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
+ ${SSH} $opts3 somehost exit 5$p
+ r=$?
+ if [ $r -eq 5$p ]; then
+ fail "ssh succeeded with bad cert in protocol $p"
+ fi
+
+ # Good cert with bad key should fail.
+ opts3="$opts -i $OBJ/user_key2"
+ opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+ ${SSH} $opts3 somehost exit 5$p
+ r=$?
+ if [ $r -eq 5$p ]; then
+ fail "ssh succeeded with no matching key in protocol $p"
+ fi
+
+ # Keys with one trusted cert, should succeed.
+ opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+ ${SSH} $opts3 somehost exit 5$p
+ r=$?
+ if [ $r -ne 5$p ]; then
+ fail "ssh failed with trusted cert and key in protocol $p"
+ fi
+
+ # Multiple certs and keys, with one trusted cert, should succeed.
+ opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
+ opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+ ${SSH} $opts3 somehost exit 5$p
+ r=$?
+ if [ $r -ne 5$p ]; then
+ fail "ssh failed with multiple certs in protocol $p"
+ fi
+
+ #Keys with trusted certificate specified in config options, should succeed.
+ opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+ ${SSH} $opts3 somehost exit 5$p
+ r=$?
+ if [ $r -ne 5$p ]; then
+ fail "ssh failed with trusted cert in config in protocol $p"
+ fi
+done
+
+#next, using an agent in combination with the keys
+SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1
+if [ $? -ne 2 ]; then
+ fatal "ssh-add -l did not fail with exit code 2"
+fi
+
+trace "start agent"
+eval `${SSHAGENT} -s` > /dev/null
+r=$?
+if [ $r -ne 0 ]; then
+ fatal "could not start ssh-agent: exit code $r"
+fi
+
+# add private keys to agent
+${SSHADD} -k $OBJ/user_key2 > /dev/null 2>&1
+if [ $? -ne 0 ]; then
+ fatal "ssh-add did not succeed with exit code 0"
+fi
+${SSHADD} -k $OBJ/user_key1 > /dev/null 2>&1
+if [ $? -ne 0 ]; then
+ fatal "ssh-add did not succeed with exit code 0"
+fi
+
+# try ssh with the agent and certificates
+# note: ssh agent only uses certificates in protocol 2
+opts="-F $OBJ/ssh_proxy"
+# with no certificates, shoud fail
+${SSH} -2 $opts somehost exit 52
+if [ $? -eq 52 ]; then
+ fail "ssh connect with agent in protocol 2 succeeded with no cert"
+fi
+
+#with an untrusted certificate, should fail
+opts="$opts -oCertificateFile=$OBJ/cert_user_key1_2.pub"
+${SSH} -2 $opts somehost exit 52
+if [ $? -eq 52 ]; then
+ fail "ssh connect with agent in protocol 2 succeeded with bad cert"
+fi
+
+#with an additional trusted certificate, should succeed
+opts="$opts -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+${SSH} -2 $opts somehost exit 52
+if [ $? -ne 52 ]; then
+ fail "ssh connect with agent in protocol 2 failed with good cert"
+fi
+
+trace "kill agent"
+${SSHAGENT} -k > /dev/null
+
+#cleanup
+rm -f $OBJ/user_ca_key* $OBJ/user_key*
+rm -f $OBJ/cert_user_key*
Modified: trunk/crypto/openssh/regress/cert-hostkey.sh
===================================================================
--- trunk/crypto/openssh/regress/cert-hostkey.sh 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/regress/cert-hostkey.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,55 +1,127 @@
-# $OpenBSD: cert-hostkey.sh,v 1.9 2014/01/26 10:22:10 djm Exp $
+# $OpenBSD: cert-hostkey.sh,v 1.14 2016/05/02 09:52:00 djm Exp $
# Placed in the Public Domain.
tid="certified host keys"
-rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
+rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/host_revoked_*
+rm -f $OBJ/cert_host_key* $OBJ/host_krl_*
+
+# Allow all hostkey/pubkey types, prefer certs for the client
+types=""
+for i in `$SSH -Q key`; do
+ if [ -z "$types" ]; then
+ types="$i"
+ continue
+ fi
+ case "$i" in
+ *cert*) types="$i,$types";;
+ *) types="$types,$i";;
+ esac
+done
+(
+ echo "HostKeyAlgorithms ${types}"
+ echo "PubkeyAcceptedKeyTypes *"
+) >> $OBJ/ssh_proxy
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+(
+ echo "HostKeyAlgorithms *"
+ echo "PubkeyAcceptedKeyTypes *"
+) >> $OBJ/sshd_proxy_bak
HOSTS='localhost-with-alias,127.0.0.1,::1'
-# Create a CA key and add it to known hosts
-${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/host_ca_key ||\
+kh_ca() {
+ for k in "$@" ; do
+ printf "@cert-authority $HOSTS "
+ cat $OBJ/$k || fatal "couldn't cat $k"
+ done
+}
+kh_revoke() {
+ for k in "$@" ; do
+ printf "@revoked * "
+ cat $OBJ/$k || fatal "couldn't cat $k"
+ done
+}
+
+# Create a CA key and add it to known hosts. Ed25519 chosen for speed.
+# RSA for testing RSA/SHA2 signatures.
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/host_ca_key ||\
fail "ssh-keygen of host_ca_key failed"
-(
- echon '@cert-authority '
- echon "$HOSTS "
- cat $OBJ/host_ca_key.pub
-) > $OBJ/known_hosts-cert
+${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/host_ca_key2 ||\
+ fail "ssh-keygen of host_ca_key failed"
+kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
+cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
+
+# Plain text revocation files
+touch $OBJ/host_revoked_empty
+touch $OBJ/host_revoked_plain
+touch $OBJ/host_revoked_cert
+cat $OBJ/host_ca_key.pub $OBJ/host_ca_key2.pub > $OBJ/host_revoked_ca
+
PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/g;s/^ssh-//'`
-type_has_legacy() {
- case $1 in
- ed25519*|ecdsa*) return 1 ;;
- esac
- return 0
-}
+if echo "$PLAIN_TYPES" | grep '^rsa$' >/dev/null 2>&1 ; then
+ PLAIN_TYPES="$PLAIN_TYPES rsa-sha2-256 rsa-sha2-512"
+fi
+# Prepare certificate, plain key and CA KRLs
+${SSHKEYGEN} -kf $OBJ/host_krl_empty || fatal "KRL init failed"
+${SSHKEYGEN} -kf $OBJ/host_krl_plain || fatal "KRL init failed"
+${SSHKEYGEN} -kf $OBJ/host_krl_cert || fatal "KRL init failed"
+${SSHKEYGEN} -kf $OBJ/host_krl_ca $OBJ/host_ca_key.pub $OBJ/host_ca_key2.pub \
+ || fatal "KRL init failed"
+
# Generate and sign host keys
-for ktype in $PLAIN_TYPES ; do
+serial=1
+for ktype in $PLAIN_TYPES ; do
verbose "$tid: sign host ${ktype} cert"
# Generate and sign a host key
${SSHKEYGEN} -q -N '' -t ${ktype} \
-f $OBJ/cert_host_key_${ktype} || \
- fail "ssh-keygen of cert_host_key_${ktype} failed"
- ${SSHKEYGEN} -h -q -s $OBJ/host_ca_key \
+ fatal "ssh-keygen of cert_host_key_${ktype} failed"
+ ${SSHKEYGEN} -ukf $OBJ/host_krl_plain \
+ $OBJ/cert_host_key_${ktype}.pub || fatal "KRL update failed"
+ cat $OBJ/cert_host_key_${ktype}.pub >> $OBJ/host_revoked_plain
+ case $ktype in
+ rsa-sha2-*) tflag="-t $ktype"; ca="$OBJ/host_ca_key2" ;;
+ *) tflag=""; ca="$OBJ/host_ca_key" ;;
+ esac
+ ${SSHKEYGEN} -h -q -s $ca -z $serial $tflag \
-I "regress host key for $USER" \
-n $HOSTS $OBJ/cert_host_key_${ktype} ||
- fail "couldn't sign cert_host_key_${ktype}"
- type_has_legacy $ktype || continue
- cp $OBJ/cert_host_key_${ktype} $OBJ/cert_host_key_${ktype}_v00
- cp $OBJ/cert_host_key_${ktype}.pub $OBJ/cert_host_key_${ktype}_v00.pub
- verbose "$tid: sign host ${ktype}_v00 cert"
- ${SSHKEYGEN} -t v00 -h -q -s $OBJ/host_ca_key \
- -I "regress host key for $USER" \
- -n $HOSTS $OBJ/cert_host_key_${ktype}_v00 ||
- fail "couldn't sign cert_host_key_${ktype}_v00"
+ fatal "couldn't sign cert_host_key_${ktype}"
+ ${SSHKEYGEN} -ukf $OBJ/host_krl_cert \
+ $OBJ/cert_host_key_${ktype}-cert.pub || \
+ fatal "KRL update failed"
+ cat $OBJ/cert_host_key_${ktype}-cert.pub >> $OBJ/host_revoked_cert
+ serial=`expr $serial + 1`
done
-# Basic connect tests
+attempt_connect() {
+ _ident="$1"
+ _expect_success="$2"
+ shift; shift
+ verbose "$tid: $_ident expect success $_expect_success"
+ cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
+ ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+ "$@" -F $OBJ/ssh_proxy somehost true
+ _r=$?
+ if [ "x$_expect_success" = "xyes" ] ; then
+ if [ $_r -ne 0 ]; then
+ fail "ssh cert connect $_ident failed"
+ fi
+ else
+ if [ $_r -eq 0 ]; then
+ fail "ssh cert connect $_ident succeeded unexpectedly"
+ fi
+ fi
+}
+
+# Basic connect and revocation tests.
for privsep in yes no ; do
- for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
+ for ktype in $PLAIN_TYPES ; do
verbose "$tid: host ${ktype} cert connect privsep $privsep"
(
cat $OBJ/sshd_proxy_bak
@@ -58,27 +130,36 @@
echo UsePrivilegeSeparation $privsep
) > $OBJ/sshd_proxy
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
- -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
- -F $OBJ/ssh_proxy somehost true
- if [ $? -ne 0 ]; then
- fail "ssh cert connect failed"
- fi
+ # test name expect success
+ attempt_connect "$ktype basic connect" "yes"
+ attempt_connect "$ktype empty KRL" "yes" \
+ -oRevokedHostKeys=$OBJ/host_krl_empty
+ attempt_connect "$ktype KRL w/ plain key revoked" "no" \
+ -oRevokedHostKeys=$OBJ/host_krl_plain
+ attempt_connect "$ktype KRL w/ cert revoked" "no" \
+ -oRevokedHostKeys=$OBJ/host_krl_cert
+ attempt_connect "$ktype KRL w/ CA revoked" "no" \
+ -oRevokedHostKeys=$OBJ/host_krl_ca
+ attempt_connect "$ktype empty plaintext revocation" "yes" \
+ -oRevokedHostKeys=$OBJ/host_revoked_empty
+ attempt_connect "$ktype plain key plaintext revocation" "no" \
+ -oRevokedHostKeys=$OBJ/host_revoked_plain
+ attempt_connect "$ktype cert plaintext revocation" "no" \
+ -oRevokedHostKeys=$OBJ/host_revoked_cert
+ attempt_connect "$ktype CA plaintext revocation" "no" \
+ -oRevokedHostKeys=$OBJ/host_revoked_ca
done
done
# Revoked certificates with key present
-(
- echon '@cert-authority '
- echon "$HOSTS "
- cat $OBJ/host_ca_key.pub
- for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
- test -f "$OBJ/cert_host_key_${ktype}.pub" || fatal "no pubkey"
- printf "@revoked * `cat $OBJ/cert_host_key_${ktype}.pub`\n"
- done
-) > $OBJ/known_hosts-cert
+kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
+for ktype in $PLAIN_TYPES ; do
+ test -f "$OBJ/cert_host_key_${ktype}.pub" || fatal "no pubkey"
+ kh_revoke cert_host_key_${ktype}.pub >> $OBJ/known_hosts-cert.orig
+done
+cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
for privsep in yes no ; do
- for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
+ for ktype in $PLAIN_TYPES ; do
verbose "$tid: host ${ktype} revoked cert privsep $privsep"
(
cat $OBJ/sshd_proxy_bak
@@ -87,6 +168,7 @@
echo UsePrivilegeSeparation $privsep
) > $OBJ/sshd_proxy
+ cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
@@ -97,15 +179,10 @@
done
# Revoked CA
-(
- echon '@cert-authority '
- echon "$HOSTS "
- cat $OBJ/host_ca_key.pub
- echon '@revoked '
- echon "* "
- cat $OBJ/host_ca_key.pub
-) > $OBJ/known_hosts-cert
-for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
+kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
+kh_revoke host_ca_key.pub host_ca_key2.pub >> $OBJ/known_hosts-cert.orig
+cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
+for ktype in $PLAIN_TYPES ; do
verbose "$tid: host ${ktype} revoked cert"
(
cat $OBJ/sshd_proxy_bak
@@ -112,6 +189,7 @@
echo HostKey $OBJ/cert_host_key_${ktype}
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
) > $OBJ/sshd_proxy
+ cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
@@ -121,11 +199,8 @@
done
# Create a CA key and add it to known hosts
-(
- echon '@cert-authority '
- echon "$HOSTS "
- cat $OBJ/host_ca_key.pub
-) > $OBJ/known_hosts-cert
+kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
+cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
test_one() {
ident=$1
@@ -132,24 +207,21 @@
result=$2
sign_opts=$3
- for kt in rsa rsa_v00 ; do
- case $kt in
- *_v00) args="-t v00" ;;
- *) args="" ;;
+ for kt in rsa ed25519 ; do
+ case $ktype in
+ rsa-sha2-*) tflag="-t $ktype"; ca="$OBJ/host_ca_key2" ;;
+ *) tflag=""; ca="$OBJ/host_ca_key" ;;
esac
-
- verbose "$tid: host cert connect $ident $kt expect $result"
- ${SSHKEYGEN} -q -s $OBJ/host_ca_key \
- -I "regress host key for $USER" \
- $sign_opts $args \
- $OBJ/cert_host_key_${kt} ||
- fail "couldn't sign cert_host_key_${kt}"
+ ${SSHKEYGEN} -q -s $ca $tflag -I "regress host key for $USER" \
+ $sign_opts $OBJ/cert_host_key_${kt} ||
+ fatal "couldn't sign cert_host_key_${kt}"
(
cat $OBJ/sshd_proxy_bak
echo HostKey $OBJ/cert_host_key_${kt}
echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
) > $OBJ/sshd_proxy
-
+
+ cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
@@ -175,70 +247,68 @@
test_one "cert has constraints" failure "-h -Oforce-command=false"
# Check downgrade of cert to raw key when no CA found
-for v in v01 v00 ; do
- for ktype in $PLAIN_TYPES ; do
- type_has_legacy $ktype || continue
- rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
- verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
- # Generate and sign a host key
- ${SSHKEYGEN} -q -N '' -t ${ktype} \
- -f $OBJ/cert_host_key_${ktype} || \
- fail "ssh-keygen of cert_host_key_${ktype} failed"
- ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/host_ca_key \
- -I "regress host key for $USER" \
- -n $HOSTS $OBJ/cert_host_key_${ktype} ||
- fail "couldn't sign cert_host_key_${ktype}"
- (
- echon "$HOSTS "
- cat $OBJ/cert_host_key_${ktype}.pub
- ) > $OBJ/known_hosts-cert
- (
- cat $OBJ/sshd_proxy_bak
- echo HostKey $OBJ/cert_host_key_${ktype}
- echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
- ) > $OBJ/sshd_proxy
-
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
- -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
- -F $OBJ/ssh_proxy somehost true
- if [ $? -ne 0 ]; then
- fail "ssh cert connect failed"
- fi
- done
+for ktype in $PLAIN_TYPES ; do
+ rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
+ verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
+ # Generate and sign a host key
+ ${SSHKEYGEN} -q -N '' -t ${ktype} -f $OBJ/cert_host_key_${ktype} || \
+ fail "ssh-keygen of cert_host_key_${ktype} failed"
+ case $ktype in
+ rsa-sha2-*) tflag="-t $ktype"; ca="$OBJ/host_ca_key2" ;;
+ *) tflag=""; ca="$OBJ/host_ca_key" ;;
+ esac
+ ${SSHKEYGEN} -h -q $tflag -s $ca $tflag \
+ -I "regress host key for $USER" \
+ -n $HOSTS $OBJ/cert_host_key_${ktype} ||
+ fatal "couldn't sign cert_host_key_${ktype}"
+ (
+ printf "$HOSTS "
+ cat $OBJ/cert_host_key_${ktype}.pub
+ ) > $OBJ/known_hosts-cert
+ (
+ cat $OBJ/sshd_proxy_bak
+ echo HostKey $OBJ/cert_host_key_${ktype}
+ echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
+ ) > $OBJ/sshd_proxy
+
+ ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+ -F $OBJ/ssh_proxy somehost true
+ if [ $? -ne 0 ]; then
+ fail "ssh cert connect failed"
+ fi
done
# Wrong certificate
-(
- echon '@cert-authority '
- echon "$HOSTS "
- cat $OBJ/host_ca_key.pub
-) > $OBJ/known_hosts-cert
-for v in v01 v00 ; do
- for kt in $PLAIN_TYPES ; do
- type_has_legacy $kt || continue
- rm -f $OBJ/cert_host_key*
- # Self-sign key
- ${SSHKEYGEN} -q -N '' -t ${kt} \
- -f $OBJ/cert_host_key_${kt} || \
- fail "ssh-keygen of cert_host_key_${kt} failed"
- ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/cert_host_key_${kt} \
- -I "regress host key for $USER" \
- -n $HOSTS $OBJ/cert_host_key_${kt} ||
- fail "couldn't sign cert_host_key_${kt}"
- verbose "$tid: host ${kt} connect wrong cert"
- (
- cat $OBJ/sshd_proxy_bak
- echo HostKey $OBJ/cert_host_key_${kt}
- echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
- ) > $OBJ/sshd_proxy
-
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
- -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
- -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
- if [ $? -eq 0 ]; then
- fail "ssh cert connect $ident succeeded unexpectedly"
- fi
- done
+kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
+cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
+for kt in $PLAIN_TYPES ; do
+ verbose "$tid: host ${kt} connect wrong cert"
+ rm -f $OBJ/cert_host_key*
+ # Self-sign key
+ ${SSHKEYGEN} -q -N '' -t ${kt} -f $OBJ/cert_host_key_${kt} || \
+ fail "ssh-keygen of cert_host_key_${kt} failed"
+ case $kt in
+ rsa-sha2-*) tflag="-t $kt" ;;
+ *) tflag="" ;;
+ esac
+ ${SSHKEYGEN} $tflag -h -q -s $OBJ/cert_host_key_${kt} \
+ -I "regress host key for $USER" \
+ -n $HOSTS $OBJ/cert_host_key_${kt} ||
+ fatal "couldn't sign cert_host_key_${kt}"
+ (
+ cat $OBJ/sshd_proxy_bak
+ echo HostKey $OBJ/cert_host_key_${kt}
+ echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
+ ) > $OBJ/sshd_proxy
+
+ cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
+ ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+ -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
+ if [ $? -eq 0 ]; then
+ fail "ssh cert connect $ident succeeded unexpectedly"
+ fi
done
-rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
+rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/cert_host_key*
Modified: trunk/crypto/openssh/regress/cert-userkey.sh
===================================================================
--- trunk/crypto/openssh/regress/cert-userkey.sh 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/regress/cert-userkey.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $OpenBSD: cert-userkey.sh,v 1.12 2013/12/06 13:52:46 markus Exp $
+# $OpenBSD: cert-userkey.sh,v 1.16 2016/05/03 12:15:49 dtucker Exp $
# Placed in the Public Domain.
tid="certified user keys"
@@ -5,14 +5,21 @@
rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/;s/^ssh-//'`
-type_has_legacy() {
- case $1 in
- ed25519*|ecdsa*) return 1 ;;
+if echo "$PLAIN_TYPES" | grep '^rsa$' >/dev/null 2>&1 ; then
+ PLAIN_TYPES="$PLAIN_TYPES rsa-sha2-256 rsa-sha2-512"
+fi
+
+kname() {
+ case $ktype in
+ rsa-sha2-*) ;;
+ # subshell because some seds will add a newline
+ *) n=$(echo $1 | sed 's/^dsa/ssh-dss/;s/^rsa/ssh-rsa/;s/^ed/ssh-ed/') ;;
esac
- return 0
+ echo "$n*,ssh-rsa*,ssh-ed25519*"
}
# Create a CA key
@@ -20,27 +27,25 @@
fail "ssh-keygen of user_ca_key failed"
# Generate and sign user keys
-for ktype in $PLAIN_TYPES ; do
+for ktype in $PLAIN_TYPES $EXTRA_TYPES ; do
verbose "$tid: sign user ${ktype} cert"
${SSHKEYGEN} -q -N '' -t ${ktype} \
-f $OBJ/cert_user_key_${ktype} || \
- fail "ssh-keygen of cert_user_key_${ktype} failed"
- ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I \
- "regress user key for $USER" \
- -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
- fail "couldn't sign cert_user_key_${ktype}"
- type_has_legacy $ktype || continue
- cp $OBJ/cert_user_key_${ktype} $OBJ/cert_user_key_${ktype}_v00
- cp $OBJ/cert_user_key_${ktype}.pub $OBJ/cert_user_key_${ktype}_v00.pub
- verbose "$tid: sign host ${ktype}_v00 cert"
- ${SSHKEYGEN} -q -t v00 -s $OBJ/user_ca_key -I \
- "regress user key for $USER" \
- -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype}_v00 ||
- fatal "couldn't sign cert_user_key_${ktype}_v00"
+ fatal "ssh-keygen of cert_user_key_${ktype} failed"
+ # Generate RSA/SHA2 certs for rsa-sha2* keys.
+ case $ktype in
+ rsa-sha2-*) tflag="-t $ktype" ;;
+ *) tflag="" ;;
+ esac
+ ${SSHKEYGEN} -q -s $OBJ/user_ca_key -z $$ \
+ -I "regress user key for $USER" \
+ -n ${USER},mekmitasdigoat $tflag $OBJ/cert_user_key_${ktype} || \
+ fatal "couldn't sign cert_user_key_${ktype}"
done
# Test explicitly-specified principals
-for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
+for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
+ t=$(kname $ktype)
for privsep in yes no ; do
_prefix="${ktype} privsep $privsep"
@@ -52,7 +57,12 @@
echo "AuthorizedPrincipalsFile " \
"$OBJ/authorized_principals_%u"
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
+ echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/sshd_proxy
+ (
+ cat $OBJ/ssh_proxy_bak
+ echo "PubkeyAcceptedKeyTypes ${t}"
+ ) > $OBJ/ssh_proxy
# Missing authorized_principals
verbose "$tid: ${_prefix} missing authorized_principals"
@@ -71,7 +81,7 @@
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
fi
-
+
# Wrong authorized_principals
verbose "$tid: ${_prefix} wrong authorized_principals"
echo gregorsamsa > $OBJ/authorized_principals_$USER
@@ -125,7 +135,12 @@
(
cat $OBJ/sshd_proxy_bak
echo "UsePrivilegeSeparation $privsep"
+ echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/sshd_proxy
+ (
+ cat $OBJ/ssh_proxy_bak
+ echo "PubkeyAcceptedKeyTypes ${t}"
+ ) > $OBJ/ssh_proxy
# Wrong principals list
verbose "$tid: ${_prefix} wrong principals key option"
@@ -165,8 +180,9 @@
echo > $OBJ/authorized_keys_$USER
extra_sshd="TrustedUserCAKeys $OBJ/user_ca_key.pub"
fi
-
- for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
+
+ for ktype in $PLAIN_TYPES ; do
+ t=$(kname $ktype)
for privsep in yes no ; do
_prefix="${ktype} privsep $privsep $auth"
# Simple connect
@@ -174,9 +190,14 @@
(
cat $OBJ/sshd_proxy_bak
echo "UsePrivilegeSeparation $privsep"
+ echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
-
+ (
+ cat $OBJ/ssh_proxy_bak
+ echo "PubkeyAcceptedKeyTypes ${t}"
+ ) > $OBJ/ssh_proxy
+
${SSH} -2i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
@@ -189,6 +210,7 @@
cat $OBJ/sshd_proxy_bak
echo "UsePrivilegeSeparation $privsep"
echo "RevokedKeys $OBJ/cert_user_key_${ktype}.pub"
+ echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
${SSH} -2i $OBJ/cert_user_key_${ktype} \
@@ -197,12 +219,13 @@
fail "ssh cert connect succeeded unexpecedly"
fi
done
-
+
# Revoked CA
verbose "$tid: ${ktype} $auth revoked CA key"
(
cat $OBJ/sshd_proxy_bak
echo "RevokedKeys $OBJ/user_ca_key.pub"
+ echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
@@ -211,10 +234,11 @@
fail "ssh cert connect succeeded unexpecedly"
fi
done
-
+
verbose "$tid: $auth CA does not authenticate"
(
cat $OBJ/sshd_proxy_bak
+ echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
verbose "$tid: ensure CA key does not authenticate user"
@@ -240,12 +264,7 @@
fi
for auth in $auth_choice ; do
- for ktype in rsa rsa_v00 ; do
- case $ktype in
- *_v00) keyv="-t v00" ;;
- *) keyv="" ;;
- esac
-
+ for ktype in rsa ed25519 ; do
cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
if test "x$auth" = "xauthorized_keys" ; then
# Add CA to authorized_keys
@@ -257,16 +276,17 @@
echo > $OBJ/authorized_keys_$USER
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub" \
>> $OBJ/sshd_proxy
+ echo "PubkeyAcceptedKeyTypes ${t}*" \
+ >> $OBJ/sshd_proxy
if test "x$auth_opt" != "x" ; then
echo $auth_opt >> $OBJ/sshd_proxy
fi
fi
-
+
verbose "$tid: $ident auth $auth expect $result $ktype"
${SSHKEYGEN} -q -s $OBJ/user_ca_key \
-I "regress user key for $USER" \
- $sign_opts $keyv \
- $OBJ/cert_user_key_${ktype} ||
+ $sign_opts $OBJ/cert_user_key_${ktype} ||
fail "couldn't sign cert_user_key_${ktype}"
${SSH} -2i $OBJ/cert_user_key_${ktype} \
@@ -318,16 +338,13 @@
# Wrong certificate
cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
-for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
- case $ktype in
- *_v00) args="-t v00" ;;
- *) args="" ;;
- esac
+for ktype in $PLAIN_TYPES ; do
+ t=$(kname $ktype)
# Self-sign
- ${SSHKEYGEN} $args -q -s $OBJ/cert_user_key_${ktype} -I \
+ ${SSHKEYGEN} -q -s $OBJ/cert_user_key_${ktype} -I \
"regress user key for $USER" \
-n $USER $OBJ/cert_user_key_${ktype} ||
- fail "couldn't sign cert_user_key_${ktype}"
+ fatal "couldn't sign cert_user_key_${ktype}"
verbose "$tid: user ${ktype} connect wrong cert"
${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
somehost true >/dev/null 2>&1
Copied: trunk/crypto/openssh/regress/cfginclude.sh (from rev 9222, vendor-crypto/openssh/dist/regress/cfginclude.sh)
===================================================================
--- trunk/crypto/openssh/regress/cfginclude.sh (rev 0)
+++ trunk/crypto/openssh/regress/cfginclude.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,293 @@
+# $OpenBSD: cfginclude.sh,v 1.2 2016/05/03 15:30:46 dtucker Exp $
+# Placed in the Public Domain.
+
+tid="config include"
+
+# to appease StrictModes
+umask 022
+
+cat > $OBJ/ssh_config.i << _EOF
+Match host a
+ Hostname aa
+
+Match host b
+ Hostname bb
+ Include $OBJ/ssh_config.i.*
+
+Match host c
+ Include $OBJ/ssh_config.i.*
+ Hostname cc
+
+Match host m
+ Include $OBJ/ssh_config.i.*
+
+Host d
+ Hostname dd
+
+Host e
+ Hostname ee
+ Include $OBJ/ssh_config.i.*
+
+Host f
+ Include $OBJ/ssh_config.i.*
+ Hostname ff
+
+Host n
+ Include $OBJ/ssh_config.i.*
+_EOF
+
+cat > $OBJ/ssh_config.i.0 << _EOF
+Match host xxxxxx
+_EOF
+
+cat > $OBJ/ssh_config.i.1 << _EOF
+Match host a
+ Hostname aaa
+
+Match host b
+ Hostname bbb
+
+Match host c
+ Hostname ccc
+
+Host d
+ Hostname ddd
+
+Host e
+ Hostname eee
+
+Host f
+ Hostname fff
+_EOF
+
+cat > $OBJ/ssh_config.i.2 << _EOF
+Match host a
+ Hostname aaaa
+
+Match host b
+ Hostname bbbb
+
+Match host c
+ Hostname cccc
+
+Host d
+ Hostname dddd
+
+Host e
+ Hostname eeee
+
+Host f
+ Hostname ffff
+
+Match all
+ Hostname xxxx
+_EOF
+
+trial() {
+ _host="$1"
+ _exp="$2"
+ ${REAL_SSH} -F $OBJ/ssh_config.i -G "$_host" > $OBJ/ssh_config.out ||
+ fatal "ssh config parse failed"
+ _got=`grep -i '^hostname ' $OBJ/ssh_config.out | awk '{print $2}'`
+ if test "x$_exp" != "x$_got" ; then
+ fail "host $_host include fail: expected $_exp got $_got"
+ fi
+}
+
+trial a aa
+trial b bb
+trial c ccc
+trial d dd
+trial e ee
+trial f fff
+trial m xxxx
+trial n xxxx
+trial x x
+
+# Prepare an included config with an error.
+
+cat > $OBJ/ssh_config.i.3 << _EOF
+Hostname xxxx
+ Junk
+_EOF
+
+${REAL_SSH} -F $OBJ/ssh_config.i -G a 2>/dev/null && \
+ fail "ssh include allowed invalid config"
+
+${REAL_SSH} -F $OBJ/ssh_config.i -G x 2>/dev/null && \
+ fail "ssh include allowed invalid config"
+
+rm -f $OBJ/ssh_config.i.*
+
+# Ensure that a missing include is not fatal.
+cat > $OBJ/ssh_config.i << _EOF
+Include $OBJ/ssh_config.i.*
+Hostname aa
+_EOF
+
+trial a aa
+
+# Ensure that Match/Host in an included config does not affect parent.
+cat > $OBJ/ssh_config.i.x << _EOF
+Match host x
+_EOF
+
+trial a aa
+
+cat > $OBJ/ssh_config.i.x << _EOF
+Host x
+_EOF
+
+trial a aa
+
+# cleanup
+rm -f $OBJ/ssh_config.i $OBJ/ssh_config.i.* $OBJ/ssh_config.out
+# $OpenBSD: cfginclude.sh,v 1.2 2016/05/03 15:30:46 dtucker Exp $
+# Placed in the Public Domain.
+
+tid="config include"
+
+cat > $OBJ/ssh_config.i << _EOF
+Match host a
+ Hostname aa
+
+Match host b
+ Hostname bb
+ Include $OBJ/ssh_config.i.*
+
+Match host c
+ Include $OBJ/ssh_config.i.*
+ Hostname cc
+
+Match host m
+ Include $OBJ/ssh_config.i.*
+
+Host d
+ Hostname dd
+
+Host e
+ Hostname ee
+ Include $OBJ/ssh_config.i.*
+
+Host f
+ Include $OBJ/ssh_config.i.*
+ Hostname ff
+
+Host n
+ Include $OBJ/ssh_config.i.*
+_EOF
+
+cat > $OBJ/ssh_config.i.0 << _EOF
+Match host xxxxxx
+_EOF
+
+cat > $OBJ/ssh_config.i.1 << _EOF
+Match host a
+ Hostname aaa
+
+Match host b
+ Hostname bbb
+
+Match host c
+ Hostname ccc
+
+Host d
+ Hostname ddd
+
+Host e
+ Hostname eee
+
+Host f
+ Hostname fff
+_EOF
+
+cat > $OBJ/ssh_config.i.2 << _EOF
+Match host a
+ Hostname aaaa
+
+Match host b
+ Hostname bbbb
+
+Match host c
+ Hostname cccc
+
+Host d
+ Hostname dddd
+
+Host e
+ Hostname eeee
+
+Host f
+ Hostname ffff
+
+Match all
+ Hostname xxxx
+_EOF
+
+trial() {
+ _host="$1"
+ _exp="$2"
+ ${REAL_SSH} -F $OBJ/ssh_config.i -G "$_host" > $OBJ/ssh_config.out ||
+ fatal "ssh config parse failed"
+ _got=`grep -i '^hostname ' $OBJ/ssh_config.out | awk '{print $2}'`
+ if test "x$_exp" != "x$_got" ; then
+ fail "host $_host include fail: expected $_exp got $_got"
+ fi
+}
+
+trial a aa
+trial b bb
+trial c ccc
+trial d dd
+trial e ee
+trial f fff
+trial m xxxx
+trial n xxxx
+trial x x
+
+# Prepare an included config with an error.
+
+cat > $OBJ/ssh_config.i.3 << _EOF
+Hostname xxxx
+ Junk
+_EOF
+
+${REAL_SSH} -F $OBJ/ssh_config.i -G a 2>/dev/null && \
+ fail "ssh include allowed invalid config"
+
+${REAL_SSH} -F $OBJ/ssh_config.i -G x 2>/dev/null && \
+ fail "ssh include allowed invalid config"
+
+rm -f $OBJ/ssh_config.i.*
+
+# Ensure that a missing include is not fatal.
+cat > $OBJ/ssh_config.i << _EOF
+Include $OBJ/ssh_config.i.*
+Hostname aa
+_EOF
+
+trial a aa
+
+# Ensure that Match/Host in an included config does not affect parent.
+cat > $OBJ/ssh_config.i.x << _EOF
+Match host x
+_EOF
+
+trial a aa
+
+cat > $OBJ/ssh_config.i.x << _EOF
+Host x
+_EOF
+
+trial a aa
+
+# Ensure that recursive includes are bounded.
+cat > $OBJ/ssh_config.i << _EOF
+Include $OBJ/ssh_config.i
+_EOF
+
+${REAL_SSH} -F $OBJ/ssh_config.i -G a 2>/dev/null && \
+ fail "ssh include allowed infinite recursion?" # or hang...
+
+# cleanup
+rm -f $OBJ/ssh_config.i $OBJ/ssh_config.i.* $OBJ/ssh_config.out
Copied: trunk/crypto/openssh/regress/cfgparse.sh (from rev 9222, vendor-crypto/openssh/dist/regress/cfgparse.sh)
===================================================================
--- trunk/crypto/openssh/regress/cfgparse.sh (rev 0)
+++ trunk/crypto/openssh/regress/cfgparse.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,75 @@
+# $OpenBSD: cfgparse.sh,v 1.6 2016/06/03 03:47:59 dtucker Exp $
+# Placed in the Public Domain.
+
+tid="sshd config parse"
+
+# This is a reasonable proxy for IPv6 support.
+if ! config_defined HAVE_STRUCT_IN6_ADDR ; then
+ SKIP_IPV6=yes
+fi
+
+# We need to use the keys generated for the regression test because sshd -T
+# will fail if we're not running with SUDO (no permissions for real keys) or
+# if we are # running tests on a system that has never had sshd installed
+# (keys won't exist).
+
+grep "HostKey " $OBJ/sshd_config > $OBJ/sshd_config_minimal
+SSHD_KEYS="`cat $OBJ/sshd_config_minimal`"
+
+verbose "reparse minimal config"
+($SUDO ${SSHD} -T -f $OBJ/sshd_config_minimal >$OBJ/sshd_config.1 &&
+ $SUDO ${SSHD} -T -f $OBJ/sshd_config.1 >$OBJ/sshd_config.2 &&
+ diff $OBJ/sshd_config.1 $OBJ/sshd_config.2) || fail "reparse minimal config"
+
+verbose "reparse regress config"
+($SUDO ${SSHD} -T -f $OBJ/sshd_config >$OBJ/sshd_config.1 &&
+ $SUDO ${SSHD} -T -f $OBJ/sshd_config.1 >$OBJ/sshd_config.2 &&
+ diff $OBJ/sshd_config.1 $OBJ/sshd_config.2) || fail "reparse regress config"
+
+verbose "listenaddress order"
+# expected output
+cat > $OBJ/sshd_config.0 <<EOD
+listenaddress 1.2.3.4:1234
+listenaddress 1.2.3.4:5678
+EOD
+[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.0 <<EOD
+listenaddress [::1]:1234
+listenaddress [::1]:5678
+EOD
+
+# test input sets. should all result in the output above.
+# test 1: addressfamily and port first
+cat > $OBJ/sshd_config.1 <<EOD
+${SSHD_KEYS}
+addressfamily any
+port 1234
+port 5678
+listenaddress 1.2.3.4
+EOD
+[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.1 <<EOD
+listenaddress ::1
+EOD
+
+($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
+ grep 'listenaddress ' >$OBJ/sshd_config.2 &&
+ diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
+ fail "listenaddress order 1"
+# test 2: listenaddress first
+cat > $OBJ/sshd_config.1 <<EOD
+${SSHD_KEYS}
+listenaddress 1.2.3.4
+port 1234
+port 5678
+addressfamily any
+EOD
+[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.1 <<EOD
+listenaddress ::1
+EOD
+
+($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
+ grep 'listenaddress ' >$OBJ/sshd_config.2 &&
+ diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
+ fail "listenaddress order 2"
+
+# cleanup
+rm -f $OBJ/sshd_config.[012]
Copied: trunk/crypto/openssh/regress/check-perm.c (from rev 9222, vendor-crypto/openssh/dist/regress/check-perm.c)
===================================================================
--- trunk/crypto/openssh/regress/check-perm.c (rev 0)
+++ trunk/crypto/openssh/regress/check-perm.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,205 @@
+/*
+ * Placed in the public domain
+ */
+
+/* $OpenBSD: modpipe.c,v 1.6 2013/11/21 03:16:47 djm Exp $ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <pwd.h>
+#ifdef HAVE_LIBGEN_H
+#include <libgen.h>
+#endif
+
+static void
+fatal(const char *fmt, ...)
+{
+ va_list args;
+
+ va_start(args, fmt);
+ vfprintf(stderr, fmt, args);
+ fputc('\n', stderr);
+ va_end(args);
+ exit(1);
+}
+/* Based on session.c. NB. keep tests in sync */
+static void
+safely_chroot(const char *path, uid_t uid)
+{
+ const char *cp;
+ char component[PATH_MAX];
+ struct stat st;
+
+ if (*path != '/')
+ fatal("chroot path does not begin at root");
+ if (strlen(path) >= sizeof(component))
+ fatal("chroot path too long");
+
+ /*
+ * Descend the path, checking that each component is a
+ * root-owned directory with strict permissions.
+ */
+ for (cp = path; cp != NULL;) {
+ if ((cp = strchr(cp, '/')) == NULL)
+ strlcpy(component, path, sizeof(component));
+ else {
+ cp++;
+ memcpy(component, path, cp - path);
+ component[cp - path] = '\0';
+ }
+
+ /* debug3("%s: checking '%s'", __func__, component); */
+
+ if (stat(component, &st) != 0)
+ fatal("%s: stat(\"%s\"): %s", __func__,
+ component, strerror(errno));
+ if (st.st_uid != 0 || (st.st_mode & 022) != 0)
+ fatal("bad ownership or modes for chroot "
+ "directory %s\"%s\"",
+ cp == NULL ? "" : "component ", component);
+ if (!S_ISDIR(st.st_mode))
+ fatal("chroot path %s\"%s\" is not a directory",
+ cp == NULL ? "" : "component ", component);
+
+ }
+
+ if (chdir(path) == -1)
+ fatal("Unable to chdir to chroot path \"%s\": "
+ "%s", path, strerror(errno));
+}
+
+/* from platform.c */
+int
+platform_sys_dir_uid(uid_t uid)
+{
+ if (uid == 0)
+ return 1;
+#ifdef PLATFORM_SYS_DIR_UID
+ if (uid == PLATFORM_SYS_DIR_UID)
+ return 1;
+#endif
+ return 0;
+}
+
+/* from auth.c */
+int
+auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
+ uid_t uid, char *err, size_t errlen)
+{
+ char buf[PATH_MAX], homedir[PATH_MAX];
+ char *cp;
+ int comparehome = 0;
+ struct stat st;
+
+ if (realpath(name, buf) == NULL) {
+ snprintf(err, errlen, "realpath %s failed: %s", name,
+ strerror(errno));
+ return -1;
+ }
+ if (pw_dir != NULL && realpath(pw_dir, homedir) != NULL)
+ comparehome = 1;
+
+ if (!S_ISREG(stp->st_mode)) {
+ snprintf(err, errlen, "%s is not a regular file", buf);
+ return -1;
+ }
+ if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) ||
+ (stp->st_mode & 022) != 0) {
+ snprintf(err, errlen, "bad ownership or modes for file %s",
+ buf);
+ return -1;
+ }
+
+ /* for each component of the canonical path, walking upwards */
+ for (;;) {
+ if ((cp = dirname(buf)) == NULL) {
+ snprintf(err, errlen, "dirname() failed");
+ return -1;
+ }
+ strlcpy(buf, cp, sizeof(buf));
+
+ if (stat(buf, &st) < 0 ||
+ (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) ||
+ (st.st_mode & 022) != 0) {
+ snprintf(err, errlen,
+ "bad ownership or modes for directory %s", buf);
+ return -1;
+ }
+
+ /* If are past the homedir then we can stop */
+ if (comparehome && strcmp(homedir, buf) == 0)
+ break;
+
+ /*
+ * dirname should always complete with a "/" path,
+ * but we can be paranoid and check for "." too
+ */
+ if ((strcmp("/", buf) == 0) || (strcmp(".", buf) == 0))
+ break;
+ }
+ return 0;
+}
+
+static void
+usage(void)
+{
+ fprintf(stderr, "check-perm -m [chroot | keys-command] [path]\n");
+ exit(1);
+}
+
+int
+main(int argc, char **argv)
+{
+ const char *path = ".";
+ char errmsg[256];
+ int ch, mode = -1;
+ extern char *optarg;
+ extern int optind;
+ struct stat st;
+
+ while ((ch = getopt(argc, argv, "hm:")) != -1) {
+ switch (ch) {
+ case 'm':
+ if (strcasecmp(optarg, "chroot") == 0)
+ mode = 1;
+ else if (strcasecmp(optarg, "keys-command") == 0)
+ mode = 2;
+ else {
+ fprintf(stderr, "Invalid -m option\n"),
+ usage();
+ }
+ break;
+ default:
+ usage();
+ }
+ }
+ argc -= optind;
+ argv += optind;
+
+ if (argc > 1)
+ usage();
+ else if (argc == 1)
+ path = argv[0];
+
+ if (mode == 1)
+ safely_chroot(path, getuid());
+ else if (mode == 2) {
+ if (stat(path, &st) < 0)
+ fatal("Could not stat %s: %s", path, strerror(errno));
+ if (auth_secure_path(path, &st, NULL, 0,
+ errmsg, sizeof(errmsg)) != 0)
+ fatal("Unsafe %s: %s", path, errmsg);
+ } else {
+ fprintf(stderr, "Invalid mode\n");
+ usage();
+ }
+ return 0;
+}
Modified: trunk/crypto/openssh/regress/dhgex.sh
===================================================================
--- trunk/crypto/openssh/regress/dhgex.sh 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/regress/dhgex.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $OpenBSD: dhgex.sh,v 1.1 2014/01/25 04:35:32 dtucker Exp $
+# $OpenBSD: dhgex.sh,v 1.3 2015/10/23 02:22:01 dtucker Exp $
# Placed in the Public Domain.
tid="dhgex"
@@ -5,6 +5,7 @@
LOG=${TEST_SSH_LOGFILE}
rm -f ${LOG}
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
kexs=`${SSH} -Q kex | grep diffie-hellman-group-exchange`
@@ -14,9 +15,14 @@
cipher="$1"; shift
kex="$1"; shift
+ cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+ echo "KexAlgorithms=$kex" >> $OBJ/sshd_proxy
+ echo "Ciphers=$cipher" >> $OBJ/sshd_proxy
rm -f ${LOG}
opts="-oKexAlgorithms=$kex -oCiphers=$cipher"
- groupsz="1024<$bits<8192"
+ min=2048
+ max=8192
+ groupsz="$min<$bits<$max"
verbose "$tid bits $bits $kex $cipher"
${SSH} ${opts} $@ -vvv -F ${OBJ}/ssh_proxy somehost true
if [ $? -ne 0 ]; then
Modified: trunk/crypto/openssh/regress/host-expand.sh
===================================================================
--- trunk/crypto/openssh/regress/host-expand.sh 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/regress/host-expand.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $OpenBSD: host-expand.sh,v 1.3 2014/02/27 23:17:41 djm Exp $
+# $OpenBSD: host-expand.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="expand %h and %n"
@@ -11,7 +11,7 @@
127.0.0.1
EOE
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
verbose "test $tid: proto $p"
${SSH} -F $OBJ/ssh_proxy -$p somehost true >$OBJ/actual
diff $OBJ/expect $OBJ/actual || fail "$tid proto $p"
Copied: trunk/crypto/openssh/regress/hostkey-agent.sh (from rev 9222, vendor-crypto/openssh/dist/regress/hostkey-agent.sh)
===================================================================
--- trunk/crypto/openssh/regress/hostkey-agent.sh (rev 0)
+++ trunk/crypto/openssh/regress/hostkey-agent.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,53 @@
+# $OpenBSD: hostkey-agent.sh,v 1.6 2015/07/10 06:23:25 markus Exp $
+# Placed in the Public Domain.
+
+tid="hostkey agent"
+
+rm -f $OBJ/agent-key.* $OBJ/ssh_proxy.orig $OBJ/known_hosts.orig
+
+trace "start agent"
+eval `${SSHAGENT} -s` > /dev/null
+r=$?
+[ $r -ne 0 ] && fatal "could not start ssh-agent: exit code $r"
+
+grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
+echo "HostKeyAgent $SSH_AUTH_SOCK" >> $OBJ/sshd_proxy.orig
+
+trace "load hostkeys"
+for k in `${SSH} -Q key-plain` ; do
+ ${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
+ (
+ printf 'localhost-with-alias,127.0.0.1,::1 '
+ cat $OBJ/agent-key.$k.pub
+ ) >> $OBJ/known_hosts.orig
+ ${SSHADD} $OBJ/agent-key.$k >/dev/null 2>&1 || \
+ fatal "couldn't load key $OBJ/agent-key.$k"
+ echo "Hostkey $OBJ/agent-key.${k}" >> $OBJ/sshd_proxy.orig
+ # Remove private key so the server can't use it.
+ rm $OBJ/agent-key.$k || fatal "couldn't rm $OBJ/agent-key.$k"
+done
+cp $OBJ/known_hosts.orig $OBJ/known_hosts
+
+unset SSH_AUTH_SOCK
+
+for ps in no yes; do
+ for k in `${SSH} -Q key-plain` ; do
+ verbose "key type $k privsep=$ps"
+ cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+ echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
+ echo "HostKeyAlgorithms $k" >> $OBJ/sshd_proxy
+ opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy"
+ cp $OBJ/known_hosts.orig $OBJ/known_hosts
+ SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
+ if [ $? -ne 0 ]; then
+ fail "protocol $p privsep=$ps failed"
+ fi
+ if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
+ fail "bad SSH_CONNECTION key type $k privsep=$ps"
+ fi
+ done
+done
+
+trace "kill agent"
+${SSHAGENT} -k > /dev/null
+
Copied: trunk/crypto/openssh/regress/hostkey-rotate.sh (from rev 9222, vendor-crypto/openssh/dist/regress/hostkey-rotate.sh)
===================================================================
--- trunk/crypto/openssh/regress/hostkey-rotate.sh (rev 0)
+++ trunk/crypto/openssh/regress/hostkey-rotate.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,110 @@
+# $OpenBSD: hostkey-rotate.sh,v 1.5 2015/09/04 04:23:10 djm Exp $
+# Placed in the Public Domain.
+
+tid="hostkey rotate"
+
+# Need full names here since they are used in HostKeyAlgorithms
+HOSTKEY_TYPES="ecdsa-sha2-nistp256 ssh-ed25519 ssh-rsa ssh-dss"
+
+rm -f $OBJ/hkr.* $OBJ/ssh_proxy.orig
+
+grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
+echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy
+rm $OBJ/known_hosts
+
+trace "prepare hostkeys"
+nkeys=0
+all_algs=""
+for k in `${SSH} -Q key-plain` ; do
+ ${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k"
+ echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig
+ nkeys=`expr $nkeys + 1`
+ test "x$all_algs" = "x" || all_algs="${all_algs},"
+ all_algs="${all_algs}$k"
+done
+
+dossh() {
+ # All ssh should succeed in this test
+ ${SSH} -F $OBJ/ssh_proxy "$@" x true || fail "ssh $@ failed"
+}
+
+expect_nkeys() {
+ _expected=$1
+ _message=$2
+ _n=`wc -l $OBJ/known_hosts | awk '{ print $1 }'` || fatal "wc failed"
+ [ "x$_n" = "x$_expected" ] || fail "$_message (got $_n wanted $_expected)"
+}
+
+check_key_present() {
+ _type=$1
+ _kfile=$2
+ test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub"
+ _kpub=`awk "/$_type /"' { print $2 }' < $_kfile` || \
+ fatal "awk failed"
+ fgrep "$_kpub" $OBJ/known_hosts > /dev/null
+}
+
+cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+
+# Connect to sshd with StrictHostkeyChecking=no
+verbose "learn hostkey with StrictHostKeyChecking=no"
+>$OBJ/known_hosts
+dossh -oHostKeyAlgorithms=ssh-ed25519 -oStrictHostKeyChecking=no
+# Verify no additional keys learned
+expect_nkeys 1 "unstrict connect keys"
+check_key_present ssh-ed25519 || fail "unstrict didn't learn key"
+
+# Connect to sshd as usual
+verbose "learn additional hostkeys"
+dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs
+# Check that other keys learned
+expect_nkeys $nkeys "learn hostkeys"
+check_key_present ssh-rsa || fail "didn't learn keys"
+
+# Check each key type
+for k in `${SSH} -Q key-plain` ; do
+ verbose "learn additional hostkeys, type=$k"
+ dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs
+ expect_nkeys $nkeys "learn hostkeys $k"
+ check_key_present $k || fail "didn't learn $k"
+done
+
+# Change one hostkey (non primary) and relearn
+verbose "learn changed non-primary hostkey"
+mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
+rm -f $OBJ/hkr.ssh-rsa
+${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa -N '' || fatal "ssh-keygen $k"
+dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs
+# Check that the key was replaced
+expect_nkeys $nkeys "learn hostkeys"
+check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
+check_key_present ssh-rsa || fail "didn't learn changed key"
+
+# Add new hostkey (primary type) to sshd and connect
+verbose "learn new primary hostkey"
+${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa-new -N '' || fatal "ssh-keygen $k"
+( cat $OBJ/sshd_proxy.orig ; echo HostKey $OBJ/hkr.ssh-rsa-new ) \
+ > $OBJ/sshd_proxy
+# Check new hostkey added
+dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
+expect_nkeys `expr $nkeys + 1` "learn hostkeys"
+check_key_present ssh-rsa || fail "current key missing"
+check_key_present ssh-rsa $OBJ/hkr.ssh-rsa-new.pub || fail "new key missing"
+
+# Remove old hostkey (primary type) from sshd
+verbose "rotate primary hostkey"
+cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
+mv $OBJ/hkr.ssh-rsa-new.pub $OBJ/hkr.ssh-rsa.pub
+mv $OBJ/hkr.ssh-rsa-new $OBJ/hkr.ssh-rsa
+# Check old hostkey removed
+dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
+expect_nkeys $nkeys "learn hostkeys"
+check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
+check_key_present ssh-rsa || fail "didn't learn changed key"
+
+# Connect again, forcing rotated key
+verbose "check rotate primary hostkey"
+dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
+expect_nkeys 1 "learn hostkeys"
+check_key_present ssh-rsa || fail "didn't learn changed key"
Modified: trunk/crypto/openssh/regress/kextype.sh
===================================================================
--- trunk/crypto/openssh/regress/kextype.sh 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/regress/kextype.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $OpenBSD: kextype.sh,v 1.4 2013/11/07 04:26:56 dtucker Exp $
+# $OpenBSD: kextype.sh,v 1.6 2015/03/24 20:19:15 markus Exp $
# Placed in the Public Domain.
tid="login with different key exchange algorithms"
@@ -7,6 +7,11 @@
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
+# Make server accept all key exchanges.
+ALLKEX=`${SSH} -Q kex`
+KEXOPT=`echo $ALLKEX | tr ' ' ,`
+echo "KexAlgorithms=$KEXOPT" >> $OBJ/sshd_proxy
+
tries="1 2 3 4"
for k in `${SSH} -Q kex`; do
verbose "kex $k"
Copied: trunk/crypto/openssh/regress/keygen-knownhosts.sh (from rev 9222, vendor-crypto/openssh/dist/regress/keygen-knownhosts.sh)
===================================================================
--- trunk/crypto/openssh/regress/keygen-knownhosts.sh (rev 0)
+++ trunk/crypto/openssh/regress/keygen-knownhosts.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,197 @@
+# $OpenBSD: keygen-knownhosts.sh,v 1.3 2015/07/17 03:34:27 djm Exp $
+# Placed in the Public Domain.
+
+tid="ssh-keygen known_hosts"
+
+rm -f $OBJ/kh.*
+
+# Generate some keys for testing (just ed25519 for speed) and make a hosts file.
+for x in host-a host-b host-c host-d host-e host-f host-a2 host-b2; do
+ ${SSHKEYGEN} -qt ed25519 -f $OBJ/kh.$x -C "$x" -N "" || \
+ fatal "ssh-keygen failed"
+ # Add a comment that we expect should be preserved.
+ echo "# $x" >> $OBJ/kh.hosts
+ (
+ case "$x" in
+ host-a|host-b) printf "$x " ;;
+ host-c) printf "@cert-authority $x " ;;
+ host-d) printf "@revoked $x " ;;
+ host-e) printf "host-e* " ;;
+ host-f) printf "host-f,host-g,host-h " ;;
+ host-a2) printf "host-a " ;;
+ host-b2) printf "host-b " ;;
+ esac
+ cat $OBJ/kh.${x}.pub
+ # Blank line should be preserved.
+ echo "" >> $OBJ/kh.hosts
+ ) >> $OBJ/kh.hosts
+done
+
+# Generate a variant with an invalid line. We'll use this for most tests,
+# because keygen should be able to cope and it should be preserved in any
+# output file.
+cat $OBJ/kh.hosts >> $OBJ/kh.invalid
+echo "host-i " >> $OBJ/kh.invalid
+
+cp $OBJ/kh.invalid $OBJ/kh.invalid.orig
+cp $OBJ/kh.hosts $OBJ/kh.hosts.orig
+
+expect_key() {
+ _host=$1
+ _hosts=$2
+ _key=$3
+ _line=$4
+ _mark=$5
+ _marker=""
+ test "x$_mark" = "xCA" && _marker="@cert-authority "
+ test "x$_mark" = "xREVOKED" && _marker="@revoked "
+ test "x$_line" != "x" &&
+ echo "# Host $_host found: line $_line $_mark" >> $OBJ/kh.expect
+ printf "${_marker}$_hosts " >> $OBJ/kh.expect
+ cat $OBJ/kh.${_key}.pub >> $OBJ/kh.expect ||
+ fatal "${_key}.pub missing"
+}
+
+check_find() {
+ _host=$1
+ _name=$2
+ _keygenopt=$3
+ ${SSHKEYGEN} $_keygenopt -f $OBJ/kh.invalid -F $_host > $OBJ/kh.result
+ if ! diff -w $OBJ/kh.expect $OBJ/kh.result ; then
+ fail "didn't find $_name"
+ fi
+}
+
+# Find key
+rm -f $OBJ/kh.expect
+expect_key host-a host-a host-a 2
+expect_key host-a host-a host-a2 20
+check_find host-a "simple find"
+
+# find CA key
+rm -f $OBJ/kh.expect
+expect_key host-c host-c host-c 8 CA
+check_find host-c "find CA key"
+
+# find revoked key
+rm -f $OBJ/kh.expect
+expect_key host-d host-d host-d 11 REVOKED
+check_find host-d "find revoked key"
+
+# find key with wildcard
+rm -f $OBJ/kh.expect
+expect_key host-e.somedomain "host-e*" host-e 14
+check_find host-e.somedomain "find wildcard key"
+
+# find key among multiple hosts
+rm -f $OBJ/kh.expect
+expect_key host-h "host-f,host-g,host-h " host-f 17
+check_find host-h "find multiple hosts"
+
+check_hashed_find() {
+ _host=$1
+ _name=$2
+ _file=$3
+ test "x$_file" = "x" && _file=$OBJ/kh.invalid
+ ${SSHKEYGEN} -f $_file -HF $_host | grep '|1|' | \
+ sed "s/^[^ ]*/$_host/" > $OBJ/kh.result
+ if ! diff -w $OBJ/kh.expect $OBJ/kh.result ; then
+ fail "didn't find $_name"
+ fi
+}
+
+# Find key and hash
+rm -f $OBJ/kh.expect
+expect_key host-a host-a host-a
+expect_key host-a host-a host-a2
+check_hashed_find host-a "find simple and hash"
+
+# Find CA key and hash
+rm -f $OBJ/kh.expect
+expect_key host-c host-c host-c "" CA
+# CA key output is not hashed.
+check_find host-c "find simple and hash" -H
+
+# Find revoked key and hash
+rm -f $OBJ/kh.expect
+expect_key host-d host-d host-d "" REVOKED
+# Revoked key output is not hashed.
+check_find host-d "find simple and hash" -H
+
+# find key with wildcard and hash
+rm -f $OBJ/kh.expect
+expect_key host-e "host-e*" host-e ""
+# Key with wildcard hostname should not be hashed.
+check_find host-e "find wildcard key" -H
+
+# find key among multiple hosts
+rm -f $OBJ/kh.expect
+# Comma-separated hostnames should be expanded and hashed.
+expect_key host-f "host-h " host-f
+expect_key host-g "host-h " host-f
+expect_key host-h "host-h " host-f
+check_hashed_find host-h "find multiple hosts"
+
+# Attempt remove key on invalid file.
+cp $OBJ/kh.invalid.orig $OBJ/kh.invalid
+${SSHKEYGEN} -qf $OBJ/kh.invalid -R host-a 2>/dev/null
+diff $OBJ/kh.invalid $OBJ/kh.invalid.orig || fail "remove on invalid succeeded"
+
+# Remove key
+cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
+${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-a 2>/dev/null
+grep -v "^host-a " $OBJ/kh.hosts.orig > $OBJ/kh.expect
+diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove simple"
+
+# Remove CA key
+cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
+${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-c 2>/dev/null
+# CA key should not be removed.
+diff $OBJ/kh.hosts $OBJ/kh.hosts.orig || fail "remove CA"
+
+# Remove revoked key
+cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
+${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-d 2>/dev/null
+# revoked key should not be removed.
+diff $OBJ/kh.hosts $OBJ/kh.hosts.orig || fail "remove revoked"
+
+# Remove wildcard
+cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
+${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-e.blahblah 2>/dev/null
+grep -v "^host-e[*] " $OBJ/kh.hosts.orig > $OBJ/kh.expect
+diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove wildcard"
+
+# Remove multiple
+cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
+${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-h 2>/dev/null
+grep -v "^host-f," $OBJ/kh.hosts.orig > $OBJ/kh.expect
+diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove wildcard"
+
+# Attempt hash on invalid file
+cp $OBJ/kh.invalid.orig $OBJ/kh.invalid
+${SSHKEYGEN} -qf $OBJ/kh.invalid -H 2>/dev/null && fail "hash invalid succeeded"
+diff $OBJ/kh.invalid $OBJ/kh.invalid.orig || fail "invalid file modified"
+
+# Hash valid file
+cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
+${SSHKEYGEN} -qf $OBJ/kh.hosts -H 2>/dev/null || fail "hash failed"
+diff $OBJ/kh.hosts.old $OBJ/kh.hosts.orig || fail "backup differs"
+grep "^host-[abfgh]" $OBJ/kh.hosts && fail "original hostnames persist"
+
+cp $OBJ/kh.hosts $OBJ/kh.hashed.orig
+
+# Test lookup
+rm -f $OBJ/kh.expect
+expect_key host-a host-a host-a
+expect_key host-a host-a host-a2
+check_hashed_find host-a "find simple in hashed" $OBJ/kh.hosts
+
+# Test multiple expanded
+rm -f $OBJ/kh.expect
+expect_key host-h host-h host-f
+check_hashed_find host-h "find simple in hashed" $OBJ/kh.hosts
+
+# Test remove
+cp $OBJ/kh.hashed.orig $OBJ/kh.hashed
+${SSHKEYGEN} -qf $OBJ/kh.hashed -R host-a 2>/dev/null
+${SSHKEYGEN} -qf $OBJ/kh.hashed -F host-a && fail "found key after hashed remove"
Modified: trunk/crypto/openssh/regress/keytype.sh
===================================================================
--- trunk/crypto/openssh/regress/keytype.sh 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/regress/keytype.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $OpenBSD: keytype.sh,v 1.3 2013/12/06 13:52:46 markus Exp $
+# $OpenBSD: keytype.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
# Placed in the Public Domain.
tid="login with different key types"
@@ -36,14 +36,26 @@
htypes=$ut
#htypes=$ktypes
for ht in $htypes; do
+ case $ht in
+ dsa-1024) t=ssh-dss;;
+ ecdsa-256) t=ecdsa-sha2-nistp256;;
+ ecdsa-384) t=ecdsa-sha2-nistp384;;
+ ecdsa-521) t=ecdsa-sha2-nistp521;;
+ ed25519-512) t=ssh-ed25519;;
+ rsa-*) t=ssh-rsa;;
+ esac
trace "ssh connect, userkey $ut, hostkey $ht"
(
grep -v HostKey $OBJ/sshd_proxy_bak
echo HostKey $OBJ/key.$ht
+ echo PubkeyAcceptedKeyTypes $t
+ echo HostKeyAlgorithms $t
) > $OBJ/sshd_proxy
(
grep -v IdentityFile $OBJ/ssh_proxy_bak
echo IdentityFile $OBJ/key.$ut
+ echo PubkeyAcceptedKeyTypes $t
+ echo HostKeyAlgorithms $t
) > $OBJ/ssh_proxy
(
echon 'localhost-with-alias,127.0.0.1,::1 '
Copied: trunk/crypto/openssh/regress/limit-keytype.sh (from rev 9222, vendor-crypto/openssh/dist/regress/limit-keytype.sh)
===================================================================
--- trunk/crypto/openssh/regress/limit-keytype.sh (rev 0)
+++ trunk/crypto/openssh/regress/limit-keytype.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,97 @@
+# $OpenBSD: limit-keytype.sh,v 1.4 2015/10/29 08:05:17 djm Exp $
+# Placed in the Public Domain.
+
+tid="restrict pubkey type"
+
+rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/user_key*
+rm -f $OBJ/authorized_principals_$USER $OBJ/cert_user_key*
+
+mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
+mv $OBJ/ssh_proxy $OBJ/ssh_proxy.orig
+
+# Create a CA key
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key ||\
+ fatal "ssh-keygen failed"
+
+# Make some keys and a certificate.
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key1 || \
+ fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key2 || \
+ fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key3 || \
+ fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t dsa -f $OBJ/user_key4 || \
+ fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
+ -z $$ -n ${USER},mekmitasdigoat $OBJ/user_key3 ||
+ fatal "couldn't sign user_key1"
+# Copy the private key alongside the cert to allow better control of when
+# it is offered.
+mv $OBJ/user_key3-cert.pub $OBJ/cert_user_key3.pub
+
+grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy
+
+opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
+certopts="$opts -i $OBJ/user_key3 -oCertificateFile=$OBJ/cert_user_key3.pub"
+
+echo mekmitasdigoat > $OBJ/authorized_principals_$USER
+cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER
+cat $OBJ/user_key2.pub >> $OBJ/authorized_keys_$USER
+
+prepare_config() {
+ (
+ grep -v "Protocol" $OBJ/sshd_proxy.orig
+ echo "Protocol 2"
+ echo "AuthenticationMethods publickey"
+ echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
+ echo "AuthorizedPrincipalsFile $OBJ/authorized_principals_%u"
+ for x in "$@" ; do
+ echo "$x"
+ done
+ ) > $OBJ/sshd_proxy
+}
+
+prepare_config
+
+# Check we can log in with all key types.
+${SSH} $certopts proxy true || fatal "cert failed"
+${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
+${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
+
+# Allow plain Ed25519 and RSA. The certificate should fail.
+verbose "allow rsa,ed25519"
+prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519"
+${SSH} $certopts proxy true && fatal "cert succeeded"
+${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
+${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
+
+# Allow Ed25519 only.
+verbose "allow ed25519"
+prepare_config "PubkeyAcceptedKeyTypes ssh-ed25519"
+${SSH} $certopts proxy true && fatal "cert succeeded"
+${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
+${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"
+
+# Allow all certs. Plain keys should fail.
+verbose "allow cert only"
+prepare_config "PubkeyAcceptedKeyTypes ssh-*-cert-v01 at openssh.com"
+${SSH} $certopts proxy true || fatal "cert failed"
+${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded"
+${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"
+
+# Allow RSA in main config, Ed25519 for non-existent user.
+verbose "match w/ no match"
+prepare_config "PubkeyAcceptedKeyTypes ssh-rsa" \
+ "Match user x$USER" "PubkeyAcceptedKeyTypes +ssh-ed25519"
+${SSH} $certopts proxy true && fatal "cert succeeded"
+${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded"
+${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
+
+# Allow only DSA in main config, Ed25519 for user.
+verbose "match w/ matching"
+prepare_config "PubkeyAcceptedKeyTypes ssh-dss" \
+ "Match user $USER" "PubkeyAcceptedKeyTypes +ssh-ed25519"
+${SSH} $certopts proxy true || fatal "cert failed"
+${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
+${SSH} $opts -i $OBJ/user_key4 proxy true && fatal "key4 succeeded"
+
Copied: trunk/crypto/openssh/regress/multipubkey.sh (from rev 9222, vendor-crypto/openssh/dist/regress/multipubkey.sh)
===================================================================
--- trunk/crypto/openssh/regress/multipubkey.sh (rev 0)
+++ trunk/crypto/openssh/regress/multipubkey.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,66 @@
+# $OpenBSD: multipubkey.sh,v 1.1 2014/12/22 08:06:03 djm Exp $
+# Placed in the Public Domain.
+
+tid="multiple pubkey"
+
+rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/user_key*
+rm -f $OBJ/authorized_principals_$USER $OBJ/cert_user_key*
+
+mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
+mv $OBJ/ssh_proxy $OBJ/ssh_proxy.orig
+
+# Create a CA key
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key ||\
+ fatal "ssh-keygen failed"
+
+# Make some keys and a certificate.
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key1 || \
+ fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key2 || \
+ fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
+ -z $$ -n ${USER},mekmitasdigoat $OBJ/user_key1 ||
+ fail "couldn't sign user_key1"
+# Copy the private key alongside the cert to allow better control of when
+# it is offered.
+mv $OBJ/user_key1-cert.pub $OBJ/cert_user_key1.pub
+cp -p $OBJ/user_key1 $OBJ/cert_user_key1
+
+grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy
+
+opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
+opts="$opts -i $OBJ/cert_user_key1 -i $OBJ/user_key1 -i $OBJ/user_key2"
+
+for privsep in no yes; do
+ (
+ grep -v "Protocol" $OBJ/sshd_proxy.orig
+ echo "Protocol 2"
+ echo "UsePrivilegeSeparation $privsep"
+ echo "AuthenticationMethods publickey,publickey"
+ echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
+ echo "AuthorizedPrincipalsFile $OBJ/authorized_principals_%u"
+ ) > $OBJ/sshd_proxy
+
+ # Single key should fail.
+ rm -f $OBJ/authorized_principals_$USER
+ cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER
+ ${SSH} $opts proxy true && fail "ssh succeeded with key"
+
+ # Single key with same-public cert should fail.
+ echo mekmitasdigoat > $OBJ/authorized_principals_$USER
+ cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER
+ ${SSH} $opts proxy true && fail "ssh succeeded with key+cert"
+
+ # Multiple plain keys should succeed.
+ rm -f $OBJ/authorized_principals_$USER
+ cat $OBJ/user_key1.pub $OBJ/user_key2.pub > \
+ $OBJ/authorized_keys_$USER
+ ${SSH} $opts proxy true || fail "ssh failed with multiple keys"
+ # Cert and different key should succeed
+
+ # Key and different-public cert should succeed.
+ echo mekmitasdigoat > $OBJ/authorized_principals_$USER
+ cat $OBJ/user_key2.pub > $OBJ/authorized_keys_$USER
+ ${SSH} $opts proxy true || fail "ssh failed with key/cert"
+done
+
Copied: trunk/crypto/openssh/regress/netcat.c (from rev 9222, vendor-crypto/openssh/dist/regress/netcat.c)
===================================================================
--- trunk/crypto/openssh/regress/netcat.c (rev 0)
+++ trunk/crypto/openssh/regress/netcat.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,1659 @@
+/* $OpenBSD: netcat.c,v 1.126 2014/10/30 16:08:31 tedu Exp $ */
+/*
+ * Copyright (c) 2001 Eric Jackson <ericj at monkey.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Re-written nc(1) for OpenBSD. Original implementation by
+ * *Hobbit* <hobbit at avian.org>.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/uio.h>
+#include <sys/un.h>
+
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <netinet/ip.h>
+
+#include <errno.h>
+#include <netdb.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <limits.h>
+#include "atomicio.h"
+
+#ifdef HAVE_POLL_H
+#include <poll.h>
+#else
+# ifdef HAVE_SYS_POLL_H
+# include <sys/poll.h>
+# endif
+#endif
+#ifdef HAVE_ERR_H
+# include <err.h>
+#endif
+
+/* Telnet options from arpa/telnet.h */
+#define IAC 255
+#define DONT 254
+#define DO 253
+#define WONT 252
+#define WILL 251
+
+#ifndef SUN_LEN
+#define SUN_LEN(su) \
+ (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path))
+#endif
+
+#define PORT_MAX 65535
+#define PORT_MAX_LEN 6
+#define UNIX_DG_TMP_SOCKET_SIZE 19
+
+#define POLL_STDIN 0
+#define POLL_NETOUT 1
+#define POLL_NETIN 2
+#define POLL_STDOUT 3
+#define BUFSIZE 16384
+
+/* Command Line Options */
+int dflag; /* detached, no stdin */
+int Fflag; /* fdpass sock to stdout */
+unsigned int iflag; /* Interval Flag */
+int kflag; /* More than one connect */
+int lflag; /* Bind to local port */
+int Nflag; /* shutdown() network socket */
+int nflag; /* Don't do name look up */
+char *Pflag; /* Proxy username */
+char *pflag; /* Localport flag */
+int rflag; /* Random ports flag */
+char *sflag; /* Source Address */
+int tflag; /* Telnet Emulation */
+int uflag; /* UDP - Default to TCP */
+int vflag; /* Verbosity */
+int xflag; /* Socks proxy */
+int zflag; /* Port Scan Flag */
+int Dflag; /* sodebug */
+int Iflag; /* TCP receive buffer size */
+int Oflag; /* TCP send buffer size */
+int Sflag; /* TCP MD5 signature option */
+int Tflag = -1; /* IP Type of Service */
+int rtableid = -1;
+
+int timeout = -1;
+int family = AF_UNSPEC;
+char *portlist[PORT_MAX+1];
+char *unix_dg_tmp_socket;
+
+void atelnet(int, unsigned char *, unsigned int);
+void build_ports(char *);
+void help(void);
+int local_listen(char *, char *, struct addrinfo);
+void readwrite(int);
+void fdpass(int nfd) __attribute__((noreturn));
+int remote_connect(const char *, const char *, struct addrinfo);
+int timeout_connect(int, const struct sockaddr *, socklen_t);
+int socks_connect(const char *, const char *, struct addrinfo,
+ const char *, const char *, struct addrinfo, int, const char *);
+int udptest(int);
+int unix_bind(char *);
+int unix_connect(char *);
+int unix_listen(char *);
+void set_common_sockopts(int);
+int map_tos(char *, int *);
+void report_connect(const struct sockaddr *, socklen_t);
+void usage(int);
+ssize_t drainbuf(int, unsigned char *, size_t *);
+ssize_t fillbuf(int, unsigned char *, size_t *);
+
+
+int
+main(int argc, char *argv[])
+{
+ int ch, s, ret, socksv;
+ char *host, *uport;
+ struct addrinfo hints;
+ struct servent *sv;
+ socklen_t len;
+ struct sockaddr_storage cliaddr;
+ char *proxy = NULL;
+ const char *errstr, *proxyhost = "", *proxyport = NULL;
+ struct addrinfo proxyhints;
+ char unix_dg_tmp_socket_buf[UNIX_DG_TMP_SOCKET_SIZE];
+
+ ret = 1;
+ s = 0;
+ socksv = 5;
+ host = NULL;
+ uport = NULL;
+ sv = NULL;
+
+ while ((ch = getopt(argc, argv,
+ "46DdFhI:i:klNnO:P:p:rSs:tT:UuV:vw:X:x:z")) != -1) {
+ switch (ch) {
+ case '4':
+ family = AF_INET;
+ break;
+ case '6':
+ family = AF_INET6;
+ break;
+ case 'U':
+ family = AF_UNIX;
+ break;
+ case 'X':
+ if (strcasecmp(optarg, "connect") == 0)
+ socksv = -1; /* HTTP proxy CONNECT */
+ else if (strcmp(optarg, "4") == 0)
+ socksv = 4; /* SOCKS v.4 */
+ else if (strcmp(optarg, "5") == 0)
+ socksv = 5; /* SOCKS v.5 */
+ else
+ errx(1, "unsupported proxy protocol");
+ break;
+ case 'd':
+ dflag = 1;
+ break;
+ case 'F':
+ Fflag = 1;
+ break;
+ case 'h':
+ help();
+ break;
+ case 'i':
+ iflag = strtonum(optarg, 0, UINT_MAX, &errstr);
+ if (errstr)
+ errx(1, "interval %s: %s", errstr, optarg);
+ break;
+ case 'k':
+ kflag = 1;
+ break;
+ case 'l':
+ lflag = 1;
+ break;
+ case 'N':
+ Nflag = 1;
+ break;
+ case 'n':
+ nflag = 1;
+ break;
+ case 'P':
+ Pflag = optarg;
+ break;
+ case 'p':
+ pflag = optarg;
+ break;
+ case 'r':
+ rflag = 1;
+ break;
+ case 's':
+ sflag = optarg;
+ break;
+ case 't':
+ tflag = 1;
+ break;
+ case 'u':
+ uflag = 1;
+ break;
+#ifdef SO_RTABLE
+ case 'V':
+ rtableid = (int)strtonum(optarg, 0,
+ RT_TABLEID_MAX, &errstr);
+ if (errstr)
+ errx(1, "rtable %s: %s", errstr, optarg);
+ break;
+#endif
+ case 'v':
+ vflag = 1;
+ break;
+ case 'w':
+ timeout = strtonum(optarg, 0, INT_MAX / 1000, &errstr);
+ if (errstr)
+ errx(1, "timeout %s: %s", errstr, optarg);
+ timeout *= 1000;
+ break;
+ case 'x':
+ xflag = 1;
+ if ((proxy = strdup(optarg)) == NULL)
+ errx(1, "strdup");
+ break;
+ case 'z':
+ zflag = 1;
+ break;
+ case 'D':
+ Dflag = 1;
+ break;
+ case 'I':
+ Iflag = strtonum(optarg, 1, 65536 << 14, &errstr);
+ if (errstr != NULL)
+ errx(1, "TCP receive window %s: %s",
+ errstr, optarg);
+ break;
+ case 'O':
+ Oflag = strtonum(optarg, 1, 65536 << 14, &errstr);
+ if (errstr != NULL)
+ errx(1, "TCP send window %s: %s",
+ errstr, optarg);
+ break;
+ case 'S':
+ Sflag = 1;
+ break;
+ case 'T':
+ errstr = NULL;
+ errno = 0;
+ if (map_tos(optarg, &Tflag))
+ break;
+ if (strlen(optarg) > 1 && optarg[0] == '0' &&
+ optarg[1] == 'x')
+ Tflag = (int)strtol(optarg, NULL, 16);
+ else
+ Tflag = (int)strtonum(optarg, 0, 255,
+ &errstr);
+ if (Tflag < 0 || Tflag > 255 || errstr || errno)
+ errx(1, "illegal tos value %s", optarg);
+ break;
+ default:
+ usage(1);
+ }
+ }
+ argc -= optind;
+ argv += optind;
+
+ /* Cruft to make sure options are clean, and used properly. */
+ if (argv[0] && !argv[1] && family == AF_UNIX) {
+ host = argv[0];
+ uport = NULL;
+ } else if (argv[0] && !argv[1]) {
+ if (!lflag)
+ usage(1);
+ uport = argv[0];
+ host = NULL;
+ } else if (argv[0] && argv[1]) {
+ host = argv[0];
+ uport = argv[1];
+ } else
+ usage(1);
+
+ if (lflag && sflag)
+ errx(1, "cannot use -s and -l");
+ if (lflag && pflag)
+ errx(1, "cannot use -p and -l");
+ if (lflag && zflag)
+ errx(1, "cannot use -z and -l");
+ if (!lflag && kflag)
+ errx(1, "must use -l with -k");
+
+ /* Get name of temporary socket for unix datagram client */
+ if ((family == AF_UNIX) && uflag && !lflag) {
+ if (sflag) {
+ unix_dg_tmp_socket = sflag;
+ } else {
+ strlcpy(unix_dg_tmp_socket_buf, "/tmp/nc.XXXXXXXXXX",
+ UNIX_DG_TMP_SOCKET_SIZE);
+ if (mktemp(unix_dg_tmp_socket_buf) == NULL)
+ err(1, "mktemp");
+ unix_dg_tmp_socket = unix_dg_tmp_socket_buf;
+ }
+ }
+
+ /* Initialize addrinfo structure. */
+ if (family != AF_UNIX) {
+ memset(&hints, 0, sizeof(struct addrinfo));
+ hints.ai_family = family;
+ hints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
+ hints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP;
+ if (nflag)
+ hints.ai_flags |= AI_NUMERICHOST;
+ }
+
+ if (xflag) {
+ if (uflag)
+ errx(1, "no proxy support for UDP mode");
+
+ if (lflag)
+ errx(1, "no proxy support for listen");
+
+ if (family == AF_UNIX)
+ errx(1, "no proxy support for unix sockets");
+
+ /* XXX IPv6 transport to proxy would probably work */
+ if (family == AF_INET6)
+ errx(1, "no proxy support for IPv6");
+
+ if (sflag)
+ errx(1, "no proxy support for local source address");
+
+ proxyhost = strsep(&proxy, ":");
+ proxyport = proxy;
+
+ memset(&proxyhints, 0, sizeof(struct addrinfo));
+ proxyhints.ai_family = family;
+ proxyhints.ai_socktype = SOCK_STREAM;
+ proxyhints.ai_protocol = IPPROTO_TCP;
+ if (nflag)
+ proxyhints.ai_flags |= AI_NUMERICHOST;
+ }
+
+ if (lflag) {
+ int connfd;
+ ret = 0;
+
+ if (family == AF_UNIX) {
+ if (uflag)
+ s = unix_bind(host);
+ else
+ s = unix_listen(host);
+ }
+
+ /* Allow only one connection at a time, but stay alive. */
+ for (;;) {
+ if (family != AF_UNIX)
+ s = local_listen(host, uport, hints);
+ if (s < 0)
+ err(1, "local_listen");
+ /*
+ * For UDP and -k, don't connect the socket, let it
+ * receive datagrams from multiple socket pairs.
+ */
+ if (uflag && kflag)
+ readwrite(s);
+ /*
+ * For UDP and not -k, we will use recvfrom() initially
+ * to wait for a caller, then use the regular functions
+ * to talk to the caller.
+ */
+ else if (uflag && !kflag) {
+ int rv, plen;
+ char buf[16384];
+ struct sockaddr_storage z;
+
+ len = sizeof(z);
+ plen = 2048;
+ rv = recvfrom(s, buf, plen, MSG_PEEK,
+ (struct sockaddr *)&z, &len);
+ if (rv < 0)
+ err(1, "recvfrom");
+
+ rv = connect(s, (struct sockaddr *)&z, len);
+ if (rv < 0)
+ err(1, "connect");
+
+ if (vflag)
+ report_connect((struct sockaddr *)&z, len);
+
+ readwrite(s);
+ } else {
+ len = sizeof(cliaddr);
+ connfd = accept(s, (struct sockaddr *)&cliaddr,
+ &len);
+ if (connfd == -1) {
+ /* For now, all errnos are fatal */
+ err(1, "accept");
+ }
+ if (vflag)
+ report_connect((struct sockaddr *)&cliaddr, len);
+
+ readwrite(connfd);
+ close(connfd);
+ }
+
+ if (family != AF_UNIX)
+ close(s);
+ else if (uflag) {
+ if (connect(s, NULL, 0) < 0)
+ err(1, "connect");
+ }
+
+ if (!kflag)
+ break;
+ }
+ } else if (family == AF_UNIX) {
+ ret = 0;
+
+ if ((s = unix_connect(host)) > 0 && !zflag) {
+ readwrite(s);
+ close(s);
+ } else
+ ret = 1;
+
+ if (uflag)
+ unlink(unix_dg_tmp_socket);
+ exit(ret);
+
+ } else {
+ int i = 0;
+
+ /* Construct the portlist[] array. */
+ build_ports(uport);
+
+ /* Cycle through portlist, connecting to each port. */
+ for (i = 0; portlist[i] != NULL; i++) {
+ if (s)
+ close(s);
+
+ if (xflag)
+ s = socks_connect(host, portlist[i], hints,
+ proxyhost, proxyport, proxyhints, socksv,
+ Pflag);
+ else
+ s = remote_connect(host, portlist[i], hints);
+
+ if (s < 0)
+ continue;
+
+ ret = 0;
+ if (vflag || zflag) {
+ /* For UDP, make sure we are connected. */
+ if (uflag) {
+ if (udptest(s) == -1) {
+ ret = 1;
+ continue;
+ }
+ }
+
+ /* Don't look up port if -n. */
+ if (nflag)
+ sv = NULL;
+ else {
+ sv = getservbyport(
+ ntohs(atoi(portlist[i])),
+ uflag ? "udp" : "tcp");
+ }
+
+ fprintf(stderr,
+ "Connection to %s %s port [%s/%s] "
+ "succeeded!\n", host, portlist[i],
+ uflag ? "udp" : "tcp",
+ sv ? sv->s_name : "*");
+ }
+ if (Fflag)
+ fdpass(s);
+ else if (!zflag)
+ readwrite(s);
+ }
+ }
+
+ if (s)
+ close(s);
+
+ exit(ret);
+}
+
+/*
+ * unix_bind()
+ * Returns a unix socket bound to the given path
+ */
+int
+unix_bind(char *path)
+{
+ struct sockaddr_un sun_sa;
+ int s;
+
+ /* Create unix domain socket. */
+ if ((s = socket(AF_UNIX, uflag ? SOCK_DGRAM : SOCK_STREAM,
+ 0)) < 0)
+ return (-1);
+
+ memset(&sun_sa, 0, sizeof(struct sockaddr_un));
+ sun_sa.sun_family = AF_UNIX;
+
+ if (strlcpy(sun_sa.sun_path, path, sizeof(sun_sa.sun_path)) >=
+ sizeof(sun_sa.sun_path)) {
+ close(s);
+ errno = ENAMETOOLONG;
+ return (-1);
+ }
+
+ if (bind(s, (struct sockaddr *)&sun_sa, SUN_LEN(&sun_sa)) < 0) {
+ close(s);
+ return (-1);
+ }
+ return (s);
+}
+
+/*
+ * unix_connect()
+ * Returns a socket connected to a local unix socket. Returns -1 on failure.
+ */
+int
+unix_connect(char *path)
+{
+ struct sockaddr_un sun_sa;
+ int s;
+
+ if (uflag) {
+ if ((s = unix_bind(unix_dg_tmp_socket)) < 0)
+ return (-1);
+ } else {
+ if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
+ return (-1);
+ }
+ (void)fcntl(s, F_SETFD, FD_CLOEXEC);
+
+ memset(&sun_sa, 0, sizeof(struct sockaddr_un));
+ sun_sa.sun_family = AF_UNIX;
+
+ if (strlcpy(sun_sa.sun_path, path, sizeof(sun_sa.sun_path)) >=
+ sizeof(sun_sa.sun_path)) {
+ close(s);
+ errno = ENAMETOOLONG;
+ return (-1);
+ }
+ if (connect(s, (struct sockaddr *)&sun_sa, SUN_LEN(&sun_sa)) < 0) {
+ close(s);
+ return (-1);
+ }
+ return (s);
+
+}
+
+/*
+ * unix_listen()
+ * Create a unix domain socket, and listen on it.
+ */
+int
+unix_listen(char *path)
+{
+ int s;
+ if ((s = unix_bind(path)) < 0)
+ return (-1);
+
+ if (listen(s, 5) < 0) {
+ close(s);
+ return (-1);
+ }
+ return (s);
+}
+
+/*
+ * remote_connect()
+ * Returns a socket connected to a remote host. Properly binds to a local
+ * port or source address if needed. Returns -1 on failure.
+ */
+int
+remote_connect(const char *host, const char *port, struct addrinfo hints)
+{
+ struct addrinfo *res, *res0;
+ int s, error;
+#if defined(SO_RTABLE) || defined(SO_BINDANY)
+ int on = 1;
+#endif
+
+ if ((error = getaddrinfo(host, port, &hints, &res)))
+ errx(1, "getaddrinfo: %s", gai_strerror(error));
+
+ res0 = res;
+ do {
+ if ((s = socket(res0->ai_family, res0->ai_socktype,
+ res0->ai_protocol)) < 0)
+ continue;
+
+#ifdef SO_RTABLE
+ if (rtableid >= 0 && (setsockopt(s, SOL_SOCKET, SO_RTABLE,
+ &rtableid, sizeof(rtableid)) == -1))
+ err(1, "setsockopt SO_RTABLE");
+#endif
+ /* Bind to a local port or source address if specified. */
+ if (sflag || pflag) {
+ struct addrinfo ahints, *ares;
+
+#ifdef SO_BINDANY
+ /* try SO_BINDANY, but don't insist */
+ setsockopt(s, SOL_SOCKET, SO_BINDANY, &on, sizeof(on));
+#endif
+ memset(&ahints, 0, sizeof(struct addrinfo));
+ ahints.ai_family = res0->ai_family;
+ ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
+ ahints.ai_protocol = uflag ? IPPROTO_UDP : IPPROTO_TCP;
+ ahints.ai_flags = AI_PASSIVE;
+ if ((error = getaddrinfo(sflag, pflag, &ahints, &ares)))
+ errx(1, "getaddrinfo: %s", gai_strerror(error));
+
+ if (bind(s, (struct sockaddr *)ares->ai_addr,
+ ares->ai_addrlen) < 0)
+ err(1, "bind failed");
+ freeaddrinfo(ares);
+ }
+
+ set_common_sockopts(s);
+
+ if (timeout_connect(s, res0->ai_addr, res0->ai_addrlen) == 0)
+ break;
+ else if (vflag)
+ warn("connect to %s port %s (%s) failed", host, port,
+ uflag ? "udp" : "tcp");
+
+ close(s);
+ s = -1;
+ } while ((res0 = res0->ai_next) != NULL);
+
+ freeaddrinfo(res);
+
+ return (s);
+}
+
+int
+timeout_connect(int s, const struct sockaddr *name, socklen_t namelen)
+{
+ struct pollfd pfd;
+ socklen_t optlen;
+ int flags = 0, optval;
+ int ret;
+
+ if (timeout != -1) {
+ flags = fcntl(s, F_GETFL, 0);
+ if (fcntl(s, F_SETFL, flags | O_NONBLOCK) == -1)
+ err(1, "set non-blocking mode");
+ }
+
+ if ((ret = connect(s, name, namelen)) != 0 && errno == EINPROGRESS) {
+ pfd.fd = s;
+ pfd.events = POLLOUT;
+ if ((ret = poll(&pfd, 1, timeout)) == 1) {
+ optlen = sizeof(optval);
+ if ((ret = getsockopt(s, SOL_SOCKET, SO_ERROR,
+ &optval, &optlen)) == 0) {
+ errno = optval;
+ ret = optval == 0 ? 0 : -1;
+ }
+ } else if (ret == 0) {
+ errno = ETIMEDOUT;
+ ret = -1;
+ } else
+ err(1, "poll failed");
+ }
+
+ if (timeout != -1 && fcntl(s, F_SETFL, flags) == -1)
+ err(1, "restoring flags");
+
+ return (ret);
+}
+
+/*
+ * local_listen()
+ * Returns a socket listening on a local port, binds to specified source
+ * address. Returns -1 on failure.
+ */
+int
+local_listen(char *host, char *port, struct addrinfo hints)
+{
+ struct addrinfo *res, *res0;
+ int s, ret, x = 1;
+ int error;
+
+ /* Allow nodename to be null. */
+ hints.ai_flags |= AI_PASSIVE;
+
+ /*
+ * In the case of binding to a wildcard address
+ * default to binding to an ipv4 address.
+ */
+ if (host == NULL && hints.ai_family == AF_UNSPEC)
+ hints.ai_family = AF_INET;
+
+ if ((error = getaddrinfo(host, port, &hints, &res)))
+ errx(1, "getaddrinfo: %s", gai_strerror(error));
+
+ res0 = res;
+ do {
+ if ((s = socket(res0->ai_family, res0->ai_socktype,
+ res0->ai_protocol)) < 0)
+ continue;
+
+#ifdef SO_RTABLE
+ if (rtableid >= 0 && (setsockopt(s, SOL_SOCKET, SO_RTABLE,
+ &rtableid, sizeof(rtableid)) == -1))
+ err(1, "setsockopt SO_RTABLE");
+#endif
+#ifdef SO_REUSEPORT
+ ret = setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &x, sizeof(x));
+ if (ret == -1)
+ err(1, "setsockopt");
+#endif
+ set_common_sockopts(s);
+
+ if (bind(s, (struct sockaddr *)res0->ai_addr,
+ res0->ai_addrlen) == 0)
+ break;
+
+ close(s);
+ s = -1;
+ } while ((res0 = res0->ai_next) != NULL);
+
+ if (!uflag && s != -1) {
+ if (listen(s, 1) < 0)
+ err(1, "listen");
+ }
+
+ freeaddrinfo(res);
+
+ return (s);
+}
+
+/*
+ * readwrite()
+ * Loop that polls on the network file descriptor and stdin.
+ */
+void
+readwrite(int net_fd)
+{
+ struct pollfd pfd[4];
+ int stdin_fd = STDIN_FILENO;
+ int stdout_fd = STDOUT_FILENO;
+ unsigned char netinbuf[BUFSIZE];
+ size_t netinbufpos = 0;
+ unsigned char stdinbuf[BUFSIZE];
+ size_t stdinbufpos = 0;
+ int n, num_fds;
+ ssize_t ret;
+
+ /* don't read from stdin if requested */
+ if (dflag)
+ stdin_fd = -1;
+
+ /* stdin */
+ pfd[POLL_STDIN].fd = stdin_fd;
+ pfd[POLL_STDIN].events = POLLIN;
+
+ /* network out */
+ pfd[POLL_NETOUT].fd = net_fd;
+ pfd[POLL_NETOUT].events = 0;
+
+ /* network in */
+ pfd[POLL_NETIN].fd = net_fd;
+ pfd[POLL_NETIN].events = POLLIN;
+
+ /* stdout */
+ pfd[POLL_STDOUT].fd = stdout_fd;
+ pfd[POLL_STDOUT].events = 0;
+
+ while (1) {
+ /* both inputs are gone, buffers are empty, we are done */
+ if (pfd[POLL_STDIN].fd == -1 && pfd[POLL_NETIN].fd == -1
+ && stdinbufpos == 0 && netinbufpos == 0) {
+ close(net_fd);
+ return;
+ }
+ /* both outputs are gone, we can't continue */
+ if (pfd[POLL_NETOUT].fd == -1 && pfd[POLL_STDOUT].fd == -1) {
+ close(net_fd);
+ return;
+ }
+ /* listen and net in gone, queues empty, done */
+ if (lflag && pfd[POLL_NETIN].fd == -1
+ && stdinbufpos == 0 && netinbufpos == 0) {
+ close(net_fd);
+ return;
+ }
+
+ /* help says -i is for "wait between lines sent". We read and
+ * write arbitrary amounts of data, and we don't want to start
+ * scanning for newlines, so this is as good as it gets */
+ if (iflag)
+ sleep(iflag);
+
+ /* poll */
+ num_fds = poll(pfd, 4, timeout);
+
+ /* treat poll errors */
+ if (num_fds == -1) {
+ close(net_fd);
+ err(1, "polling error");
+ }
+
+ /* timeout happened */
+ if (num_fds == 0)
+ return;
+
+ /* treat socket error conditions */
+ for (n = 0; n < 4; n++) {
+ if (pfd[n].revents & (POLLERR|POLLNVAL)) {
+ pfd[n].fd = -1;
+ }
+ }
+ /* reading is possible after HUP */
+ if (pfd[POLL_STDIN].events & POLLIN &&
+ pfd[POLL_STDIN].revents & POLLHUP &&
+ ! (pfd[POLL_STDIN].revents & POLLIN))
+ pfd[POLL_STDIN].fd = -1;
+
+ if (pfd[POLL_NETIN].events & POLLIN &&
+ pfd[POLL_NETIN].revents & POLLHUP &&
+ ! (pfd[POLL_NETIN].revents & POLLIN))
+ pfd[POLL_NETIN].fd = -1;
+
+ if (pfd[POLL_NETOUT].revents & POLLHUP) {
+ if (Nflag)
+ shutdown(pfd[POLL_NETOUT].fd, SHUT_WR);
+ pfd[POLL_NETOUT].fd = -1;
+ }
+ /* if HUP, stop watching stdout */
+ if (pfd[POLL_STDOUT].revents & POLLHUP)
+ pfd[POLL_STDOUT].fd = -1;
+ /* if no net out, stop watching stdin */
+ if (pfd[POLL_NETOUT].fd == -1)
+ pfd[POLL_STDIN].fd = -1;
+ /* if no stdout, stop watching net in */
+ if (pfd[POLL_STDOUT].fd == -1) {
+ if (pfd[POLL_NETIN].fd != -1)
+ shutdown(pfd[POLL_NETIN].fd, SHUT_RD);
+ pfd[POLL_NETIN].fd = -1;
+ }
+
+ /* try to read from stdin */
+ if (pfd[POLL_STDIN].revents & POLLIN && stdinbufpos < BUFSIZE) {
+ ret = fillbuf(pfd[POLL_STDIN].fd, stdinbuf,
+ &stdinbufpos);
+ /* error or eof on stdin - remove from pfd */
+ if (ret == 0 || ret == -1)
+ pfd[POLL_STDIN].fd = -1;
+ /* read something - poll net out */
+ if (stdinbufpos > 0)
+ pfd[POLL_NETOUT].events = POLLOUT;
+ /* filled buffer - remove self from polling */
+ if (stdinbufpos == BUFSIZE)
+ pfd[POLL_STDIN].events = 0;
+ }
+ /* try to write to network */
+ if (pfd[POLL_NETOUT].revents & POLLOUT && stdinbufpos > 0) {
+ ret = drainbuf(pfd[POLL_NETOUT].fd, stdinbuf,
+ &stdinbufpos);
+ if (ret == -1)
+ pfd[POLL_NETOUT].fd = -1;
+ /* buffer empty - remove self from polling */
+ if (stdinbufpos == 0)
+ pfd[POLL_NETOUT].events = 0;
+ /* buffer no longer full - poll stdin again */
+ if (stdinbufpos < BUFSIZE)
+ pfd[POLL_STDIN].events = POLLIN;
+ }
+ /* try to read from network */
+ if (pfd[POLL_NETIN].revents & POLLIN && netinbufpos < BUFSIZE) {
+ ret = fillbuf(pfd[POLL_NETIN].fd, netinbuf,
+ &netinbufpos);
+ if (ret == -1)
+ pfd[POLL_NETIN].fd = -1;
+ /* eof on net in - remove from pfd */
+ if (ret == 0) {
+ shutdown(pfd[POLL_NETIN].fd, SHUT_RD);
+ pfd[POLL_NETIN].fd = -1;
+ }
+ /* read something - poll stdout */
+ if (netinbufpos > 0)
+ pfd[POLL_STDOUT].events = POLLOUT;
+ /* filled buffer - remove self from polling */
+ if (netinbufpos == BUFSIZE)
+ pfd[POLL_NETIN].events = 0;
+ /* handle telnet */
+ if (tflag)
+ atelnet(pfd[POLL_NETIN].fd, netinbuf,
+ netinbufpos);
+ }
+ /* try to write to stdout */
+ if (pfd[POLL_STDOUT].revents & POLLOUT && netinbufpos > 0) {
+ ret = drainbuf(pfd[POLL_STDOUT].fd, netinbuf,
+ &netinbufpos);
+ if (ret == -1)
+ pfd[POLL_STDOUT].fd = -1;
+ /* buffer empty - remove self from polling */
+ if (netinbufpos == 0)
+ pfd[POLL_STDOUT].events = 0;
+ /* buffer no longer full - poll net in again */
+ if (netinbufpos < BUFSIZE)
+ pfd[POLL_NETIN].events = POLLIN;
+ }
+
+ /* stdin gone and queue empty? */
+ if (pfd[POLL_STDIN].fd == -1 && stdinbufpos == 0) {
+ if (pfd[POLL_NETOUT].fd != -1 && Nflag)
+ shutdown(pfd[POLL_NETOUT].fd, SHUT_WR);
+ pfd[POLL_NETOUT].fd = -1;
+ }
+ /* net in gone and queue empty? */
+ if (pfd[POLL_NETIN].fd == -1 && netinbufpos == 0) {
+ pfd[POLL_STDOUT].fd = -1;
+ }
+ }
+}
+
+ssize_t
+drainbuf(int fd, unsigned char *buf, size_t *bufpos)
+{
+ ssize_t n;
+ ssize_t adjust;
+
+ n = write(fd, buf, *bufpos);
+ /* don't treat EAGAIN, EINTR as error */
+ if (n == -1 && (errno == EAGAIN || errno == EINTR))
+ n = -2;
+ if (n <= 0)
+ return n;
+ /* adjust buffer */
+ adjust = *bufpos - n;
+ if (adjust > 0)
+ memmove(buf, buf + n, adjust);
+ *bufpos -= n;
+ return n;
+}
+
+
+ssize_t
+fillbuf(int fd, unsigned char *buf, size_t *bufpos)
+{
+ size_t num = BUFSIZE - *bufpos;
+ ssize_t n;
+
+ n = read(fd, buf + *bufpos, num);
+ /* don't treat EAGAIN, EINTR as error */
+ if (n == -1 && (errno == EAGAIN || errno == EINTR))
+ n = -2;
+ if (n <= 0)
+ return n;
+ *bufpos += n;
+ return n;
+}
+
+/*
+ * fdpass()
+ * Pass the connected file descriptor to stdout and exit.
+ */
+void
+fdpass(int nfd)
+{
+#if defined(HAVE_SENDMSG) && (defined(HAVE_ACCRIGHTS_IN_MSGHDR) || defined(HAVE_CONTROL_IN_MSGHDR))
+ struct msghdr msg;
+#ifndef HAVE_ACCRIGHTS_IN_MSGHDR
+ union {
+ struct cmsghdr hdr;
+ char buf[CMSG_SPACE(sizeof(int))];
+ } cmsgbuf;
+ struct cmsghdr *cmsg;
+#endif
+ struct iovec vec;
+ char ch = '\0';
+ struct pollfd pfd;
+ ssize_t r;
+
+ memset(&msg, 0, sizeof(msg));
+#ifdef HAVE_ACCRIGHTS_IN_MSGHDR
+ msg.msg_accrights = (caddr_t)&nfd;
+ msg.msg_accrightslen = sizeof(nfd);
+#else
+ memset(&cmsgbuf, 0, sizeof(cmsgbuf));
+ msg.msg_control = (caddr_t)&cmsgbuf.buf;
+ msg.msg_controllen = sizeof(cmsgbuf.buf);
+ cmsg = CMSG_FIRSTHDR(&msg);
+ cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+ cmsg->cmsg_level = SOL_SOCKET;
+ cmsg->cmsg_type = SCM_RIGHTS;
+ *(int *)CMSG_DATA(cmsg) = nfd;
+#endif
+
+ vec.iov_base = &ch;
+ vec.iov_len = 1;
+ msg.msg_iov = &vec;
+ msg.msg_iovlen = 1;
+
+ bzero(&pfd, sizeof(pfd));
+ pfd.fd = STDOUT_FILENO;
+ for (;;) {
+ r = sendmsg(STDOUT_FILENO, &msg, 0);
+ if (r == -1) {
+ if (errno == EAGAIN || errno == EINTR) {
+ pfd.events = POLLOUT;
+ if (poll(&pfd, 1, -1) == -1)
+ err(1, "poll");
+ continue;
+ }
+ err(1, "sendmsg");
+ } else if (r == -1)
+ errx(1, "sendmsg: unexpected return value %zd", r);
+ else
+ break;
+ }
+ exit(0);
+#else
+ errx(1, "%s: file descriptor passing not supported", __func__);
+#endif
+}
+
+/* Deal with RFC 854 WILL/WONT DO/DONT negotiation. */
+void
+atelnet(int nfd, unsigned char *buf, unsigned int size)
+{
+ unsigned char *p, *end;
+ unsigned char obuf[4];
+
+ if (size < 3)
+ return;
+ end = buf + size - 2;
+
+ for (p = buf; p < end; p++) {
+ if (*p != IAC)
+ continue;
+
+ obuf[0] = IAC;
+ p++;
+ if ((*p == WILL) || (*p == WONT))
+ obuf[1] = DONT;
+ else if ((*p == DO) || (*p == DONT))
+ obuf[1] = WONT;
+ else
+ continue;
+
+ p++;
+ obuf[2] = *p;
+ if (atomicio(vwrite, nfd, obuf, 3) != 3)
+ warn("Write Error!");
+ }
+}
+
+/*
+ * build_ports()
+ * Build an array of ports in portlist[], listing each port
+ * that we should try to connect to.
+ */
+void
+build_ports(char *p)
+{
+ const char *errstr;
+ char *n;
+ int hi, lo, cp;
+ int x = 0;
+
+ if ((n = strchr(p, '-')) != NULL) {
+ *n = '\0';
+ n++;
+
+ /* Make sure the ports are in order: lowest->highest. */
+ hi = strtonum(n, 1, PORT_MAX, &errstr);
+ if (errstr)
+ errx(1, "port number %s: %s", errstr, n);
+ lo = strtonum(p, 1, PORT_MAX, &errstr);
+ if (errstr)
+ errx(1, "port number %s: %s", errstr, p);
+
+ if (lo > hi) {
+ cp = hi;
+ hi = lo;
+ lo = cp;
+ }
+
+ /* Load ports sequentially. */
+ for (cp = lo; cp <= hi; cp++) {
+ portlist[x] = calloc(1, PORT_MAX_LEN);
+ if (portlist[x] == NULL)
+ errx(1, "calloc");
+ snprintf(portlist[x], PORT_MAX_LEN, "%d", cp);
+ x++;
+ }
+
+ /* Randomly swap ports. */
+ if (rflag) {
+ int y;
+ char *c;
+
+ for (x = 0; x <= (hi - lo); x++) {
+ y = (arc4random() & 0xFFFF) % (hi - lo);
+ c = portlist[x];
+ portlist[x] = portlist[y];
+ portlist[y] = c;
+ }
+ }
+ } else {
+ hi = strtonum(p, 1, PORT_MAX, &errstr);
+ if (errstr)
+ errx(1, "port number %s: %s", errstr, p);
+ portlist[0] = strdup(p);
+ if (portlist[0] == NULL)
+ errx(1, "strdup");
+ }
+}
+
+/*
+ * udptest()
+ * Do a few writes to see if the UDP port is there.
+ * Fails once PF state table is full.
+ */
+int
+udptest(int s)
+{
+ int i, ret;
+
+ for (i = 0; i <= 3; i++) {
+ if (write(s, "X", 1) == 1)
+ ret = 1;
+ else
+ ret = -1;
+ }
+ return (ret);
+}
+
+void
+set_common_sockopts(int s)
+{
+ int x = 1;
+
+#ifdef TCP_MD5SIG
+ if (Sflag) {
+ if (setsockopt(s, IPPROTO_TCP, TCP_MD5SIG,
+ &x, sizeof(x)) == -1)
+ err(1, "setsockopt");
+ }
+#endif
+ if (Dflag) {
+ if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
+ &x, sizeof(x)) == -1)
+ err(1, "setsockopt");
+ }
+ if (Tflag != -1) {
+ if (setsockopt(s, IPPROTO_IP, IP_TOS,
+ &Tflag, sizeof(Tflag)) == -1)
+ err(1, "set IP ToS");
+ }
+ if (Iflag) {
+ if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
+ &Iflag, sizeof(Iflag)) == -1)
+ err(1, "set TCP receive buffer size");
+ }
+ if (Oflag) {
+ if (setsockopt(s, SOL_SOCKET, SO_SNDBUF,
+ &Oflag, sizeof(Oflag)) == -1)
+ err(1, "set TCP send buffer size");
+ }
+}
+
+int
+map_tos(char *s, int *val)
+{
+ /* DiffServ Codepoints and other TOS mappings */
+ const struct toskeywords {
+ const char *keyword;
+ int val;
+ } *t, toskeywords[] = {
+ { "af11", IPTOS_DSCP_AF11 },
+ { "af12", IPTOS_DSCP_AF12 },
+ { "af13", IPTOS_DSCP_AF13 },
+ { "af21", IPTOS_DSCP_AF21 },
+ { "af22", IPTOS_DSCP_AF22 },
+ { "af23", IPTOS_DSCP_AF23 },
+ { "af31", IPTOS_DSCP_AF31 },
+ { "af32", IPTOS_DSCP_AF32 },
+ { "af33", IPTOS_DSCP_AF33 },
+ { "af41", IPTOS_DSCP_AF41 },
+ { "af42", IPTOS_DSCP_AF42 },
+ { "af43", IPTOS_DSCP_AF43 },
+ { "critical", IPTOS_PREC_CRITIC_ECP },
+ { "cs0", IPTOS_DSCP_CS0 },
+ { "cs1", IPTOS_DSCP_CS1 },
+ { "cs2", IPTOS_DSCP_CS2 },
+ { "cs3", IPTOS_DSCP_CS3 },
+ { "cs4", IPTOS_DSCP_CS4 },
+ { "cs5", IPTOS_DSCP_CS5 },
+ { "cs6", IPTOS_DSCP_CS6 },
+ { "cs7", IPTOS_DSCP_CS7 },
+ { "ef", IPTOS_DSCP_EF },
+ { "inetcontrol", IPTOS_PREC_INTERNETCONTROL },
+ { "lowdelay", IPTOS_LOWDELAY },
+ { "netcontrol", IPTOS_PREC_NETCONTROL },
+ { "reliability", IPTOS_RELIABILITY },
+ { "throughput", IPTOS_THROUGHPUT },
+ { NULL, -1 },
+ };
+
+ for (t = toskeywords; t->keyword != NULL; t++) {
+ if (strcmp(s, t->keyword) == 0) {
+ *val = t->val;
+ return (1);
+ }
+ }
+
+ return (0);
+}
+
+void
+report_connect(const struct sockaddr *sa, socklen_t salen)
+{
+ char remote_host[NI_MAXHOST];
+ char remote_port[NI_MAXSERV];
+ int herr;
+ int flags = NI_NUMERICSERV;
+
+ if (nflag)
+ flags |= NI_NUMERICHOST;
+
+ if ((herr = getnameinfo(sa, salen,
+ remote_host, sizeof(remote_host),
+ remote_port, sizeof(remote_port),
+ flags)) != 0) {
+ if (herr == EAI_SYSTEM)
+ err(1, "getnameinfo");
+ else
+ errx(1, "getnameinfo: %s", gai_strerror(herr));
+ }
+
+ fprintf(stderr,
+ "Connection from %s %s "
+ "received!\n", remote_host, remote_port);
+}
+
+void
+help(void)
+{
+ usage(0);
+ fprintf(stderr, "\tCommand Summary:\n\
+ \t-4 Use IPv4\n\
+ \t-6 Use IPv6\n\
+ \t-D Enable the debug socket option\n\
+ \t-d Detach from stdin\n\
+ \t-F Pass socket fd\n\
+ \t-h This help text\n\
+ \t-I length TCP receive buffer length\n\
+ \t-i secs\t Delay interval for lines sent, ports scanned\n\
+ \t-k Keep inbound sockets open for multiple connects\n\
+ \t-l Listen mode, for inbound connects\n\
+ \t-N Shutdown the network socket after EOF on stdin\n\
+ \t-n Suppress name/port resolutions\n\
+ \t-O length TCP send buffer length\n\
+ \t-P proxyuser\tUsername for proxy authentication\n\
+ \t-p port\t Specify local port for remote connects\n\
+ \t-r Randomize remote ports\n\
+ \t-S Enable the TCP MD5 signature option\n\
+ \t-s addr\t Local source address\n\
+ \t-T toskeyword\tSet IP Type of Service\n\
+ \t-t Answer TELNET negotiation\n\
+ \t-U Use UNIX domain socket\n\
+ \t-u UDP mode\n\
+ \t-V rtable Specify alternate routing table\n\
+ \t-v Verbose\n\
+ \t-w secs\t Timeout for connects and final net reads\n\
+ \t-X proto Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
+ \t-x addr[:port]\tSpecify proxy address and port\n\
+ \t-z Zero-I/O mode [used for scanning]\n\
+ Port numbers can be individual or ranges: lo-hi [inclusive]\n");
+ exit(1);
+}
+
+void
+usage(int ret)
+{
+ fprintf(stderr,
+ "usage: nc [-46DdFhklNnrStUuvz] [-I length] [-i interval] [-O length]\n"
+ "\t [-P proxy_username] [-p source_port] [-s source] [-T ToS]\n"
+ "\t [-V rtable] [-w timeout] [-X proxy_protocol]\n"
+ "\t [-x proxy_address[:port]] [destination] [port]\n");
+ if (ret)
+ exit(1);
+}
+
+/* *** src/usr.bin/nc/socks.c *** */
+
+
+/* $OpenBSD: socks.c,v 1.20 2012/03/08 09:56:28 espie Exp $ */
+
+/*
+ * Copyright (c) 1999 Niklas Hallqvist. All rights reserved.
+ * Copyright (c) 2004, 2005 Damien Miller. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <resolv.h>
+
+#define SOCKS_PORT "1080"
+#define HTTP_PROXY_PORT "3128"
+#define HTTP_MAXHDRS 64
+#define SOCKS_V5 5
+#define SOCKS_V4 4
+#define SOCKS_NOAUTH 0
+#define SOCKS_NOMETHOD 0xff
+#define SOCKS_CONNECT 1
+#define SOCKS_IPV4 1
+#define SOCKS_DOMAIN 3
+#define SOCKS_IPV6 4
+
+int remote_connect(const char *, const char *, struct addrinfo);
+int socks_connect(const char *, const char *, struct addrinfo,
+ const char *, const char *, struct addrinfo, int,
+ const char *);
+
+static int
+decode_addrport(const char *h, const char *p, struct sockaddr *addr,
+ socklen_t addrlen, int v4only, int numeric)
+{
+ int r;
+ struct addrinfo hints, *res;
+
+ bzero(&hints, sizeof(hints));
+ hints.ai_family = v4only ? PF_INET : PF_UNSPEC;
+ hints.ai_flags = numeric ? AI_NUMERICHOST : 0;
+ hints.ai_socktype = SOCK_STREAM;
+ r = getaddrinfo(h, p, &hints, &res);
+ /* Don't fatal when attempting to convert a numeric address */
+ if (r != 0) {
+ if (!numeric) {
+ errx(1, "getaddrinfo(\"%.64s\", \"%.64s\"): %s", h, p,
+ gai_strerror(r));
+ }
+ return (-1);
+ }
+ if (addrlen < res->ai_addrlen) {
+ freeaddrinfo(res);
+ errx(1, "internal error: addrlen < res->ai_addrlen");
+ }
+ memcpy(addr, res->ai_addr, res->ai_addrlen);
+ freeaddrinfo(res);
+ return (0);
+}
+
+static int
+proxy_read_line(int fd, char *buf, size_t bufsz)
+{
+ size_t off;
+
+ for(off = 0;;) {
+ if (off >= bufsz)
+ errx(1, "proxy read too long");
+ if (atomicio(read, fd, buf + off, 1) != 1)
+ err(1, "proxy read");
+ /* Skip CR */
+ if (buf[off] == '\r')
+ continue;
+ if (buf[off] == '\n') {
+ buf[off] = '\0';
+ break;
+ }
+ off++;
+ }
+ return (off);
+}
+
+static const char *
+getproxypass(const char *proxyuser, const char *proxyhost)
+{
+ char prompt[512];
+ static char pw[256];
+
+ snprintf(prompt, sizeof(prompt), "Proxy password for %s@%s: ",
+ proxyuser, proxyhost);
+ if (readpassphrase(prompt, pw, sizeof(pw), RPP_REQUIRE_TTY) == NULL)
+ errx(1, "Unable to read proxy passphrase");
+ return (pw);
+}
+
+int
+socks_connect(const char *host, const char *port,
+ struct addrinfo hints __attribute__ ((__unused__)),
+ const char *proxyhost, const char *proxyport, struct addrinfo proxyhints,
+ int socksv, const char *proxyuser)
+{
+ int proxyfd, r, authretry = 0;
+ size_t hlen, wlen = 0;
+ unsigned char buf[1024];
+ size_t cnt;
+ struct sockaddr_storage addr;
+ struct sockaddr_in *in4 = (struct sockaddr_in *)&addr;
+ struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)&addr;
+ in_port_t serverport;
+ const char *proxypass = NULL;
+
+ if (proxyport == NULL)
+ proxyport = (socksv == -1) ? HTTP_PROXY_PORT : SOCKS_PORT;
+
+ /* Abuse API to lookup port */
+ if (decode_addrport("0.0.0.0", port, (struct sockaddr *)&addr,
+ sizeof(addr), 1, 1) == -1)
+ errx(1, "unknown port \"%.64s\"", port);
+ serverport = in4->sin_port;
+
+ again:
+ if (authretry++ > 3)
+ errx(1, "Too many authentication failures");
+
+ proxyfd = remote_connect(proxyhost, proxyport, proxyhints);
+
+ if (proxyfd < 0)
+ return (-1);
+
+ if (socksv == 5) {
+ if (decode_addrport(host, port, (struct sockaddr *)&addr,
+ sizeof(addr), 0, 1) == -1)
+ addr.ss_family = 0; /* used in switch below */
+
+ /* Version 5, one method: no authentication */
+ buf[0] = SOCKS_V5;
+ buf[1] = 1;
+ buf[2] = SOCKS_NOAUTH;
+ cnt = atomicio(vwrite, proxyfd, buf, 3);
+ if (cnt != 3)
+ err(1, "write failed (%zu/3)", cnt);
+
+ cnt = atomicio(read, proxyfd, buf, 2);
+ if (cnt != 2)
+ err(1, "read failed (%zu/3)", cnt);
+
+ if (buf[1] == SOCKS_NOMETHOD)
+ errx(1, "authentication method negotiation failed");
+
+ switch (addr.ss_family) {
+ case 0:
+ /* Version 5, connect: domain name */
+
+ /* Max domain name length is 255 bytes */
+ hlen = strlen(host);
+ if (hlen > 255)
+ errx(1, "host name too long for SOCKS5");
+ buf[0] = SOCKS_V5;
+ buf[1] = SOCKS_CONNECT;
+ buf[2] = 0;
+ buf[3] = SOCKS_DOMAIN;
+ buf[4] = hlen;
+ memcpy(buf + 5, host, hlen);
+ memcpy(buf + 5 + hlen, &serverport, sizeof serverport);
+ wlen = 7 + hlen;
+ break;
+ case AF_INET:
+ /* Version 5, connect: IPv4 address */
+ buf[0] = SOCKS_V5;
+ buf[1] = SOCKS_CONNECT;
+ buf[2] = 0;
+ buf[3] = SOCKS_IPV4;
+ memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
+ memcpy(buf + 8, &in4->sin_port, sizeof in4->sin_port);
+ wlen = 10;
+ break;
+ case AF_INET6:
+ /* Version 5, connect: IPv6 address */
+ buf[0] = SOCKS_V5;
+ buf[1] = SOCKS_CONNECT;
+ buf[2] = 0;
+ buf[3] = SOCKS_IPV6;
+ memcpy(buf + 4, &in6->sin6_addr, sizeof in6->sin6_addr);
+ memcpy(buf + 20, &in6->sin6_port,
+ sizeof in6->sin6_port);
+ wlen = 22;
+ break;
+ default:
+ errx(1, "internal error: silly AF");
+ }
+
+ cnt = atomicio(vwrite, proxyfd, buf, wlen);
+ if (cnt != wlen)
+ err(1, "write failed (%zu/%zu)", cnt, wlen);
+
+ cnt = atomicio(read, proxyfd, buf, 4);
+ if (cnt != 4)
+ err(1, "read failed (%zu/4)", cnt);
+ if (buf[1] != 0)
+ errx(1, "connection failed, SOCKS error %d", buf[1]);
+ switch (buf[3]) {
+ case SOCKS_IPV4:
+ cnt = atomicio(read, proxyfd, buf + 4, 6);
+ if (cnt != 6)
+ err(1, "read failed (%zu/6)", cnt);
+ break;
+ case SOCKS_IPV6:
+ cnt = atomicio(read, proxyfd, buf + 4, 18);
+ if (cnt != 18)
+ err(1, "read failed (%zu/18)", cnt);
+ break;
+ default:
+ errx(1, "connection failed, unsupported address type");
+ }
+ } else if (socksv == 4) {
+ /* This will exit on lookup failure */
+ decode_addrport(host, port, (struct sockaddr *)&addr,
+ sizeof(addr), 1, 0);
+
+ /* Version 4 */
+ buf[0] = SOCKS_V4;
+ buf[1] = SOCKS_CONNECT; /* connect */
+ memcpy(buf + 2, &in4->sin_port, sizeof in4->sin_port);
+ memcpy(buf + 4, &in4->sin_addr, sizeof in4->sin_addr);
+ buf[8] = 0; /* empty username */
+ wlen = 9;
+
+ cnt = atomicio(vwrite, proxyfd, buf, wlen);
+ if (cnt != wlen)
+ err(1, "write failed (%zu/%zu)", cnt, wlen);
+
+ cnt = atomicio(read, proxyfd, buf, 8);
+ if (cnt != 8)
+ err(1, "read failed (%zu/8)", cnt);
+ if (buf[1] != 90)
+ errx(1, "connection failed, SOCKS error %d", buf[1]);
+ } else if (socksv == -1) {
+ /* HTTP proxy CONNECT */
+
+ /* Disallow bad chars in hostname */
+ if (strcspn(host, "\r\n\t []:") != strlen(host))
+ errx(1, "Invalid hostname");
+
+ /* Try to be sane about numeric IPv6 addresses */
+ if (strchr(host, ':') != NULL) {
+ r = snprintf(buf, sizeof(buf),
+ "CONNECT [%s]:%d HTTP/1.0\r\n",
+ host, ntohs(serverport));
+ } else {
+ r = snprintf(buf, sizeof(buf),
+ "CONNECT %s:%d HTTP/1.0\r\n",
+ host, ntohs(serverport));
+ }
+ if (r == -1 || (size_t)r >= sizeof(buf))
+ errx(1, "hostname too long");
+ r = strlen(buf);
+
+ cnt = atomicio(vwrite, proxyfd, buf, r);
+ if (cnt != (size_t)r)
+ err(1, "write failed (%zu/%d)", cnt, r);
+
+ if (authretry > 1) {
+ char resp[1024];
+
+ proxypass = getproxypass(proxyuser, proxyhost);
+ r = snprintf(buf, sizeof(buf), "%s:%s",
+ proxyuser, proxypass);
+ if (r == -1 || (size_t)r >= sizeof(buf) ||
+ b64_ntop(buf, strlen(buf), resp,
+ sizeof(resp)) == -1)
+ errx(1, "Proxy username/password too long");
+ r = snprintf(buf, sizeof(buf), "Proxy-Authorization: "
+ "Basic %s\r\n", resp);
+ if (r == -1 || (size_t)r >= sizeof(buf))
+ errx(1, "Proxy auth response too long");
+ r = strlen(buf);
+ if ((cnt = atomicio(vwrite, proxyfd, buf, r)) != (size_t)r)
+ err(1, "write failed (%zu/%d)", cnt, r);
+ }
+
+ /* Terminate headers */
+ if ((r = atomicio(vwrite, proxyfd, "\r\n", 2)) != 2)
+ err(1, "write failed (2/%d)", r);
+
+ /* Read status reply */
+ proxy_read_line(proxyfd, buf, sizeof(buf));
+ if (proxyuser != NULL &&
+ strncmp(buf, "HTTP/1.0 407 ", 12) == 0) {
+ if (authretry > 1) {
+ fprintf(stderr, "Proxy authentication "
+ "failed\n");
+ }
+ close(proxyfd);
+ goto again;
+ } else if (strncmp(buf, "HTTP/1.0 200 ", 12) != 0 &&
+ strncmp(buf, "HTTP/1.1 200 ", 12) != 0)
+ errx(1, "Proxy error: \"%s\"", buf);
+
+ /* Headers continue until we hit an empty line */
+ for (r = 0; r < HTTP_MAXHDRS; r++) {
+ proxy_read_line(proxyfd, buf, sizeof(buf));
+ if (*buf == '\0')
+ break;
+ }
+ if (*buf != '\0')
+ errx(1, "Too many proxy headers received");
+ } else
+ errx(1, "Unknown proxy protocol %d", socksv);
+
+ return (proxyfd);
+}
+
Copied: trunk/crypto/openssh/regress/principals-command.sh (from rev 9222, vendor-crypto/openssh/dist/regress/principals-command.sh)
===================================================================
--- trunk/crypto/openssh/regress/principals-command.sh (rev 0)
+++ trunk/crypto/openssh/regress/principals-command.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,152 @@
+# $OpenBSD: principals-command.sh,v 1.1 2015/05/21 06:44:25 djm Exp $
+# Placed in the Public Domain.
+
+tid="authorized principals command"
+
+rm -f $OBJ/user_ca_key* $OBJ/cert_user_key*
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+
+if test -z "$SUDO" ; then
+ echo "skipped (SUDO not set)"
+ echo "need SUDO to create file in /var/run, test won't work without"
+ exit 0
+fi
+
+# Establish a AuthorizedPrincipalsCommand in /var/run where it will have
+# acceptable directory permissions.
+PRINCIPALS_CMD="/var/run/principals_command_${LOGNAME}"
+cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_CMD'"
+#!/bin/sh
+test "x\$1" != "x${LOGNAME}" && exit 1
+test -f "$OBJ/authorized_principals_${LOGNAME}" &&
+ exec cat "$OBJ/authorized_principals_${LOGNAME}"
+_EOF
+test $? -eq 0 || fatal "couldn't prepare principals command"
+$SUDO chmod 0755 "$PRINCIPALS_CMD"
+
+if ! $OBJ/check-perm -m keys-command $PRINCIPALS_CMD ; then
+ echo "skipping: $PRINCIPALS_CMD is unsuitable as " \
+ "AuthorizedPrincipalsCommand"
+ $SUDO rm -f $PRINCIPALS_CMD
+ exit 0
+fi
+
+# Create a CA key and a user certificate.
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key || \
+ fatal "ssh-keygen of user_ca_key failed"
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/cert_user_key || \
+ fatal "ssh-keygen of cert_user_key failed"
+${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
+ -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
+ fatal "couldn't sign cert_user_key"
+
+if [ -x $PRINCIPALS_CMD ]; then
+ # Test explicitly-specified principals
+ for privsep in yes no ; do
+ _prefix="privsep $privsep"
+
+ # Setup for AuthorizedPrincipalsCommand
+ rm -f $OBJ/authorized_keys_$USER
+ (
+ cat $OBJ/sshd_proxy_bak
+ echo "UsePrivilegeSeparation $privsep"
+ echo "AuthorizedKeysFile none"
+ echo "AuthorizedPrincipalsCommand $PRINCIPALS_CMD %u"
+ echo "AuthorizedPrincipalsCommandUser ${LOGNAME}"
+ echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
+ ) > $OBJ/sshd_proxy
+
+ # XXX test missing command
+ # XXX test failing command
+
+ # Empty authorized_principals
+ verbose "$tid: ${_prefix} empty authorized_principals"
+ echo > $OBJ/authorized_principals_$USER
+ ${SSH} -2i $OBJ/cert_user_key \
+ -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+ if [ $? -eq 0 ]; then
+ fail "ssh cert connect succeeded unexpectedly"
+ fi
+
+ # Wrong authorized_principals
+ verbose "$tid: ${_prefix} wrong authorized_principals"
+ echo gregorsamsa > $OBJ/authorized_principals_$USER
+ ${SSH} -2i $OBJ/cert_user_key \
+ -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+ if [ $? -eq 0 ]; then
+ fail "ssh cert connect succeeded unexpectedly"
+ fi
+
+ # Correct authorized_principals
+ verbose "$tid: ${_prefix} correct authorized_principals"
+ echo mekmitasdigoat > $OBJ/authorized_principals_$USER
+ ${SSH} -2i $OBJ/cert_user_key \
+ -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+ if [ $? -ne 0 ]; then
+ fail "ssh cert connect failed"
+ fi
+
+ # authorized_principals with bad key option
+ verbose "$tid: ${_prefix} authorized_principals bad key opt"
+ echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
+ ${SSH} -2i $OBJ/cert_user_key \
+ -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+ if [ $? -eq 0 ]; then
+ fail "ssh cert connect succeeded unexpectedly"
+ fi
+
+ # authorized_principals with command=false
+ verbose "$tid: ${_prefix} authorized_principals command=false"
+ echo 'command="false" mekmitasdigoat' > \
+ $OBJ/authorized_principals_$USER
+ ${SSH} -2i $OBJ/cert_user_key \
+ -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+ if [ $? -eq 0 ]; then
+ fail "ssh cert connect succeeded unexpectedly"
+ fi
+
+ # authorized_principals with command=true
+ verbose "$tid: ${_prefix} authorized_principals command=true"
+ echo 'command="true" mekmitasdigoat' > \
+ $OBJ/authorized_principals_$USER
+ ${SSH} -2i $OBJ/cert_user_key \
+ -F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
+ if [ $? -ne 0 ]; then
+ fail "ssh cert connect failed"
+ fi
+
+ # Setup for principals= key option
+ rm -f $OBJ/authorized_principals_$USER
+ (
+ cat $OBJ/sshd_proxy_bak
+ echo "UsePrivilegeSeparation $privsep"
+ ) > $OBJ/sshd_proxy
+
+ # Wrong principals list
+ verbose "$tid: ${_prefix} wrong principals key option"
+ (
+ printf 'cert-authority,principals="gregorsamsa" '
+ cat $OBJ/user_ca_key.pub
+ ) > $OBJ/authorized_keys_$USER
+ ${SSH} -2i $OBJ/cert_user_key \
+ -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+ if [ $? -eq 0 ]; then
+ fail "ssh cert connect succeeded unexpectedly"
+ fi
+
+ # Correct principals list
+ verbose "$tid: ${_prefix} correct principals key option"
+ (
+ printf 'cert-authority,principals="mekmitasdigoat" '
+ cat $OBJ/user_ca_key.pub
+ ) > $OBJ/authorized_keys_$USER
+ ${SSH} -2i $OBJ/cert_user_key \
+ -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+ if [ $? -ne 0 ]; then
+ fail "ssh cert connect failed"
+ fi
+ done
+else
+ echo "SKIPPED: $PRINCIPALS_COMMAND not executable " \
+ "(/var/run mounted noexec?)"
+fi
Modified: trunk/crypto/openssh/regress/setuid-allowed.c
===================================================================
--- trunk/crypto/openssh/regress/setuid-allowed.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/regress/setuid-allowed.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -26,7 +26,7 @@
#include <string.h>
#include <errno.h>
-void
+static void
usage(void)
{
fprintf(stderr, "check-setuid [path]\n");
Copied: trunk/crypto/openssh/regress/sshcfgparse.sh (from rev 9222, vendor-crypto/openssh/dist/regress/sshcfgparse.sh)
===================================================================
--- trunk/crypto/openssh/regress/sshcfgparse.sh (rev 0)
+++ trunk/crypto/openssh/regress/sshcfgparse.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,29 @@
+# $OpenBSD: sshcfgparse.sh,v 1.2 2016/07/14 01:24:21 dtucker Exp $
+# Placed in the Public Domain.
+
+tid="ssh config parse"
+
+verbose "reparse minimal config"
+(${SSH} -G -F $OBJ/ssh_config somehost >$OBJ/ssh_config.1 &&
+ ${SSH} -G -F $OBJ/ssh_config.1 somehost >$OBJ/ssh_config.2 &&
+ diff $OBJ/ssh_config.1 $OBJ/ssh_config.2) || fail "reparse minimal config"
+
+verbose "ssh -W opts"
+f=`${SSH} -GF $OBJ/ssh_config host | awk '/exitonforwardfailure/{print $2}'`
+test "$f" = "no" || fail "exitonforwardfailure default"
+f=`${SSH} -GF $OBJ/ssh_config -W a:1 h | awk '/exitonforwardfailure/{print $2}'`
+test "$f" = "yes" || fail "exitonforwardfailure enable"
+f=`${SSH} -GF $OBJ/ssh_config -W a:1 -o exitonforwardfailure=no h | \
+ awk '/exitonforwardfailure/{print $2}'`
+test "$f" = "no" || fail "exitonforwardfailure override"
+
+f=`${SSH} -GF $OBJ/ssh_config host | awk '/clearallforwardings/{print $2}'`
+test "$f" = "no" || fail "clearallforwardings default"
+f=`${SSH} -GF $OBJ/ssh_config -W a:1 h | awk '/clearallforwardings/{print $2}'`
+test "$f" = "yes" || fail "clearallforwardings enable"
+f=`${SSH} -GF $OBJ/ssh_config -W a:1 -o clearallforwardings=no h | \
+ awk '/clearallforwardings/{print $2}'`
+test "$f" = "no" || fail "clearallforwardings override"
+
+# cleanup
+rm -f $OBJ/ssh_config.[012]
Copied: trunk/crypto/openssh/regress/t11.ok (from rev 9222, vendor-crypto/openssh/dist/regress/t11.ok)
===================================================================
--- trunk/crypto/openssh/regress/t11.ok (rev 0)
+++ trunk/crypto/openssh/regress/t11.ok 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1 @@
+SHA256:4w1rnrek3klTJOTVhwuCIFd5k+pq9Bfo5KTxxb8BqbY
Copied: trunk/crypto/openssh/regress/valgrind-unit.sh (from rev 9222, vendor-crypto/openssh/dist/regress/valgrind-unit.sh)
===================================================================
--- trunk/crypto/openssh/regress/valgrind-unit.sh (rev 0)
+++ trunk/crypto/openssh/regress/valgrind-unit.sh 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+UNIT_BINARY="$1"
+shift
+UNIT_ARGS="$@"
+
+test "x$OBJ" = "x" && OBJ=$PWD
+
+# This mostly replicates the logic in test-exec.sh for running the
+# regress tests under valgrind.
+VG_TEST=`basename $UNIT_BINARY`
+VG_LOG="$OBJ/valgrind-out/${VG_TEST}.%p"
+VG_OPTS="--track-origins=yes --leak-check=full --log-file=${VG_LOG}"
+VG_OPTS="$VG_OPTS --trace-children=yes"
+VG_PATH="valgrind"
+if [ "x$VALGRIND_PATH" != "x" ]; then
+ VG_PATH="$VALGRIND_PATH"
+fi
+
+exec $VG_PATH $VG_OPTS $UNIT_BINARY $UNIT_ARGS
Modified: trunk/crypto/openssh/rijndael.c
===================================================================
--- trunk/crypto/openssh/rijndael.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/rijndael.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: rijndael.c,v 1.16 2004/06/23 00:39:38 mouring Exp $ */
+/* $OpenBSD: rijndael.c,v 1.20 2015/03/16 11:09:52 djm Exp $ */
/**
* rijndael-alg-fst.c
@@ -25,6 +25,7 @@
* OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
* EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
+
#include "includes.h"
#include <stdlib.h>
@@ -32,7 +33,7 @@
#include "rijndael.h"
-#define FULL_UNROLL
+#undef FULL_UNROLL
/*
Te0[x] = S [x].[02, 01, 01, 03];
@@ -39,13 +40,12 @@
Te1[x] = S [x].[03, 02, 01, 01];
Te2[x] = S [x].[01, 03, 02, 01];
Te3[x] = S [x].[01, 01, 03, 02];
-Te4[x] = S [x].[01, 01, 01, 01];
Td0[x] = Si[x].[0e, 09, 0d, 0b];
Td1[x] = Si[x].[0b, 0e, 09, 0d];
Td2[x] = Si[x].[0d, 0b, 0e, 09];
Td3[x] = Si[x].[09, 0d, 0b, 0e];
-Td4[x] = Si[x].[01, 01, 01, 01];
+Td4[x] = Si[x].[01];
*/
static const u32 Te0[256] = {
@@ -247,7 +247,6 @@
0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
};
static const u32 Te3[256] = {
-
0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
@@ -313,72 +312,7 @@
0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
};
-static const u32 Te4[256] = {
- 0x63636363U, 0x7c7c7c7cU, 0x77777777U, 0x7b7b7b7bU,
- 0xf2f2f2f2U, 0x6b6b6b6bU, 0x6f6f6f6fU, 0xc5c5c5c5U,
- 0x30303030U, 0x01010101U, 0x67676767U, 0x2b2b2b2bU,
- 0xfefefefeU, 0xd7d7d7d7U, 0xababababU, 0x76767676U,
- 0xcacacacaU, 0x82828282U, 0xc9c9c9c9U, 0x7d7d7d7dU,
- 0xfafafafaU, 0x59595959U, 0x47474747U, 0xf0f0f0f0U,
- 0xadadadadU, 0xd4d4d4d4U, 0xa2a2a2a2U, 0xafafafafU,
- 0x9c9c9c9cU, 0xa4a4a4a4U, 0x72727272U, 0xc0c0c0c0U,
- 0xb7b7b7b7U, 0xfdfdfdfdU, 0x93939393U, 0x26262626U,
- 0x36363636U, 0x3f3f3f3fU, 0xf7f7f7f7U, 0xccccccccU,
- 0x34343434U, 0xa5a5a5a5U, 0xe5e5e5e5U, 0xf1f1f1f1U,
- 0x71717171U, 0xd8d8d8d8U, 0x31313131U, 0x15151515U,
- 0x04040404U, 0xc7c7c7c7U, 0x23232323U, 0xc3c3c3c3U,
- 0x18181818U, 0x96969696U, 0x05050505U, 0x9a9a9a9aU,
- 0x07070707U, 0x12121212U, 0x80808080U, 0xe2e2e2e2U,
- 0xebebebebU, 0x27272727U, 0xb2b2b2b2U, 0x75757575U,
- 0x09090909U, 0x83838383U, 0x2c2c2c2cU, 0x1a1a1a1aU,
- 0x1b1b1b1bU, 0x6e6e6e6eU, 0x5a5a5a5aU, 0xa0a0a0a0U,
- 0x52525252U, 0x3b3b3b3bU, 0xd6d6d6d6U, 0xb3b3b3b3U,
- 0x29292929U, 0xe3e3e3e3U, 0x2f2f2f2fU, 0x84848484U,
- 0x53535353U, 0xd1d1d1d1U, 0x00000000U, 0xededededU,
- 0x20202020U, 0xfcfcfcfcU, 0xb1b1b1b1U, 0x5b5b5b5bU,
- 0x6a6a6a6aU, 0xcbcbcbcbU, 0xbebebebeU, 0x39393939U,
- 0x4a4a4a4aU, 0x4c4c4c4cU, 0x58585858U, 0xcfcfcfcfU,
- 0xd0d0d0d0U, 0xefefefefU, 0xaaaaaaaaU, 0xfbfbfbfbU,
- 0x43434343U, 0x4d4d4d4dU, 0x33333333U, 0x85858585U,
- 0x45454545U, 0xf9f9f9f9U, 0x02020202U, 0x7f7f7f7fU,
- 0x50505050U, 0x3c3c3c3cU, 0x9f9f9f9fU, 0xa8a8a8a8U,
- 0x51515151U, 0xa3a3a3a3U, 0x40404040U, 0x8f8f8f8fU,
- 0x92929292U, 0x9d9d9d9dU, 0x38383838U, 0xf5f5f5f5U,
- 0xbcbcbcbcU, 0xb6b6b6b6U, 0xdadadadaU, 0x21212121U,
- 0x10101010U, 0xffffffffU, 0xf3f3f3f3U, 0xd2d2d2d2U,
- 0xcdcdcdcdU, 0x0c0c0c0cU, 0x13131313U, 0xececececU,
- 0x5f5f5f5fU, 0x97979797U, 0x44444444U, 0x17171717U,
- 0xc4c4c4c4U, 0xa7a7a7a7U, 0x7e7e7e7eU, 0x3d3d3d3dU,
- 0x64646464U, 0x5d5d5d5dU, 0x19191919U, 0x73737373U,
- 0x60606060U, 0x81818181U, 0x4f4f4f4fU, 0xdcdcdcdcU,
- 0x22222222U, 0x2a2a2a2aU, 0x90909090U, 0x88888888U,
- 0x46464646U, 0xeeeeeeeeU, 0xb8b8b8b8U, 0x14141414U,
- 0xdedededeU, 0x5e5e5e5eU, 0x0b0b0b0bU, 0xdbdbdbdbU,
- 0xe0e0e0e0U, 0x32323232U, 0x3a3a3a3aU, 0x0a0a0a0aU,
- 0x49494949U, 0x06060606U, 0x24242424U, 0x5c5c5c5cU,
- 0xc2c2c2c2U, 0xd3d3d3d3U, 0xacacacacU, 0x62626262U,
- 0x91919191U, 0x95959595U, 0xe4e4e4e4U, 0x79797979U,
- 0xe7e7e7e7U, 0xc8c8c8c8U, 0x37373737U, 0x6d6d6d6dU,
- 0x8d8d8d8dU, 0xd5d5d5d5U, 0x4e4e4e4eU, 0xa9a9a9a9U,
- 0x6c6c6c6cU, 0x56565656U, 0xf4f4f4f4U, 0xeaeaeaeaU,
- 0x65656565U, 0x7a7a7a7aU, 0xaeaeaeaeU, 0x08080808U,
- 0xbabababaU, 0x78787878U, 0x25252525U, 0x2e2e2e2eU,
- 0x1c1c1c1cU, 0xa6a6a6a6U, 0xb4b4b4b4U, 0xc6c6c6c6U,
- 0xe8e8e8e8U, 0xddddddddU, 0x74747474U, 0x1f1f1f1fU,
- 0x4b4b4b4bU, 0xbdbdbdbdU, 0x8b8b8b8bU, 0x8a8a8a8aU,
- 0x70707070U, 0x3e3e3e3eU, 0xb5b5b5b5U, 0x66666666U,
- 0x48484848U, 0x03030303U, 0xf6f6f6f6U, 0x0e0e0e0eU,
- 0x61616161U, 0x35353535U, 0x57575757U, 0xb9b9b9b9U,
- 0x86868686U, 0xc1c1c1c1U, 0x1d1d1d1dU, 0x9e9e9e9eU,
- 0xe1e1e1e1U, 0xf8f8f8f8U, 0x98989898U, 0x11111111U,
- 0x69696969U, 0xd9d9d9d9U, 0x8e8e8e8eU, 0x94949494U,
- 0x9b9b9b9bU, 0x1e1e1e1eU, 0x87878787U, 0xe9e9e9e9U,
- 0xcecececeU, 0x55555555U, 0x28282828U, 0xdfdfdfdfU,
- 0x8c8c8c8cU, 0xa1a1a1a1U, 0x89898989U, 0x0d0d0d0dU,
- 0xbfbfbfbfU, 0xe6e6e6e6U, 0x42424242U, 0x68686868U,
- 0x41414141U, 0x99999999U, 0x2d2d2d2dU, 0x0f0f0f0fU,
- 0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
-};
+#if 0
static const u32 Td0[256] = {
0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
@@ -532,7 +466,6 @@
0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U,
0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U,
0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU,
-
0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U,
0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U,
0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U,
@@ -644,72 +577,41 @@
0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
};
-static const u32 Td4[256] = {
- 0x52525252U, 0x09090909U, 0x6a6a6a6aU, 0xd5d5d5d5U,
- 0x30303030U, 0x36363636U, 0xa5a5a5a5U, 0x38383838U,
- 0xbfbfbfbfU, 0x40404040U, 0xa3a3a3a3U, 0x9e9e9e9eU,
- 0x81818181U, 0xf3f3f3f3U, 0xd7d7d7d7U, 0xfbfbfbfbU,
- 0x7c7c7c7cU, 0xe3e3e3e3U, 0x39393939U, 0x82828282U,
- 0x9b9b9b9bU, 0x2f2f2f2fU, 0xffffffffU, 0x87878787U,
- 0x34343434U, 0x8e8e8e8eU, 0x43434343U, 0x44444444U,
- 0xc4c4c4c4U, 0xdedededeU, 0xe9e9e9e9U, 0xcbcbcbcbU,
- 0x54545454U, 0x7b7b7b7bU, 0x94949494U, 0x32323232U,
- 0xa6a6a6a6U, 0xc2c2c2c2U, 0x23232323U, 0x3d3d3d3dU,
- 0xeeeeeeeeU, 0x4c4c4c4cU, 0x95959595U, 0x0b0b0b0bU,
- 0x42424242U, 0xfafafafaU, 0xc3c3c3c3U, 0x4e4e4e4eU,
- 0x08080808U, 0x2e2e2e2eU, 0xa1a1a1a1U, 0x66666666U,
- 0x28282828U, 0xd9d9d9d9U, 0x24242424U, 0xb2b2b2b2U,
- 0x76767676U, 0x5b5b5b5bU, 0xa2a2a2a2U, 0x49494949U,
- 0x6d6d6d6dU, 0x8b8b8b8bU, 0xd1d1d1d1U, 0x25252525U,
- 0x72727272U, 0xf8f8f8f8U, 0xf6f6f6f6U, 0x64646464U,
- 0x86868686U, 0x68686868U, 0x98989898U, 0x16161616U,
- 0xd4d4d4d4U, 0xa4a4a4a4U, 0x5c5c5c5cU, 0xccccccccU,
- 0x5d5d5d5dU, 0x65656565U, 0xb6b6b6b6U, 0x92929292U,
- 0x6c6c6c6cU, 0x70707070U, 0x48484848U, 0x50505050U,
- 0xfdfdfdfdU, 0xededededU, 0xb9b9b9b9U, 0xdadadadaU,
- 0x5e5e5e5eU, 0x15151515U, 0x46464646U, 0x57575757U,
- 0xa7a7a7a7U, 0x8d8d8d8dU, 0x9d9d9d9dU, 0x84848484U,
- 0x90909090U, 0xd8d8d8d8U, 0xababababU, 0x00000000U,
- 0x8c8c8c8cU, 0xbcbcbcbcU, 0xd3d3d3d3U, 0x0a0a0a0aU,
- 0xf7f7f7f7U, 0xe4e4e4e4U, 0x58585858U, 0x05050505U,
- 0xb8b8b8b8U, 0xb3b3b3b3U, 0x45454545U, 0x06060606U,
- 0xd0d0d0d0U, 0x2c2c2c2cU, 0x1e1e1e1eU, 0x8f8f8f8fU,
- 0xcacacacaU, 0x3f3f3f3fU, 0x0f0f0f0fU, 0x02020202U,
- 0xc1c1c1c1U, 0xafafafafU, 0xbdbdbdbdU, 0x03030303U,
- 0x01010101U, 0x13131313U, 0x8a8a8a8aU, 0x6b6b6b6bU,
- 0x3a3a3a3aU, 0x91919191U, 0x11111111U, 0x41414141U,
- 0x4f4f4f4fU, 0x67676767U, 0xdcdcdcdcU, 0xeaeaeaeaU,
- 0x97979797U, 0xf2f2f2f2U, 0xcfcfcfcfU, 0xcecececeU,
- 0xf0f0f0f0U, 0xb4b4b4b4U, 0xe6e6e6e6U, 0x73737373U,
- 0x96969696U, 0xacacacacU, 0x74747474U, 0x22222222U,
- 0xe7e7e7e7U, 0xadadadadU, 0x35353535U, 0x85858585U,
- 0xe2e2e2e2U, 0xf9f9f9f9U, 0x37373737U, 0xe8e8e8e8U,
- 0x1c1c1c1cU, 0x75757575U, 0xdfdfdfdfU, 0x6e6e6e6eU,
- 0x47474747U, 0xf1f1f1f1U, 0x1a1a1a1aU, 0x71717171U,
- 0x1d1d1d1dU, 0x29292929U, 0xc5c5c5c5U, 0x89898989U,
- 0x6f6f6f6fU, 0xb7b7b7b7U, 0x62626262U, 0x0e0e0e0eU,
- 0xaaaaaaaaU, 0x18181818U, 0xbebebebeU, 0x1b1b1b1bU,
- 0xfcfcfcfcU, 0x56565656U, 0x3e3e3e3eU, 0x4b4b4b4bU,
- 0xc6c6c6c6U, 0xd2d2d2d2U, 0x79797979U, 0x20202020U,
- 0x9a9a9a9aU, 0xdbdbdbdbU, 0xc0c0c0c0U, 0xfefefefeU,
- 0x78787878U, 0xcdcdcdcdU, 0x5a5a5a5aU, 0xf4f4f4f4U,
- 0x1f1f1f1fU, 0xddddddddU, 0xa8a8a8a8U, 0x33333333U,
- 0x88888888U, 0x07070707U, 0xc7c7c7c7U, 0x31313131U,
- 0xb1b1b1b1U, 0x12121212U, 0x10101010U, 0x59595959U,
- 0x27272727U, 0x80808080U, 0xececececU, 0x5f5f5f5fU,
- 0x60606060U, 0x51515151U, 0x7f7f7f7fU, 0xa9a9a9a9U,
- 0x19191919U, 0xb5b5b5b5U, 0x4a4a4a4aU, 0x0d0d0d0dU,
- 0x2d2d2d2dU, 0xe5e5e5e5U, 0x7a7a7a7aU, 0x9f9f9f9fU,
- 0x93939393U, 0xc9c9c9c9U, 0x9c9c9c9cU, 0xefefefefU,
- 0xa0a0a0a0U, 0xe0e0e0e0U, 0x3b3b3b3bU, 0x4d4d4d4dU,
- 0xaeaeaeaeU, 0x2a2a2a2aU, 0xf5f5f5f5U, 0xb0b0b0b0U,
- 0xc8c8c8c8U, 0xebebebebU, 0xbbbbbbbbU, 0x3c3c3c3cU,
- 0x83838383U, 0x53535353U, 0x99999999U, 0x61616161U,
- 0x17171717U, 0x2b2b2b2bU, 0x04040404U, 0x7e7e7e7eU,
- 0xbabababaU, 0x77777777U, 0xd6d6d6d6U, 0x26262626U,
- 0xe1e1e1e1U, 0x69696969U, 0x14141414U, 0x63636363U,
- 0x55555555U, 0x21212121U, 0x0c0c0c0cU, 0x7d7d7d7dU,
+static const u8 Td4[256] = {
+ 0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U,
+ 0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU,
+ 0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U,
+ 0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU,
+ 0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU,
+ 0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU,
+ 0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U,
+ 0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U,
+ 0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U,
+ 0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U,
+ 0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU,
+ 0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U,
+ 0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU,
+ 0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U,
+ 0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U,
+ 0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU,
+ 0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU,
+ 0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U,
+ 0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U,
+ 0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU,
+ 0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U,
+ 0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU,
+ 0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U,
+ 0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U,
+ 0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U,
+ 0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU,
+ 0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU,
+ 0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU,
+ 0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U,
+ 0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U,
+ 0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U,
+ 0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU,
};
+#endif
static const u32 rcon[] = {
0x01000000, 0x02000000, 0x04000000, 0x08000000,
0x10000000, 0x20000000, 0x40000000, 0x80000000,
@@ -724,8 +626,10 @@
*
* @return the number of rounds for the given cipher key size.
*/
-static int rijndaelKeySetupEnc(u32 rk[/*4*(Nr + 1)*/], const u8 cipherKey[], int keyBits) {
- int i = 0;
+int
+rijndaelKeySetupEnc(u32 rk[/*4*(Nr + 1)*/], const u8 cipherKey[], int keyBits)
+{
+ int i = 0;
u32 temp;
rk[0] = GETU32(cipherKey );
@@ -736,10 +640,10 @@
for (;;) {
temp = rk[3];
rk[4] = rk[0] ^
- (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
- (Te4[(temp >> 8) & 0xff] & 0x00ff0000) ^
- (Te4[(temp ) & 0xff] & 0x0000ff00) ^
- (Te4[(temp >> 24) ] & 0x000000ff) ^
+ (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
+ (Te3[(temp >> 8) & 0xff] & 0x00ff0000) ^
+ (Te0[(temp ) & 0xff] & 0x0000ff00) ^
+ (Te1[(temp >> 24) ] & 0x000000ff) ^
rcon[i];
rk[5] = rk[1] ^ rk[4];
rk[6] = rk[2] ^ rk[5];
@@ -756,10 +660,10 @@
for (;;) {
temp = rk[ 5];
rk[ 6] = rk[ 0] ^
- (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
- (Te4[(temp >> 8) & 0xff] & 0x00ff0000) ^
- (Te4[(temp ) & 0xff] & 0x0000ff00) ^
- (Te4[(temp >> 24) ] & 0x000000ff) ^
+ (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
+ (Te3[(temp >> 8) & 0xff] & 0x00ff0000) ^
+ (Te0[(temp ) & 0xff] & 0x0000ff00) ^
+ (Te1[(temp >> 24) ] & 0x000000ff) ^
rcon[i];
rk[ 7] = rk[ 1] ^ rk[ 6];
rk[ 8] = rk[ 2] ^ rk[ 7];
@@ -778,26 +682,26 @@
for (;;) {
temp = rk[ 7];
rk[ 8] = rk[ 0] ^
- (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
- (Te4[(temp >> 8) & 0xff] & 0x00ff0000) ^
- (Te4[(temp ) & 0xff] & 0x0000ff00) ^
- (Te4[(temp >> 24) ] & 0x000000ff) ^
+ (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
+ (Te3[(temp >> 8) & 0xff] & 0x00ff0000) ^
+ (Te0[(temp ) & 0xff] & 0x0000ff00) ^
+ (Te1[(temp >> 24) ] & 0x000000ff) ^
rcon[i];
rk[ 9] = rk[ 1] ^ rk[ 8];
rk[10] = rk[ 2] ^ rk[ 9];
rk[11] = rk[ 3] ^ rk[10];
- if (++i == 7) {
- return 14;
- }
+ if (++i == 7) {
+ return 14;
+ }
temp = rk[11];
rk[12] = rk[ 4] ^
- (Te4[(temp >> 24) ] & 0xff000000) ^
- (Te4[(temp >> 16) & 0xff] & 0x00ff0000) ^
- (Te4[(temp >> 8) & 0xff] & 0x0000ff00) ^
- (Te4[(temp ) & 0xff] & 0x000000ff);
+ (Te2[(temp >> 24) ] & 0xff000000) ^
+ (Te3[(temp >> 16) & 0xff] & 0x00ff0000) ^
+ (Te0[(temp >> 8) & 0xff] & 0x0000ff00) ^
+ (Te1[(temp ) & 0xff] & 0x000000ff);
rk[13] = rk[ 5] ^ rk[12];
rk[14] = rk[ 6] ^ rk[13];
- rk[15] = rk[ 7] ^ rk[14];
+ rk[15] = rk[ 7] ^ rk[14];
rk += 8;
}
}
@@ -804,23 +708,21 @@
return 0;
}
+#if 0
/**
* Expand the cipher key into the decryption key schedule.
*
* @return the number of rounds for the given cipher key size.
*/
-static int
-rijndaelKeySetupDec(u32 rk[/*4*(Nr + 1)*/], const u8 cipherKey[], int keyBits,
- int have_encrypt) {
+int
+rijndaelKeySetupDec(u32 rk[/*4*(Nr + 1)*/], const u8 cipherKey[], int keyBits)
+{
int Nr, i, j;
u32 temp;
- if (have_encrypt) {
- Nr = have_encrypt;
- } else {
- /* expand the cipher key: */
- Nr = rijndaelKeySetupEnc(rk, cipherKey, keyBits);
- }
+ /* expand the cipher key: */
+ Nr = rijndaelKeySetupEnc(rk, cipherKey, keyBits);
+
/* invert the order of the round keys: */
for (i = 0, j = 4*Nr; i < j; i += 4, j -= 4) {
temp = rk[i ]; rk[i ] = rk[j ]; rk[j ] = temp;
@@ -832,30 +734,34 @@
for (i = 1; i < Nr; i++) {
rk += 4;
rk[0] =
- Td0[Te4[(rk[0] >> 24) ] & 0xff] ^
- Td1[Te4[(rk[0] >> 16) & 0xff] & 0xff] ^
- Td2[Te4[(rk[0] >> 8) & 0xff] & 0xff] ^
- Td3[Te4[(rk[0] ) & 0xff] & 0xff];
+ Td0[Te1[(rk[0] >> 24) ] & 0xff] ^
+ Td1[Te1[(rk[0] >> 16) & 0xff] & 0xff] ^
+ Td2[Te1[(rk[0] >> 8) & 0xff] & 0xff] ^
+ Td3[Te1[(rk[0] ) & 0xff] & 0xff];
rk[1] =
- Td0[Te4[(rk[1] >> 24) ] & 0xff] ^
- Td1[Te4[(rk[1] >> 16) & 0xff] & 0xff] ^
- Td2[Te4[(rk[1] >> 8) & 0xff] & 0xff] ^
- Td3[Te4[(rk[1] ) & 0xff] & 0xff];
+ Td0[Te1[(rk[1] >> 24) ] & 0xff] ^
+ Td1[Te1[(rk[1] >> 16) & 0xff] & 0xff] ^
+ Td2[Te1[(rk[1] >> 8) & 0xff] & 0xff] ^
+ Td3[Te1[(rk[1] ) & 0xff] & 0xff];
rk[2] =
- Td0[Te4[(rk[2] >> 24) ] & 0xff] ^
- Td1[Te4[(rk[2] >> 16) & 0xff] & 0xff] ^
- Td2[Te4[(rk[2] >> 8) & 0xff] & 0xff] ^
- Td3[Te4[(rk[2] ) & 0xff] & 0xff];
+ Td0[Te1[(rk[2] >> 24) ] & 0xff] ^
+ Td1[Te1[(rk[2] >> 16) & 0xff] & 0xff] ^
+ Td2[Te1[(rk[2] >> 8) & 0xff] & 0xff] ^
+ Td3[Te1[(rk[2] ) & 0xff] & 0xff];
rk[3] =
- Td0[Te4[(rk[3] >> 24) ] & 0xff] ^
- Td1[Te4[(rk[3] >> 16) & 0xff] & 0xff] ^
- Td2[Te4[(rk[3] >> 8) & 0xff] & 0xff] ^
- Td3[Te4[(rk[3] ) & 0xff] & 0xff];
+ Td0[Te1[(rk[3] >> 24) ] & 0xff] ^
+ Td1[Te1[(rk[3] >> 16) & 0xff] & 0xff] ^
+ Td2[Te1[(rk[3] >> 8) & 0xff] & 0xff] ^
+ Td3[Te1[(rk[3] ) & 0xff] & 0xff];
}
return Nr;
}
+#endif
-static void rijndaelEncrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 pt[16], u8 ct[16]) {
+void
+rijndaelEncrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 pt[16],
+ u8 ct[16])
+{
u32 s0, s1, s2, s3, t0, t1, t2, t3;
#ifndef FULL_UNROLL
int r;
@@ -871,50 +777,50 @@
s3 = GETU32(pt + 12) ^ rk[3];
#ifdef FULL_UNROLL
/* round 1: */
- t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[ 4];
- t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[ 5];
- t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[ 6];
- t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[ 7];
- /* round 2: */
- s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[ 8];
- s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[ 9];
- s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[10];
- s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[11];
+ t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[ 4];
+ t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[ 5];
+ t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[ 6];
+ t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[ 7];
+ /* round 2: */
+ s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[ 8];
+ s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[ 9];
+ s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[10];
+ s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[11];
/* round 3: */
- t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[12];
- t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[13];
- t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[14];
- t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[15];
- /* round 4: */
- s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[16];
- s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[17];
- s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[18];
- s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[19];
+ t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[12];
+ t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[13];
+ t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[14];
+ t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[15];
+ /* round 4: */
+ s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[16];
+ s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[17];
+ s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[18];
+ s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[19];
/* round 5: */
- t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[20];
- t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[21];
- t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[22];
- t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[23];
- /* round 6: */
- s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[24];
- s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[25];
- s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[26];
- s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[27];
+ t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[20];
+ t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[21];
+ t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[22];
+ t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[23];
+ /* round 6: */
+ s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[24];
+ s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[25];
+ s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[26];
+ s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[27];
/* round 7: */
- t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[28];
- t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[29];
- t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[30];
- t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[31];
- /* round 8: */
- s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[32];
- s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[33];
- s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[34];
- s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[35];
+ t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[28];
+ t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[29];
+ t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[30];
+ t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[31];
+ /* round 8: */
+ s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[32];
+ s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >> 8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[33];
+ s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >> 8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[34];
+ s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >> 8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[35];
/* round 9: */
- t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[36];
- t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[37];
- t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[38];
- t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[39];
+ t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >> 8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[36];
+ t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >> 8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[37];
+ t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >> 8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[38];
+ t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >> 8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[39];
if (Nr > 10) {
/* round 10: */
s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >> 8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[40];
@@ -1007,36 +913,40 @@
* map cipher state to byte array block:
*/
s0 =
- (Te4[(t0 >> 24) ] & 0xff000000) ^
- (Te4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
- (Te4[(t2 >> 8) & 0xff] & 0x0000ff00) ^
- (Te4[(t3 ) & 0xff] & 0x000000ff) ^
+ (Te2[(t0 >> 24) ] & 0xff000000) ^
+ (Te3[(t1 >> 16) & 0xff] & 0x00ff0000) ^
+ (Te0[(t2 >> 8) & 0xff] & 0x0000ff00) ^
+ (Te1[(t3 ) & 0xff] & 0x000000ff) ^
rk[0];
PUTU32(ct , s0);
s1 =
- (Te4[(t1 >> 24) ] & 0xff000000) ^
- (Te4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
- (Te4[(t3 >> 8) & 0xff] & 0x0000ff00) ^
- (Te4[(t0 ) & 0xff] & 0x000000ff) ^
+ (Te2[(t1 >> 24) ] & 0xff000000) ^
+ (Te3[(t2 >> 16) & 0xff] & 0x00ff0000) ^
+ (Te0[(t3 >> 8) & 0xff] & 0x0000ff00) ^
+ (Te1[(t0 ) & 0xff] & 0x000000ff) ^
rk[1];
PUTU32(ct + 4, s1);
s2 =
- (Te4[(t2 >> 24) ] & 0xff000000) ^
- (Te4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
- (Te4[(t0 >> 8) & 0xff] & 0x0000ff00) ^
- (Te4[(t1 ) & 0xff] & 0x000000ff) ^
+ (Te2[(t2 >> 24) ] & 0xff000000) ^
+ (Te3[(t3 >> 16) & 0xff] & 0x00ff0000) ^
+ (Te0[(t0 >> 8) & 0xff] & 0x0000ff00) ^
+ (Te1[(t1 ) & 0xff] & 0x000000ff) ^
rk[2];
PUTU32(ct + 8, s2);
s3 =
- (Te4[(t3 >> 24) ] & 0xff000000) ^
- (Te4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
- (Te4[(t1 >> 8) & 0xff] & 0x0000ff00) ^
- (Te4[(t2 ) & 0xff] & 0x000000ff) ^
+ (Te2[(t3 >> 24) ] & 0xff000000) ^
+ (Te3[(t0 >> 16) & 0xff] & 0x00ff0000) ^
+ (Te0[(t1 >> 8) & 0xff] & 0x0000ff00) ^
+ (Te1[(t2 ) & 0xff] & 0x000000ff) ^
rk[3];
PUTU32(ct + 12, s3);
}
-static void rijndaelDecrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 ct[16], u8 pt[16]) {
+#if 0
+static void
+rijndaelDecrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 ct[16],
+ u8 pt[16])
+{
u32 s0, s1, s2, s3, t0, t1, t2, t3;
#ifndef FULL_UNROLL
int r;
@@ -1187,58 +1097,33 @@
* apply last round and
* map cipher state to byte array block:
*/
- s0 =
- (Td4[(t0 >> 24) ] & 0xff000000) ^
- (Td4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
- (Td4[(t2 >> 8) & 0xff] & 0x0000ff00) ^
- (Td4[(t1 ) & 0xff] & 0x000000ff) ^
- rk[0];
+ s0 =
+ (Td4[(t0 >> 24) ] << 24) ^
+ (Td4[(t3 >> 16) & 0xff] << 16) ^
+ (Td4[(t2 >> 8) & 0xff] << 8) ^
+ (Td4[(t1 ) & 0xff]) ^
+ rk[0];
PUTU32(pt , s0);
- s1 =
- (Td4[(t1 >> 24) ] & 0xff000000) ^
- (Td4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
- (Td4[(t3 >> 8) & 0xff] & 0x0000ff00) ^
- (Td4[(t2 ) & 0xff] & 0x000000ff) ^
- rk[1];
+ s1 =
+ (Td4[(t1 >> 24) ] << 24) ^
+ (Td4[(t0 >> 16) & 0xff] << 16) ^
+ (Td4[(t3 >> 8) & 0xff] << 8) ^
+ (Td4[(t2 ) & 0xff]) ^
+ rk[1];
PUTU32(pt + 4, s1);
- s2 =
- (Td4[(t2 >> 24) ] & 0xff000000) ^
- (Td4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
- (Td4[(t0 >> 8) & 0xff] & 0x0000ff00) ^
- (Td4[(t3 ) & 0xff] & 0x000000ff) ^
- rk[2];
+ s2 =
+ (Td4[(t2 >> 24) ] << 24) ^
+ (Td4[(t1 >> 16) & 0xff] << 16) ^
+ (Td4[(t0 >> 8) & 0xff] << 8) ^
+ (Td4[(t3 ) & 0xff]) ^
+ rk[2];
PUTU32(pt + 8, s2);
- s3 =
- (Td4[(t3 >> 24) ] & 0xff000000) ^
- (Td4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
- (Td4[(t1 >> 8) & 0xff] & 0x0000ff00) ^
- (Td4[(t0 ) & 0xff] & 0x000000ff) ^
- rk[3];
+ s3 =
+ (Td4[(t3 >> 24) ] << 24) ^
+ (Td4[(t2 >> 16) & 0xff] << 16) ^
+ (Td4[(t1 >> 8) & 0xff] << 8) ^
+ (Td4[(t0 ) & 0xff]) ^
+ rk[3];
PUTU32(pt + 12, s3);
}
-
-void
-rijndael_set_key(rijndael_ctx *ctx, u_char *key, int bits, int do_encrypt)
-{
- ctx->Nr = rijndaelKeySetupEnc(ctx->ek, key, bits);
- if (do_encrypt) {
- ctx->decrypt = 0;
- memset(ctx->dk, 0, sizeof(ctx->dk));
- } else {
- ctx->decrypt = 1;
- memcpy(ctx->dk, ctx->ek, sizeof(ctx->dk));
- rijndaelKeySetupDec(ctx->dk, key, bits, ctx->Nr);
- }
-}
-
-void
-rijndael_decrypt(rijndael_ctx *ctx, u_char *src, u_char *dst)
-{
- rijndaelDecrypt(ctx->dk, ctx->Nr, src, dst);
-}
-
-void
-rijndael_encrypt(rijndael_ctx *ctx, u_char *src, u_char *dst)
-{
- rijndaelEncrypt(ctx->ek, ctx->Nr, src, dst);
-}
+#endif
Modified: trunk/crypto/openssh/rijndael.h
===================================================================
--- trunk/crypto/openssh/rijndael.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/rijndael.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: rijndael.h,v 1.12 2001/12/19 07:18:56 deraadt Exp $ */
+/* $OpenBSD: rijndael.h,v 1.14 2014/04/29 15:42:07 markus Exp $ */
/**
* rijndael-alg-fst.h
@@ -25,23 +25,28 @@
* OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
* EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
-#ifndef __RIJNDAEL_H
-#define __RIJNDAEL_H
+#ifndef _PRIVATE_RIJNDAEL_H
+#define _PRIVATE_RIJNDAEL_H
-#define MAXKC (256/32)
-#define MAXKB (256/8)
-#define MAXNR 14
+#define AES_MAXKEYBITS (256)
+#define AES_MAXKEYBYTES (AES_MAXKEYBITS/8)
+/* for 256-bit keys, fewer for less */
+#define AES_MAXROUNDS 14
typedef unsigned char u8;
typedef unsigned short u16;
typedef unsigned int u32;
+int rijndaelKeySetupEnc(unsigned int [], const unsigned char [], int);
+void rijndaelEncrypt(const unsigned int [], int, const unsigned char [],
+ unsigned char []);
+
/* The structure for key information */
typedef struct {
int decrypt;
- int Nr; /* key-length-dependent number of rounds */
- u32 ek[4*(MAXNR + 1)]; /* encrypt key schedule */
- u32 dk[4*(MAXNR + 1)]; /* decrypt key schedule */
+ int Nr; /* key-length-dependent number of rounds */
+ u32 ek[4*(AES_MAXROUNDS + 1)]; /* encrypt key schedule */
+ u32 dk[4*(AES_MAXROUNDS + 1)]; /* decrypt key schedule */
} rijndael_ctx;
void rijndael_set_key(rijndael_ctx *, u_char *, int, int);
@@ -48,4 +53,4 @@
void rijndael_decrypt(rijndael_ctx *, u_char *, u_char *);
void rijndael_encrypt(rijndael_ctx *, u_char *, u_char *);
-#endif /* __RIJNDAEL_H */
+#endif /* _PRIVATE_RIJNDAEL_H */
Modified: trunk/crypto/openssh/rsa.c
===================================================================
--- trunk/crypto/openssh/rsa.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/rsa.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa.c,v 1.31 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: rsa.c,v 1.32 2014/06/24 01:13:21 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -67,85 +67,122 @@
#include <stdarg.h>
#include <string.h>
-#include "xmalloc.h"
#include "rsa.h"
#include "log.h"
+#include "ssherr.h"
-void
+int
rsa_public_encrypt(BIGNUM *out, BIGNUM *in, RSA *key)
{
- u_char *inbuf, *outbuf;
- int len, ilen, olen;
+ u_char *inbuf = NULL, *outbuf = NULL;
+ int len, ilen, olen, r = SSH_ERR_INTERNAL_ERROR;
if (BN_num_bits(key->e) < 2 || !BN_is_odd(key->e))
- fatal("rsa_public_encrypt() exponent too small or not odd");
+ return SSH_ERR_INVALID_ARGUMENT;
olen = BN_num_bytes(key->n);
- outbuf = xmalloc(olen);
+ if ((outbuf = malloc(olen)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
ilen = BN_num_bytes(in);
- inbuf = xmalloc(ilen);
+ if ((inbuf = malloc(ilen)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
BN_bn2bin(in, inbuf);
if ((len = RSA_public_encrypt(ilen, inbuf, outbuf, key,
- RSA_PKCS1_PADDING)) <= 0)
- fatal("rsa_public_encrypt() failed");
+ RSA_PKCS1_PADDING)) <= 0) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
- if (BN_bin2bn(outbuf, len, out) == NULL)
- fatal("rsa_public_encrypt: BN_bin2bn failed");
+ if (BN_bin2bn(outbuf, len, out) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ r = 0;
- explicit_bzero(outbuf, olen);
- explicit_bzero(inbuf, ilen);
- free(outbuf);
- free(inbuf);
+ out:
+ if (outbuf != NULL) {
+ explicit_bzero(outbuf, olen);
+ free(outbuf);
+ }
+ if (inbuf != NULL) {
+ explicit_bzero(inbuf, ilen);
+ free(inbuf);
+ }
+ return r;
}
int
rsa_private_decrypt(BIGNUM *out, BIGNUM *in, RSA *key)
{
- u_char *inbuf, *outbuf;
- int len, ilen, olen;
+ u_char *inbuf = NULL, *outbuf = NULL;
+ int len, ilen, olen, r = SSH_ERR_INTERNAL_ERROR;
olen = BN_num_bytes(key->n);
- outbuf = xmalloc(olen);
+ if ((outbuf = malloc(olen)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
ilen = BN_num_bytes(in);
- inbuf = xmalloc(ilen);
+ if ((inbuf = malloc(ilen)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
BN_bn2bin(in, inbuf);
if ((len = RSA_private_decrypt(ilen, inbuf, outbuf, key,
RSA_PKCS1_PADDING)) <= 0) {
- error("rsa_private_decrypt() failed");
- } else {
- if (BN_bin2bn(outbuf, len, out) == NULL)
- fatal("rsa_private_decrypt: BN_bin2bn failed");
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ } else if (BN_bin2bn(outbuf, len, out) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
}
- explicit_bzero(outbuf, olen);
- explicit_bzero(inbuf, ilen);
- free(outbuf);
- free(inbuf);
- return len;
+ r = 0;
+ out:
+ if (outbuf != NULL) {
+ explicit_bzero(outbuf, olen);
+ free(outbuf);
+ }
+ if (inbuf != NULL) {
+ explicit_bzero(inbuf, ilen);
+ free(inbuf);
+ }
+ return r;
}
/* calculate p-1 and q-1 */
-void
+int
rsa_generate_additional_parameters(RSA *rsa)
{
- BIGNUM *aux;
- BN_CTX *ctx;
+ BIGNUM *aux = NULL;
+ BN_CTX *ctx = NULL;
+ int r;
- if ((aux = BN_new()) == NULL)
- fatal("rsa_generate_additional_parameters: BN_new failed");
if ((ctx = BN_CTX_new()) == NULL)
- fatal("rsa_generate_additional_parameters: BN_CTX_new failed");
+ return SSH_ERR_ALLOC_FAIL;
+ if ((aux = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
if ((BN_sub(aux, rsa->q, BN_value_one()) == 0) ||
(BN_mod(rsa->dmq1, rsa->d, aux, ctx) == 0) ||
(BN_sub(aux, rsa->p, BN_value_one()) == 0) ||
- (BN_mod(rsa->dmp1, rsa->d, aux, ctx) == 0))
- fatal("rsa_generate_additional_parameters: BN_sub/mod failed");
-
+ (BN_mod(rsa->dmp1, rsa->d, aux, ctx) == 0)) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ r = 0;
+ out:
BN_clear_free(aux);
BN_CTX_free(ctx);
+ return r;
}
Modified: trunk/crypto/openssh/rsa.h
===================================================================
--- trunk/crypto/openssh/rsa.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/rsa.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa.h,v 1.16 2006/03/25 22:22:43 djm Exp $ */
+/* $OpenBSD: rsa.h,v 1.17 2014/06/24 01:13:21 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -19,8 +19,8 @@
#include <openssl/bn.h>
#include <openssl/rsa.h>
-void rsa_public_encrypt(BIGNUM *, BIGNUM *, RSA *);
+int rsa_public_encrypt(BIGNUM *, BIGNUM *, RSA *);
int rsa_private_decrypt(BIGNUM *, BIGNUM *, RSA *);
-void rsa_generate_additional_parameters(RSA *);
+int rsa_generate_additional_parameters(RSA *);
#endif /* RSA_H */
Copied: trunk/crypto/openssh/sandbox-pledge.c (from rev 9222, vendor-crypto/openssh/dist/sandbox-pledge.c)
===================================================================
--- trunk/crypto/openssh/sandbox-pledge.c (rev 0)
+++ trunk/crypto/openssh/sandbox-pledge.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,77 @@
+/* $OpenBSD: sandbox-pledge.c,v 1.1 2015/10/09 01:37:08 deraadt Exp $ */
+/*
+ * Copyright (c) 2015 Theo de Raadt <deraadt at openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#ifdef SANDBOX_PLEDGE
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/syscall.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+
+#include <errno.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <pwd.h>
+
+#include "log.h"
+#include "ssh-sandbox.h"
+#include "xmalloc.h"
+
+struct ssh_sandbox {
+ pid_t child_pid;
+};
+
+struct ssh_sandbox *
+ssh_sandbox_init(struct monitor *m)
+{
+ struct ssh_sandbox *box;
+
+ debug3("%s: preparing pledge sandbox", __func__);
+ box = xcalloc(1, sizeof(*box));
+ box->child_pid = 0;
+
+ return box;
+}
+
+void
+ssh_sandbox_child(struct ssh_sandbox *box)
+{
+ if (pledge("stdio", NULL) == -1)
+ fatal("%s: pledge()", __func__);
+}
+
+void
+ssh_sandbox_parent_finish(struct ssh_sandbox *box)
+{
+ free(box);
+ debug3("%s: finished", __func__);
+}
+
+void
+ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)
+{
+ box->child_pid = child_pid;
+ /* Nothing to do here */
+}
+
+#endif /* SANDBOX_PLEDGE */
Modified: trunk/crypto/openssh/sandbox-seccomp-filter.c
===================================================================
--- trunk/crypto/openssh/sandbox-seccomp-filter.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sandbox-seccomp-filter.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -25,6 +25,8 @@
*/
/* #define SANDBOX_SECCOMP_FILTER_DEBUG 1 */
+/* XXX it should be possible to do logging via the log socket safely */
+
#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
/* Use the kernel headers in case of an older toolchain. */
# include <asm/siginfo.h>
@@ -41,6 +43,7 @@
#include <sys/resource.h>
#include <sys/prctl.h>
+#include <linux/net.h>
#include <linux/audit.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
@@ -77,6 +80,16 @@
#define SC_ALLOW(_nr) \
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
+#define SC_ALLOW_ARG(_nr, _arg_nr, _arg_val) \
+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 4), \
+ /* load first syscall argument */ \
+ BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+ offsetof(struct seccomp_data, args[(_arg_nr)])), \
+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (_arg_val), 0, 1), \
+ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), \
+ /* reload syscall number; all rules expect it in accumulator */ \
+ BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+ offsetof(struct seccomp_data, nr))
/* Syscall filtering set for preauth. */
static const struct sock_filter preauth_insns[] = {
@@ -88,40 +101,114 @@
/* Load the syscall number for checking. */
BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
offsetof(struct seccomp_data, nr)),
+
+ /* Syscalls to non-fatally deny */
+#ifdef __NR_lstat
+ SC_DENY(lstat, EACCES),
+#endif
+#ifdef __NR_lstat64
+ SC_DENY(lstat64, EACCES),
+#endif
+#ifdef __NR_fstat
+ SC_DENY(fstat, EACCES),
+#endif
+#ifdef __NR_fstat64
+ SC_DENY(fstat64, EACCES),
+#endif
+#ifdef __NR_open
SC_DENY(open, EACCES),
- SC_ALLOW(getpid),
- SC_ALLOW(gettimeofday),
+#endif
+#ifdef __NR_openat
+ SC_DENY(openat, EACCES),
+#endif
+#ifdef __NR_newfstatat
+ SC_DENY(newfstatat, EACCES),
+#endif
+#ifdef __NR_stat
+ SC_DENY(stat, EACCES),
+#endif
+#ifdef __NR_stat64
+ SC_DENY(stat64, EACCES),
+#endif
+
+ /* Syscalls to permit */
+#ifdef __NR_brk
+ SC_ALLOW(brk),
+#endif
+#ifdef __NR_clock_gettime
SC_ALLOW(clock_gettime),
-#ifdef __NR_time /* not defined on EABI ARM */
- SC_ALLOW(time),
#endif
- SC_ALLOW(read),
- SC_ALLOW(write),
+#ifdef __NR_close
SC_ALLOW(close),
-#ifdef __NR_shutdown /* not defined on archs that go via socketcall(2) */
- SC_ALLOW(shutdown),
#endif
- SC_ALLOW(brk),
- SC_ALLOW(poll),
-#ifdef __NR__newselect
- SC_ALLOW(_newselect),
-#else
- SC_ALLOW(select),
+#ifdef __NR_exit
+ SC_ALLOW(exit),
#endif
+#ifdef __NR_exit_group
+ SC_ALLOW(exit_group),
+#endif
+#ifdef __NR_getpgid
+ SC_ALLOW(getpgid),
+#endif
+#ifdef __NR_getpid
+ SC_ALLOW(getpid),
+#endif
+#ifdef __NR_getrandom
+ SC_ALLOW(getrandom),
+#endif
+#ifdef __NR_gettimeofday
+ SC_ALLOW(gettimeofday),
+#endif
+#ifdef __NR_madvise
SC_ALLOW(madvise),
-#ifdef __NR_mmap2 /* EABI ARM only has mmap2() */
- SC_ALLOW(mmap2),
#endif
#ifdef __NR_mmap
SC_ALLOW(mmap),
#endif
+#ifdef __NR_mmap2
+ SC_ALLOW(mmap2),
+#endif
+#ifdef __NR_mremap
+ SC_ALLOW(mremap),
+#endif
+#ifdef __NR_munmap
SC_ALLOW(munmap),
- SC_ALLOW(exit_group),
+#endif
+#ifdef __NR__newselect
+ SC_ALLOW(_newselect),
+#endif
+#ifdef __NR_poll
+ SC_ALLOW(poll),
+#endif
+#ifdef __NR_pselect6
+ SC_ALLOW(pselect6),
+#endif
+#ifdef __NR_read
+ SC_ALLOW(read),
+#endif
#ifdef __NR_rt_sigprocmask
SC_ALLOW(rt_sigprocmask),
-#else
+#endif
+#ifdef __NR_select
+ SC_ALLOW(select),
+#endif
+#ifdef __NR_shutdown
+ SC_ALLOW(shutdown),
+#endif
+#ifdef __NR_sigprocmask
SC_ALLOW(sigprocmask),
#endif
+#ifdef __NR_time
+ SC_ALLOW(time),
+#endif
+#ifdef __NR_write
+ SC_ALLOW(write),
+#endif
+#ifdef __NR_socketcall
+ SC_ALLOW_ARG(socketcall, 0, SYS_SHUTDOWN),
+#endif
+
+ /* Default deny */
BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
};
Copied: trunk/crypto/openssh/sandbox-solaris.c (from rev 9222, vendor-crypto/openssh/dist/sandbox-solaris.c)
===================================================================
--- trunk/crypto/openssh/sandbox-solaris.c (rev 0)
+++ trunk/crypto/openssh/sandbox-solaris.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2015 Joyent, Inc
+ * Author: Alex Wilson <alex.wilson at joyent.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#ifdef SANDBOX_SOLARIS
+#ifndef USE_SOLARIS_PRIVS
+# error "--with-solaris-privs must be used with the Solaris sandbox"
+#endif
+
+#include <sys/types.h>
+
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#ifdef HAVE_PRIV_H
+# include <priv.h>
+#endif
+
+#include "log.h"
+#include "ssh-sandbox.h"
+#include "xmalloc.h"
+
+struct ssh_sandbox {
+ priv_set_t *pset;
+};
+
+struct ssh_sandbox *
+ssh_sandbox_init(struct monitor *monitor)
+{
+ struct ssh_sandbox *box = NULL;
+
+ box = xcalloc(1, sizeof(*box));
+
+ /* Start with "basic" and drop everything we don't need. */
+ box->pset = solaris_basic_privset();
+
+ if (box->pset == NULL) {
+ free(box);
+ return NULL;
+ }
+
+ /* Drop everything except the ability to use already-opened files */
+ if (priv_delset(box->pset, PRIV_FILE_LINK_ANY) != 0 ||
+#ifdef PRIV_NET_ACCESS
+ priv_delset(box->pset, PRIV_NET_ACCESS) != 0 ||
+#endif
+ priv_delset(box->pset, PRIV_PROC_EXEC) != 0 ||
+ priv_delset(box->pset, PRIV_PROC_FORK) != 0 ||
+ priv_delset(box->pset, PRIV_PROC_INFO) != 0 ||
+ priv_delset(box->pset, PRIV_PROC_SESSION) != 0) {
+ free(box);
+ return NULL;
+ }
+
+ /* These may not be available on older Solaris-es */
+# if defined(PRIV_FILE_READ) && defined(PRIV_FILE_WRITE)
+ if (priv_delset(box->pset, PRIV_FILE_READ) != 0 ||
+ priv_delset(box->pset, PRIV_FILE_WRITE) != 0) {
+ free(box);
+ return NULL;
+ }
+# endif
+
+ return box;
+}
+
+void
+ssh_sandbox_child(struct ssh_sandbox *box)
+{
+ if (setppriv(PRIV_SET, PRIV_PERMITTED, box->pset) != 0 ||
+ setppriv(PRIV_SET, PRIV_LIMIT, box->pset) != 0 ||
+ setppriv(PRIV_SET, PRIV_INHERITABLE, box->pset) != 0)
+ fatal("setppriv: %s", strerror(errno));
+}
+
+void
+ssh_sandbox_parent_finish(struct ssh_sandbox *box)
+{
+ priv_freeset(box->pset);
+ box->pset = NULL;
+ free(box);
+}
+
+void
+ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)
+{
+ /* Nothing to do here */
+}
+
+#endif /* SANDBOX_SOLARIS */
Modified: trunk/crypto/openssh/sandbox-systrace.c
===================================================================
--- trunk/crypto/openssh/sandbox-systrace.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sandbox-systrace.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sandbox-systrace.c,v 1.9 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: sandbox-systrace.c,v 1.18 2015/10/02 01:39:26 deraadt Exp $ */
/*
* Copyright (c) 2011 Damien Miller <djm at mindrot.org>
*
@@ -20,7 +20,6 @@
#ifdef SANDBOX_SYSTRACE
#include <sys/types.h>
-#include <sys/param.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <sys/socket.h>
@@ -37,6 +36,7 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
#include "atomicio.h"
#include "log.h"
@@ -50,25 +50,43 @@
/* Permitted syscalls in preauth. Unlisted syscalls get SYSTR_POLICY_KILL */
static const struct sandbox_policy preauth_policy[] = {
- { SYS_open, SYSTR_POLICY_NEVER },
+ { SYS_exit, SYSTR_POLICY_PERMIT },
+#ifdef SYS_kbind
+ { SYS_kbind, SYSTR_POLICY_PERMIT },
+#endif
- { SYS___sysctl, SYSTR_POLICY_PERMIT },
- { SYS_close, SYSTR_POLICY_PERMIT },
- { SYS_exit, SYSTR_POLICY_PERMIT },
{ SYS_getpid, SYSTR_POLICY_PERMIT },
+ { SYS_getpgid, SYSTR_POLICY_PERMIT },
+ { SYS_clock_gettime, SYSTR_POLICY_PERMIT },
{ SYS_gettimeofday, SYSTR_POLICY_PERMIT },
- { SYS_clock_gettime, SYSTR_POLICY_PERMIT },
+ { SYS_sigprocmask, SYSTR_POLICY_PERMIT },
+
+#ifdef SYS_getentropy
+ /* OpenBSD 5.6 and newer use getentropy(2) to seed arc4random(3). */
+ { SYS_getentropy, SYSTR_POLICY_PERMIT },
+#else
+ /* Previous releases used sysctl(3)'s kern.arnd variable. */
+ { SYS___sysctl, SYSTR_POLICY_PERMIT },
+#endif
+#ifdef SYS_sendsyslog
+ { SYS_sendsyslog, SYSTR_POLICY_PERMIT },
+#endif
+
{ SYS_madvise, SYSTR_POLICY_PERMIT },
{ SYS_mmap, SYSTR_POLICY_PERMIT },
{ SYS_mprotect, SYSTR_POLICY_PERMIT },
{ SYS_mquery, SYSTR_POLICY_PERMIT },
+ { SYS_munmap, SYSTR_POLICY_PERMIT },
+
{ SYS_poll, SYSTR_POLICY_PERMIT },
- { SYS_munmap, SYSTR_POLICY_PERMIT },
+ { SYS_select, SYSTR_POLICY_PERMIT },
{ SYS_read, SYSTR_POLICY_PERMIT },
- { SYS_select, SYSTR_POLICY_PERMIT },
+ { SYS_write, SYSTR_POLICY_PERMIT },
{ SYS_shutdown, SYSTR_POLICY_PERMIT },
- { SYS_sigprocmask, SYSTR_POLICY_PERMIT },
- { SYS_write, SYSTR_POLICY_PERMIT },
+ { SYS_close, SYSTR_POLICY_PERMIT },
+
+ { SYS_open, SYSTR_POLICY_NEVER },
+
{ -1, -1 }
};
Modified: trunk/crypto/openssh/scp.0
===================================================================
--- trunk/crypto/openssh/scp.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/scp.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-SCP(1) OpenBSD Reference Manual SCP(1)
+SCP(1) General Commands Manual SCP(1)
NAME
- scp - secure copy (remote file copy program)
+ scp M-bM-^@M-^S secure copy (remote file copy program)
SYNOPSIS
scp [-12346BCpqrv] [-c cipher] [-F ssh_config] [-i identity_file]
@@ -11,13 +11,13 @@
DESCRIPTION
scp copies files between hosts on a network. It uses ssh(1) for data
transfer, and uses the same authentication and provides the same security
- as ssh(1). Unlike rcp(1), scp will ask for passwords or passphrases if
- they are needed for authentication.
+ as ssh(1). scp will ask for passwords or passphrases if they are needed
+ for authentication.
File names may contain a user and host specification to indicate that the
file is to be copied to/from that host. Local file names can be made
explicit using absolute or relative pathnames to avoid scp treating file
- names containing `:' as host specifiers. Copies between two remote hosts
+ names containing M-bM-^@M-^X:M-bM-^@M-^Y as host specifiers. Copies between two remote hosts
are also permitted.
The options are as follows:
@@ -72,6 +72,7 @@
CanonicalizeHostname
CanonicalizeMaxDots
CanonicalizePermittedCNAMEs
+ CertificateFile
ChallengeResponseAuthentication
CheckHostIP
Cipher
@@ -89,11 +90,13 @@
HashKnownHosts
Host
HostbasedAuthentication
+ HostbasedKeyTypes
HostKeyAlgorithms
HostKeyAlias
HostName
+ IdentitiesOnly
+ IdentityAgent
IdentityFile
- IdentitiesOnly
IPQoS
KbdInteractiveAuthentication
KbdInteractiveDevices
@@ -108,6 +111,8 @@
PreferredAuthentications
Protocol
ProxyCommand
+ ProxyJump
+ PubkeyAcceptedKeyTypes
PubkeyAuthentication
RekeyLimit
RhostsRSAAuthentication
@@ -117,6 +122,7 @@
ServerAliveCountMax
StrictHostKeyChecking
TCPKeepAlive
+ UpdateHostKeys
UsePrivilegedPort
User
UserKnownHostsFile
@@ -124,9 +130,8 @@
-P port
Specifies the port to connect to on the remote host. Note that
- this option is written with a capital `P', because -p is already
- reserved for preserving the times and modes of the file in
- rcp(1).
+ this option is written with a capital M-bM-^@M-^XPM-bM-^@M-^Y, because -p is already
+ reserved for preserving the times and modes of the file.
-p Preserves modification times, access times, and modes from the
original file.
@@ -146,14 +151,14 @@
authentication, and configuration problems.
EXIT STATUS
- The scp utility exits 0 on success, and >0 if an error occurs.
+ The scp utility exitsM-BM- 0 on success, andM-BM- >0 if an error occurs.
SEE ALSO
- rcp(1), sftp(1), ssh(1), ssh-add(1), ssh-agent(1), ssh-keygen(1),
- ssh_config(5), sshd(8)
+ sftp(1), ssh(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), ssh_config(5),
+ sshd(8)
HISTORY
- scp is based on the rcp(1) program in BSD source code from the Regents of
+ scp is based on the rcp program in BSD source code from the Regents of
the University of California.
AUTHORS
@@ -160,4 +165,4 @@
Timo Rinne <tri at iki.fi>
Tatu Ylonen <ylo at cs.hut.fi>
-OpenBSD 5.5 October 20, 2013 OpenBSD 5.5
+OpenBSD 6.0 July 16, 2016 OpenBSD 6.0
Modified: trunk/crypto/openssh/scp.1
===================================================================
--- trunk/crypto/openssh/scp.1 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/scp.1 2016-11-05 20:36:34 UTC (rev 9223)
@@ -8,9 +8,9 @@
.\"
.\" Created: Sun May 7 00:14:37 1995 ylo
.\"
-.\" $OpenBSD: scp.1,v 1.61 2013/10/20 09:51:26 djm Exp $
+.\" $OpenBSD: scp.1,v 1.71 2016/07/16 06:57:55 jmc Exp $
.\"
-.Dd $Mdocdate: October 20 2013 $
+.Dd $Mdocdate: July 16 2016 $
.Dt SCP 1
.Os
.Sh NAME
@@ -30,7 +30,7 @@
.Sm off
.Oo
.Op Ar user No @
-.Ar host1 No :
+.Ar host1 :
.Oc Ar file1
.Sm on
.Ar ...
@@ -37,7 +37,7 @@
.Sm off
.Oo
.Op Ar user No @
-.Ar host2 No :
+.Ar host2 :
.Oc Ar file2
.Sm on
.Ek
@@ -49,8 +49,6 @@
for data transfer, and uses the same authentication and provides the
same security as
.Xr ssh 1 .
-Unlike
-.Xr rcp 1 ,
.Nm
will ask for passwords or passphrases if they are needed for
authentication.
@@ -135,6 +133,7 @@
.It CanonicalizeHostname
.It CanonicalizeMaxDots
.It CanonicalizePermittedCNAMEs
+.It CertificateFile
.It ChallengeResponseAuthentication
.It CheckHostIP
.It Cipher
@@ -152,11 +151,13 @@
.It HashKnownHosts
.It Host
.It HostbasedAuthentication
+.It HostbasedKeyTypes
.It HostKeyAlgorithms
.It HostKeyAlias
.It HostName
+.It IdentitiesOnly
+.It IdentityAgent
.It IdentityFile
-.It IdentitiesOnly
.It IPQoS
.It KbdInteractiveAuthentication
.It KbdInteractiveDevices
@@ -171,6 +172,8 @@
.It PreferredAuthentications
.It Protocol
.It ProxyCommand
+.It ProxyJump
+.It PubkeyAcceptedKeyTypes
.It PubkeyAuthentication
.It RekeyLimit
.It RhostsRSAAuthentication
@@ -180,6 +183,7 @@
.It ServerAliveCountMax
.It StrictHostKeyChecking
.It TCPKeepAlive
+.It UpdateHostKeys
.It UsePrivilegedPort
.It User
.It UserKnownHostsFile
@@ -191,8 +195,7 @@
.Sq P ,
because
.Fl p
-is already reserved for preserving the times and modes of the file in
-.Xr rcp 1 .
+is already reserved for preserving the times and modes of the file.
.It Fl p
Preserves modification times, access times, and modes from the
original file.
@@ -225,7 +228,6 @@
.Sh EXIT STATUS
.Ex -std scp
.Sh SEE ALSO
-.Xr rcp 1 ,
.Xr sftp 1 ,
.Xr ssh 1 ,
.Xr ssh-add 1 ,
@@ -235,9 +237,7 @@
.Xr sshd 8
.Sh HISTORY
.Nm
-is based on the
-.Xr rcp 1
-program in
+is based on the rcp program in
.Bx
source code from the Regents of the University of California.
.Sh AUTHORS
Modified: trunk/crypto/openssh/scp.c
===================================================================
--- trunk/crypto/openssh/scp.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/scp.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: scp.c,v 1.179 2013/11/20 20:53:10 deraadt Exp $ */
+/* $OpenBSD: scp.c,v 1.186 2016/05/25 23:48:45 schwarze Exp $ */
/*
* scp - secure remote copy. This is basically patched BSD rcp which
* uses ssh to do the data transfer (instead of using rcmd).
@@ -95,6 +95,8 @@
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
+#include <limits.h>
+#include <locale.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
@@ -113,6 +115,7 @@
#include "log.h"
#include "misc.h"
#include "progressmeter.h"
+#include "utf8.h"
extern char *__progname;
@@ -190,7 +193,7 @@
if (verbose_mode) {
fprintf(stderr, "Executing:");
for (i = 0; i < a->num; i++)
- fprintf(stderr, " %s", a->list[i]);
+ fmprintf(stderr, " %s", a->list[i]);
fprintf(stderr, "\n");
}
if ((pid = fork()) == -1)
@@ -231,7 +234,7 @@
int pin[2], pout[2], reserved[2];
if (verbose_mode)
- fprintf(stderr,
+ fmprintf(stderr,
"Executing: program %s host %s, user %s, command %s\n",
ssh_program, host,
remuser ? remuser : "(unspecified)", cmd);
@@ -306,7 +309,7 @@
int status;
if (verbose_mode)
- fprintf(stderr,
+ fmprintf(stderr,
"Executing: 2nd program %s host %s, user %s, command %s\n",
ssh_program, host,
remuser ? remuser : "(unspecified)", cmd);
@@ -377,6 +380,8 @@
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
+ setlocale(LC_CTYPE, "");
+
/* Copy argv, because we modify it */
newargv = xcalloc(MAX(argc + 1, 1), sizeof(*newargv));
for (n = 0; n < argc; n++)
@@ -483,6 +488,16 @@
if (!isatty(STDOUT_FILENO))
showprogress = 0;
+ if (pflag) {
+ /* Cannot pledge: -p allows setuid/setgid files... */
+ } else {
+ if (pledge("stdio rpath wpath cpath fattr tty proc exec",
+ NULL) == -1) {
+ perror("pledge");
+ exit(1);
+ }
+ }
+
remin = STDIN_FILENO;
remout = STDOUT_FILENO;
@@ -747,9 +762,9 @@
static BUF buffer;
BUF *bp;
off_t i, statbytes;
- size_t amt;
+ size_t amt, nr;
int fd = -1, haderr, indx;
- char *last, *name, buf[2048], encname[MAXPATHLEN];
+ char *last, *name, buf[2048], encname[PATH_MAX];
int len;
for (indx = 0; indx < argc; ++indx) {
@@ -799,9 +814,8 @@
snprintf(buf, sizeof buf, "C%04o %lld %s\n",
(u_int) (stb.st_mode & FILEMODEMASK),
(long long)stb.st_size, last);
- if (verbose_mode) {
- fprintf(stderr, "Sending file modes: %s", buf);
- }
+ if (verbose_mode)
+ fmprintf(stderr, "Sending file modes: %s", buf);
(void) atomicio(vwrite, remout, buf, strlen(buf));
if (response() < 0)
goto next;
@@ -820,12 +834,16 @@
if (i + (off_t)amt > stb.st_size)
amt = stb.st_size - i;
if (!haderr) {
- if (atomicio(read, fd, bp->buf, amt) != amt)
+ if ((nr = atomicio(read, fd,
+ bp->buf, amt)) != amt) {
haderr = errno;
+ memset(bp->buf + nr, 0, amt - nr);
+ }
}
/* Keep writing after error to retain sync */
if (haderr) {
(void)atomicio(vwrite, remout, bp->buf, amt);
+ memset(bp->buf, 0, amt);
continue;
}
if (atomicio6(vwrite, remout, bp->buf, amt, scpio,
@@ -833,8 +851,6 @@
haderr = errno;
}
unset_nonblock(remout);
- if (showprogress)
- stop_progress_meter();
if (fd != -1) {
if (close(fd) < 0 && !haderr)
@@ -846,6 +862,8 @@
else
run_err("%s: %s", name, strerror(haderr));
(void) response();
+ if (showprogress)
+ stop_progress_meter();
}
}
@@ -854,7 +872,7 @@
{
DIR *dirp;
struct dirent *dp;
- char *last, *vect[1], path[MAXPATHLEN];
+ char *last, *vect[1], path[PATH_MAX];
if (!(dirp = opendir(name))) {
run_err("%s: %s", name, strerror(errno));
@@ -861,7 +879,7 @@
return;
}
last = strrchr(name, '/');
- if (last == 0)
+ if (last == NULL)
last = name;
else
last++;
@@ -874,7 +892,7 @@
(void) snprintf(path, sizeof path, "D%04o %d %.1024s\n",
(u_int) (statp->st_mode & FILEMODEMASK), 0, last);
if (verbose_mode)
- fprintf(stderr, "Entering directory: %s", path);
+ fmprintf(stderr, "Entering directory: %s", path);
(void) atomicio(vwrite, remout, path, strlen(path));
if (response() < 0) {
closedir(dirp);
@@ -914,7 +932,7 @@
off_t size, statbytes;
unsigned long long ull;
int setimes, targisdir, wrerrno = 0;
- char ch, *cp, *np, *targ, *why, *vect[1], buf[2048];
+ char ch, *cp, *np, *targ, *why, *vect[1], buf[2048], visbuf[2048];
struct timeval tv[2];
#define atime tv[0]
@@ -949,12 +967,15 @@
} while (cp < &buf[sizeof(buf) - 1] && ch != '\n');
*cp = 0;
if (verbose_mode)
- fprintf(stderr, "Sink: %s", buf);
+ fmprintf(stderr, "Sink: %s", buf);
if (buf[0] == '\01' || buf[0] == '\02') {
- if (iamremote == 0)
+ if (iamremote == 0) {
+ (void) snmprintf(visbuf, sizeof(visbuf),
+ NULL, "%s", buf + 1);
(void) atomicio(vwrite, STDERR_FILENO,
- buf + 1, strlen(buf + 1));
+ visbuf, strlen(visbuf));
+ }
if (buf[0] == '\02')
exit(1);
++errs;
@@ -1130,8 +1151,6 @@
}
}
unset_nonblock(remin);
- if (showprogress)
- stop_progress_meter();
if (count != 0 && wrerr == NO &&
atomicio(vwrite, ofd, bp->buf, count) != count) {
wrerr = YES;
@@ -1170,6 +1189,8 @@
wrerrno = errno;
}
(void) response();
+ if (showprogress)
+ stop_progress_meter();
if (setimes && wrerr == NO) {
setimes = 0;
if (utimes(np, tv) < 0) {
@@ -1197,7 +1218,7 @@
int
response(void)
{
- char ch, *cp, resp, rbuf[2048];
+ char ch, *cp, resp, rbuf[2048], visbuf[2048];
if (atomicio(read, remin, &resp, sizeof(resp)) != sizeof(resp))
lostconn(0);
@@ -1217,8 +1238,13 @@
*cp++ = ch;
} while (cp < &rbuf[sizeof(rbuf) - 1] && ch != '\n');
- if (!iamremote)
- (void) atomicio(vwrite, STDERR_FILENO, rbuf, cp - rbuf);
+ if (!iamremote) {
+ cp[-1] = '\0';
+ (void) snmprintf(visbuf, sizeof(visbuf),
+ NULL, "%s\n", rbuf);
+ (void) atomicio(vwrite, STDERR_FILENO,
+ visbuf, strlen(visbuf));
+ }
++errs;
if (resp == 1)
return (-1);
@@ -1256,7 +1282,7 @@
if (!iamremote) {
va_start(ap, fmt);
- vfprintf(stderr, fmt, ap);
+ vfmprintf(stderr, fmt, ap);
va_end(ap);
fprintf(stderr, "\n");
}
@@ -1302,7 +1328,7 @@
} while (*++cp);
return (1);
-bad: fprintf(stderr, "%s: invalid user name\n", cp0);
+bad: fmprintf(stderr, "%s: invalid user name\n", cp0);
return (0);
}
@@ -1328,7 +1354,7 @@
if (bp->buf == NULL)
bp->buf = xmalloc(size);
else
- bp->buf = xrealloc(bp->buf, 1, size);
+ bp->buf = xreallocarray(bp->buf, 1, size);
memset(bp->buf, 0, size);
bp->cnt = size;
return (bp);
Modified: trunk/crypto/openssh/servconf.c
===================================================================
--- trunk/crypto/openssh/servconf.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/servconf.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,5 +1,5 @@
-/* $OpenBSD: servconf.c,v 1.249 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.292 2016/06/23 05:17:51 djm Exp $ */
/*
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
* All rights reserved
@@ -28,6 +28,7 @@
#include <string.h>
#include <signal.h>
#include <unistd.h>
+#include <limits.h>
#include <stdarg.h>
#include <errno.h>
#ifdef HAVE_UTIL_H
@@ -39,10 +40,10 @@
#include "ssh.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
#include "compat.h"
#include "pathnames.h"
-#include "misc.h"
#include "cipher.h"
#include "key.h"
#include "kex.h"
@@ -54,6 +55,8 @@
#include "packet.h"
#include "hostfile.h"
#include "auth.h"
+#include "myproposal.h"
+#include "digest.h"
static void add_listen_addr(ServerOptions *, char *, int);
static void add_one_listen_addr(ServerOptions *, char *, int);
@@ -75,6 +78,8 @@
/* Standard Options */
options->num_ports = 0;
options->ports_from_cmdline = 0;
+ options->queued_listen_addrs = NULL;
+ options->num_queued_listens = 0;
options->listen_addrs = NULL;
options->address_family = -1;
options->num_host_key_files = 0;
@@ -93,6 +98,7 @@
options->x11_display_offset = -1;
options->x11_use_localhost = -1;
options->permit_tty = -1;
+ options->permit_user_rc = -1;
options->xauth_location = NULL;
options->strict_modes = -1;
options->tcp_keep_alive = -1;
@@ -101,8 +107,11 @@
options->rhosts_rsa_authentication = -1;
options->hostbased_authentication = -1;
options->hostbased_uses_name_from_packet_only = -1;
+ options->hostbased_key_types = NULL;
+ options->hostkeyalgorithms = NULL;
options->rsa_authentication = -1;
options->pubkey_authentication = -1;
+ options->pubkey_key_types = NULL;
options->kerberos_authentication = -1;
options->kerberos_or_local_passwd = -1;
options->kerberos_ticket_cleanup = -1;
@@ -109,6 +118,7 @@
options->kerberos_get_afs_token = -1;
options->gss_authentication=-1;
options->gss_cleanup_creds = -1;
+ options->gss_strict_acceptor = -1;
options->password_authentication = -1;
options->kbd_interactive_authentication = -1;
options->challenge_response_authentication = -1;
@@ -119,6 +129,7 @@
options->rekey_limit = -1;
options->rekey_interval = -1;
options->allow_tcp_forwarding = -1;
+ options->allow_streamlocal_forwarding = -1;
options->allow_agent_forwarding = -1;
options->num_allow_users = 0;
options->num_deny_users = 0;
@@ -128,7 +139,9 @@
options->macs = NULL;
options->kex_algorithms = NULL;
options->protocol = SSH_PROTO_UNKNOWN;
- options->gateway_ports = -1;
+ options->fwd_opts.gateway_ports = -1;
+ options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
+ options->fwd_opts.streamlocal_bind_unlink = -1;
options->num_subsystems = 0;
options->max_startups_begin = -1;
options->max_startups_rate = -1;
@@ -150,14 +163,40 @@
options->revoked_keys_file = NULL;
options->trusted_user_ca_keys = NULL;
options->authorized_principals_file = NULL;
+ options->authorized_principals_command = NULL;
+ options->authorized_principals_command_user = NULL;
options->ip_qos_interactive = -1;
options->ip_qos_bulk = -1;
options->version_addendum = NULL;
+ options->fingerprint_hash = -1;
}
+/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
+static int
+option_clear_or_none(const char *o)
+{
+ return o == NULL || strcasecmp(o, "none") == 0;
+}
+
+static void
+assemble_algorithms(ServerOptions *o)
+{
+ if (kex_assemble_names(KEX_SERVER_ENCRYPT, &o->ciphers) != 0 ||
+ kex_assemble_names(KEX_SERVER_MAC, &o->macs) != 0 ||
+ kex_assemble_names(KEX_SERVER_KEX, &o->kex_algorithms) != 0 ||
+ kex_assemble_names(KEX_DEFAULT_PK_ALG,
+ &o->hostkeyalgorithms) != 0 ||
+ kex_assemble_names(KEX_DEFAULT_PK_ALG,
+ &o->hostbased_key_types) != 0 ||
+ kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->pubkey_key_types) != 0)
+ fatal("kex_assemble_names failed");
+}
+
void
fill_default_server_options(ServerOptions *options)
{
+ int i;
+
/* Portable-specific options */
if (options->use_pam == -1)
options->use_pam = 0;
@@ -186,10 +225,12 @@
/* No certificates by default */
if (options->num_ports == 0)
options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
+ if (options->address_family == -1)
+ options->address_family = AF_UNSPEC;
if (options->listen_addrs == NULL)
add_listen_addr(options, NULL, 0);
if (options->pid_file == NULL)
- options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
+ options->pid_file = xstrdup(_PATH_SSH_DAEMON_PID_FILE);
if (options->server_key_bits == -1)
options->server_key_bits = 1024;
if (options->login_grace_time == -1)
@@ -197,7 +238,7 @@
if (options->key_regeneration_time == -1)
options->key_regeneration_time = 3600;
if (options->permit_root_login == PERMIT_NOT_SET)
- options->permit_root_login = PERMIT_YES;
+ options->permit_root_login = PERMIT_NO_PASSWD;
if (options->ignore_rhosts == -1)
options->ignore_rhosts = 1;
if (options->ignore_user_known_hosts == -1)
@@ -213,9 +254,11 @@
if (options->x11_use_localhost == -1)
options->x11_use_localhost = 1;
if (options->xauth_location == NULL)
- options->xauth_location = _PATH_XAUTH;
+ options->xauth_location = xstrdup(_PATH_XAUTH);
if (options->permit_tty == -1)
options->permit_tty = 1;
+ if (options->permit_user_rc == -1)
+ options->permit_user_rc = 1;
if (options->strict_modes == -1)
options->strict_modes = 1;
if (options->tcp_keep_alive == -1)
@@ -246,6 +289,8 @@
options->gss_authentication = 0;
if (options->gss_cleanup_creds == -1)
options->gss_cleanup_creds = 1;
+ if (options->gss_strict_acceptor == -1)
+ options->gss_strict_acceptor = 0;
if (options->password_authentication == -1)
options->password_authentication = 1;
if (options->kbd_interactive_authentication == -1)
@@ -266,10 +311,12 @@
options->rekey_interval = 0;
if (options->allow_tcp_forwarding == -1)
options->allow_tcp_forwarding = FORWARD_ALLOW;
+ if (options->allow_streamlocal_forwarding == -1)
+ options->allow_streamlocal_forwarding = FORWARD_ALLOW;
if (options->allow_agent_forwarding == -1)
options->allow_agent_forwarding = 1;
- if (options->gateway_ports == -1)
- options->gateway_ports = 0;
+ if (options->fwd_opts.gateway_ports == -1)
+ options->fwd_opts.gateway_ports = 0;
if (options->max_startups == -1)
options->max_startups = 100;
if (options->max_startups_rate == -1)
@@ -281,7 +328,7 @@
if (options->max_sessions == -1)
options->max_sessions = DEFAULT_SESSIONS_MAX;
if (options->use_dns == -1)
- options->use_dns = 1;
+ options->use_dns = 0;
if (options->client_alive_interval == -1)
options->client_alive_interval = 0;
if (options->client_alive_count_max == -1)
@@ -300,10 +347,48 @@
options->ip_qos_bulk = IPTOS_THROUGHPUT;
if (options->version_addendum == NULL)
options->version_addendum = xstrdup("");
- /* Turn privilege separation on by default */
+ if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
+ options->fwd_opts.streamlocal_bind_mask = 0177;
+ if (options->fwd_opts.streamlocal_bind_unlink == -1)
+ options->fwd_opts.streamlocal_bind_unlink = 0;
+ if (options->fingerprint_hash == -1)
+ options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
+
+ assemble_algorithms(options);
+
+ /* Turn privilege separation and sandboxing on by default */
if (use_privsep == -1)
- use_privsep = PRIVSEP_NOSANDBOX;
+ use_privsep = PRIVSEP_ON;
+#define CLEAR_ON_NONE(v) \
+ do { \
+ if (option_clear_or_none(v)) { \
+ free(v); \
+ v = NULL; \
+ } \
+ } while(0)
+ CLEAR_ON_NONE(options->pid_file);
+ CLEAR_ON_NONE(options->xauth_location);
+ CLEAR_ON_NONE(options->banner);
+ CLEAR_ON_NONE(options->trusted_user_ca_keys);
+ CLEAR_ON_NONE(options->revoked_keys_file);
+ CLEAR_ON_NONE(options->authorized_principals_file);
+ CLEAR_ON_NONE(options->adm_forced_command);
+ CLEAR_ON_NONE(options->chroot_directory);
+ for (i = 0; i < options->num_host_key_files; i++)
+ CLEAR_ON_NONE(options->host_key_files[i]);
+ for (i = 0; i < options->num_host_cert_files; i++)
+ CLEAR_ON_NONE(options->host_cert_files[i]);
+#undef CLEAR_ON_NONE
+
+ /* Similar handling for AuthenticationMethods=any */
+ if (options->num_auth_methods == 1 &&
+ strcmp(options->auth_methods[0], "any") == 0) {
+ free(options->auth_methods[0]);
+ options->auth_methods[0] = NULL;
+ options->num_auth_methods = 0;
+ }
+
#ifndef HAVE_MMAP
if (use_privsep && options->compression == 1) {
error("This platform does not support both privilege "
@@ -321,8 +406,8 @@
/* Portable-specific options */
sUsePAM,
/* Standard Options */
- sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
- sPermitRootLogin, sLogFacility, sLogLevel,
+ sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime,
+ sKeyRegenerationTime, sPermitRootLogin, sLogFacility, sLogLevel,
sRhostsRSAAuthentication, sRSAAuthentication,
sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
sKerberosGetAFSToken,
@@ -335,19 +420,24 @@
sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
- sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
- sMaxStartups, sMaxAuthTries, sMaxSessions,
+ sGatewayPorts, sPubkeyAuthentication, sPubkeyAcceptedKeyTypes,
+ sXAuthLocation, sSubsystem, sMaxStartups, sMaxAuthTries, sMaxSessions,
sBanner, sUseDNS, sHostbasedAuthentication,
- sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
- sClientAliveCountMax, sAuthorizedKeysFile,
- sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
+ sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
+ sHostKeyAlgorithms,
+ sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
+ sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
+ sAcceptEnv, sPermitTunnel,
sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
sUsePrivilegeSeparation, sAllowAgentForwarding,
sHostCertificate,
sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
+ sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser,
sKexAlgorithms, sIPQoS, sVersionAddendum,
sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
- sAuthenticationMethods, sHostKeyAgent,
+ sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
+ sStreamLocalBindMask, sStreamLocalBindUnlink,
+ sAllowStreamLocalForwarding, sFingerprintHash,
sDeprecated, sUnsupported
} ServerOpCodes;
@@ -384,8 +474,11 @@
{ "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
{ "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
{ "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
+ { "hostbasedacceptedkeytypes", sHostbasedAcceptedKeyTypes, SSHCFG_ALL },
+ { "hostkeyalgorithms", sHostKeyAlgorithms, SSHCFG_GLOBAL },
{ "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
{ "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
+ { "pubkeyacceptedkeytypes", sPubkeyAcceptedKeyTypes, SSHCFG_ALL },
{ "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
#ifdef KRB5
{ "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
@@ -407,9 +500,11 @@
#ifdef GSSAPI
{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
+ { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
#else
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
+ { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
#endif
{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
@@ -419,7 +514,11 @@
{ "listenaddress", sListenAddress, SSHCFG_GLOBAL },
{ "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
{ "printmotd", sPrintMotd, SSHCFG_GLOBAL },
+#ifdef DISABLE_LASTLOG
+ { "printlastlog", sUnsupported, SSHCFG_GLOBAL },
+#else
{ "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
+#endif
{ "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
@@ -460,6 +559,7 @@
{ "acceptenv", sAcceptEnv, SSHCFG_ALL },
{ "permittunnel", sPermitTunnel, SSHCFG_ALL },
{ "permittty", sPermitTTY, SSHCFG_ALL },
+ { "permituserrc", sPermitUserRC, SSHCFG_ALL },
{ "match", sMatch, SSHCFG_ALL },
{ "permitopen", sPermitOpen, SSHCFG_ALL },
{ "forcecommand", sForceCommand, SSHCFG_ALL },
@@ -472,8 +572,14 @@
{ "ipqos", sIPQoS, SSHCFG_ALL },
{ "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
{ "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
+ { "authorizedprincipalscommand", sAuthorizedPrincipalsCommand, SSHCFG_ALL },
+ { "authorizedprincipalscommanduser", sAuthorizedPrincipalsCommandUser, SSHCFG_ALL },
{ "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
{ "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
+ { "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL },
+ { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL },
+ { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
+ { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
{ NULL, sBadOption, 0 }
};
@@ -512,8 +618,10 @@
char *
derelativise_path(const char *path)
{
- char *expanded, *ret, cwd[MAXPATHLEN];
+ char *expanded, *ret, cwd[PATH_MAX];
+ if (strcasecmp(path, "none") == 0)
+ return xstrdup("none");
expanded = tilde_expand_filename(path, getuid());
if (*expanded == '/')
return expanded;
@@ -529,10 +637,6 @@
{
u_int i;
- if (options->num_ports == 0)
- options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
- if (options->address_family == -1)
- options->address_family = AF_UNSPEC;
if (port == 0)
for (i = 0; i < options->num_ports; i++)
add_one_listen_addr(options, addr, options->ports[i]);
@@ -562,17 +666,63 @@
options->listen_addrs = aitop;
}
+/*
+ * Queue a ListenAddress to be processed once we have all of the Ports
+ * and AddressFamily options.
+ */
+static void
+queue_listen_addr(ServerOptions *options, char *addr, int port)
+{
+ options->queued_listen_addrs = xreallocarray(
+ options->queued_listen_addrs, options->num_queued_listens + 1,
+ sizeof(addr));
+ options->queued_listen_ports = xreallocarray(
+ options->queued_listen_ports, options->num_queued_listens + 1,
+ sizeof(port));
+ options->queued_listen_addrs[options->num_queued_listens] =
+ xstrdup(addr);
+ options->queued_listen_ports[options->num_queued_listens] = port;
+ options->num_queued_listens++;
+}
+
+/*
+ * Process queued (text) ListenAddress entries.
+ */
+static void
+process_queued_listen_addrs(ServerOptions *options)
+{
+ u_int i;
+
+ if (options->num_ports == 0)
+ options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
+ if (options->address_family == -1)
+ options->address_family = AF_UNSPEC;
+
+ for (i = 0; i < options->num_queued_listens; i++) {
+ add_listen_addr(options, options->queued_listen_addrs[i],
+ options->queued_listen_ports[i]);
+ free(options->queued_listen_addrs[i]);
+ options->queued_listen_addrs[i] = NULL;
+ }
+ free(options->queued_listen_addrs);
+ options->queued_listen_addrs = NULL;
+ free(options->queued_listen_ports);
+ options->queued_listen_ports = NULL;
+ options->num_queued_listens = 0;
+}
+
struct connection_info *
get_connection_info(int populate, int use_dns)
{
+ struct ssh *ssh = active_state; /* XXX */
static struct connection_info ci;
if (!populate)
return &ci;
- ci.host = get_canonical_hostname(use_dns);
- ci.address = get_remote_ipaddr();
- ci.laddress = get_local_ipaddr(packet_get_connection_in());
- ci.lport = get_local_port();
+ ci.host = auth_get_canonical_hostname(ssh, use_dns);
+ ci.address = ssh_remote_ipaddr(ssh);
+ ci.laddress = ssh_local_ipaddr(ssh);
+ ci.lport = ssh_local_port(ssh);
return &ci;
}
@@ -647,7 +797,6 @@
{
int result = 1, attributes = 0, port;
char *arg, *attrib, *cp = *condition;
- size_t len;
if (ci == NULL)
debug3("checking syntax for 'Match %s'", cp);
@@ -674,13 +823,12 @@
error("Missing Match criteria for %s", attrib);
return -1;
}
- len = strlen(arg);
if (strcasecmp(attrib, "user") == 0) {
if (ci == NULL || ci->user == NULL) {
result = 0;
continue;
}
- if (match_pattern_list(ci->user, arg, len, 0) != 1)
+ if (match_pattern_list(ci->user, arg, 0) != 1)
result = 0;
else
debug("user %.100s matched 'User %.100s' at "
@@ -701,7 +849,7 @@
result = 0;
continue;
}
- if (match_hostname(ci->host, arg, len) != 1)
+ if (match_hostname(ci->host, arg) != 1)
result = 0;
else
debug("connection from %.100s matched 'Host "
@@ -788,6 +936,7 @@
};
static const struct multistate multistate_permitrootlogin[] = {
{ "without-password", PERMIT_NO_PASSWD },
+ { "prohibit-password", PERMIT_NO_PASSWD },
{ "forced-commands-only", PERMIT_FORCED_ONLY },
{ "yes", PERMIT_YES },
{ "no", PERMIT_NO },
@@ -878,9 +1027,6 @@
/* ignore ports from configfile if cmdline specifies ports */
if (options->ports_from_cmdline)
return 0;
- if (options->listen_addrs != NULL)
- fatal("%s line %d: ports must be specified before "
- "ListenAddress.", filename, linenum);
if (options->num_ports >= MAX_PORTS)
fatal("%s line %d: too many ports.",
filename, linenum);
@@ -916,7 +1062,7 @@
if ((value = convtime(arg)) == -1)
fatal("%s line %d: invalid time value.",
filename, linenum);
- if (*intptr == -1)
+ if (*activep && *intptr == -1)
*intptr = value;
break;
@@ -932,7 +1078,7 @@
/* check for bare IPv6 address: no "[]" and 2 or more ":" */
if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
&& strchr(p+1, ':') != NULL) {
- add_listen_addr(options, arg, 0);
+ queue_listen_addr(options, arg, 0);
break;
}
p = hpdelim(&arg);
@@ -945,7 +1091,7 @@
else if ((port = a2port(arg)) <= 0)
fatal("%s line %d: bad port number", filename, linenum);
- add_listen_addr(options, p, port);
+ queue_listen_addr(options, p, port);
break;
@@ -952,9 +1098,6 @@
case sAddressFamily:
intptr = &options->address_family;
multistate_ptr = multistate_addressfamily;
- if (options->listen_addrs != NULL)
- fatal("%s line %d: address family must be specified "
- "before ListenAddress.", filename, linenum);
parse_multistate:
arg = strdelim(&cp);
if (!arg || *arg == '\0')
@@ -1058,6 +1201,24 @@
intptr = &options->hostbased_uses_name_from_packet_only;
goto parse_flag;
+ case sHostbasedAcceptedKeyTypes:
+ charptr = &options->hostbased_key_types;
+ parse_keytypes:
+ arg = strdelim(&cp);
+ if (!arg || *arg == '\0')
+ fatal("%s line %d: Missing argument.",
+ filename, linenum);
+ if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
+ fatal("%s line %d: Bad key types '%s'.",
+ filename, linenum, arg ? arg : "<NONE>");
+ if (*activep && *charptr == NULL)
+ *charptr = xstrdup(arg);
+ break;
+
+ case sHostKeyAlgorithms:
+ charptr = &options->hostkeyalgorithms;
+ goto parse_keytypes;
+
case sRSAAuthentication:
intptr = &options->rsa_authentication;
goto parse_flag;
@@ -1066,6 +1227,10 @@
intptr = &options->pubkey_authentication;
goto parse_flag;
+ case sPubkeyAcceptedKeyTypes:
+ charptr = &options->pubkey_key_types;
+ goto parse_keytypes;
+
case sKerberosAuthentication:
intptr = &options->kerberos_authentication;
goto parse_flag;
@@ -1090,6 +1255,10 @@
intptr = &options->gss_cleanup_creds;
goto parse_flag;
+ case sGssStrictAcceptor:
+ intptr = &options->gss_strict_acceptor;
+ goto parse_flag;
+
case sPasswordAuthentication:
intptr = &options->password_authentication;
goto parse_flag;
@@ -1130,6 +1299,10 @@
intptr = &options->permit_tty;
goto parse_flag;
+ case sPermitUserRC:
+ intptr = &options->permit_user_rc;
+ goto parse_flag;
+
case sStrictModes:
intptr = &options->strict_modes;
goto parse_flag;
@@ -1166,16 +1339,12 @@
if (scan_scaled(arg, &val64) == -1)
fatal("%.200s line %d: Bad number '%s': %s",
filename, linenum, arg, strerror(errno));
- /* check for too-large or too-small limits */
- if (val64 > UINT_MAX)
- fatal("%.200s line %d: RekeyLimit too large",
- filename, linenum);
if (val64 != 0 && val64 < 16)
fatal("%.200s line %d: RekeyLimit too small",
filename, linenum);
}
if (*activep && options->rekey_limit == -1)
- options->rekey_limit = (u_int32_t)val64;
+ options->rekey_limit = val64;
if (cp != NULL) { /* optional rekey interval present */
if (strcmp(cp, "none") == 0) {
(void)strdelim(&cp); /* discard */
@@ -1187,7 +1356,7 @@
break;
case sGatewayPorts:
- intptr = &options->gateway_ports;
+ intptr = &options->fwd_opts.gateway_ports;
multistate_ptr = multistate_gatewayports;
goto parse_multistate;
@@ -1222,6 +1391,11 @@
multistate_ptr = multistate_tcpfwd;
goto parse_multistate;
+ case sAllowStreamLocalForwarding:
+ intptr = &options->allow_streamlocal_forwarding;
+ multistate_ptr = multistate_tcpfwd;
+ goto parse_multistate;
+
case sAllowAgentForwarding:
intptr = &options->allow_agent_forwarding;
goto parse_flag;
@@ -1283,7 +1457,7 @@
arg = strdelim(&cp);
if (!arg || *arg == '\0')
fatal("%s line %d: Missing argument.", filename, linenum);
- if (!ciphers_valid(arg))
+ if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (options->ciphers == NULL)
@@ -1294,7 +1468,7 @@
arg = strdelim(&cp);
if (!arg || *arg == '\0')
fatal("%s line %d: Missing argument.", filename, linenum);
- if (!mac_valid(arg))
+ if (!mac_valid(*arg == '+' ? arg + 1 : arg))
fatal("%s line %d: Bad SSH2 mac spec '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (options->macs == NULL)
@@ -1306,7 +1480,7 @@
if (!arg || *arg == '\0')
fatal("%s line %d: Missing argument.",
filename, linenum);
- if (!kex_names_valid(arg))
+ if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (options->kex_algorithms == NULL)
@@ -1355,7 +1529,7 @@
len = strlen(p) + 1;
while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
len += 1 + strlen(arg);
- p = xrealloc(p, 1, len);
+ p = xreallocarray(p, 1, len);
strlcat(p, " ", len);
strlcat(p, arg, len);
}
@@ -1470,7 +1644,7 @@
if (value == -1)
fatal("%s line %d: Bad yes/point-to-point/ethernet/"
"no argument: %s", filename, linenum, arg);
- if (*intptr == -1)
+ if (*activep && *intptr == -1)
*intptr = value;
break;
@@ -1523,7 +1697,7 @@
break;
case sForceCommand:
- if (cp == NULL)
+ if (cp == NULL || *cp == '\0')
fatal("%.200s line %d: Missing argument.", filename,
linenum);
len = strspn(cp, WHITESPACE);
@@ -1568,7 +1742,7 @@
break;
case sVersionAddendum:
- if (cp == NULL)
+ if (cp == NULL || *cp == '\0')
fatal("%.200s line %d: Missing argument.", filename,
linenum);
len = strspn(cp, WHITESPACE);
@@ -1584,6 +1758,9 @@
return 0;
case sAuthorizedKeysCommand:
+ if (cp == NULL)
+ fatal("%.200s line %d: Missing argument.", filename,
+ linenum);
len = strspn(cp, WHITESPACE);
if (*activep && options->authorized_keys_command == NULL) {
if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
@@ -1598,12 +1775,45 @@
charptr = &options->authorized_keys_command_user;
arg = strdelim(&cp);
+ if (!arg || *arg == '\0')
+ fatal("%s line %d: missing AuthorizedKeysCommandUser "
+ "argument.", filename, linenum);
if (*activep && *charptr == NULL)
*charptr = xstrdup(arg);
break;
+ case sAuthorizedPrincipalsCommand:
+ if (cp == NULL)
+ fatal("%.200s line %d: Missing argument.", filename,
+ linenum);
+ len = strspn(cp, WHITESPACE);
+ if (*activep &&
+ options->authorized_principals_command == NULL) {
+ if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
+ fatal("%.200s line %d: "
+ "AuthorizedPrincipalsCommand must be "
+ "an absolute path", filename, linenum);
+ options->authorized_principals_command =
+ xstrdup(cp + len);
+ }
+ return 0;
+
+ case sAuthorizedPrincipalsCommandUser:
+ charptr = &options->authorized_principals_command_user;
+
+ arg = strdelim(&cp);
+ if (!arg || *arg == '\0')
+ fatal("%s line %d: missing "
+ "AuthorizedPrincipalsCommandUser argument.",
+ filename, linenum);
+ if (*activep && *charptr == NULL)
+ *charptr = xstrdup(arg);
+ break;
+
case sAuthenticationMethods:
- if (*activep && options->num_auth_methods == 0) {
+ if (options->num_auth_methods == 0) {
+ value = 0; /* seen "any" pseudo-method */
+ value2 = 0; /* sucessfully parsed any method */
while ((arg = strdelim(&cp)) && *arg != '\0') {
if (options->num_auth_methods >=
MAX_AUTH_METHODS)
@@ -1610,16 +1820,65 @@
fatal("%s line %d: "
"too many authentication methods.",
filename, linenum);
- if (auth2_methods_valid(arg, 0) != 0)
+ if (strcmp(arg, "any") == 0) {
+ if (options->num_auth_methods > 0) {
+ fatal("%s line %d: \"any\" "
+ "must appear alone in "
+ "AuthenticationMethods",
+ filename, linenum);
+ }
+ value = 1;
+ } else if (value) {
+ fatal("%s line %d: \"any\" must appear "
+ "alone in AuthenticationMethods",
+ filename, linenum);
+ } else if (auth2_methods_valid(arg, 0) != 0) {
fatal("%s line %d: invalid "
"authentication method list.",
filename, linenum);
+ }
+ value2 = 1;
+ if (!*activep)
+ continue;
options->auth_methods[
options->num_auth_methods++] = xstrdup(arg);
}
+ if (value2 == 0) {
+ fatal("%s line %d: no AuthenticationMethods "
+ "specified", filename, linenum);
+ }
}
return 0;
+ case sStreamLocalBindMask:
+ arg = strdelim(&cp);
+ if (!arg || *arg == '\0')
+ fatal("%s line %d: missing StreamLocalBindMask "
+ "argument.", filename, linenum);
+ /* Parse mode in octal format */
+ value = strtol(arg, &p, 8);
+ if (arg == p || value < 0 || value > 0777)
+ fatal("%s line %d: Bad mask.", filename, linenum);
+ if (*activep)
+ options->fwd_opts.streamlocal_bind_mask = (mode_t)value;
+ break;
+
+ case sStreamLocalBindUnlink:
+ intptr = &options->fwd_opts.streamlocal_bind_unlink;
+ goto parse_flag;
+
+ case sFingerprintHash:
+ arg = strdelim(&cp);
+ if (!arg || *arg == '\0')
+ fatal("%.200s line %d: Missing argument.",
+ filename, linenum);
+ if ((value = ssh_digest_alg_by_name(arg)) == -1)
+ fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
+ filename, linenum, arg);
+ if (*activep)
+ options->fingerprint_hash = value;
+ break;
+
case sDeprecated:
logit("%s line %d: Deprecated option %s",
filename, linenum, arg);
@@ -1759,13 +2018,16 @@
M_CP_INTOPT(permit_empty_passwd);
M_CP_INTOPT(allow_tcp_forwarding);
+ M_CP_INTOPT(allow_streamlocal_forwarding);
M_CP_INTOPT(allow_agent_forwarding);
M_CP_INTOPT(permit_tun);
- M_CP_INTOPT(gateway_ports);
+ M_CP_INTOPT(fwd_opts.gateway_ports);
+ M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
M_CP_INTOPT(x11_display_offset);
M_CP_INTOPT(x11_forwarding);
M_CP_INTOPT(x11_use_localhost);
M_CP_INTOPT(permit_tty);
+ M_CP_INTOPT(permit_user_rc);
M_CP_INTOPT(max_sessions);
M_CP_INTOPT(max_authtries);
M_CP_INTOPT(ip_qos_interactive);
@@ -1773,6 +2035,16 @@
M_CP_INTOPT(rekey_limit);
M_CP_INTOPT(rekey_interval);
+ /*
+ * The bind_mask is a mode_t that may be unsigned, so we can't use
+ * M_CP_INTOPT - it does a signed comparison that causes compiler
+ * warnings.
+ */
+ if (src->fwd_opts.streamlocal_bind_mask != (mode_t)-1) {
+ dst->fwd_opts.streamlocal_bind_mask =
+ src->fwd_opts.streamlocal_bind_mask;
+ }
+
/* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */
#define M_CP_STROPT(n) do {\
if (src->n != NULL && dst->n != src->n) { \
@@ -1790,6 +2062,9 @@
/* See comment in servconf.h */
COPY_MATCH_STRING_OPTS();
+ /* Arguments that accept '+...' need to be expanded */
+ assemble_algorithms(dst);
+
/*
* The only things that should be below this point are string options
* which are only used after authentication.
@@ -1797,8 +2072,17 @@
if (preauth)
return;
+ /* These options may be "none" to clear a global setting */
M_CP_STROPT(adm_forced_command);
+ if (option_clear_or_none(dst->adm_forced_command)) {
+ free(dst->adm_forced_command);
+ dst->adm_forced_command = NULL;
+ }
M_CP_STROPT(chroot_directory);
+ if (option_clear_or_none(dst->chroot_directory)) {
+ free(dst->chroot_directory);
+ dst->chroot_directory = NULL;
+ }
}
#undef M_CP_INTOPT
@@ -1814,7 +2098,8 @@
debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
- obuf = cbuf = xstrdup(buffer_ptr(conf));
+ if ((obuf = cbuf = sshbuf_dup_string(conf)) == NULL)
+ fatal("%s: sshbuf_dup_string failed", __func__);
active = connectinfo ? 0 : 1;
linenum = 1;
while ((cp = strsep(&cbuf, "\n")) != NULL) {
@@ -1826,6 +2111,7 @@
if (bad_options > 0)
fatal("%s: terminating, %d bad configuration options",
filename, bad_options);
+ process_queued_listen_addrs(options);
}
static const char *
@@ -1858,6 +2144,10 @@
return fmt_multistate_int(val, multistate_privsep);
case sAllowTcpForwarding:
return fmt_multistate_int(val, multistate_tcpfwd);
+ case sAllowStreamLocalForwarding:
+ return fmt_multistate_int(val, multistate_tcpfwd);
+ case sFingerprintHash:
+ return ssh_digest_alg_name(val);
case sProtocol:
switch (val) {
case SSH_PROTO_1:
@@ -1899,6 +2189,12 @@
}
static void
+dump_cfg_oct(ServerOpCodes code, int val)
+{
+ printf("%s 0%o\n", lookup_opcode_name(code), val);
+}
+
+static void
dump_cfg_fmtint(ServerOpCodes code, int val)
{
printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
@@ -1909,7 +2205,8 @@
{
if (val == NULL)
return;
- printf("%s %s\n", lookup_opcode_name(code), val);
+ printf("%s %s\n", lookup_opcode_name(code),
+ val == NULL ? "none" : val);
}
static void
@@ -1926,9 +2223,13 @@
{
u_int i;
+ if (count <= 0 && code != sAuthenticationMethods)
+ return;
printf("%s", lookup_opcode_name(code));
for (i = 0; i < count; i++)
printf(" %s", vals[i]);
+ if (code == sAuthenticationMethods && count == 0)
+ printf(" any");
printf("\n");
}
@@ -1939,6 +2240,7 @@
int ret;
struct addrinfo *ai;
char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
+ char *laddr1 = xstrdup(""), *laddr2 = NULL;
/* these are usually at the top of the config */
for (i = 0; i < o->num_ports; i++)
@@ -1946,7 +2248,11 @@
dump_cfg_fmtint(sProtocol, o->protocol);
dump_cfg_fmtint(sAddressFamily, o->address_family);
- /* ListenAddress must be after Port */
+ /*
+ * ListenAddress must be after Port. add_one_listen_addr pushes
+ * addresses onto a stack, so to maintain ordering we need to
+ * print these in reverse order.
+ */
for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
sizeof(addr), port, sizeof(port),
@@ -1955,16 +2261,22 @@
(ret != EAI_SYSTEM) ? gai_strerror(ret) :
strerror(errno));
} else {
+ laddr2 = laddr1;
if (ai->ai_family == AF_INET6)
- printf("listenaddress [%s]:%s\n", addr, port);
+ xasprintf(&laddr1, "listenaddress [%s]:%s\n%s",
+ addr, port, laddr2);
else
- printf("listenaddress %s:%s\n", addr, port);
+ xasprintf(&laddr1, "listenaddress %s:%s\n%s",
+ addr, port, laddr2);
+ free(laddr2);
}
}
+ printf("%s", laddr1);
+ free(laddr1);
/* integer arguments */
#ifdef USE_PAM
- dump_cfg_int(sUsePAM, o->use_pam);
+ dump_cfg_fmtint(sUsePAM, o->use_pam);
#endif
dump_cfg_int(sServerKeyBits, o->server_key_bits);
dump_cfg_int(sLoginGraceTime, o->login_grace_time);
@@ -1974,6 +2286,7 @@
dump_cfg_int(sMaxSessions, o->max_sessions);
dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
+ dump_cfg_oct(sStreamLocalBindMask, o->fwd_opts.streamlocal_bind_mask);
/* formatted integer arguments */
dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
@@ -2003,10 +2316,13 @@
dump_cfg_fmtint(sChallengeResponseAuthentication,
o->challenge_response_authentication);
dump_cfg_fmtint(sPrintMotd, o->print_motd);
+#ifndef DISABLE_LASTLOG
dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
+#endif
dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
dump_cfg_fmtint(sPermitTTY, o->permit_tty);
+ dump_cfg_fmtint(sPermitUserRC, o->permit_user_rc);
dump_cfg_fmtint(sStrictModes, o->strict_modes);
dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
@@ -2013,17 +2329,20 @@
dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
dump_cfg_fmtint(sUseLogin, o->use_login);
dump_cfg_fmtint(sCompression, o->compression);
- dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
+ dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);
dump_cfg_fmtint(sUseDNS, o->use_dns);
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
+ dump_cfg_fmtint(sAllowAgentForwarding, o->allow_agent_forwarding);
+ dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
+ dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
+ dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
/* string arguments */
dump_cfg_string(sPidFile, o->pid_file);
dump_cfg_string(sXAuthLocation, o->xauth_location);
- dump_cfg_string(sCiphers, o->ciphers ? o->ciphers :
- cipher_alg_list(',', 0));
- dump_cfg_string(sMacs, o->macs ? o->macs : mac_alg_list(','));
+ dump_cfg_string(sCiphers, o->ciphers ? o->ciphers : KEX_SERVER_ENCRYPT);
+ dump_cfg_string(sMacs, o->macs ? o->macs : KEX_SERVER_MAC);
dump_cfg_string(sBanner, o->banner);
dump_cfg_string(sForceCommand, o->adm_forced_command);
dump_cfg_string(sChrootDirectory, o->chroot_directory);
@@ -2031,12 +2350,21 @@
dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
dump_cfg_string(sAuthorizedPrincipalsFile,
o->authorized_principals_file);
- dump_cfg_string(sVersionAddendum, o->version_addendum);
+ dump_cfg_string(sVersionAddendum, *o->version_addendum == '\0'
+ ? "none" : o->version_addendum);
dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
+ dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command);
+ dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user);
dump_cfg_string(sHostKeyAgent, o->host_key_agent);
- dump_cfg_string(sKexAlgorithms, o->kex_algorithms ? o->kex_algorithms :
- kex_alg_list(','));
+ dump_cfg_string(sKexAlgorithms,
+ o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX);
+ dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ?
+ o->hostbased_key_types : KEX_DEFAULT_PK_ALG);
+ dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ?
+ o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
+ dump_cfg_string(sPubkeyAcceptedKeyTypes, o->pubkey_key_types ?
+ o->pubkey_key_types : KEX_DEFAULT_PK_ALG);
/* string arguments requiring a lookup */
dump_cfg_string(sLogLevel, log_level_name(o->log_level));
@@ -2047,7 +2375,7 @@
o->authorized_keys_files);
dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
o->host_key_files);
- dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files,
+ dump_cfg_strarray(sHostCertificate, o->num_host_cert_files,
o->host_cert_files);
dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
@@ -2075,7 +2403,7 @@
printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
printf("%s\n", iptos2str(o->ip_qos_bulk));
- printf("rekeylimit %lld %d\n", (long long)o->rekey_limit,
+ printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit,
o->rekey_interval);
channel_print_adm_permitted_opens();
Modified: trunk/crypto/openssh/servconf.h
===================================================================
--- trunk/crypto/openssh/servconf.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/servconf.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.112 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.120 2015/07/10 06:21:53 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -58,7 +58,9 @@
u_int num_ports;
u_int ports_from_cmdline;
int ports[MAX_PORTS]; /* Port number to listen on. */
- char *listen_addr; /* Address on which the server listens. */
+ u_int num_queued_listens;
+ char **queued_listen_addrs;
+ int *queued_listen_ports;
struct addrinfo *listen_addrs; /* Addresses on which the server listens. */
int address_family; /* Address family used by the server. */
char *host_key_files[MAX_HOSTKEYS]; /* Files containing host keys. */
@@ -83,6 +85,7 @@
int x11_use_localhost; /* If true, use localhost for fake X11 server. */
char *xauth_location; /* Location of xauth program */
int permit_tty; /* If false, deny pty allocation */
+ int permit_user_rc; /* If false, deny ~/.ssh/rc execution */
int strict_modes; /* If true, require string home dir modes. */
int tcp_keep_alive; /* If true, set SO_KEEPALIVE. */
int ip_qos_interactive; /* IP ToS/DSCP/class for interactive */
@@ -91,7 +94,7 @@
char *macs; /* Supported SSH2 macs. */
char *kex_algorithms; /* SSH2 kex methods in order of preference. */
int protocol; /* Supported protocol versions. */
- int gateway_ports; /* If true, allow remote connects to forwarded ports. */
+ struct ForwardOptions fwd_opts; /* forwarding options */
SyslogFacility log_facility; /* Facility for system logging. */
LogLevel log_level; /* Level for system logging. */
int rhosts_rsa_authentication; /* If true, permit rhosts RSA
@@ -98,8 +101,11 @@
* authentication. */
int hostbased_authentication; /* If true, permit ssh2 hostbased auth */
int hostbased_uses_name_from_packet_only; /* experimental */
+ char *hostbased_key_types; /* Key types allowed for hostbased */
+ char *hostkeyalgorithms; /* SSH2 server key types */
int rsa_authentication; /* If true, permit RSA authentication. */
int pubkey_authentication; /* If true, permit ssh2 pubkey authentication. */
+ char *pubkey_key_types; /* Key types allowed for public key */
int kerberos_authentication; /* If true, permit Kerberos
* authentication. */
int kerberos_or_local_passwd; /* If true, permit kerberos
@@ -113,6 +119,7 @@
* authenticated with Kerberos. */
int gss_authentication; /* If true, permit GSSAPI authentication */
int gss_cleanup_creds; /* If true, destroy cred cache on logout */
+ int gss_strict_acceptor; /* If true, restrict the GSSAPI acceptor name */
int password_authentication; /* If true, permit password
* authentication. */
int kbd_interactive_authentication; /* If true, permit */
@@ -123,6 +130,7 @@
int use_login; /* If true, login(1) is used */
int compression; /* If true, compression is allowed */
int allow_tcp_forwarding; /* One of FORWARD_* */
+ int allow_streamlocal_forwarding; /* One of FORWARD_* */
int allow_agent_forwarding;
u_int num_allow_users;
char *allow_users[MAX_ALLOW_USERS];
@@ -172,9 +180,11 @@
char *chroot_directory;
char *revoked_keys_file;
char *trusted_user_ca_keys;
- char *authorized_principals_file;
char *authorized_keys_command;
char *authorized_keys_command_user;
+ char *authorized_principals_file;
+ char *authorized_principals_command;
+ char *authorized_principals_command_user;
int64_t rekey_limit;
int rekey_interval;
@@ -183,6 +193,8 @@
u_int num_auth_methods;
char *auth_methods[MAX_AUTH_METHODS];
+
+ int fingerprint_hash;
} ServerOptions;
/* Information about the incoming connection as used by Match */
@@ -208,9 +220,13 @@
M_CP_STROPT(banner); \
M_CP_STROPT(trusted_user_ca_keys); \
M_CP_STROPT(revoked_keys_file); \
- M_CP_STROPT(authorized_principals_file); \
M_CP_STROPT(authorized_keys_command); \
M_CP_STROPT(authorized_keys_command_user); \
+ M_CP_STROPT(authorized_principals_file); \
+ M_CP_STROPT(authorized_principals_command); \
+ M_CP_STROPT(authorized_principals_command_user); \
+ M_CP_STROPT(hostbased_key_types); \
+ M_CP_STROPT(pubkey_key_types); \
M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \
M_CP_STRARRAYOPT(allow_users, num_allow_users); \
M_CP_STRARRAYOPT(deny_users, num_deny_users); \
Modified: trunk/crypto/openssh/serverloop.c
===================================================================
--- trunk/crypto/openssh/serverloop.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/serverloop.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: serverloop.c,v 1.170 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: serverloop.c,v 1.184 2016/03/07 19:02:43 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -37,8 +37,8 @@
#include "includes.h"
+#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
-#include <sys/param.h>
#include <sys/wait.h>
#include <sys/socket.h>
#ifdef HAVE_SYS_TIME_H
@@ -61,6 +61,7 @@
#include "packet.h"
#include "buffer.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "canohost.h"
#include "sshpty.h"
@@ -77,13 +78,11 @@
#include "dispatch.h"
#include "auth-options.h"
#include "serverloop.h"
-#include "misc.h"
-#include "roaming.h"
+#include "ssherr.h"
extern ServerOptions options;
/* XXX */
-extern Kex *xxx_kex;
extern Authctxt *the_authctxt;
extern int use_privsep;
@@ -277,7 +276,7 @@
*/
static void
wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
- u_int *nallocp, u_int64_t max_time_milliseconds)
+ u_int *nallocp, u_int64_t max_time_ms)
{
struct timeval tv, *tvp;
int ret;
@@ -289,9 +288,9 @@
channel_prepare_select(readsetp, writesetp, maxfdp, nallocp,
&minwait_secs, 0);
+ /* XXX need proper deadline system for rekey/client alive */
if (minwait_secs != 0)
- max_time_milliseconds = MIN(max_time_milliseconds,
- (u_int)minwait_secs * 1000);
+ max_time_ms = MIN(max_time_ms, (u_int)minwait_secs * 1000);
/*
* if using client_alive, set the max timeout accordingly,
@@ -301,11 +300,13 @@
* this could be randomized somewhat to make traffic
* analysis more difficult, but we're not doing it yet.
*/
- if (compat20 &&
- max_time_milliseconds == 0 && options.client_alive_interval) {
+ if (compat20 && options.client_alive_interval) {
+ uint64_t keepalive_ms =
+ (uint64_t)options.client_alive_interval * 1000;
+
client_alive_scheduled = 1;
- max_time_milliseconds =
- (u_int64_t)options.client_alive_interval * 1000;
+ if (max_time_ms == 0 || max_time_ms > keepalive_ms)
+ max_time_ms = keepalive_ms;
}
if (compat20) {
@@ -354,14 +355,14 @@
* from it, then read as much as is available and exit.
*/
if (child_terminated && packet_not_very_much_data_to_write())
- if (max_time_milliseconds == 0 || client_alive_scheduled)
- max_time_milliseconds = 100;
+ if (max_time_ms == 0 || client_alive_scheduled)
+ max_time_ms = 100;
- if (max_time_milliseconds == 0)
+ if (max_time_ms == 0)
tvp = NULL;
else {
- tv.tv_sec = max_time_milliseconds / 1000;
- tv.tv_usec = 1000 * (max_time_milliseconds % 1000);
+ tv.tv_sec = max_time_ms / 1000;
+ tv.tv_usec = 1000 * (max_time_ms % 1000);
tvp = &tv;
}
@@ -394,18 +395,16 @@
static void
process_input(fd_set *readset)
{
+ struct ssh *ssh = active_state; /* XXX */
int len;
char buf[16384];
/* Read and buffer any input data from the client. */
if (FD_ISSET(connection_in, readset)) {
- int cont = 0;
- len = roaming_read(connection_in, buf, sizeof(buf), &cont);
+ len = read(connection_in, buf, sizeof(buf));
if (len == 0) {
- if (cont)
- return;
- verbose("Connection closed by %.100s",
- get_remote_ipaddr());
+ verbose("Connection closed by %.100s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
connection_closed = 1;
if (compat20)
return;
@@ -414,8 +413,9 @@
if (errno != EINTR && errno != EAGAIN &&
errno != EWOULDBLOCK) {
verbose("Read error from remote host "
- "%.100s: %.100s",
- get_remote_ipaddr(), strerror(errno));
+ "%.100s port %d: %.100s",
+ ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh), strerror(errno));
cleanup_exit(255);
}
} else {
@@ -545,7 +545,7 @@
static void
process_buffered_input_packets(void)
{
- dispatch_run(DISPATCH_NONBLOCK, NULL, compat20 ? xxx_kex : NULL);
+ dispatch_run(DISPATCH_NONBLOCK, NULL, active_state);
}
/*
@@ -824,7 +824,7 @@
server_loop2(Authctxt *authctxt)
{
fd_set *readset = NULL, *writeset = NULL;
- int rekeying = 0, max_fd;
+ int max_fd;
u_int nalloc = 0;
u_int64_t rekey_timeout_ms = 0;
@@ -851,11 +851,11 @@
for (;;) {
process_buffered_input_packets();
- rekeying = (xxx_kex != NULL && !xxx_kex->done);
-
- if (!rekeying && packet_not_very_much_data_to_write())
+ if (!ssh_packet_is_rekeying(active_state) &&
+ packet_not_very_much_data_to_write())
channel_output_poll();
- if (options.rekey_interval > 0 && compat20 && !rekeying)
+ if (options.rekey_interval > 0 && compat20 &&
+ !ssh_packet_is_rekeying(active_state))
rekey_timeout_ms = packet_get_rekey_timeout() * 1000;
else
rekey_timeout_ms = 0;
@@ -870,14 +870,8 @@
}
collect_children();
- if (!rekeying) {
+ if (!ssh_packet_is_rekeying(active_state))
channel_after_select(readset, writeset);
- if (packet_need_rekeying()) {
- debug("need rekeying");
- xxx_kex->done = 0;
- kex_send_kexinit(xxx_kex);
- }
- }
process_input(readset);
if (connection_closed)
break;
@@ -895,7 +889,7 @@
session_destroy_all(NULL);
}
-static void
+static int
server_input_keep_alive(int type, u_int32_t seq, void *ctxt)
{
debug("Got %d/%u for keepalive", type, seq);
@@ -905,9 +899,10 @@
* the bogus CHANNEL_REQUEST we send for keepalives.
*/
packet_set_alive_timeouts(0);
+ return 0;
}
-static void
+static int
server_input_stdin_data(int type, u_int32_t seq, void *ctxt)
{
char *data;
@@ -916,15 +911,16 @@
/* Stdin data from the client. Append it to the buffer. */
/* Ignore any data if the client has closed stdin. */
if (fdin == -1)
- return;
+ return 0;
data = packet_get_string(&data_len);
packet_check_eom();
buffer_append(&stdin_buffer, data, data_len);
explicit_bzero(data, data_len);
free(data);
+ return 0;
}
-static void
+static int
server_input_eof(int type, u_int32_t seq, void *ctxt)
{
/*
@@ -935,9 +931,10 @@
debug("EOF received for stdin.");
packet_check_eom();
stdin_eof = 1;
+ return 0;
}
-static void
+static int
server_input_window_size(int type, u_int32_t seq, void *ctxt)
{
u_int row = packet_get_int();
@@ -949,6 +946,7 @@
packet_check_eom();
if (fdin != -1)
pty_change_window_size(fdin, row, col, xpixel, ypixel);
+ return 0;
}
static Channel *
@@ -970,7 +968,7 @@
/* XXX fine grained permissions */
if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0 &&
!no_port_forwarding_flag) {
- c = channel_connect_to(target, target_port,
+ c = channel_connect_to_port(target, target_port,
"direct-tcpip", "direct-tcpip");
} else {
logit("refused local port forward: "
@@ -985,6 +983,38 @@
}
static Channel *
+server_request_direct_streamlocal(void)
+{
+ Channel *c = NULL;
+ char *target, *originator;
+ u_short originator_port;
+
+ target = packet_get_string(NULL);
+ originator = packet_get_string(NULL);
+ originator_port = packet_get_int();
+ packet_check_eom();
+
+ debug("server_request_direct_streamlocal: originator %s port %d, target %s",
+ originator, originator_port, target);
+
+ /* XXX fine grained permissions */
+ if ((options.allow_streamlocal_forwarding & FORWARD_LOCAL) != 0 &&
+ !no_port_forwarding_flag) {
+ c = channel_connect_to_path(target,
+ "direct-streamlocal at openssh.com", "direct-streamlocal");
+ } else {
+ logit("refused streamlocal port forward: "
+ "originator %s port %d, target %s",
+ originator, originator_port, target);
+ }
+
+ free(originator);
+ free(target);
+
+ return c;
+}
+
+static Channel *
server_request_tun(void)
{
Channel *c = NULL;
@@ -1061,7 +1091,7 @@
return c;
}
-static void
+static int
server_input_channel_open(int type, u_int32_t seq, void *ctxt)
{
Channel *c = NULL;
@@ -1081,6 +1111,8 @@
c = server_request_session();
} else if (strcmp(ctype, "direct-tcpip") == 0) {
c = server_request_direct_tcpip();
+ } else if (strcmp(ctype, "direct-streamlocal at openssh.com") == 0) {
+ c = server_request_direct_streamlocal();
} else if (strcmp(ctype, "tun at openssh.com") == 0) {
c = server_request_tun();
}
@@ -1109,14 +1141,86 @@
packet_send();
}
free(ctype);
+ return 0;
}
-static void
+static int
+server_input_hostkeys_prove(struct sshbuf **respp)
+{
+ struct ssh *ssh = active_state; /* XXX */
+ struct sshbuf *resp = NULL;
+ struct sshbuf *sigbuf = NULL;
+ struct sshkey *key = NULL, *key_pub = NULL, *key_prv = NULL;
+ int r, ndx, success = 0;
+ const u_char *blob;
+ u_char *sig = 0;
+ size_t blen, slen;
+
+ if ((resp = sshbuf_new()) == NULL || (sigbuf = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new", __func__);
+
+ while (ssh_packet_remaining(ssh) > 0) {
+ sshkey_free(key);
+ key = NULL;
+ if ((r = sshpkt_get_string_direct(ssh, &blob, &blen)) != 0 ||
+ (r = sshkey_from_blob(blob, blen, &key)) != 0) {
+ error("%s: couldn't parse key: %s",
+ __func__, ssh_err(r));
+ goto out;
+ }
+ /*
+ * Better check that this is actually one of our hostkeys
+ * before attempting to sign anything with it.
+ */
+ if ((ndx = ssh->kex->host_key_index(key, 1, ssh)) == -1) {
+ error("%s: unknown host %s key",
+ __func__, sshkey_type(key));
+ goto out;
+ }
+ /*
+ * XXX refactor: make kex->sign just use an index rather
+ * than passing in public and private keys
+ */
+ if ((key_prv = get_hostkey_by_index(ndx)) == NULL &&
+ (key_pub = get_hostkey_public_by_index(ndx, ssh)) == NULL) {
+ error("%s: can't retrieve hostkey %d", __func__, ndx);
+ goto out;
+ }
+ sshbuf_reset(sigbuf);
+ free(sig);
+ sig = NULL;
+ if ((r = sshbuf_put_cstring(sigbuf,
+ "hostkeys-prove-00 at openssh.com")) != 0 ||
+ (r = sshbuf_put_string(sigbuf,
+ ssh->kex->session_id, ssh->kex->session_id_len)) != 0 ||
+ (r = sshkey_puts(key, sigbuf)) != 0 ||
+ (r = ssh->kex->sign(key_prv, key_pub, &sig, &slen,
+ sshbuf_ptr(sigbuf), sshbuf_len(sigbuf), NULL, 0)) != 0 ||
+ (r = sshbuf_put_string(resp, sig, slen)) != 0) {
+ error("%s: couldn't prepare signature: %s",
+ __func__, ssh_err(r));
+ goto out;
+ }
+ }
+ /* Success */
+ *respp = resp;
+ resp = NULL; /* don't free it */
+ success = 1;
+ out:
+ free(sig);
+ sshbuf_free(resp);
+ sshbuf_free(sigbuf);
+ sshkey_free(key);
+ return success;
+}
+
+static int
server_input_global_request(int type, u_int32_t seq, void *ctxt)
{
char *rtype;
int want_reply;
- int success = 0, allocated_listen_port = 0;
+ int r, success = 0, allocated_listen_port = 0;
+ struct sshbuf *resp = NULL;
rtype = packet_get_string(NULL);
want_reply = packet_get_char();
@@ -1125,63 +1229,97 @@
/* -R style forwarding */
if (strcmp(rtype, "tcpip-forward") == 0) {
struct passwd *pw;
- char *listen_address;
- u_short listen_port;
+ struct Forward fwd;
pw = the_authctxt->pw;
if (pw == NULL || !the_authctxt->valid)
fatal("server_input_global_request: no/invalid user");
- listen_address = packet_get_string(NULL);
- listen_port = (u_short)packet_get_int();
+ memset(&fwd, 0, sizeof(fwd));
+ fwd.listen_host = packet_get_string(NULL);
+ fwd.listen_port = (u_short)packet_get_int();
debug("server_input_global_request: tcpip-forward listen %s port %d",
- listen_address, listen_port);
+ fwd.listen_host, fwd.listen_port);
/* check permissions */
if ((options.allow_tcp_forwarding & FORWARD_REMOTE) == 0 ||
no_port_forwarding_flag ||
- (!want_reply && listen_port == 0)
-#ifndef NO_IPPORT_RESERVED_CONCEPT
- || (listen_port != 0 && listen_port < IPPORT_RESERVED &&
- pw->pw_uid != 0)
-#endif
- ) {
+ (!want_reply && fwd.listen_port == 0) ||
+ (fwd.listen_port != 0 && fwd.listen_port < IPPORT_RESERVED &&
+ pw->pw_uid != 0)) {
success = 0;
packet_send_debug("Server has disabled port forwarding.");
} else {
/* Start listening on the port */
- success = channel_setup_remote_fwd_listener(
- listen_address, listen_port,
- &allocated_listen_port, options.gateway_ports);
+ success = channel_setup_remote_fwd_listener(&fwd,
+ &allocated_listen_port, &options.fwd_opts);
}
- free(listen_address);
+ free(fwd.listen_host);
+ if ((resp = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new", __func__);
+ if (allocated_listen_port != 0 &&
+ (r = sshbuf_put_u32(resp, allocated_listen_port)) != 0)
+ fatal("%s: sshbuf_put_u32: %s", __func__, ssh_err(r));
} else if (strcmp(rtype, "cancel-tcpip-forward") == 0) {
- char *cancel_address;
- u_short cancel_port;
+ struct Forward fwd;
- cancel_address = packet_get_string(NULL);
- cancel_port = (u_short)packet_get_int();
+ memset(&fwd, 0, sizeof(fwd));
+ fwd.listen_host = packet_get_string(NULL);
+ fwd.listen_port = (u_short)packet_get_int();
debug("%s: cancel-tcpip-forward addr %s port %d", __func__,
- cancel_address, cancel_port);
+ fwd.listen_host, fwd.listen_port);
- success = channel_cancel_rport_listener(cancel_address,
- cancel_port);
- free(cancel_address);
+ success = channel_cancel_rport_listener(&fwd);
+ free(fwd.listen_host);
+ } else if (strcmp(rtype, "streamlocal-forward at openssh.com") == 0) {
+ struct Forward fwd;
+
+ memset(&fwd, 0, sizeof(fwd));
+ fwd.listen_path = packet_get_string(NULL);
+ debug("server_input_global_request: streamlocal-forward listen path %s",
+ fwd.listen_path);
+
+ /* check permissions */
+ if ((options.allow_streamlocal_forwarding & FORWARD_REMOTE) == 0
+ || no_port_forwarding_flag) {
+ success = 0;
+ packet_send_debug("Server has disabled port forwarding.");
+ } else {
+ /* Start listening on the socket */
+ success = channel_setup_remote_fwd_listener(
+ &fwd, NULL, &options.fwd_opts);
+ }
+ free(fwd.listen_path);
+ } else if (strcmp(rtype, "cancel-streamlocal-forward at openssh.com") == 0) {
+ struct Forward fwd;
+
+ memset(&fwd, 0, sizeof(fwd));
+ fwd.listen_path = packet_get_string(NULL);
+ debug("%s: cancel-streamlocal-forward path %s", __func__,
+ fwd.listen_path);
+
+ success = channel_cancel_rport_listener(&fwd);
+ free(fwd.listen_path);
} else if (strcmp(rtype, "no-more-sessions at openssh.com") == 0) {
no_more_sessions = 1;
success = 1;
+ } else if (strcmp(rtype, "hostkeys-prove-00 at openssh.com") == 0) {
+ success = server_input_hostkeys_prove(&resp);
}
if (want_reply) {
packet_start(success ?
SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
- if (success && allocated_listen_port > 0)
- packet_put_int(allocated_listen_port);
+ if (success && resp != NULL)
+ ssh_packet_put_raw(active_state, sshbuf_ptr(resp),
+ sshbuf_len(resp));
packet_send();
packet_write_wait();
}
free(rtype);
+ sshbuf_free(resp);
+ return 0;
}
-static void
+static int
server_input_channel_req(int type, u_int32_t seq, void *ctxt)
{
Channel *c;
@@ -1204,7 +1342,7 @@
} else if ((c->type == SSH_CHANNEL_LARVAL ||
c->type == SSH_CHANNEL_OPEN) && strcmp(c->ctype, "session") == 0)
success = session_input_channel_req(c, rtype);
- if (reply) {
+ if (reply && !(c->flags & CHAN_CLOSE_SENT)) {
packet_start(success ?
SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE);
packet_put_int(c->remote_id);
@@ -1211,6 +1349,7 @@
packet_send();
}
free(rtype);
+ return 0;
}
static void
Modified: trunk/crypto/openssh/session.c
===================================================================
--- trunk/crypto/openssh/session.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/session.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.270 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: session.c,v 1.282 2016/03/10 11:47:57 djm Exp $ */
/*
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
* All rights reserved
@@ -50,6 +50,7 @@
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
+#include <netdb.h>
#ifdef HAVE_PATHS_H
#include <paths.h>
#endif
@@ -60,6 +61,7 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
#include "openbsd-compat/sys-queue.h"
#include "xmalloc.h"
@@ -84,11 +86,11 @@
#include "authfd.h"
#include "pathnames.h"
#include "log.h"
+#include "misc.h"
#include "servconf.h"
#include "sshlogin.h"
#include "serverloop.h"
#include "canohost.h"
-#include "misc.h"
#include "session.h"
#include "kex.h"
#include "monitor_wrap.h"
@@ -159,6 +161,7 @@
#endif
static int is_child = 0;
+static int in_chroot = 0;
/* Name and directory of socket for authentication agent forwarding. */
static char *auth_sock_name = NULL;
@@ -183,7 +186,6 @@
{
Channel *nc;
int sock = -1;
- struct sockaddr_un sunaddr;
if (auth_sock_name != NULL) {
error("authentication forwarding requested twice.");
@@ -209,33 +211,15 @@
xasprintf(&auth_sock_name, "%s/agent.%ld",
auth_sock_dir, (long) getpid());
- /* Create the socket. */
- sock = socket(AF_UNIX, SOCK_STREAM, 0);
- if (sock < 0) {
- error("socket: %.100s", strerror(errno));
- restore_uid();
- goto authsock_err;
- }
+ /* Start a Unix listener on auth_sock_name. */
+ sock = unix_listener(auth_sock_name, SSH_LISTEN_BACKLOG, 0);
- /* Bind it to the name. */
- memset(&sunaddr, 0, sizeof(sunaddr));
- sunaddr.sun_family = AF_UNIX;
- strlcpy(sunaddr.sun_path, auth_sock_name, sizeof(sunaddr.sun_path));
-
- if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) {
- error("bind: %.100s", strerror(errno));
- restore_uid();
- goto authsock_err;
- }
-
/* Restore the privileged uid. */
restore_uid();
- /* Start listening on the socket. */
- if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
- error("listen: %.100s", strerror(errno));
+ /* Check for socket/bind/listen failure. */
+ if (sock < 0)
goto authsock_err;
- }
/* Allocate a channel for the authentication agent socket. */
nc = channel_new("auth socket",
@@ -274,6 +258,7 @@
setproctitle("%s", authctxt->pw->pw_name);
/* setup the channel layer */
+ /* XXX - streamlocal? */
if (no_port_forwarding_flag ||
(options.allow_tcp_forwarding & FORWARD_LOCAL) == 0)
channel_disable_adm_local_opens();
@@ -414,7 +399,7 @@
}
debug("Received TCP/IP port forwarding request.");
if (channel_input_port_forward_request(s->pw->pw_uid == 0,
- options.gateway_ports) < 0) {
+ &options.fwd_opts) < 0) {
debug("Port forwarding failed.");
break;
}
@@ -784,6 +769,7 @@
static void
do_pre_login(Session *s)
{
+ struct ssh *ssh = active_state; /* XXX */
socklen_t fromlen;
struct sockaddr_storage from;
pid_t pid = getpid();
@@ -803,7 +789,7 @@
}
record_utmp_only(pid, s->tty, s->pw->pw_name,
- get_remote_name_or_ip(utmp_len, options.use_dns),
+ session_get_remote_name_or_ip(ssh, utmp_len, options.use_dns),
(struct sockaddr *)&from, fromlen);
}
#endif
@@ -815,9 +801,10 @@
int
do_exec(Session *s, const char *command)
{
+ struct ssh *ssh = active_state; /* XXX */
int ret;
- const char *forced = NULL;
- char session_type[1024], *tty = NULL;
+ const char *forced = NULL, *tty = NULL;
+ char session_type[1024];
if (options.adm_forced_command) {
original_command = command;
@@ -852,13 +839,14 @@
tty += 5;
}
- verbose("Starting session: %s%s%s for %s from %.200s port %d",
+ verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
session_type,
tty == NULL ? "" : " on ",
tty == NULL ? "" : tty,
s->pw->pw_name,
- get_remote_ipaddr(),
- get_remote_port());
+ ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh),
+ s->self);
#ifdef SSH_AUDIT_EVENTS
if (command != NULL)
@@ -892,6 +880,7 @@
void
do_login(Session *s, const char *command)
{
+ struct ssh *ssh = active_state; /* XXX */
socklen_t fromlen;
struct sockaddr_storage from;
struct passwd * pw = s->pw;
@@ -914,7 +903,7 @@
/* Record that there was a login on that tty from the remote host. */
if (!use_privsep)
record_login(pid, s->tty, pw->pw_name, pw->pw_uid,
- get_remote_name_or_ip(utmp_len,
+ session_get_remote_name_or_ip(ssh, utmp_len,
options.use_dns),
(struct sockaddr *)&from, fromlen);
@@ -1035,7 +1024,7 @@
if (envsize >= 1000)
fatal("child_set_env: too many env vars");
envsize += 50;
- env = (*envp) = xrealloc(env, envsize, sizeof(char *));
+ env = (*envp) = xreallocarray(env, envsize, sizeof(char *));
*envsizep = envsize;
}
/* Need to set the NULL pointer at end of array beyond the new slot. */
@@ -1175,6 +1164,7 @@
static char **
do_setup_env(Session *s, const char *shell)
{
+ struct ssh *ssh = active_state; /* XXX */
char buf[256];
u_int i, envsize;
char **env, *laddr;
@@ -1276,12 +1266,14 @@
/* SSH_CLIENT deprecated */
snprintf(buf, sizeof buf, "%.50s %d %d",
- get_remote_ipaddr(), get_remote_port(), get_local_port());
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
+ ssh_local_port(ssh));
child_set_env(&env, &envsize, "SSH_CLIENT", buf);
laddr = get_local_ipaddr(packet_get_connection_in());
snprintf(buf, sizeof buf, "%.50s %d %.50s %d",
- get_remote_ipaddr(), get_remote_port(), laddr, get_local_port());
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
+ laddr, ssh_local_port(ssh));
free(laddr);
child_set_env(&env, &envsize, "SSH_CONNECTION", buf);
@@ -1331,7 +1323,7 @@
* Pull in any environment variables that may have
* been set by PAM.
*/
- if (options.use_pam) {
+ if (options.use_pam && !options.use_login) {
char **p;
p = fetch_pam_child_environment();
@@ -1380,7 +1372,8 @@
/* ignore _PATH_SSH_USER_RC for subsystems and admin forced commands */
if (!s->is_subsystem && options.adm_forced_command == NULL &&
- !no_user_rc && stat(_PATH_SSH_USER_RC, &st) >= 0) {
+ !no_user_rc && options.permit_user_rc &&
+ stat(_PATH_SSH_USER_RC, &st) >= 0) {
snprintf(cmd, sizeof cmd, "%s -c '%s %s'",
shell, _PATH_BSHELL, _PATH_SSH_USER_RC);
if (debug_flag)
@@ -1475,7 +1468,7 @@
safely_chroot(const char *path, uid_t uid)
{
const char *cp;
- char component[MAXPATHLEN];
+ char component[PATH_MAX];
struct stat st;
if (*path != '/')
@@ -1554,7 +1547,7 @@
platform_setusercontext_post_groups(pw);
- if (options.chroot_directory != NULL &&
+ if (!in_chroot && options.chroot_directory != NULL &&
strcasecmp(options.chroot_directory, "none") != 0) {
tmp = tilde_expand_filename(options.chroot_directory,
pw->pw_uid);
@@ -1566,6 +1559,7 @@
/* Make sure we don't attempt to chroot again */
free(options.chroot_directory);
options.chroot_directory = NULL;
+ in_chroot = 1;
}
#ifdef HAVE_LOGIN_CAP
@@ -1580,9 +1574,16 @@
(void) setusercontext(lc, pw, pw->pw_uid, LOGIN_SETUMASK);
#else
# ifdef USE_LIBIAF
- if (set_id(pw->pw_name) != 0) {
- fatal("set_id(%s) Failed", pw->pw_name);
- }
+ /*
+ * In a chroot environment, the set_id() will always fail;
+ * typically because of the lack of necessary authentication
+ * services and runtime such as ./usr/lib/libiaf.so,
+ * ./usr/lib/libpam.so.1, and ./etc/passwd We skip it in the
+ * internal sftp chroot case. We'll lose auditing and ACLs but
+ * permanently_set_uid will take care of the rest.
+ */
+ if (!in_chroot && set_id(pw->pw_name) != 0)
+ fatal("set_id(%s) Failed", pw->pw_name);
# endif /* USE_LIBIAF */
/* Permanently switch to the desired uid. */
permanently_set_uid(pw);
@@ -1645,11 +1646,11 @@
static void
child_close_fds(void)
{
- extern AuthenticationConnection *auth_conn;
+ extern int auth_sock;
- if (auth_conn) {
- ssh_close_authentication_connection(auth_conn);
- auth_conn = NULL;
+ if (auth_sock != -1) {
+ close(auth_sock);
+ auth_sock = -1;
}
if (packet_get_connection_in() == packet_get_connection_out())
@@ -1689,6 +1690,7 @@
void
do_child(Session *s, const char *command)
{
+ struct ssh *ssh = active_state; /* XXX */
extern char **environ;
char **env;
char *argv[ARGV_MAX];
@@ -1765,7 +1767,7 @@
/* we have to stash the hostname before we close our socket. */
if (options.use_login)
- hostname = get_remote_name_or_ip(utmp_len,
+ hostname = session_get_remote_name_or_ip(ssh, utmp_len,
options.use_dns);
/*
* Close the connection descriptors; note that this is the child, and
@@ -1772,7 +1774,7 @@
* the server will still have the socket open, and it is important
* that we do not shutdown it. Note that the descriptors cannot be
* closed before building the environment, as we call
- * get_remote_ipaddr there.
+ * ssh_remote_ipaddr there.
*/
child_close_fds();
@@ -1814,11 +1816,11 @@
#ifdef HAVE_LOGIN_CAP
r = login_getcapbool(lc, "requirehome", 0);
#endif
- if (r || options.chroot_directory == NULL ||
- strcasecmp(options.chroot_directory, "none") == 0)
+ if (r || !in_chroot) {
fprintf(stderr, "Could not chdir to home "
"directory %s: %s\n", pw->pw_dir,
strerror(errno));
+ }
if (r)
exit(1);
}
@@ -1938,7 +1940,7 @@
return NULL;
debug2("%s: allocate (allocated %d max %d)",
__func__, sessions_nalloc, options.max_sessions);
- tmp = xrealloc(sessions, sessions_nalloc + 1,
+ tmp = xreallocarray(sessions, sessions_nalloc + 1,
sizeof(*sessions));
if (tmp == NULL) {
error("%s: cannot allocate %d sessions",
@@ -2271,7 +2273,7 @@
for (i = 0; i < options.num_accept_env; i++) {
if (match_pattern(name, options.accept_env[i])) {
debug2("Setting env %d: %s=%s", s->num_env, name, val);
- s->env = xrealloc(s->env, s->num_env + 1,
+ s->env = xreallocarray(s->env, s->num_env + 1,
sizeof(*s->env));
s->env[s->num_env].name = name;
s->env[s->num_env].val = val;
@@ -2531,9 +2533,15 @@
void
session_close(Session *s)
{
+ struct ssh *ssh = active_state; /* XXX */
u_int i;
- debug("session_close: session %d pid %ld", s->self, (long)s->pid);
+ verbose("Close session: user %s from %.200s port %d id %d",
+ s->pw->pw_name,
+ ssh_remote_ipaddr(ssh),
+ ssh_remote_port(ssh),
+ s->self);
+
if (s->ttyfd != -1)
session_pty_cleanup(s);
free(s->term);
@@ -2668,7 +2676,7 @@
{
struct stat st;
char display[512], auth_display[512];
- char hostname[MAXHOSTNAMELEN];
+ char hostname[NI_MAXHOST];
u_int i;
if (no_x11_forwarding_flag) {
@@ -2679,7 +2687,7 @@
debug("X11 forwarding disabled in server configuration file.");
return 0;
}
- if (!options.xauth_location ||
+ if (options.xauth_location == NULL ||
(stat(options.xauth_location, &st) == -1)) {
packet_send_debug("No xauth program; cannot forward with spoofing.");
return 0;
@@ -2800,3 +2808,18 @@
if (!use_privsep || mm_is_monitor())
session_destroy_all(session_pty_cleanup2);
}
+
+/* Return a name for the remote host that fits inside utmp_size */
+
+const char *
+session_get_remote_name_or_ip(struct ssh *ssh, u_int utmp_size, int use_dns)
+{
+ const char *remote = "";
+
+ if (utmp_size > 0)
+ remote = auth_get_canonical_hostname(ssh, use_dns);
+ if (utmp_size == 0 || strlen(remote) > utmp_size)
+ remote = ssh_remote_ipaddr(ssh);
+ return remote;
+}
+
Modified: trunk/crypto/openssh/session.h
===================================================================
--- trunk/crypto/openssh/session.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/session.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.h,v 1.31 2013/10/14 21:20:52 djm Exp $ */
+/* $OpenBSD: session.h,v 1.32 2016/03/07 19:02:43 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -81,4 +81,6 @@
void child_set_env(char ***envp, u_int *envsizep, const char *name,
const char *value);
+const char *session_get_remote_name_or_ip(struct ssh *, u_int, int);
+
#endif
Modified: trunk/crypto/openssh/sftp-client.c
===================================================================
--- trunk/crypto/openssh/sftp-client.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-client.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-client.c,v 1.114 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: sftp-client.c,v 1.124 2016/05/25 23:48:45 schwarze Exp $ */
/*
* Copyright (c) 2001-2004 Damien Miller <djm at openbsd.org>
*
@@ -22,8 +22,8 @@
#include "includes.h"
+#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
-#include <sys/param.h>
#ifdef HAVE_SYS_STATVFS_H
#include <sys/statvfs.h>
#endif
@@ -47,11 +47,13 @@
#include <unistd.h>
#include "xmalloc.h"
-#include "buffer.h"
+#include "ssherr.h"
+#include "sshbuf.h"
#include "log.h"
#include "atomicio.h"
#include "progressmeter.h"
#include "misc.h"
+#include "utf8.h"
#include "sftp.h"
#include "sftp-common.h"
@@ -83,8 +85,8 @@
struct bwlimit bwlimit_in, bwlimit_out;
};
-static char *
-get_handle(struct sftp_conn *conn, u_int expected_id, u_int *len,
+static u_char *
+get_handle(struct sftp_conn *conn, u_int expected_id, size_t *len,
const char *errfmt, ...) __attribute__((format(printf, 4, 5)));
/* ARGSUSED */
@@ -98,36 +100,39 @@
}
static void
-send_msg(struct sftp_conn *conn, Buffer *m)
+send_msg(struct sftp_conn *conn, struct sshbuf *m)
{
u_char mlen[4];
struct iovec iov[2];
- if (buffer_len(m) > SFTP_MAX_MSG_LENGTH)
- fatal("Outbound message too long %u", buffer_len(m));
+ if (sshbuf_len(m) > SFTP_MAX_MSG_LENGTH)
+ fatal("Outbound message too long %zu", sshbuf_len(m));
/* Send length first */
- put_u32(mlen, buffer_len(m));
+ put_u32(mlen, sshbuf_len(m));
iov[0].iov_base = mlen;
iov[0].iov_len = sizeof(mlen);
- iov[1].iov_base = buffer_ptr(m);
- iov[1].iov_len = buffer_len(m);
+ iov[1].iov_base = (u_char *)sshbuf_ptr(m);
+ iov[1].iov_len = sshbuf_len(m);
if (atomiciov6(writev, conn->fd_out, iov, 2,
conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) !=
- buffer_len(m) + sizeof(mlen))
+ sshbuf_len(m) + sizeof(mlen))
fatal("Couldn't send packet: %s", strerror(errno));
- buffer_clear(m);
+ sshbuf_reset(m);
}
static void
-get_msg(struct sftp_conn *conn, Buffer *m)
+get_msg(struct sftp_conn *conn, struct sshbuf *m)
{
u_int msg_len;
+ u_char *p;
+ int r;
- buffer_append_space(m, 4);
- if (atomicio6(read, conn->fd_in, buffer_ptr(m), 4,
+ if ((r = sshbuf_reserve(m, 4, &p)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (atomicio6(read, conn->fd_in, p, 4,
conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) {
if (errno == EPIPE)
fatal("Connection closed");
@@ -135,12 +140,14 @@
fatal("Couldn't read packet: %s", strerror(errno));
}
- msg_len = buffer_get_int(m);
+ if ((r = sshbuf_get_u32(m, &msg_len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (msg_len > SFTP_MAX_MSG_LENGTH)
fatal("Received message too long %u", msg_len);
- buffer_append_space(m, msg_len);
- if (atomicio6(read, conn->fd_in, buffer_ptr(m), msg_len,
+ if ((r = sshbuf_reserve(m, msg_len, &p)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (atomicio6(read, conn->fd_in, p, msg_len,
conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in)
!= msg_len) {
if (errno == EPIPE)
@@ -151,46 +158,56 @@
}
static void
-send_string_request(struct sftp_conn *conn, u_int id, u_int code, char *s,
+send_string_request(struct sftp_conn *conn, u_int id, u_int code, const char *s,
u_int len)
{
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
- buffer_init(&msg);
- buffer_put_char(&msg, code);
- buffer_put_int(&msg, id);
- buffer_put_string(&msg, s, len);
- send_msg(conn, &msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, code)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_string(msg, s, len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message fd %d T:%u I:%u", conn->fd_out, code, id);
- buffer_free(&msg);
+ sshbuf_free(msg);
}
static void
send_string_attrs_request(struct sftp_conn *conn, u_int id, u_int code,
- char *s, u_int len, Attrib *a)
+ const void *s, u_int len, Attrib *a)
{
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
- buffer_init(&msg);
- buffer_put_char(&msg, code);
- buffer_put_int(&msg, id);
- buffer_put_string(&msg, s, len);
- encode_attrib(&msg, a);
- send_msg(conn, &msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, code)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_string(msg, s, len)) != 0 ||
+ (r = encode_attrib(msg, a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message fd %d T:%u I:%u", conn->fd_out, code, id);
- buffer_free(&msg);
+ sshbuf_free(msg);
}
static u_int
get_status(struct sftp_conn *conn, u_int expected_id)
{
- Buffer msg;
- u_int type, id, status;
+ struct sshbuf *msg;
+ u_char type;
+ u_int id, status;
+ int r;
- buffer_init(&msg);
- get_msg(conn, &msg);
- type = buffer_get_char(&msg);
- id = buffer_get_int(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ get_msg(conn, msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (id != expected_id)
fatal("ID mismatch (%u != %u)", id, expected_id);
@@ -198,8 +215,9 @@
fatal("Expected SSH2_FXP_STATUS(%u) packet, got %u",
SSH2_FXP_STATUS, type);
- status = buffer_get_int(&msg);
- buffer_free(&msg);
+ if ((r = sshbuf_get_u32(msg, &status)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ sshbuf_free(msg);
debug3("SSH2_FXP_STATUS %u", status);
@@ -206,15 +224,17 @@
return status;
}
-static char *
-get_handle(struct sftp_conn *conn, u_int expected_id, u_int *len,
+static u_char *
+get_handle(struct sftp_conn *conn, u_int expected_id, size_t *len,
const char *errfmt, ...)
{
- Buffer msg;
- u_int type, id;
- char *handle, errmsg[256];
+ struct sshbuf *msg;
+ u_int id, status;
+ u_char type;
+ u_char *handle;
+ char errmsg[256];
va_list args;
- int status;
+ int r;
va_start(args, errfmt);
if (errfmt != NULL)
@@ -221,63 +241,77 @@
vsnprintf(errmsg, sizeof(errmsg), errfmt, args);
va_end(args);
- buffer_init(&msg);
- get_msg(conn, &msg);
- type = buffer_get_char(&msg);
- id = buffer_get_int(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ get_msg(conn, msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (id != expected_id)
fatal("%s: ID mismatch (%u != %u)",
errfmt == NULL ? __func__ : errmsg, id, expected_id);
if (type == SSH2_FXP_STATUS) {
- status = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u32(msg, &status)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (errfmt != NULL)
error("%s: %s", errmsg, fx2txt(status));
- buffer_free(&msg);
+ sshbuf_free(msg);
return(NULL);
} else if (type != SSH2_FXP_HANDLE)
fatal("%s: Expected SSH2_FXP_HANDLE(%u) packet, got %u",
errfmt == NULL ? __func__ : errmsg, SSH2_FXP_HANDLE, type);
- handle = buffer_get_string(&msg, len);
- buffer_free(&msg);
+ if ((r = sshbuf_get_string(msg, &handle, len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ sshbuf_free(msg);
- return(handle);
+ return handle;
}
static Attrib *
get_decode_stat(struct sftp_conn *conn, u_int expected_id, int quiet)
{
- Buffer msg;
- u_int type, id;
- Attrib *a;
+ struct sshbuf *msg;
+ u_int id;
+ u_char type;
+ int r;
+ static Attrib a;
- buffer_init(&msg);
- get_msg(conn, &msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ get_msg(conn, msg);
- type = buffer_get_char(&msg);
- id = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug3("Received stat reply T:%u I:%u", type, id);
if (id != expected_id)
fatal("ID mismatch (%u != %u)", id, expected_id);
if (type == SSH2_FXP_STATUS) {
- int status = buffer_get_int(&msg);
+ u_int status;
+ if ((r = sshbuf_get_u32(msg, &status)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (quiet)
debug("Couldn't stat remote file: %s", fx2txt(status));
else
error("Couldn't stat remote file: %s", fx2txt(status));
- buffer_free(&msg);
+ sshbuf_free(msg);
return(NULL);
} else if (type != SSH2_FXP_ATTRS) {
fatal("Expected SSH2_FXP_ATTRS(%u) packet, got %u",
SSH2_FXP_ATTRS, type);
}
- a = decode_attrib(&msg);
- buffer_free(&msg);
+ if ((r = decode_attrib(msg, &a)) != 0) {
+ error("%s: couldn't decode attrib: %s", __func__, ssh_err(r));
+ sshbuf_free(msg);
+ return NULL;
+ }
+ sshbuf_free(msg);
- return(a);
+ return &a;
}
static int
@@ -284,26 +318,33 @@
get_decode_statvfs(struct sftp_conn *conn, struct sftp_statvfs *st,
u_int expected_id, int quiet)
{
- Buffer msg;
- u_int type, id, flag;
+ struct sshbuf *msg;
+ u_char type;
+ u_int id;
+ u_int64_t flag;
+ int r;
- buffer_init(&msg);
- get_msg(conn, &msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ get_msg(conn, msg);
- type = buffer_get_char(&msg);
- id = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug3("Received statvfs reply T:%u I:%u", type, id);
if (id != expected_id)
fatal("ID mismatch (%u != %u)", id, expected_id);
if (type == SSH2_FXP_STATUS) {
- int status = buffer_get_int(&msg);
+ u_int status;
+ if ((r = sshbuf_get_u32(msg, &status)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (quiet)
debug("Couldn't statvfs: %s", fx2txt(status));
else
error("Couldn't statvfs: %s", fx2txt(status));
- buffer_free(&msg);
+ sshbuf_free(msg);
return -1;
} else if (type != SSH2_FXP_EXTENDED_REPLY) {
fatal("Expected SSH2_FXP_EXTENDED_REPLY(%u) packet, got %u",
@@ -311,22 +352,23 @@
}
memset(st, 0, sizeof(*st));
- st->f_bsize = buffer_get_int64(&msg);
- st->f_frsize = buffer_get_int64(&msg);
- st->f_blocks = buffer_get_int64(&msg);
- st->f_bfree = buffer_get_int64(&msg);
- st->f_bavail = buffer_get_int64(&msg);
- st->f_files = buffer_get_int64(&msg);
- st->f_ffree = buffer_get_int64(&msg);
- st->f_favail = buffer_get_int64(&msg);
- st->f_fsid = buffer_get_int64(&msg);
- flag = buffer_get_int64(&msg);
- st->f_namemax = buffer_get_int64(&msg);
+ if ((r = sshbuf_get_u64(msg, &st->f_bsize)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_frsize)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_blocks)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_bfree)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_bavail)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_files)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_ffree)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_favail)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_fsid)) != 0 ||
+ (r = sshbuf_get_u64(msg, &flag)) != 0 ||
+ (r = sshbuf_get_u64(msg, &st->f_namemax)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
st->f_flag = (flag & SSH2_FXE_STATVFS_ST_RDONLY) ? ST_RDONLY : 0;
st->f_flag |= (flag & SSH2_FXE_STATVFS_ST_NOSUID) ? ST_NOSUID : 0;
- buffer_free(&msg);
+ sshbuf_free(msg);
return 0;
}
@@ -335,9 +377,10 @@
do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests,
u_int64_t limit_kbps)
{
- u_int type;
- Buffer msg;
+ u_char type;
+ struct sshbuf *msg;
struct sftp_conn *ret;
+ int r;
ret = xcalloc(1, sizeof(*ret));
ret->msg_id = 1;
@@ -348,52 +391,62 @@
ret->exts = 0;
ret->limit_kbps = 0;
- buffer_init(&msg);
- buffer_put_char(&msg, SSH2_FXP_INIT);
- buffer_put_int(&msg, SSH2_FILEXFER_VERSION);
- send_msg(ret, &msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_INIT)) != 0 ||
+ (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(ret, msg);
- buffer_clear(&msg);
+ sshbuf_reset(msg);
- get_msg(ret, &msg);
+ get_msg(ret, msg);
/* Expecting a VERSION reply */
- if ((type = buffer_get_char(&msg)) != SSH2_FXP_VERSION) {
+ if ((r = sshbuf_get_u8(msg, &type)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (type != SSH2_FXP_VERSION) {
error("Invalid packet back from SSH2_FXP_INIT (type %u)",
type);
- buffer_free(&msg);
+ sshbuf_free(msg);
+ free(ret);
return(NULL);
}
- ret->version = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u32(msg, &ret->version)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug2("Remote version: %u", ret->version);
/* Check for extensions */
- while (buffer_len(&msg) > 0) {
- char *name = buffer_get_string(&msg, NULL);
- char *value = buffer_get_string(&msg, NULL);
+ while (sshbuf_len(msg) > 0) {
+ char *name;
+ u_char *value;
+ size_t vlen;
int known = 0;
+ if ((r = sshbuf_get_cstring(msg, &name, NULL)) != 0 ||
+ (r = sshbuf_get_string(msg, &value, &vlen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (strcmp(name, "posix-rename at openssh.com") == 0 &&
- strcmp(value, "1") == 0) {
+ strcmp((char *)value, "1") == 0) {
ret->exts |= SFTP_EXT_POSIX_RENAME;
known = 1;
} else if (strcmp(name, "statvfs at openssh.com") == 0 &&
- strcmp(value, "2") == 0) {
+ strcmp((char *)value, "2") == 0) {
ret->exts |= SFTP_EXT_STATVFS;
known = 1;
} else if (strcmp(name, "fstatvfs at openssh.com") == 0 &&
- strcmp(value, "2") == 0) {
+ strcmp((char *)value, "2") == 0) {
ret->exts |= SFTP_EXT_FSTATVFS;
known = 1;
} else if (strcmp(name, "hardlink at openssh.com") == 0 &&
- strcmp(value, "1") == 0) {
+ strcmp((char *)value, "1") == 0) {
ret->exts |= SFTP_EXT_HARDLINK;
known = 1;
- } else if (strcmp(name, "fsync at openssh.com") == 0 &&
- strcmp(value, "1") == 0) {
- ret->exts |= SFTP_EXT_FSYNC;
- known = 1;
+ } else if (strcmp(name, "fsync at openssh.com") == 0 &&
+ strcmp((char *)value, "1") == 0) {
+ ret->exts |= SFTP_EXT_FSYNC;
+ known = 1;
}
if (known) {
debug2("Server supports extension \"%s\" revision %s",
@@ -405,7 +458,7 @@
free(value);
}
- buffer_free(&msg);
+ sshbuf_free(msg);
/* Some filexfer v.0 servers don't support large packets */
if (ret->version == 0)
@@ -429,18 +482,21 @@
}
int
-do_close(struct sftp_conn *conn, char *handle, u_int handle_len)
+do_close(struct sftp_conn *conn, const u_char *handle, u_int handle_len)
{
u_int id, status;
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
id = conn->msg_id++;
- buffer_put_char(&msg, SSH2_FXP_CLOSE);
- buffer_put_int(&msg, id);
- buffer_put_string(&msg, handle, handle_len);
- send_msg(conn, &msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_CLOSE)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message SSH2_FXP_CLOSE I:%u", id);
status = get_status(conn, id);
@@ -447,20 +503,22 @@
if (status != SSH2_FX_OK)
error("Couldn't close file: %s", fx2txt(status));
- buffer_free(&msg);
+ sshbuf_free(msg);
- return status;
+ return status == SSH2_FX_OK ? 0 : -1;
}
static int
-do_lsreaddir(struct sftp_conn *conn, char *path, int print_flag,
+do_lsreaddir(struct sftp_conn *conn, const char *path, int print_flag,
SFTP_DIRENT ***dir)
{
- Buffer msg;
- u_int count, type, id, handle_len, i, expected_id, ents = 0;
- char *handle;
+ struct sshbuf *msg;
+ u_int count, id, i, expected_id, ents = 0;
+ size_t handle_len;
+ u_char type, *handle;
int status = SSH2_FX_FAILURE;
+ int r;
if (dir)
*dir = NULL;
@@ -467,16 +525,18 @@
id = conn->msg_id++;
- buffer_init(&msg);
- buffer_put_char(&msg, SSH2_FXP_OPENDIR);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, path);
- send_msg(conn, &msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPENDIR)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, path)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
handle = get_handle(conn, id, &handle_len,
"remote readdir(\"%s\")", path);
if (handle == NULL) {
- buffer_free(&msg);
+ sshbuf_free(msg);
return -1;
}
@@ -491,18 +551,20 @@
debug3("Sending SSH2_FXP_READDIR I:%u", id);
- buffer_clear(&msg);
- buffer_put_char(&msg, SSH2_FXP_READDIR);
- buffer_put_int(&msg, id);
- buffer_put_string(&msg, handle, handle_len);
- send_msg(conn, &msg);
+ sshbuf_reset(msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_READDIR)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
- buffer_clear(&msg);
+ sshbuf_reset(msg);
- get_msg(conn, &msg);
+ get_msg(conn, msg);
- type = buffer_get_char(&msg);
- id = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug3("Received reply T:%u I:%u", type, id);
@@ -510,30 +572,46 @@
fatal("ID mismatch (%u != %u)", id, expected_id);
if (type == SSH2_FXP_STATUS) {
- status = buffer_get_int(&msg);
- debug3("Received SSH2_FXP_STATUS %d", status);
- if (status == SSH2_FX_EOF)
+ u_int rstatus;
+
+ if ((r = sshbuf_get_u32(msg, &rstatus)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
+ debug3("Received SSH2_FXP_STATUS %d", rstatus);
+ if (rstatus == SSH2_FX_EOF)
break;
- error("Couldn't read directory: %s", fx2txt(status));
+ error("Couldn't read directory: %s", fx2txt(rstatus));
goto out;
} else if (type != SSH2_FXP_NAME)
fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
SSH2_FXP_NAME, type);
- count = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u32(msg, &count)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (count == 0)
break;
debug3("Received %d SSH2_FXP_NAME responses", count);
for (i = 0; i < count; i++) {
char *filename, *longname;
- Attrib *a;
+ Attrib a;
- filename = buffer_get_string(&msg, NULL);
- longname = buffer_get_string(&msg, NULL);
- a = decode_attrib(&msg);
+ if ((r = sshbuf_get_cstring(msg, &filename,
+ NULL)) != 0 ||
+ (r = sshbuf_get_cstring(msg, &longname,
+ NULL)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
+ if ((r = decode_attrib(msg, &a)) != 0) {
+ error("%s: couldn't decode attrib: %s",
+ __func__, ssh_err(r));
+ free(filename);
+ free(longname);
+ sshbuf_free(msg);
+ return -1;
+ }
if (print_flag)
- printf("%s\n", longname);
+ mprintf("%s\n", longname);
/*
* Directory entries should never contain '/'
@@ -544,11 +622,11 @@
error("Server sent suspect path \"%s\" "
"during readdir of \"%s\"", filename, path);
} else if (dir) {
- *dir = xrealloc(*dir, ents + 2, sizeof(**dir));
+ *dir = xreallocarray(*dir, ents + 2, sizeof(**dir));
(*dir)[ents] = xcalloc(1, sizeof(***dir));
(*dir)[ents]->filename = xstrdup(filename);
(*dir)[ents]->longname = xstrdup(longname);
- memcpy(&(*dir)[ents]->a, a, sizeof(*a));
+ memcpy(&(*dir)[ents]->a, &a, sizeof(a));
(*dir)[++ents] = NULL;
}
free(filename);
@@ -558,7 +636,7 @@
status = 0;
out:
- buffer_free(&msg);
+ sshbuf_free(msg);
do_close(conn, handle, handle_len);
free(handle);
@@ -577,7 +655,7 @@
}
int
-do_readdir(struct sftp_conn *conn, char *path, SFTP_DIRENT ***dir)
+do_readdir(struct sftp_conn *conn, const char *path, SFTP_DIRENT ***dir)
{
return(do_lsreaddir(conn, path, 0, dir));
}
@@ -597,7 +675,7 @@
}
int
-do_rm(struct sftp_conn *conn, char *path)
+do_rm(struct sftp_conn *conn, const char *path)
{
u_int status, id;
@@ -608,11 +686,11 @@
status = get_status(conn, id);
if (status != SSH2_FX_OK)
error("Couldn't delete file: %s", fx2txt(status));
- return(status);
+ return status == SSH2_FX_OK ? 0 : -1;
}
int
-do_mkdir(struct sftp_conn *conn, char *path, Attrib *a, int print_flag)
+do_mkdir(struct sftp_conn *conn, const char *path, Attrib *a, int print_flag)
{
u_int status, id;
@@ -624,11 +702,11 @@
if (status != SSH2_FX_OK && print_flag)
error("Couldn't create directory: %s", fx2txt(status));
- return(status);
+ return status == SSH2_FX_OK ? 0 : -1;
}
int
-do_rmdir(struct sftp_conn *conn, char *path)
+do_rmdir(struct sftp_conn *conn, const char *path)
{
u_int status, id;
@@ -640,11 +718,11 @@
if (status != SSH2_FX_OK)
error("Couldn't remove directory: %s", fx2txt(status));
- return(status);
+ return status == SSH2_FX_OK ? 0 : -1;
}
Attrib *
-do_stat(struct sftp_conn *conn, char *path, int quiet)
+do_stat(struct sftp_conn *conn, const char *path, int quiet)
{
u_int id;
@@ -658,7 +736,7 @@
}
Attrib *
-do_lstat(struct sftp_conn *conn, char *path, int quiet)
+do_lstat(struct sftp_conn *conn, const char *path, int quiet)
{
u_int id;
@@ -679,7 +757,8 @@
#ifdef notyet
Attrib *
-do_fstat(struct sftp_conn *conn, char *handle, u_int handle_len, int quiet)
+do_fstat(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
+ int quiet)
{
u_int id;
@@ -692,7 +771,7 @@
#endif
int
-do_setstat(struct sftp_conn *conn, char *path, Attrib *a)
+do_setstat(struct sftp_conn *conn, const char *path, Attrib *a)
{
u_int status, id;
@@ -705,11 +784,11 @@
error("Couldn't setstat on \"%s\": %s", path,
fx2txt(status));
- return(status);
+ return status == SSH2_FX_OK ? 0 : -1;
}
int
-do_fsetstat(struct sftp_conn *conn, char *handle, u_int handle_len,
+do_fsetstat(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
Attrib *a)
{
u_int status, id;
@@ -722,85 +801,98 @@
if (status != SSH2_FX_OK)
error("Couldn't fsetstat: %s", fx2txt(status));
- return(status);
+ return status == SSH2_FX_OK ? 0 : -1;
}
char *
-do_realpath(struct sftp_conn *conn, char *path)
+do_realpath(struct sftp_conn *conn, const char *path)
{
- Buffer msg;
- u_int type, expected_id, count, id;
+ struct sshbuf *msg;
+ u_int expected_id, count, id;
char *filename, *longname;
- Attrib *a;
+ Attrib a;
+ u_char type;
+ int r;
expected_id = id = conn->msg_id++;
send_string_request(conn, id, SSH2_FXP_REALPATH, path,
strlen(path));
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
- get_msg(conn, &msg);
- type = buffer_get_char(&msg);
- id = buffer_get_int(&msg);
+ get_msg(conn, msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (id != expected_id)
fatal("ID mismatch (%u != %u)", id, expected_id);
if (type == SSH2_FXP_STATUS) {
- u_int status = buffer_get_int(&msg);
+ u_int status;
+ if ((r = sshbuf_get_u32(msg, &status)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
error("Couldn't canonicalize: %s", fx2txt(status));
- buffer_free(&msg);
+ sshbuf_free(msg);
return NULL;
} else if (type != SSH2_FXP_NAME)
fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
SSH2_FXP_NAME, type);
- count = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u32(msg, &count)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (count != 1)
fatal("Got multiple names (%d) from SSH_FXP_REALPATH", count);
- filename = buffer_get_string(&msg, NULL);
- longname = buffer_get_string(&msg, NULL);
- a = decode_attrib(&msg);
+ if ((r = sshbuf_get_cstring(msg, &filename, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(msg, &longname, NULL)) != 0 ||
+ (r = decode_attrib(msg, &a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug3("SSH_FXP_REALPATH %s -> %s size %lu", path, filename,
- (unsigned long)a->size);
+ (unsigned long)a.size);
free(longname);
- buffer_free(&msg);
+ sshbuf_free(msg);
return(filename);
}
int
-do_rename(struct sftp_conn *conn, char *oldpath, char *newpath,
+do_rename(struct sftp_conn *conn, const char *oldpath, const char *newpath,
int force_legacy)
{
- Buffer msg;
+ struct sshbuf *msg;
u_int status, id;
- int use_ext = (conn->exts & SFTP_EXT_POSIX_RENAME) && !force_legacy;
+ int r, use_ext = (conn->exts & SFTP_EXT_POSIX_RENAME) && !force_legacy;
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
/* Send rename request */
id = conn->msg_id++;
if (use_ext) {
- buffer_put_char(&msg, SSH2_FXP_EXTENDED);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, "posix-rename at openssh.com");
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg,
+ "posix-rename at openssh.com")) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
} else {
- buffer_put_char(&msg, SSH2_FXP_RENAME);
- buffer_put_int(&msg, id);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_RENAME)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
}
- buffer_put_cstring(&msg, oldpath);
- buffer_put_cstring(&msg, newpath);
- send_msg(conn, &msg);
+ if ((r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
+ (r = sshbuf_put_cstring(msg, newpath)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message %s \"%s\" -> \"%s\"",
- use_ext ? "posix-rename at openssh.com" : "SSH2_FXP_RENAME",
- oldpath, newpath);
- buffer_free(&msg);
+ use_ext ? "posix-rename at openssh.com" :
+ "SSH2_FXP_RENAME", oldpath, newpath);
+ sshbuf_free(msg);
status = get_status(conn, id);
if (status != SSH2_FX_OK)
@@ -807,14 +899,15 @@
error("Couldn't rename file \"%s\" to \"%s\": %s", oldpath,
newpath, fx2txt(status));
- return(status);
+ return status == SSH2_FX_OK ? 0 : -1;
}
int
-do_hardlink(struct sftp_conn *conn, char *oldpath, char *newpath)
+do_hardlink(struct sftp_conn *conn, const char *oldpath, const char *newpath)
{
- Buffer msg;
+ struct sshbuf *msg;
u_int status, id;
+ int r;
if ((conn->exts & SFTP_EXT_HARDLINK) == 0) {
error("Server does not support hardlink at openssh.com extension");
@@ -821,19 +914,21 @@
return -1;
}
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
/* Send link request */
id = conn->msg_id++;
- buffer_put_char(&msg, SSH2_FXP_EXTENDED);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, "hardlink at openssh.com");
- buffer_put_cstring(&msg, oldpath);
- buffer_put_cstring(&msg, newpath);
- send_msg(conn, &msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, "hardlink at openssh.com")) != 0 ||
+ (r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
+ (r = sshbuf_put_cstring(msg, newpath)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message hardlink at openssh.com \"%s\" -> \"%s\"",
oldpath, newpath);
- buffer_free(&msg);
+ sshbuf_free(msg);
status = get_status(conn, id);
if (status != SSH2_FX_OK)
@@ -840,14 +935,15 @@
error("Couldn't link file \"%s\" to \"%s\": %s", oldpath,
newpath, fx2txt(status));
- return(status);
+ return status == SSH2_FX_OK ? 0 : -1;
}
int
-do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath)
+do_symlink(struct sftp_conn *conn, const char *oldpath, const char *newpath)
{
- Buffer msg;
+ struct sshbuf *msg;
u_int status, id;
+ int r;
if (conn->version < 3) {
error("This server does not support the symlink operation");
@@ -854,18 +950,20 @@
return(SSH2_FX_OP_UNSUPPORTED);
}
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
/* Send symlink request */
id = conn->msg_id++;
- buffer_put_char(&msg, SSH2_FXP_SYMLINK);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, oldpath);
- buffer_put_cstring(&msg, newpath);
- send_msg(conn, &msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_SYMLINK)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
+ (r = sshbuf_put_cstring(msg, newpath)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message SSH2_FXP_SYMLINK \"%s\" -> \"%s\"", oldpath,
newpath);
- buffer_free(&msg);
+ sshbuf_free(msg);
status = get_status(conn, id);
if (status != SSH2_FX_OK)
@@ -872,31 +970,32 @@
error("Couldn't symlink file \"%s\" to \"%s\": %s", oldpath,
newpath, fx2txt(status));
- return(status);
+ return status == SSH2_FX_OK ? 0 : -1;
}
int
-do_fsync(struct sftp_conn *conn, char *handle, u_int handle_len)
+do_fsync(struct sftp_conn *conn, u_char *handle, u_int handle_len)
{
- Buffer msg;
+ struct sshbuf *msg;
u_int status, id;
+ int r;
/* Silently return if the extension is not supported */
if ((conn->exts & SFTP_EXT_FSYNC) == 0)
return -1;
- buffer_init(&msg);
-
/* Send fsync request */
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
id = conn->msg_id++;
-
- buffer_put_char(&msg, SSH2_FXP_EXTENDED);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, "fsync at openssh.com");
- buffer_put_string(&msg, handle, handle_len);
- send_msg(conn, &msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, "fsync at openssh.com")) != 0 ||
+ (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message fsync at openssh.com I:%u", id);
- buffer_free(&msg);
+ sshbuf_free(msg);
status = get_status(conn, id);
if (status != SSH2_FX_OK)
@@ -907,50 +1006,58 @@
#ifdef notyet
char *
-do_readlink(struct sftp_conn *conn, char *path)
+do_readlink(struct sftp_conn *conn, const char *path)
{
- Buffer msg;
- u_int type, expected_id, count, id;
+ struct sshbuf *msg;
+ u_int expected_id, count, id;
char *filename, *longname;
- Attrib *a;
+ Attrib a;
+ u_char type;
+ int r;
expected_id = id = conn->msg_id++;
send_string_request(conn, id, SSH2_FXP_READLINK, path, strlen(path));
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
- get_msg(conn, &msg);
- type = buffer_get_char(&msg);
- id = buffer_get_int(&msg);
+ get_msg(conn, msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (id != expected_id)
fatal("ID mismatch (%u != %u)", id, expected_id);
if (type == SSH2_FXP_STATUS) {
- u_int status = buffer_get_int(&msg);
+ u_int status;
+ if ((r = sshbuf_get_u32(msg, &status)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
error("Couldn't readlink: %s", fx2txt(status));
- buffer_free(&msg);
+ sshbuf_free(msg);
return(NULL);
} else if (type != SSH2_FXP_NAME)
fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
SSH2_FXP_NAME, type);
- count = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u32(msg, &count)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (count != 1)
fatal("Got multiple names (%d) from SSH_FXP_READLINK", count);
- filename = buffer_get_string(&msg, NULL);
- longname = buffer_get_string(&msg, NULL);
- a = decode_attrib(&msg);
+ if ((r = sshbuf_get_cstring(msg, &filename, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(msg, &longname, NULL)) != 0 ||
+ (r = decode_attrib(msg, &a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug3("SSH_FXP_READLINK %s -> %s", path, filename);
free(longname);
- buffer_free(&msg);
+ sshbuf_free(msg);
- return(filename);
+ return filename;
}
#endif
@@ -958,8 +1065,9 @@
do_statvfs(struct sftp_conn *conn, const char *path, struct sftp_statvfs *st,
int quiet)
{
- Buffer msg;
+ struct sshbuf *msg;
u_int id;
+ int r;
if ((conn->exts & SFTP_EXT_STATVFS) == 0) {
error("Server does not support statvfs at openssh.com extension");
@@ -968,14 +1076,16 @@
id = conn->msg_id++;
- buffer_init(&msg);
- buffer_clear(&msg);
- buffer_put_char(&msg, SSH2_FXP_EXTENDED);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, "statvfs at openssh.com");
- buffer_put_cstring(&msg, path);
- send_msg(conn, &msg);
- buffer_free(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ sshbuf_reset(msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, "statvfs at openssh.com")) != 0 ||
+ (r = sshbuf_put_cstring(msg, path)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
+ sshbuf_free(msg);
return get_decode_statvfs(conn, st, id, quiet);
}
@@ -982,10 +1092,10 @@
#ifdef notyet
int
-do_fstatvfs(struct sftp_conn *conn, const char *handle, u_int handle_len,
+do_fstatvfs(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
struct sftp_statvfs *st, int quiet)
{
- Buffer msg;
+ struct sshbuf *msg;
u_int id;
if ((conn->exts & SFTP_EXT_FSTATVFS) == 0) {
@@ -995,14 +1105,16 @@
id = conn->msg_id++;
- buffer_init(&msg);
- buffer_clear(&msg);
- buffer_put_char(&msg, SSH2_FXP_EXTENDED);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, "fstatvfs at openssh.com");
- buffer_put_string(&msg, handle, handle_len);
- send_msg(conn, &msg);
- buffer_free(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ sshbuf_reset(msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, "fstatvfs at openssh.com")) != 0 ||
+ (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
+ sshbuf_free(msg);
return get_decode_statvfs(conn, st, id, quiet);
}
@@ -1010,42 +1122,48 @@
static void
send_read_request(struct sftp_conn *conn, u_int id, u_int64_t offset,
- u_int len, char *handle, u_int handle_len)
+ u_int len, const u_char *handle, u_int handle_len)
{
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
- buffer_init(&msg);
- buffer_clear(&msg);
- buffer_put_char(&msg, SSH2_FXP_READ);
- buffer_put_int(&msg, id);
- buffer_put_string(&msg, handle, handle_len);
- buffer_put_int64(&msg, offset);
- buffer_put_int(&msg, len);
- send_msg(conn, &msg);
- buffer_free(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ sshbuf_reset(msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_READ)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_string(msg, handle, handle_len)) != 0 ||
+ (r = sshbuf_put_u64(msg, offset)) != 0 ||
+ (r = sshbuf_put_u32(msg, len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
+ sshbuf_free(msg);
}
int
-do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
- Attrib *a, int preserve_flag, int resume_flag, int fsync_flag)
+do_download(struct sftp_conn *conn, const char *remote_path,
+ const char *local_path, Attrib *a, int preserve_flag, int resume_flag,
+ int fsync_flag)
{
Attrib junk;
- Buffer msg;
- char *handle;
- int local_fd = -1, status = 0, write_error;
- int read_error, write_errno, reordered = 0;
+ struct sshbuf *msg;
+ u_char *handle;
+ int local_fd = -1, write_error;
+ int read_error, write_errno, reordered = 0, r;
u_int64_t offset = 0, size, highwater;
- u_int handle_len, mode, type, id, buflen, num_req, max_req;
+ u_int mode, id, buflen, num_req, max_req, status = SSH2_FX_OK;
off_t progress_counter;
+ size_t handle_len;
struct stat st;
struct request {
u_int id;
- u_int len;
+ size_t len;
u_int64_t offset;
TAILQ_ENTRY(request) tq;
};
TAILQ_HEAD(reqhead, request) requests;
struct request *req;
+ u_char type;
TAILQ_INIT(&requests);
@@ -1070,23 +1188,26 @@
size = 0;
buflen = conn->transfer_buflen;
- buffer_init(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ attrib_clear(&junk); /* Send empty attributes */
+
/* Send open request */
id = conn->msg_id++;
- buffer_put_char(&msg, SSH2_FXP_OPEN);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, remote_path);
- buffer_put_int(&msg, SSH2_FXF_READ);
- attrib_clear(&junk); /* Send empty attributes */
- encode_attrib(&msg, &junk);
- send_msg(conn, &msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPEN)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, remote_path)) != 0 ||
+ (r = sshbuf_put_u32(msg, SSH2_FXF_READ)) != 0 ||
+ (r = encode_attrib(msg, &junk)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, remote_path);
handle = get_handle(conn, id, &handle_len,
"remote open(\"%s\")", remote_path);
if (handle == NULL) {
- buffer_free(&msg);
+ sshbuf_free(msg);
return(-1);
}
@@ -1113,7 +1234,7 @@
"local file is larger than remote", local_path);
fail:
do_close(conn, handle, handle_len);
- buffer_free(&msg);
+ sshbuf_free(msg);
free(handle);
if (local_fd != -1)
close(local_fd);
@@ -1131,8 +1252,8 @@
start_progress_meter(remote_path, size, &progress_counter);
while (num_req > 0 || max_req > 0) {
- char *data;
- u_int len;
+ u_char *data;
+ size_t len;
/*
* Simulate EOF on interrupt: stop sending new requests and
@@ -1161,10 +1282,11 @@
req->len, handle, handle_len);
}
- buffer_clear(&msg);
- get_msg(conn, &msg);
- type = buffer_get_char(&msg);
- id = buffer_get_int(&msg);
+ sshbuf_reset(msg);
+ get_msg(conn, msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug3("Received reply T:%u I:%u R:%d", type, id, max_req);
/* Find the request in our queue */
@@ -1177,7 +1299,9 @@
switch (type) {
case SSH2_FXP_STATUS:
- status = buffer_get_int(&msg);
+ if ((r = sshbuf_get_u32(msg, &status)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
if (status != SSH2_FX_EOF)
read_error = 1;
max_req = 0;
@@ -1186,13 +1310,15 @@
num_req--;
break;
case SSH2_FXP_DATA:
- data = buffer_get_string(&msg, &len);
+ if ((r = sshbuf_get_string(msg, &data, &len)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
debug3("Received data %llu -> %llu",
(unsigned long long)req->offset,
(unsigned long long)req->offset + len - 1);
if (len > req->len)
fatal("Received more data than asked for "
- "%u > %u", len, req->len);
+ "%zu > %zu", len, req->len);
if ((lseek(local_fd, req->offset, SEEK_SET) == -1 ||
atomicio(vwrite, local_fd, data, len) != len) &&
!write_error) {
@@ -1259,7 +1385,9 @@
"server reordered requests", local_path);
}
debug("truncating at %llu", (unsigned long long)highwater);
- ftruncate(local_fd, highwater);
+ if (ftruncate(local_fd, highwater) == -1)
+ error("ftruncate \"%s\": %s", local_path,
+ strerror(errno));
}
if (read_error) {
error("Couldn't read from remote file \"%s\" : %s",
@@ -1269,12 +1397,13 @@
} else if (write_error) {
error("Couldn't write to \"%s\": %s", local_path,
strerror(write_errno));
- status = -1;
+ status = SSH2_FX_FAILURE;
do_close(conn, handle, handle_len);
} else {
- status = do_close(conn, handle, handle_len);
- if (interrupted || status != SSH2_FX_OK)
- status = -1;
+ if (do_close(conn, handle, handle_len) != 0 || interrupted)
+ status = SSH2_FX_FAILURE;
+ else
+ status = SSH2_FX_OK;
/* Override umask and utimes if asked */
#ifdef HAVE_FCHMOD
if (preserve_flag && fchmod(local_fd, mode) == -1)
@@ -1301,7 +1430,7 @@
}
}
close(local_fd);
- buffer_free(&msg);
+ sshbuf_free(msg);
free(handle);
return(status);
@@ -1308,9 +1437,9 @@
}
static int
-download_dir_internal(struct sftp_conn *conn, char *src, char *dst, int depth,
- Attrib *dirattrib, int preserve_flag, int print_flag, int resume_flag,
- int fsync_flag)
+download_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
+ int depth, Attrib *dirattrib, int preserve_flag, int print_flag,
+ int resume_flag, int fsync_flag)
{
int i, ret = 0;
SFTP_DIRENT **dir_entries;
@@ -1332,7 +1461,7 @@
return -1;
}
if (print_flag)
- printf("Retrieving %s\n", src);
+ mprintf("Retrieving %s\n", src);
if (dirattrib->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
mode = dirattrib->perm & 01777;
@@ -1400,9 +1529,9 @@
}
int
-download_dir(struct sftp_conn *conn, char *src, char *dst,
- Attrib *dirattrib, int preserve_flag, int print_flag,
- int resume_flag, int fsync_flag)
+download_dir(struct sftp_conn *conn, const char *src, const char *dst,
+ Attrib *dirattrib, int preserve_flag, int print_flag, int resume_flag,
+ int fsync_flag)
{
char *src_canon;
int ret;
@@ -1419,17 +1548,18 @@
}
int
-do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
- int preserve_flag, int fsync_flag)
+do_upload(struct sftp_conn *conn, const char *local_path,
+ const char *remote_path, int preserve_flag, int resume, int fsync_flag)
{
- int local_fd;
- int status = SSH2_FX_OK;
- u_int handle_len, id, type;
+ int r, local_fd;
+ u_int status = SSH2_FX_OK;
+ u_int id;
+ u_char type;
off_t offset, progress_counter;
- char *handle, *data;
- Buffer msg;
+ u_char *handle, *data;
+ struct sshbuf *msg;
struct stat sb;
- Attrib a;
+ Attrib a, *c = NULL;
u_int32_t startid;
u_int32_t ackid;
struct outstanding_ack {
@@ -1440,6 +1570,7 @@
};
TAILQ_HEAD(ackhead, outstanding_ack) acks;
struct outstanding_ack *ack = NULL;
+ size_t handle_len;
TAILQ_INIT(&acks);
@@ -1467,25 +1598,48 @@
if (!preserve_flag)
a.flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
- buffer_init(&msg);
+ if (resume) {
+ /* Get remote file size if it exists */
+ if ((c = do_stat(conn, remote_path, 0)) == NULL) {
+ close(local_fd);
+ return -1;
+ }
+ if ((off_t)c->size >= sb.st_size) {
+ error("destination file bigger or same size as "
+ "source file");
+ close(local_fd);
+ return -1;
+ }
+
+ if (lseek(local_fd, (off_t)c->size, SEEK_SET) == -1) {
+ close(local_fd);
+ return -1;
+ }
+ }
+
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+
/* Send open request */
id = conn->msg_id++;
- buffer_put_char(&msg, SSH2_FXP_OPEN);
- buffer_put_int(&msg, id);
- buffer_put_cstring(&msg, remote_path);
- buffer_put_int(&msg, SSH2_FXF_WRITE|SSH2_FXF_CREAT|SSH2_FXF_TRUNC);
- encode_attrib(&msg, &a);
- send_msg(conn, &msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPEN)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_cstring(msg, remote_path)) != 0 ||
+ (r = sshbuf_put_u32(msg, SSH2_FXF_WRITE|SSH2_FXF_CREAT|
+ (resume ? SSH2_FXF_APPEND : SSH2_FXF_TRUNC))) != 0 ||
+ (r = encode_attrib(msg, &a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, remote_path);
- buffer_clear(&msg);
+ sshbuf_reset(msg);
handle = get_handle(conn, id, &handle_len,
"remote open(\"%s\")", remote_path);
if (handle == NULL) {
close(local_fd);
- buffer_free(&msg);
+ sshbuf_free(msg);
return -1;
}
@@ -1493,7 +1647,7 @@
data = xmalloc(conn->transfer_buflen);
/* Read from local and write to remote */
- offset = progress_counter = 0;
+ offset = progress_counter = (resume ? c->size : 0);
if (showprogress)
start_progress_meter(local_path, sb.st_size,
&progress_counter);
@@ -1525,13 +1679,16 @@
ack->len = len;
TAILQ_INSERT_TAIL(&acks, ack, tq);
- buffer_clear(&msg);
- buffer_put_char(&msg, SSH2_FXP_WRITE);
- buffer_put_int(&msg, ack->id);
- buffer_put_string(&msg, handle, handle_len);
- buffer_put_int64(&msg, offset);
- buffer_put_string(&msg, data, len);
- send_msg(conn, &msg);
+ sshbuf_reset(msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_WRITE)) != 0 ||
+ (r = sshbuf_put_u32(msg, ack->id)) != 0 ||
+ (r = sshbuf_put_string(msg, handle,
+ handle_len)) != 0 ||
+ (r = sshbuf_put_u64(msg, offset)) != 0 ||
+ (r = sshbuf_put_string(msg, data, len)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
+ send_msg(conn, msg);
debug3("Sent message SSH2_FXP_WRITE I:%u O:%llu S:%u",
id, (unsigned long long)offset, len);
} else if (TAILQ_FIRST(&acks) == NULL)
@@ -1542,27 +1699,31 @@
if (id == startid || len == 0 ||
id - ackid >= conn->num_requests) {
- u_int r_id;
+ u_int rid;
- buffer_clear(&msg);
- get_msg(conn, &msg);
- type = buffer_get_char(&msg);
- r_id = buffer_get_int(&msg);
+ sshbuf_reset(msg);
+ get_msg(conn, msg);
+ if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+ (r = sshbuf_get_u32(msg, &rid)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
if (type != SSH2_FXP_STATUS)
fatal("Expected SSH2_FXP_STATUS(%d) packet, "
"got %d", SSH2_FXP_STATUS, type);
- status = buffer_get_int(&msg);
- debug3("SSH2_FXP_STATUS %d", status);
+ if ((r = sshbuf_get_u32(msg, &status)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
+ debug3("SSH2_FXP_STATUS %u", status);
/* Find the request in our queue */
for (ack = TAILQ_FIRST(&acks);
- ack != NULL && ack->id != r_id;
+ ack != NULL && ack->id != rid;
ack = TAILQ_NEXT(ack, tq))
;
if (ack == NULL)
- fatal("Can't find request for ID %u", r_id);
+ fatal("Can't find request for ID %u", rid);
TAILQ_REMOVE(&acks, ack, tq);
debug3("In write loop, ack for %u %u bytes at %lld",
ack->id, ack->len, (long long)ack->offset);
@@ -1574,7 +1735,7 @@
if (offset < 0)
fatal("%s: offset < 0", __func__);
}
- buffer_free(&msg);
+ sshbuf_free(msg);
if (showprogress)
stop_progress_meter();
@@ -1583,13 +1744,13 @@
if (status != SSH2_FX_OK) {
error("Couldn't write to remote file \"%s\": %s",
remote_path, fx2txt(status));
- status = -1;
+ status = SSH2_FX_FAILURE;
}
if (close(local_fd) == -1) {
error("Couldn't close local file \"%s\": %s", local_path,
strerror(errno));
- status = -1;
+ status = SSH2_FX_FAILURE;
}
/* Override umask and utimes if asked */
@@ -1599,23 +1760,24 @@
if (fsync_flag)
(void)do_fsync(conn, handle, handle_len);
- if (do_close(conn, handle, handle_len) != SSH2_FX_OK)
- status = -1;
+ if (do_close(conn, handle, handle_len) != 0)
+ status = SSH2_FX_FAILURE;
+
free(handle);
- return status;
+ return status == SSH2_FX_OK ? 0 : -1;
}
static int
-upload_dir_internal(struct sftp_conn *conn, char *src, char *dst, int depth,
- int preserve_flag, int print_flag, int fsync_flag)
+upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
+ int depth, int preserve_flag, int print_flag, int resume, int fsync_flag)
{
- int ret = 0, status;
+ int ret = 0;
DIR *dirp;
struct dirent *dp;
char *filename, *new_src, *new_dst;
struct stat sb;
- Attrib a;
+ Attrib a, *dirattrib;
if (depth >= MAX_DIR_DEPTH) {
error("Maximum directory depth exceeded: %d levels", depth);
@@ -1632,7 +1794,7 @@
return -1;
}
if (print_flag)
- printf("Entering %s\n", src);
+ mprintf("Entering %s\n", src);
attrib_clear(&a);
stat_to_attrib(&sb, &a);
@@ -1642,17 +1804,18 @@
if (!preserve_flag)
a.flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
- status = do_mkdir(conn, dst, &a, 0);
/*
- * we lack a portable status for errno EEXIST,
- * so if we get a SSH2_FX_FAILURE back we must check
- * if it was created successfully.
+ * sftp lacks a portable status value to match errno EEXIST,
+ * so if we get a failure back then we must check whether
+ * the path already existed and is a directory.
*/
- if (status != SSH2_FX_OK) {
- if (status != SSH2_FX_FAILURE)
+ if (do_mkdir(conn, dst, &a, 0) != 0) {
+ if ((dirattrib = do_stat(conn, dst, 0)) == NULL)
return -1;
- if (do_stat(conn, dst, 0) == NULL)
+ if (!S_ISDIR(dirattrib->perm)) {
+ error("\"%s\" exists but is not a directory", dst);
return -1;
+ }
}
if ((dirp = opendir(src)) == NULL) {
@@ -1677,12 +1840,12 @@
continue;
if (upload_dir_internal(conn, new_src, new_dst,
- depth + 1, preserve_flag, print_flag,
+ depth + 1, preserve_flag, print_flag, resume,
fsync_flag) == -1)
ret = -1;
} else if (S_ISREG(sb.st_mode)) {
if (do_upload(conn, new_src, new_dst,
- preserve_flag, fsync_flag) == -1) {
+ preserve_flag, resume, fsync_flag) == -1) {
error("Uploading of file %s to %s failed!",
new_src, new_dst);
ret = -1;
@@ -1700,8 +1863,8 @@
}
int
-upload_dir(struct sftp_conn *conn, char *src, char *dst, int preserve_flag,
- int print_flag, int fsync_flag)
+upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
+ int preserve_flag, int print_flag, int resume, int fsync_flag)
{
char *dst_canon;
int ret;
@@ -1712,7 +1875,7 @@
}
ret = upload_dir_internal(conn, src, dst_canon, 0, preserve_flag,
- print_flag, fsync_flag);
+ print_flag, resume, fsync_flag);
free(dst_canon);
return ret;
@@ -1719,7 +1882,7 @@
}
char *
-path_append(char *p1, char *p2)
+path_append(const char *p1, const char *p2)
{
char *ret;
size_t len = strlen(p1) + strlen(p2) + 2;
Modified: trunk/crypto/openssh/sftp-client.h
===================================================================
--- trunk/crypto/openssh/sftp-client.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-client.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-client.h,v 1.24 2013/10/17 00:30:13 djm Exp $ */
+/* $OpenBSD: sftp-client.h,v 1.27 2015/05/08 06:45:13 djm Exp $ */
/*
* Copyright (c) 2001-2004 Damien Miller <djm at openbsd.org>
@@ -21,6 +21,12 @@
#ifndef _SFTP_CLIENT_H
#define _SFTP_CLIENT_H
+#ifdef USE_SYSTEM_GLOB
+# include <glob.h>
+#else
+# include "openbsd-compat/glob.h"
+#endif
+
typedef struct SFTP_DIRENT SFTP_DIRENT;
struct SFTP_DIRENT {
@@ -56,79 +62,81 @@
u_int sftp_proto_version(struct sftp_conn *);
/* Close file referred to by 'handle' */
-int do_close(struct sftp_conn *, char *, u_int);
+int do_close(struct sftp_conn *, const u_char *, u_int);
/* Read contents of 'path' to NULL-terminated array 'dir' */
-int do_readdir(struct sftp_conn *, char *, SFTP_DIRENT ***);
+int do_readdir(struct sftp_conn *, const char *, SFTP_DIRENT ***);
/* Frees a NULL-terminated array of SFTP_DIRENTs (eg. from do_readdir) */
void free_sftp_dirents(SFTP_DIRENT **);
/* Delete file 'path' */
-int do_rm(struct sftp_conn *, char *);
+int do_rm(struct sftp_conn *, const char *);
/* Create directory 'path' */
-int do_mkdir(struct sftp_conn *, char *, Attrib *, int);
+int do_mkdir(struct sftp_conn *, const char *, Attrib *, int);
/* Remove directory 'path' */
-int do_rmdir(struct sftp_conn *, char *);
+int do_rmdir(struct sftp_conn *, const char *);
/* Get file attributes of 'path' (follows symlinks) */
-Attrib *do_stat(struct sftp_conn *, char *, int);
+Attrib *do_stat(struct sftp_conn *, const char *, int);
/* Get file attributes of 'path' (does not follow symlinks) */
-Attrib *do_lstat(struct sftp_conn *, char *, int);
+Attrib *do_lstat(struct sftp_conn *, const char *, int);
/* Set file attributes of 'path' */
-int do_setstat(struct sftp_conn *, char *, Attrib *);
+int do_setstat(struct sftp_conn *, const char *, Attrib *);
/* Set file attributes of open file 'handle' */
-int do_fsetstat(struct sftp_conn *, char *, u_int, Attrib *);
+int do_fsetstat(struct sftp_conn *, const u_char *, u_int, Attrib *);
/* Canonicalise 'path' - caller must free result */
-char *do_realpath(struct sftp_conn *, char *);
+char *do_realpath(struct sftp_conn *, const char *);
/* Get statistics for filesystem hosting file at "path" */
int do_statvfs(struct sftp_conn *, const char *, struct sftp_statvfs *, int);
/* Rename 'oldpath' to 'newpath' */
-int do_rename(struct sftp_conn *, char *, char *m, int force_legacy);
+int do_rename(struct sftp_conn *, const char *, const char *, int force_legacy);
/* Link 'oldpath' to 'newpath' */
-int do_hardlink(struct sftp_conn *, char *, char *);
+int do_hardlink(struct sftp_conn *, const char *, const char *);
/* Rename 'oldpath' to 'newpath' */
-int do_symlink(struct sftp_conn *, char *, char *);
+int do_symlink(struct sftp_conn *, const char *, const char *);
/* Call fsync() on open file 'handle' */
-int do_fsync(struct sftp_conn *conn, char *, u_int);
+int do_fsync(struct sftp_conn *conn, u_char *, u_int);
/*
* Download 'remote_path' to 'local_path'. Preserve permissions and times
* if 'pflag' is set
*/
-int do_download(struct sftp_conn *, char *, char *, Attrib *, int, int, int);
+int do_download(struct sftp_conn *, const char *, const char *,
+ Attrib *, int, int, int);
/*
- * Recursively download 'remote_directory' to 'local_directory'. Preserve
+ * Recursively download 'remote_directory' to 'local_directory'. Preserve
* times if 'pflag' is set
*/
-int download_dir(struct sftp_conn *, char *, char *, Attrib *, int,
- int, int, int);
+int download_dir(struct sftp_conn *, const char *, const char *,
+ Attrib *, int, int, int, int);
/*
* Upload 'local_path' to 'remote_path'. Preserve permissions and times
* if 'pflag' is set
*/
-int do_upload(struct sftp_conn *, char *, char *, int, int);
+int do_upload(struct sftp_conn *, const char *, const char *, int, int, int);
/*
- * Recursively upload 'local_directory' to 'remote_directory'. Preserve
+ * Recursively upload 'local_directory' to 'remote_directory'. Preserve
* times if 'pflag' is set
*/
-int upload_dir(struct sftp_conn *, char *, char *, int, int, int);
+int upload_dir(struct sftp_conn *, const char *, const char *, int, int, int,
+ int);
/* Concatenate paths, taking care of slashes. Caller must free result. */
-char *path_append(char *, char *);
+char *path_append(const char *, const char *);
#endif
Modified: trunk/crypto/openssh/sftp-common.c
===================================================================
--- trunk/crypto/openssh/sftp-common.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-common.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-common.c,v 1.26 2014/01/09 03:26:00 guenther Exp $ */
+/* $OpenBSD: sftp-common.c,v 1.28 2015/01/20 23:14:00 deraadt Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2001 Damien Miller. All rights reserved.
@@ -26,9 +26,9 @@
#include "includes.h"
+#include <sys/param.h> /* MAX */
#include <sys/types.h>
#include <sys/stat.h>
-#include <sys/param.h>
#include <grp.h>
#include <pwd.h>
@@ -42,7 +42,8 @@
#endif
#include "xmalloc.h"
-#include "buffer.h"
+#include "ssherr.h"
+#include "sshbuf.h"
#include "log.h"
#include "sftp.h"
@@ -100,59 +101,81 @@
}
/* Decode attributes in buffer */
-Attrib *
-decode_attrib(Buffer *b)
+int
+decode_attrib(struct sshbuf *b, Attrib *a)
{
- static Attrib a;
+ int r;
- attrib_clear(&a);
- a.flags = buffer_get_int(b);
- if (a.flags & SSH2_FILEXFER_ATTR_SIZE)
- a.size = buffer_get_int64(b);
- if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
- a.uid = buffer_get_int(b);
- a.gid = buffer_get_int(b);
+ attrib_clear(a);
+ if ((r = sshbuf_get_u32(b, &a->flags)) != 0)
+ return r;
+ if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
+ if ((r = sshbuf_get_u64(b, &a->size)) != 0)
+ return r;
}
- if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
- a.perm = buffer_get_int(b);
- if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
- a.atime = buffer_get_int(b);
- a.mtime = buffer_get_int(b);
+ if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
+ if ((r = sshbuf_get_u32(b, &a->uid)) != 0 ||
+ (r = sshbuf_get_u32(b, &a->gid)) != 0)
+ return r;
}
+ if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
+ if ((r = sshbuf_get_u32(b, &a->perm)) != 0)
+ return r;
+ }
+ if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
+ if ((r = sshbuf_get_u32(b, &a->atime)) != 0 ||
+ (r = sshbuf_get_u32(b, &a->mtime)) != 0)
+ return r;
+ }
/* vendor-specific extensions */
- if (a.flags & SSH2_FILEXFER_ATTR_EXTENDED) {
- char *type, *data;
- int i, count;
+ if (a->flags & SSH2_FILEXFER_ATTR_EXTENDED) {
+ char *type;
+ u_char *data;
+ size_t dlen;
+ u_int i, count;
- count = buffer_get_int(b);
+ if ((r = sshbuf_get_u32(b, &count)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
for (i = 0; i < count; i++) {
- type = buffer_get_string(b, NULL);
- data = buffer_get_string(b, NULL);
- debug3("Got file attribute \"%s\"", type);
+ if ((r = sshbuf_get_cstring(b, &type, NULL)) != 0 ||
+ (r = sshbuf_get_string(b, &data, &dlen)) != 0)
+ return r;
+ debug3("Got file attribute \"%.100s\" len %zu",
+ type, dlen);
free(type);
free(data);
}
}
- return &a;
+ return 0;
}
/* Encode attributes to buffer */
-void
-encode_attrib(Buffer *b, const Attrib *a)
+int
+encode_attrib(struct sshbuf *b, const Attrib *a)
{
- buffer_put_int(b, a->flags);
- if (a->flags & SSH2_FILEXFER_ATTR_SIZE)
- buffer_put_int64(b, a->size);
+ int r;
+
+ if ((r = sshbuf_put_u32(b, a->flags)) != 0)
+ return r;
+ if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
+ if ((r = sshbuf_put_u64(b, a->size)) != 0)
+ return r;
+ }
if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
- buffer_put_int(b, a->uid);
- buffer_put_int(b, a->gid);
+ if ((r = sshbuf_put_u32(b, a->uid)) != 0 ||
+ (r = sshbuf_put_u32(b, a->gid)) != 0)
+ return r;
}
- if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
- buffer_put_int(b, a->perm);
+ if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
+ if ((r = sshbuf_put_u32(b, a->perm)) != 0)
+ return r;
+ }
if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
- buffer_put_int(b, a->atime);
- buffer_put_int(b, a->mtime);
+ if ((r = sshbuf_put_u32(b, a->atime)) != 0 ||
+ (r = sshbuf_put_u32(b, a->mtime)) != 0)
+ return r;
}
+ return 0;
}
/* Convert from SSH2_FX_ status to text error message */
Modified: trunk/crypto/openssh/sftp-common.h
===================================================================
--- trunk/crypto/openssh/sftp-common.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-common.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-common.h,v 1.11 2010/01/13 01:40:16 djm Exp $ */
+/* $OpenBSD: sftp-common.h,v 1.12 2015/01/14 13:54:13 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
@@ -28,6 +28,7 @@
/* Maximum packet that we are willing to send/accept */
#define SFTP_MAX_MSG_LENGTH (256 * 1024)
+struct sshbuf;
typedef struct Attrib Attrib;
/* File attributes */
@@ -44,8 +45,8 @@
void attrib_clear(Attrib *);
void stat_to_attrib(const struct stat *, Attrib *);
void attrib_to_stat(const Attrib *, struct stat *);
-Attrib *decode_attrib(Buffer *);
-void encode_attrib(Buffer *, const Attrib *);
+int decode_attrib(struct sshbuf *, Attrib *);
+int encode_attrib(struct sshbuf *, const Attrib *);
char *ls_file(const char *, const struct stat *, int, int);
const char *fx2txt(int);
Modified: trunk/crypto/openssh/sftp-glob.c
===================================================================
--- trunk/crypto/openssh/sftp-glob.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-glob.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-glob.c,v 1.26 2013/11/08 11:15:19 dtucker Exp $ */
+/* $OpenBSD: sftp-glob.c,v 1.27 2015/01/14 13:54:13 djm Exp $ */
/*
* Copyright (c) 2001-2004 Damien Miller <djm at openbsd.org>
*
@@ -25,10 +25,10 @@
#include <dirent.h>
#include <stdlib.h>
#include <string.h>
+#include <stdlib.h>
#include "xmalloc.h"
#include "sftp.h"
-#include "buffer.h"
#include "sftp-common.h"
#include "sftp-client.h"
Modified: trunk/crypto/openssh/sftp-server-main.c
===================================================================
--- trunk/crypto/openssh/sftp-server-main.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-server-main.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-server-main.c,v 1.4 2009/02/21 19:32:04 tobias Exp $ */
+/* $OpenBSD: sftp-server-main.c,v 1.5 2016/02/15 09:47:49 dtucker Exp $ */
/*
* Copyright (c) 2008 Markus Friedl. All rights reserved.
*
@@ -26,6 +26,7 @@
#include "log.h"
#include "sftp.h"
#include "misc.h"
+#include "xmalloc.h"
void
cleanup_exit(int i)
@@ -38,6 +39,7 @@
{
struct passwd *user_pw;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
Modified: trunk/crypto/openssh/sftp-server.0
===================================================================
--- trunk/crypto/openssh/sftp-server.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-server.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-SFTP-SERVER(8) OpenBSD System Manager's Manual SFTP-SERVER(8)
+SFTP-SERVER(8) System Manager's Manual SFTP-SERVER(8)
NAME
- sftp-server - SFTP server subsystem
+ sftp-server M-bM-^@M-^S SFTP server subsystem
SYNOPSIS
sftp-server [-ehR] [-d start_directory] [-f log_facility] [-l log_level]
@@ -23,7 +23,7 @@
-d start_directory
specifies an alternate starting directory for users. The
pathname may contain the following tokens that are expanded at
- runtime: %% is replaced by a literal '%', %h is replaced by the
+ runtime: %% is replaced by a literal '%', %d is replaced by the
home directory of the user being authenticated, and %u is
replaced by the username of that user. The default is to use the
user's home directory. This option is useful in conjunction with
@@ -65,8 +65,8 @@
-Q protocol_feature
Query protocol features supported by sftp-server. At present the
- only feature that may be queried is ``requests'', which may be
- used for black or whitelisting (flags -P and -p respectively).
+ only feature that may be queried is M-bM-^@M-^\requestsM-bM-^@M-^], which may be used
+ for black or whitelisting (flags -P and -p respectively).
-R Places this instance of sftp-server into a read-only mode.
Attempts to open files for writing, as well as other operations
@@ -76,9 +76,10 @@
Sets an explicit umask(2) to be applied to newly-created files
and directories, instead of the user's default mask.
- For logging to work, sftp-server must be able to access /dev/log. Use of
- sftp-server in a chroot configuration therefore requires that syslogd(8)
- establish a logging socket inside the chroot directory.
+ On some systems, sftp-server must be able to access /dev/log for logging
+ to work, and use of sftp-server in a chroot configuration therefore
+ requires that syslogd(8) establish a logging socket inside the chroot
+ directory.
SEE ALSO
sftp(1), ssh(1), sshd_config(5), sshd(8)
@@ -92,4 +93,4 @@
AUTHORS
Markus Friedl <markus at openbsd.org>
-OpenBSD 5.5 October 14, 2013 OpenBSD 5.5
+OpenBSD 6.0 December 11, 2014 OpenBSD 6.0
Modified: trunk/crypto/openssh/sftp-server.8
===================================================================
--- trunk/crypto/openssh/sftp-server.8 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-server.8 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp-server.8,v 1.25 2013/10/14 14:18:56 jmc Exp $
+.\" $OpenBSD: sftp-server.8,v 1.27 2014/12/11 04:16:14 djm Exp $
.\"
.\" Copyright (c) 2000 Markus Friedl. All rights reserved.
.\"
@@ -22,7 +22,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: October 14 2013 $
+.Dd $Mdocdate: December 11 2014 $
.Dt SFTP-SERVER 8
.Os
.Sh NAME
@@ -67,7 +67,7 @@
specifies an alternate starting directory for users.
The pathname may contain the following tokens that are expanded at runtime:
%% is replaced by a literal '%',
-%h is replaced by the home directory of the user being authenticated,
+%d is replaced by the home directory of the user being authenticated,
and %u is replaced by the username of that user.
The default is to use the user's home directory.
This option is useful in conjunction with the
@@ -140,11 +140,11 @@
user's default mask.
.El
.Pp
-For logging to work,
+On some systems,
.Nm
must be able to access
-.Pa /dev/log .
-Use of
+.Pa /dev/log
+for logging to work, and use of
.Nm
in a chroot configuration therefore requires that
.Xr syslogd 8
Modified: trunk/crypto/openssh/sftp-server.c
===================================================================
--- trunk/crypto/openssh/sftp-server.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp-server.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-server.c,v 1.103 2014/01/17 06:23:24 dtucker Exp $ */
+/* $OpenBSD: sftp-server.c,v 1.109 2016/02/15 09:47:49 dtucker Exp $ */
/*
* Copyright (c) 2000-2004 Markus Friedl. All rights reserved.
*
@@ -17,8 +17,8 @@
#include "includes.h"
+#include <sys/param.h> /* MIN */
#include <sys/types.h>
-#include <sys/param.h>
#include <sys/stat.h>
#ifdef HAVE_SYS_TIME_H
# include <sys/time.h>
@@ -37,13 +37,13 @@
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
-#include <pwd.h>
#include <time.h>
#include <unistd.h>
#include <stdarg.h>
#include "xmalloc.h"
-#include "buffer.h"
+#include "sshbuf.h"
+#include "ssherr.h"
#include "log.h"
#include "misc.h"
#include "match.h"
@@ -52,11 +52,6 @@
#include "sftp.h"
#include "sftp-common.h"
-/* helper */
-#define get_int64() buffer_get_int64(&iqueue);
-#define get_int() buffer_get_int(&iqueue);
-#define get_string(lenp) buffer_get_string(&iqueue, lenp);
-
/* Our verbosity */
static LogLevel log_level = SYSLOG_LEVEL_ERROR;
@@ -65,8 +60,8 @@
static char *client_addr = NULL;
/* input and output queue */
-static Buffer iqueue;
-static Buffer oqueue;
+struct sshbuf *iqueue;
+struct sshbuf *oqueue;
/* Version of client */
static u_int version;
@@ -272,12 +267,6 @@
return ret;
}
-static Attrib *
-get_attrib(void)
-{
- return decode_attrib(&iqueue);
-}
-
/* handle handles */
typedef struct Handle Handle;
@@ -317,7 +306,7 @@
if (num_handles + 1 <= num_handles)
return -1;
num_handles++;
- handles = xrealloc(handles, num_handles, sizeof(Handle));
+ handles = xreallocarray(handles, num_handles, sizeof(Handle));
handle_unused(num_handles - 1);
}
@@ -341,7 +330,7 @@
}
static int
-handle_to_string(int handle, char **stringp, int *hlenp)
+handle_to_string(int handle, u_char **stringp, int *hlenp)
{
if (stringp == NULL || hlenp == NULL)
return -1;
@@ -352,7 +341,7 @@
}
static int
-handle_from_string(const char *handle, u_int hlen)
+handle_from_string(const u_char *handle, u_int hlen)
{
int val;
@@ -474,29 +463,31 @@
}
static int
-get_handle(void)
+get_handle(struct sshbuf *queue, int *hp)
{
- char *handle;
- int val = -1;
- u_int hlen;
+ u_char *handle;
+ int r;
+ size_t hlen;
- handle = get_string(&hlen);
+ *hp = -1;
+ if ((r = sshbuf_get_string(queue, &handle, &hlen)) != 0)
+ return r;
if (hlen < 256)
- val = handle_from_string(handle, hlen);
+ *hp = handle_from_string(handle, hlen);
free(handle);
- return val;
+ return 0;
}
/* send replies */
static void
-send_msg(Buffer *m)
+send_msg(struct sshbuf *m)
{
- int mlen = buffer_len(m);
+ int r;
- buffer_put_int(&oqueue, mlen);
- buffer_append(&oqueue, buffer_ptr(m), mlen);
- buffer_consume(m, mlen);
+ if ((r = sshbuf_put_stringb(oqueue, m)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ sshbuf_reset(m);
}
static const char *
@@ -520,38 +511,46 @@
static void
send_status(u_int32_t id, u_int32_t status)
{
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
debug3("request %u: sent status %u", id, status);
if (log_level > SYSLOG_LEVEL_VERBOSE ||
(status != SSH2_FX_OK && status != SSH2_FX_EOF))
logit("sent status %s", status_to_message(status));
- buffer_init(&msg);
- buffer_put_char(&msg, SSH2_FXP_STATUS);
- buffer_put_int(&msg, id);
- buffer_put_int(&msg, status);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_STATUS)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_u32(msg, status)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (version >= 3) {
- buffer_put_cstring(&msg, status_to_message(status));
- buffer_put_cstring(&msg, "");
+ if ((r = sshbuf_put_cstring(msg,
+ status_to_message(status))) != 0 ||
+ (r = sshbuf_put_cstring(msg, "")) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
}
- send_msg(&msg);
- buffer_free(&msg);
+ send_msg(msg);
+ sshbuf_free(msg);
}
static void
-send_data_or_handle(char type, u_int32_t id, const char *data, int dlen)
+send_data_or_handle(char type, u_int32_t id, const u_char *data, int dlen)
{
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
- buffer_init(&msg);
- buffer_put_char(&msg, type);
- buffer_put_int(&msg, id);
- buffer_put_string(&msg, data, dlen);
- send_msg(&msg);
- buffer_free(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, type)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_string(msg, data, dlen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(msg);
+ sshbuf_free(msg);
}
static void
-send_data(u_int32_t id, const char *data, int dlen)
+send_data(u_int32_t id, const u_char *data, int dlen)
{
debug("request %u: sent data len %d", id, dlen);
send_data_or_handle(SSH2_FXP_DATA, id, data, dlen);
@@ -560,7 +559,7 @@
static void
send_handle(u_int32_t id, int handle)
{
- char *string;
+ u_char *string;
int hlen;
handle_to_string(handle, &string, &hlen);
@@ -572,62 +571,71 @@
static void
send_names(u_int32_t id, int count, const Stat *stats)
{
- Buffer msg;
- int i;
+ struct sshbuf *msg;
+ int i, r;
- buffer_init(&msg);
- buffer_put_char(&msg, SSH2_FXP_NAME);
- buffer_put_int(&msg, id);
- buffer_put_int(&msg, count);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_NAME)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_u32(msg, count)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug("request %u: sent names count %d", id, count);
for (i = 0; i < count; i++) {
- buffer_put_cstring(&msg, stats[i].name);
- buffer_put_cstring(&msg, stats[i].long_name);
- encode_attrib(&msg, &stats[i].attrib);
+ if ((r = sshbuf_put_cstring(msg, stats[i].name)) != 0 ||
+ (r = sshbuf_put_cstring(msg, stats[i].long_name)) != 0 ||
+ (r = encode_attrib(msg, &stats[i].attrib)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
}
- send_msg(&msg);
- buffer_free(&msg);
+ send_msg(msg);
+ sshbuf_free(msg);
}
static void
send_attrib(u_int32_t id, const Attrib *a)
{
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
debug("request %u: sent attrib have 0x%x", id, a->flags);
- buffer_init(&msg);
- buffer_put_char(&msg, SSH2_FXP_ATTRS);
- buffer_put_int(&msg, id);
- encode_attrib(&msg, a);
- send_msg(&msg);
- buffer_free(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_ATTRS)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = encode_attrib(msg, a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(msg);
+ sshbuf_free(msg);
}
static void
send_statvfs(u_int32_t id, struct statvfs *st)
{
- Buffer msg;
+ struct sshbuf *msg;
u_int64_t flag;
+ int r;
flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0;
flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0;
- buffer_init(&msg);
- buffer_put_char(&msg, SSH2_FXP_EXTENDED_REPLY);
- buffer_put_int(&msg, id);
- buffer_put_int64(&msg, st->f_bsize);
- buffer_put_int64(&msg, st->f_frsize);
- buffer_put_int64(&msg, st->f_blocks);
- buffer_put_int64(&msg, st->f_bfree);
- buffer_put_int64(&msg, st->f_bavail);
- buffer_put_int64(&msg, st->f_files);
- buffer_put_int64(&msg, st->f_ffree);
- buffer_put_int64(&msg, st->f_favail);
- buffer_put_int64(&msg, FSID_TO_ULONG(st->f_fsid));
- buffer_put_int64(&msg, flag);
- buffer_put_int64(&msg, st->f_namemax);
- send_msg(&msg);
- buffer_free(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 ||
+ (r = sshbuf_put_u32(msg, id)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_bsize)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_frsize)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_blocks)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_bfree)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_bavail)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_files)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_ffree)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_favail)) != 0 ||
+ (r = sshbuf_put_u64(msg, FSID_TO_ULONG(st->f_fsid))) != 0 ||
+ (r = sshbuf_put_u64(msg, flag)) != 0 ||
+ (r = sshbuf_put_u64(msg, st->f_namemax)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(msg);
+ sshbuf_free(msg);
}
/* parse incoming */
@@ -635,30 +643,34 @@
static void
process_init(void)
{
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
- version = get_int();
+ if ((r = sshbuf_get_u32(iqueue, &version)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
verbose("received client version %u", version);
- buffer_init(&msg);
- buffer_put_char(&msg, SSH2_FXP_VERSION);
- buffer_put_int(&msg, SSH2_FILEXFER_VERSION);
- /* POSIX rename extension */
- buffer_put_cstring(&msg, "posix-rename at openssh.com");
- buffer_put_cstring(&msg, "1"); /* version */
- /* statvfs extension */
- buffer_put_cstring(&msg, "statvfs at openssh.com");
- buffer_put_cstring(&msg, "2"); /* version */
- /* fstatvfs extension */
- buffer_put_cstring(&msg, "fstatvfs at openssh.com");
- buffer_put_cstring(&msg, "2"); /* version */
- /* hardlink extension */
- buffer_put_cstring(&msg, "hardlink at openssh.com");
- buffer_put_cstring(&msg, "1"); /* version */
- /* fsync extension */
- buffer_put_cstring(&msg, "fsync at openssh.com");
- buffer_put_cstring(&msg, "1"); /* version */
- send_msg(&msg);
- buffer_free(&msg);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, SSH2_FXP_VERSION)) != 0 ||
+ (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0 ||
+ /* POSIX rename extension */
+ (r = sshbuf_put_cstring(msg, "posix-rename at openssh.com")) != 0 ||
+ (r = sshbuf_put_cstring(msg, "1")) != 0 || /* version */
+ /* statvfs extension */
+ (r = sshbuf_put_cstring(msg, "statvfs at openssh.com")) != 0 ||
+ (r = sshbuf_put_cstring(msg, "2")) != 0 || /* version */
+ /* fstatvfs extension */
+ (r = sshbuf_put_cstring(msg, "fstatvfs at openssh.com")) != 0 ||
+ (r = sshbuf_put_cstring(msg, "2")) != 0 || /* version */
+ /* hardlink extension */
+ (r = sshbuf_put_cstring(msg, "hardlink at openssh.com")) != 0 ||
+ (r = sshbuf_put_cstring(msg, "1")) != 0 || /* version */
+ /* fsync extension */
+ (r = sshbuf_put_cstring(msg, "fsync at openssh.com")) != 0 ||
+ (r = sshbuf_put_cstring(msg, "1")) != 0) /* version */
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send_msg(msg);
+ sshbuf_free(msg);
}
static void
@@ -665,16 +677,18 @@
process_open(u_int32_t id)
{
u_int32_t pflags;
- Attrib *a;
+ Attrib a;
char *name;
- int handle, fd, flags, mode, status = SSH2_FX_FAILURE;
+ int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
- name = get_string(NULL);
- pflags = get_int(); /* portable flags */
+ if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
+ (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
+ (r = decode_attrib(iqueue, &a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: open flags %d", id, pflags);
- a = get_attrib();
flags = flags_from_portable(pflags);
- mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
+ mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
logit("open \"%s\" flags %s mode 0%o",
name, string_from_portable(pflags), mode);
if (readonly &&
@@ -681,7 +695,7 @@
((flags & O_ACCMODE) == O_WRONLY ||
(flags & O_ACCMODE) == O_RDWR)) {
verbose("Refusing open request in read-only mode");
- status = SSH2_FX_PERMISSION_DENIED;
+ status = SSH2_FX_PERMISSION_DENIED;
} else {
fd = open(name, flags, mode);
if (fd < 0) {
@@ -704,9 +718,11 @@
static void
process_close(u_int32_t id)
{
- int handle, ret, status = SSH2_FX_FAILURE;
+ int r, handle, ret, status = SSH2_FX_FAILURE;
- handle = get_handle();
+ if ((r = get_handle(iqueue, &handle)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: close handle %u", id, handle);
handle_log_close(handle, NULL);
ret = handle_close(handle);
@@ -717,14 +733,15 @@
static void
process_read(u_int32_t id)
{
- char buf[64*1024];
+ u_char buf[64*1024];
u_int32_t len;
- int handle, fd, ret, status = SSH2_FX_FAILURE;
+ int r, handle, fd, ret, status = SSH2_FX_FAILURE;
u_int64_t off;
- handle = get_handle();
- off = get_int64();
- len = get_int();
+ if ((r = get_handle(iqueue, &handle)) != 0 ||
+ (r = sshbuf_get_u64(iqueue, &off)) != 0 ||
+ (r = sshbuf_get_u32(iqueue, &len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug("request %u: read \"%s\" (handle %d) off %llu len %d",
id, handle_to_name(handle), handle, (unsigned long long)off, len);
@@ -758,18 +775,19 @@
process_write(u_int32_t id)
{
u_int64_t off;
- u_int len;
- int handle, fd, ret, status;
- char *data;
+ size_t len;
+ int r, handle, fd, ret, status;
+ u_char *data;
- handle = get_handle();
- off = get_int64();
- data = get_string(&len);
+ if ((r = get_handle(iqueue, &handle)) != 0 ||
+ (r = sshbuf_get_u64(iqueue, &off)) != 0 ||
+ (r = sshbuf_get_string(iqueue, &data, &len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
- debug("request %u: write \"%s\" (handle %d) off %llu len %d",
+ debug("request %u: write \"%s\" (handle %d) off %llu len %zu",
id, handle_to_name(handle), handle, (unsigned long long)off, len);
fd = handle_to_fd(handle);
-
+
if (fd < 0)
status = SSH2_FX_FAILURE;
else {
@@ -802,13 +820,15 @@
Attrib a;
struct stat st;
char *name;
- int ret, status = SSH2_FX_FAILURE;
+ int r, status = SSH2_FX_FAILURE;
- name = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: %sstat", id, do_lstat ? "l" : "");
verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name);
- ret = do_lstat ? lstat(name, &st) : stat(name, &st);
- if (ret < 0) {
+ r = do_lstat ? lstat(name, &st) : stat(name, &st);
+ if (r < 0) {
status = errno_to_portable(errno);
} else {
stat_to_attrib(&st, &a);
@@ -837,15 +857,16 @@
{
Attrib a;
struct stat st;
- int fd, ret, handle, status = SSH2_FX_FAILURE;
+ int fd, r, handle, status = SSH2_FX_FAILURE;
- handle = get_handle();
+ if ((r = get_handle(iqueue, &handle)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug("request %u: fstat \"%s\" (handle %u)",
id, handle_to_name(handle), handle);
fd = handle_to_fd(handle);
if (fd >= 0) {
- ret = fstat(fd, &st);
- if (ret < 0) {
+ r = fstat(fd, &st);
+ if (r < 0) {
status = errno_to_portable(errno);
} else {
stat_to_attrib(&st, &a);
@@ -872,42 +893,44 @@
static void
process_setstat(u_int32_t id)
{
- Attrib *a;
+ Attrib a;
char *name;
- int status = SSH2_FX_OK, ret;
+ int r, status = SSH2_FX_OK;
- name = get_string(NULL);
- a = get_attrib();
+ if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
+ (r = decode_attrib(iqueue, &a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug("request %u: setstat name \"%s\"", id, name);
- if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
+ if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
logit("set \"%s\" size %llu",
- name, (unsigned long long)a->size);
- ret = truncate(name, a->size);
- if (ret == -1)
+ name, (unsigned long long)a.size);
+ r = truncate(name, a.size);
+ if (r == -1)
status = errno_to_portable(errno);
}
- if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
- logit("set \"%s\" mode %04o", name, a->perm);
- ret = chmod(name, a->perm & 07777);
- if (ret == -1)
+ if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
+ logit("set \"%s\" mode %04o", name, a.perm);
+ r = chmod(name, a.perm & 07777);
+ if (r == -1)
status = errno_to_portable(errno);
}
- if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
+ if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
char buf[64];
- time_t t = a->mtime;
+ time_t t = a.mtime;
strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
localtime(&t));
logit("set \"%s\" modtime %s", name, buf);
- ret = utimes(name, attrib_to_tv(a));
- if (ret == -1)
+ r = utimes(name, attrib_to_tv(&a));
+ if (r == -1)
status = errno_to_portable(errno);
}
- if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
+ if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
logit("set \"%s\" owner %lu group %lu", name,
- (u_long)a->uid, (u_long)a->gid);
- ret = chown(name, a->uid, a->gid);
- if (ret == -1)
+ (u_long)a.uid, (u_long)a.gid);
+ r = chown(name, a.uid, a.gid);
+ if (r == -1)
status = errno_to_portable(errno);
}
send_status(id, status);
@@ -917,12 +940,14 @@
static void
process_fsetstat(u_int32_t id)
{
- Attrib *a;
- int handle, fd, ret;
+ Attrib a;
+ int handle, fd, r;
int status = SSH2_FX_OK;
- handle = get_handle();
- a = get_attrib();
+ if ((r = get_handle(iqueue, &handle)) != 0 ||
+ (r = decode_attrib(iqueue, &a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug("request %u: fsetstat handle %d", id, handle);
fd = handle_to_fd(handle);
if (fd < 0)
@@ -930,47 +955,47 @@
else {
char *name = handle_to_name(handle);
- if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
+ if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
logit("set \"%s\" size %llu",
- name, (unsigned long long)a->size);
- ret = ftruncate(fd, a->size);
- if (ret == -1)
+ name, (unsigned long long)a.size);
+ r = ftruncate(fd, a.size);
+ if (r == -1)
status = errno_to_portable(errno);
}
- if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
- logit("set \"%s\" mode %04o", name, a->perm);
+ if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
+ logit("set \"%s\" mode %04o", name, a.perm);
#ifdef HAVE_FCHMOD
- ret = fchmod(fd, a->perm & 07777);
+ r = fchmod(fd, a.perm & 07777);
#else
- ret = chmod(name, a->perm & 07777);
+ r = chmod(name, a.perm & 07777);
#endif
- if (ret == -1)
+ if (r == -1)
status = errno_to_portable(errno);
}
- if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
+ if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
char buf[64];
- time_t t = a->mtime;
+ time_t t = a.mtime;
strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
localtime(&t));
logit("set \"%s\" modtime %s", name, buf);
#ifdef HAVE_FUTIMES
- ret = futimes(fd, attrib_to_tv(a));
+ r = futimes(fd, attrib_to_tv(&a));
#else
- ret = utimes(name, attrib_to_tv(a));
+ r = utimes(name, attrib_to_tv(&a));
#endif
- if (ret == -1)
+ if (r == -1)
status = errno_to_portable(errno);
}
- if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
+ if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
logit("set \"%s\" owner %lu group %lu", name,
- (u_long)a->uid, (u_long)a->gid);
+ (u_long)a.uid, (u_long)a.gid);
#ifdef HAVE_FCHOWN
- ret = fchown(fd, a->uid, a->gid);
+ r = fchown(fd, a.uid, a.gid);
#else
- ret = chown(name, a->uid, a->gid);
+ r = chown(name, a.uid, a.gid);
#endif
- if (ret == -1)
+ if (r == -1)
status = errno_to_portable(errno);
}
}
@@ -982,9 +1007,11 @@
{
DIR *dirp = NULL;
char *path;
- int handle, status = SSH2_FX_FAILURE;
+ int r, handle, status = SSH2_FX_FAILURE;
- path = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: opendir", id);
logit("opendir \"%s\"", path);
dirp = opendir(path);
@@ -1011,9 +1038,11 @@
DIR *dirp;
struct dirent *dp;
char *path;
- int handle;
+ int r, handle;
- handle = get_handle();
+ if ((r = get_handle(iqueue, &handle)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug("request %u: readdir \"%s\" (handle %d)", id,
handle_to_name(handle), handle);
dirp = handle_to_dir(handle);
@@ -1022,7 +1051,7 @@
send_status(id, SSH2_FX_FAILURE);
} else {
struct stat st;
- char pathname[MAXPATHLEN];
+ char pathname[PATH_MAX];
Stat *stats;
int nstats = 10, count = 0, i;
@@ -1030,7 +1059,7 @@
while ((dp = readdir(dirp)) != NULL) {
if (count >= nstats) {
nstats *= 2;
- stats = xrealloc(stats, nstats, sizeof(Stat));
+ stats = xreallocarray(stats, nstats, sizeof(Stat));
}
/* XXX OVERFLOW ? */
snprintf(pathname, sizeof pathname, "%s%s%s", path,
@@ -1063,14 +1092,15 @@
process_remove(u_int32_t id)
{
char *name;
- int status = SSH2_FX_FAILURE;
- int ret;
+ int r, status = SSH2_FX_FAILURE;
- name = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: remove", id);
logit("remove name \"%s\"", name);
- ret = unlink(name);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+ r = unlink(name);
+ status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status);
free(name);
}
@@ -1078,18 +1108,20 @@
static void
process_mkdir(u_int32_t id)
{
- Attrib *a;
+ Attrib a;
char *name;
- int ret, mode, status = SSH2_FX_FAILURE;
+ int r, mode, status = SSH2_FX_FAILURE;
- name = get_string(NULL);
- a = get_attrib();
- mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
- a->perm & 07777 : 0777;
+ if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
+ (r = decode_attrib(iqueue, &a)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
+ mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
+ a.perm & 07777 : 0777;
debug3("request %u: mkdir", id);
logit("mkdir name \"%s\" mode 0%o", name, mode);
- ret = mkdir(name, mode);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+ r = mkdir(name, mode);
+ status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status);
free(name);
}
@@ -1098,13 +1130,15 @@
process_rmdir(u_int32_t id)
{
char *name;
- int ret, status;
+ int r, status;
- name = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: rmdir", id);
logit("rmdir name \"%s\"", name);
- ret = rmdir(name);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+ r = rmdir(name);
+ status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status);
free(name);
}
@@ -1112,10 +1146,13 @@
static void
process_realpath(u_int32_t id)
{
- char resolvedname[MAXPATHLEN];
+ char resolvedname[PATH_MAX];
char *path;
+ int r;
- path = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
if (path[0] == '\0') {
free(path);
path = xstrdup(".");
@@ -1137,11 +1174,13 @@
process_rename(u_int32_t id)
{
char *oldpath, *newpath;
- int status;
+ int r, status;
struct stat sb;
- oldpath = get_string(NULL);
- newpath = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: rename", id);
logit("rename old \"%s\" new \"%s\"", oldpath, newpath);
status = SSH2_FX_FAILURE;
@@ -1194,11 +1233,13 @@
static void
process_readlink(u_int32_t id)
{
- int len;
- char buf[MAXPATHLEN];
+ int r, len;
+ char buf[PATH_MAX];
char *path;
- path = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: readlink", id);
verbose("readlink \"%s\"", path);
if ((len = readlink(path, buf, sizeof(buf) - 1)) == -1)
@@ -1218,15 +1259,17 @@
process_symlink(u_int32_t id)
{
char *oldpath, *newpath;
- int ret, status;
+ int r, status;
- oldpath = get_string(NULL);
- newpath = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: symlink", id);
logit("symlink old \"%s\" new \"%s\"", oldpath, newpath);
/* this will fail if 'newpath' exists */
- ret = symlink(oldpath, newpath);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+ r = symlink(oldpath, newpath);
+ status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status);
free(oldpath);
free(newpath);
@@ -1236,14 +1279,16 @@
process_extended_posix_rename(u_int32_t id)
{
char *oldpath, *newpath;
- int ret, status;
+ int r, status;
- oldpath = get_string(NULL);
- newpath = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: posix-rename", id);
logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath);
- ret = rename(oldpath, newpath);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+ r = rename(oldpath, newpath);
+ status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status);
free(oldpath);
free(newpath);
@@ -1254,8 +1299,10 @@
{
char *path;
struct statvfs st;
+ int r;
- path = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug3("request %u: statvfs", id);
logit("statvfs \"%s\"", path);
@@ -1269,10 +1316,11 @@
static void
process_extended_fstatvfs(u_int32_t id)
{
- int handle, fd;
+ int r, handle, fd;
struct statvfs st;
- handle = get_handle();
+ if ((r = get_handle(iqueue, &handle)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug("request %u: fstatvfs \"%s\" (handle %u)",
id, handle_to_name(handle), handle);
if ((fd = handle_to_fd(handle)) < 0) {
@@ -1289,14 +1337,16 @@
process_extended_hardlink(u_int32_t id)
{
char *oldpath, *newpath;
- int ret, status;
+ int r, status;
- oldpath = get_string(NULL);
- newpath = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
debug3("request %u: hardlink", id);
logit("hardlink old \"%s\" new \"%s\"", oldpath, newpath);
- ret = link(oldpath, newpath);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+ r = link(oldpath, newpath);
+ status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status);
free(oldpath);
free(newpath);
@@ -1305,16 +1355,17 @@
static void
process_extended_fsync(u_int32_t id)
{
- int handle, fd, ret, status = SSH2_FX_OP_UNSUPPORTED;
+ int handle, fd, r, status = SSH2_FX_OP_UNSUPPORTED;
- handle = get_handle();
+ if ((r = get_handle(iqueue, &handle)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug3("request %u: fsync (handle %u)", id, handle);
verbose("fsync \"%s\"", handle_to_name(handle));
if ((fd = handle_to_fd(handle)) < 0)
status = SSH2_FX_NO_SUCH_FILE;
else if (handle_is_ok(handle, HANDLE_FILE)) {
- ret = fsync(fd);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+ r = fsync(fd);
+ status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
}
send_status(id, status);
}
@@ -1323,9 +1374,10 @@
process_extended(u_int32_t id)
{
char *request;
- u_int i;
+ int i, r;
- request = get_string(NULL);
+ if ((r = sshbuf_get_cstring(iqueue, &request, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
for (i = 0; extended_handlers[i].handler != NULL; i++) {
if (strcmp(request, extended_handlers[i].ext_name) == 0) {
if (!request_permitted(&extended_handlers[i]))
@@ -1347,14 +1399,18 @@
static void
process(void)
{
- u_int msg_len, buf_len, consumed, type, i;
- u_char *cp;
+ u_int msg_len;
+ u_int buf_len;
+ u_int consumed;
+ u_char type;
+ const u_char *cp;
+ int i, r;
u_int32_t id;
- buf_len = buffer_len(&iqueue);
+ buf_len = sshbuf_len(iqueue);
if (buf_len < 5)
return; /* Incomplete message. */
- cp = buffer_ptr(&iqueue);
+ cp = sshbuf_ptr(iqueue);
msg_len = get_u32(cp);
if (msg_len > SFTP_MAX_MSG_LENGTH) {
error("bad message from %s local user %s",
@@ -1363,9 +1419,11 @@
}
if (buf_len < msg_len + 4)
return;
- buffer_consume(&iqueue, 4);
+ if ((r = sshbuf_consume(iqueue, 4)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
buf_len -= 4;
- type = buffer_get_char(&iqueue);
+ if ((r = sshbuf_get_u8(iqueue, &type)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
switch (type) {
case SSH2_FXP_INIT:
@@ -1375,13 +1433,15 @@
case SSH2_FXP_EXTENDED:
if (!init_done)
fatal("Received extended request before init");
- id = get_int();
+ if ((r = sshbuf_get_u32(iqueue, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
process_extended(id);
break;
default:
if (!init_done)
fatal("Received %u request before init", type);
- id = get_int();
+ if ((r = sshbuf_get_u32(iqueue, &id)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
for (i = 0; handlers[i].handler != NULL; i++) {
if (type == handlers[i].type) {
if (!request_permitted(&handlers[i])) {
@@ -1397,17 +1457,18 @@
error("Unknown message %u", type);
}
/* discard the remaining bytes from the current packet */
- if (buf_len < buffer_len(&iqueue)) {
+ if (buf_len < sshbuf_len(iqueue)) {
error("iqueue grew unexpectedly");
sftp_server_cleanup_exit(255);
}
- consumed = buf_len - buffer_len(&iqueue);
+ consumed = buf_len - sshbuf_len(iqueue);
if (msg_len < consumed) {
error("msg_len %u < consumed %u", msg_len, consumed);
sftp_server_cleanup_exit(255);
}
- if (msg_len > consumed)
- buffer_consume(&iqueue, msg_len - consumed);
+ if (msg_len > consumed &&
+ (r = sshbuf_consume(iqueue, msg_len - consumed)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
}
/* Cleanup handler that logs active handles upon normal exit */
@@ -1440,7 +1501,7 @@
sftp_server_main(int argc, char **argv, struct passwd *user_pw)
{
fd_set *rset, *wset;
- int i, in, out, max, ch, skipargs = 0, log_stderr = 0;
+ int i, r, in, out, max, ch, skipargs = 0, log_stderr = 0;
ssize_t len, olen, set_size;
SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
char *cp, *homedir = NULL, buf[4*4096];
@@ -1449,6 +1510,7 @@
extern char *optarg;
extern char *__progname;
+ ssh_malloc_init(); /* must be called before any mallocs */
__progname = ssh_get_progname(argv[0]);
log_init(__progname, log_level, log_facility, log_stderr);
@@ -1523,6 +1585,17 @@
log_init(__progname, log_level, log_facility, log_stderr);
+ /*
+ * On platforms where we can, avoid making /proc/self/{mem,maps}
+ * available to the user so that sftp access doesn't automatically
+ * imply arbitrary code execution access that will break
+ * restricted configurations.
+ */
+ platform_disable_tracing(1); /* strict */
+
+ /* Drop any fine-grained privileges we don't need */
+ platform_pledge_sftp_server();
+
if ((cp = getenv("SSH_CONNECTION")) != NULL) {
client_addr = xstrdup(cp);
if ((cp = strchr(client_addr, ' ')) == NULL) {
@@ -1551,12 +1624,13 @@
if (out > max)
max = out;
- buffer_init(&iqueue);
- buffer_init(&oqueue);
+ if ((iqueue = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((oqueue = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
- set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
- rset = (fd_set *)xmalloc(set_size);
- wset = (fd_set *)xmalloc(set_size);
+ rset = xcalloc(howmany(max + 1, NFDBITS), sizeof(fd_mask));
+ wset = xcalloc(howmany(max + 1, NFDBITS), sizeof(fd_mask));
if (homedir != NULL) {
if (chdir(homedir) != 0) {
@@ -1565,6 +1639,7 @@
}
}
+ set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
for (;;) {
memset(rset, 0, set_size);
memset(wset, 0, set_size);
@@ -1574,11 +1649,15 @@
* the worst-case length packet it can generate,
* otherwise apply backpressure by stopping reads.
*/
- if (buffer_check_alloc(&iqueue, sizeof(buf)) &&
- buffer_check_alloc(&oqueue, SFTP_MAX_MSG_LENGTH))
+ if ((r = sshbuf_check_reserve(iqueue, sizeof(buf))) == 0 &&
+ (r = sshbuf_check_reserve(oqueue,
+ SFTP_MAX_MSG_LENGTH)) == 0)
FD_SET(in, rset);
+ else if (r != SSH_ERR_NO_BUFFER_SPACE)
+ fatal("%s: sshbuf_check_reserve failed: %s",
+ __func__, ssh_err(r));
- olen = buffer_len(&oqueue);
+ olen = sshbuf_len(oqueue);
if (olen > 0)
FD_SET(out, wset);
@@ -1598,18 +1677,20 @@
} else if (len < 0) {
error("read: %s", strerror(errno));
sftp_server_cleanup_exit(1);
- } else {
- buffer_append(&iqueue, buf, len);
+ } else if ((r = sshbuf_put(iqueue, buf, len)) != 0) {
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
}
}
/* send oqueue to stdout */
if (FD_ISSET(out, wset)) {
- len = write(out, buffer_ptr(&oqueue), olen);
+ len = write(out, sshbuf_ptr(oqueue), olen);
if (len < 0) {
error("write: %s", strerror(errno));
sftp_server_cleanup_exit(1);
- } else {
- buffer_consume(&oqueue, len);
+ } else if ((r = sshbuf_consume(oqueue, len)) != 0) {
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
}
}
@@ -1618,7 +1699,11 @@
* into the output buffer, otherwise stop processing input
* and let the output queue drain.
*/
- if (buffer_check_alloc(&oqueue, SFTP_MAX_MSG_LENGTH))
+ r = sshbuf_check_reserve(oqueue, SFTP_MAX_MSG_LENGTH);
+ if (r == 0)
process();
+ else if (r != SSH_ERR_NO_BUFFER_SPACE)
+ fatal("%s: sshbuf_check_reserve: %s",
+ __func__, ssh_err(r));
}
}
Modified: trunk/crypto/openssh/sftp.0
===================================================================
--- trunk/crypto/openssh/sftp.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-SFTP(1) OpenBSD Reference Manual SFTP(1)
+SFTP(1) General Commands Manual SFTP(1)
NAME
- sftp - secure file transfer program
+ sftp M-bM-^@M-^S secure file transfer program
SYNOPSIS
sftp [-1246aCfpqrv] [-B buffer_size] [-b batchfile] [-c cipher]
@@ -44,9 +44,9 @@
-6 Forces sftp to use IPv6 addresses only.
- -a Attempt to continue interrupted downloads rather than overwriting
- existing partial or complete copies of files. If the remote file
- contents differ from the partial local copy then the resultant
+ -a Attempt to continue interrupted transfers rather than overwriting
+ existing partial or complete copies of files. If the partial
+ contents differ from those being transferred, then the resultant
file is likely to be corrupt.
-B buffer_size
@@ -58,12 +58,13 @@
Batch mode reads a series of commands from an input batchfile
instead of stdin. Since it lacks user interaction it should be
used in conjunction with non-interactive authentication. A
- batchfile of `-' may be used to indicate standard input. sftp
+ batchfile of M-bM-^@M-^X-M-bM-^@M-^Y may be used to indicate standard input. sftp
will abort if any of the following commands fail: get, put,
- reget, rename, ln, rm, mkdir, chdir, ls, lchdir, chmod, chown,
- chgrp, lpwd, df, symlink, and lmkdir. Termination on error can
- be suppressed on a command by command basis by prefixing the
- command with a `-' character (for example, -rm /tmp/blah*).
+ reget, reput, rename, ln, rm, mkdir, chdir, ls, lchdir, chmod,
+ chown, chgrp, lpwd, df, symlink, and lmkdir. Termination on
+ error can be suppressed on a command by command basis by
+ prefixing the command with a M-bM-^@M-^X-M-bM-^@M-^Y character (for example, -rm
+ /tmp/blah*).
-C Enables compression (via ssh's -C flag).
@@ -107,6 +108,7 @@
CanonicalizeHostname
CanonicalizeMaxDots
CanonicalizePermittedCNAMEs
+ CertificateFile
ChallengeResponseAuthentication
CheckHostIP
Cipher
@@ -124,11 +126,13 @@
HashKnownHosts
Host
HostbasedAuthentication
+ HostbasedKeyTypes
HostKeyAlgorithms
HostKeyAlias
HostName
+ IdentitiesOnly
+ IdentityAgent
IdentityFile
- IdentitiesOnly
IPQoS
KbdInteractiveAuthentication
KbdInteractiveDevices
@@ -143,6 +147,7 @@
PreferredAuthentications
Protocol
ProxyCommand
+ ProxyJump
PubkeyAuthentication
RekeyLimit
RhostsRSAAuthentication
@@ -152,6 +157,7 @@
ServerAliveCountMax
StrictHostKeyChecking
TCPKeepAlive
+ UpdateHostKeys
UsePrivilegedPort
User
UserKnownHostsFile
@@ -192,7 +198,7 @@
those of ftp(1). Commands are case insensitive. Pathnames that contain
spaces must be enclosed in quotes. Any special characters contained
within pathnames that are recognized by glob(3) must be escaped with
- backslashes (`\').
+ backslashes (M-bM-^@M-^X\M-bM-^@M-^Y).
bye Quit sftp.
@@ -219,7 +225,7 @@
the capacity information will be displayed using "human-readable"
suffixes. The -i flag requests display of inode information in
addition to capacity information. This command is only supported
- on servers that implement the ``statvfs at openssh.com'' extension.
+ on servers that implement the M-bM-^@M-^\statvfs at openssh.comM-bM-^@M-^] extension.
exit Quit sftp.
@@ -278,7 +284,7 @@
-1 Produce single columnar output.
- -a List files beginning with a dot (`.').
+ -a List files beginning with a dot (M-bM-^@M-^X.M-bM-^@M-^Y).
-f Do not sort the listing. The default sort order is
lexicographical.
@@ -310,7 +316,7 @@
progress
Toggle display of progress meter.
- put [-fPpr] local-path [remote-path]
+ put [-afPpr] local-path [remote-path]
Upload local-path and store it on the remote machine. If the
remote path name is not specified, it is given the same name it
has on the local machine. local-path may contain glob(3)
@@ -318,6 +324,12 @@
remote-path is specified, then remote-path must specify a
directory.
+ If the -a flag is specified, then attempt to resume partial
+ transfers of existing files. Note that resumption assumes that
+ any partial copy of the remote file matches the local copy. If
+ the local file contents differ from the remote local copy then
+ the resultant file is likely to be corrupt.
+
If the -f flag is specified, then a request will be sent to the
server to call fsync(2) after the file has been transferred.
Note that this is only supported by servers that implement the
@@ -338,6 +350,10 @@
Resume download of remote-path. Equivalent to get with the -a
flag set.
+ reput [-Ppr] [local-path] remote-path
+ Resume upload of [local-path]. Equivalent to put with the -a
+ flag set.
+
rename oldpath newpath
Rename remote file from oldpath to newpath.
@@ -367,4 +383,4 @@
T. Ylonen and S. Lehtinen, SSH File Transfer Protocol, draft-ietf-secsh-
filexfer-00.txt, January 2001, work in progress material.
-OpenBSD 5.5 October 20, 2013 OpenBSD 5.5
+OpenBSD 6.0 July 16, 2016 OpenBSD 6.0
Modified: trunk/crypto/openssh/sftp.1
===================================================================
--- trunk/crypto/openssh/sftp.1 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp.1 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp.1,v 1.97 2013/10/20 09:51:26 djm Exp $
+.\" $OpenBSD: sftp.1,v 1.105 2016/07/16 06:57:55 jmc Exp $
.\"
.\" Copyright (c) 2001 Damien Miller. All rights reserved.
.\"
@@ -22,7 +22,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: October 20 2013 $
+.Dd $Mdocdate: July 16 2016 $
.Dt SFTP 1
.Os
.Sh NAME
@@ -108,10 +108,10 @@
.Nm
to use IPv6 addresses only.
.It Fl a
-Attempt to continue interrupted downloads rather than overwriting existing
-partial or complete copies of files.
-If the remote file contents differ from the partial local copy then the
-resultant file is likely to be corrupt.
+Attempt to continue interrupted transfers rather than overwriting
+existing partial or complete copies of files.
+If the partial contents differ from those being transferred,
+then the resultant file is likely to be corrupt.
.It Fl B Ar buffer_size
Specify the size of the buffer that
.Nm
@@ -134,7 +134,7 @@
.Nm
will abort if any of the following
commands fail:
-.Ic get , put , reget , rename , ln ,
+.Ic get , put , reget , reput, rename , ln ,
.Ic rm , mkdir , chdir , ls ,
.Ic lchdir , chmod , chown ,
.Ic chgrp , lpwd , df , symlink ,
@@ -198,6 +198,7 @@
.It CanonicalizeHostname
.It CanonicalizeMaxDots
.It CanonicalizePermittedCNAMEs
+.It CertificateFile
.It ChallengeResponseAuthentication
.It CheckHostIP
.It Cipher
@@ -215,11 +216,13 @@
.It HashKnownHosts
.It Host
.It HostbasedAuthentication
+.It HostbasedKeyTypes
.It HostKeyAlgorithms
.It HostKeyAlias
.It HostName
+.It IdentitiesOnly
+.It IdentityAgent
.It IdentityFile
-.It IdentitiesOnly
.It IPQoS
.It KbdInteractiveAuthentication
.It KbdInteractiveDevices
@@ -234,6 +237,7 @@
.It PreferredAuthentications
.It Protocol
.It ProxyCommand
+.It ProxyJump
.It PubkeyAuthentication
.It RekeyLimit
.It RhostsRSAAuthentication
@@ -243,6 +247,7 @@
.It ServerAliveCountMax
.It StrictHostKeyChecking
.It TCPKeepAlive
+.It UpdateHostKeys
.It UsePrivilegedPort
.It User
.It UserKnownHostsFile
@@ -495,7 +500,7 @@
.It Ic progress
Toggle display of progress meter.
.It Xo Ic put
-.Op Fl fPpr
+.Op Fl afPpr
.Ar local-path
.Op Ar remote-path
.Xc
@@ -515,6 +520,15 @@
must specify a directory.
.Pp
If the
+.Fl a
+flag is specified, then attempt to resume partial
+transfers of existing files.
+Note that resumption assumes that any partial copy of the remote file
+matches the local copy.
+If the local file contents differ from the remote local copy then
+the resultant file is likely to be corrupt.
+.Pp
+If the
.Fl f
flag is specified, then a request will be sent to the server to call
.Xr fsync 2
@@ -552,6 +566,18 @@
with the
.Fl a
flag set.
+.It Xo Ic reput
+.Op Fl Ppr
+.Op Ar local-path
+.Ar remote-path
+.Xc
+Resume upload of
+.Op Ar local-path .
+Equivalent to
+.Ic put
+with the
+.Fl a
+flag set.
.It Ic rename Ar oldpath Ar newpath
Rename remote file from
.Ar oldpath
Modified: trunk/crypto/openssh/sftp.c
===================================================================
--- trunk/crypto/openssh/sftp.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sftp.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.158 2013/11/20 20:54:10 deraadt Exp $ */
+/* $OpenBSD: sftp.c,v 1.175 2016/07/22 03:47:36 djm Exp $ */
/*
* Copyright (c) 2001-2004 Damien Miller <djm at openbsd.org>
*
@@ -17,6 +17,7 @@
#include "includes.h"
+#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
#include <sys/ioctl.h>
#ifdef HAVE_SYS_STAT_H
@@ -46,7 +47,9 @@
#else
typedef void EditLine;
#endif
+#include <limits.h>
#include <signal.h>
+#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
@@ -61,9 +64,11 @@
#include "log.h"
#include "pathnames.h"
#include "misc.h"
+#include "utf8.h"
#include "sftp.h"
-#include "buffer.h"
+#include "ssherr.h"
+#include "sshbuf.h"
#include "sftp-common.h"
#include "sftp-client.h"
@@ -88,7 +93,7 @@
/* When this option is set, we always recursively download/upload directories */
int global_rflag = 0;
-/* When this option is set, we resume download if possible */
+/* When this option is set, we resume download or upload if possible */
int global_aflag = 0;
/* When this option is set, the file transfers will always preserve times */
@@ -151,7 +156,9 @@
I_PUT,
I_PWD,
I_QUIT,
+ I_REGET,
I_RENAME,
+ I_REPUT,
I_RM,
I_RMDIR,
I_SHELL,
@@ -158,7 +165,6 @@
I_SYMLINK,
I_VERSION,
I_PROGRESS,
- I_REGET,
};
struct CMD {
@@ -201,6 +207,7 @@
{ "quit", I_QUIT, NOARGS },
{ "reget", I_REGET, REMOTE },
{ "rename", I_RENAME, REMOTE },
+ { "reput", I_REPUT, LOCAL },
{ "rm", I_RM, REMOTE },
{ "rmdir", I_RMDIR, REMOTE },
{ "symlink", I_SYMLINK, REMOTE },
@@ -248,8 +255,9 @@
"df [-hi] [path] Display statistics for current directory or\n"
" filesystem containing 'path'\n"
"exit Quit sftp\n"
- "get [-Ppr] remote [local] Download file\n"
- "reget remote [local] Resume download file\n"
+ "get [-afPpRr] remote [local] Download file\n"
+ "reget [-fPpRr] remote [local] Resume download file\n"
+ "reput [-fPpRr] [local] remote Resume upload file\n"
"help Display this help text\n"
"lcd path Change local directory to 'path'\n"
"lls [ls-options [path]] Display local directory listing\n"
@@ -260,7 +268,7 @@
"lumask umask Set local umask to 'umask'\n"
"mkdir path Create remote directory\n"
"progress Toggle display of progress meter\n"
- "put [-Ppr] local [remote] Upload file\n"
+ "put [-afPpRr] local [remote] Upload file\n"
"pwd Display remote working directory\n"
"quit Quit sftp\n"
"rename oldpath newpath Rename remote file\n"
@@ -329,7 +337,7 @@
/* Strip one path (usually the pwd) from the start of another */
static char *
-path_strip(char *path, char *strip)
+path_strip(const char *path, const char *strip)
{
size_t len;
@@ -347,7 +355,7 @@
}
static char *
-make_absolute(char *p, char *pwd)
+make_absolute(char *p, const char *pwd)
{
char *abs_str;
@@ -545,7 +553,7 @@
}
static int
-is_dir(char *path)
+is_dir(const char *path)
{
struct stat sb;
@@ -557,7 +565,7 @@
}
static int
-remote_is_dir(struct sftp_conn *conn, char *path)
+remote_is_dir(struct sftp_conn *conn, const char *path)
{
Attrib *a;
@@ -571,7 +579,7 @@
/* Check whether path returned from glob(..., GLOB_MARK, ...) is a directory */
static int
-pathname_is_dir(char *pathname)
+pathname_is_dir(const char *pathname)
{
size_t l = strlen(pathname);
@@ -579,14 +587,14 @@
}
static int
-process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd,
- int pflag, int rflag, int resume, int fflag)
+process_get(struct sftp_conn *conn, const char *src, const char *dst,
+ const char *pwd, int pflag, int rflag, int resume, int fflag)
{
char *abs_src = NULL;
char *abs_dst = NULL;
glob_t g;
char *filename, *tmp=NULL;
- int i, err = 0;
+ int i, r, err = 0;
abs_src = xstrdup(src);
abs_src = make_absolute(abs_src, pwd);
@@ -593,8 +601,12 @@
memset(&g, 0, sizeof(g));
debug3("Looking up %s", abs_src);
- if (remote_glob(conn, abs_src, GLOB_MARK, NULL, &g)) {
- error("File \"%s\" not found.", abs_src);
+ if ((r = remote_glob(conn, abs_src, GLOB_MARK, NULL, &g)) != 0) {
+ if (r == GLOB_NOSPACE) {
+ error("Too many matches for \"%s\".", abs_src);
+ } else {
+ error("File \"%s\" not found.", abs_src);
+ }
err = -1;
goto out;
}
@@ -634,9 +646,11 @@
resume |= global_aflag;
if (!quiet && resume)
- printf("Resuming %s to %s\n", g.gl_pathv[i], abs_dst);
+ mprintf("Resuming %s to %s\n",
+ g.gl_pathv[i], abs_dst);
else if (!quiet && !resume)
- printf("Fetching %s to %s\n", g.gl_pathv[i], abs_dst);
+ mprintf("Fetching %s to %s\n",
+ g.gl_pathv[i], abs_dst);
if (pathname_is_dir(g.gl_pathv[i]) && (rflag || global_rflag)) {
if (download_dir(conn, g.gl_pathv[i], abs_dst, NULL,
pflag || global_pflag, 1, resume,
@@ -659,8 +673,8 @@
}
static int
-process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd,
- int pflag, int rflag, int fflag)
+process_put(struct sftp_conn *conn, const char *src, const char *dst,
+ const char *pwd, int pflag, int rflag, int resume, int fflag)
{
char *tmp_dst = NULL;
char *abs_dst = NULL;
@@ -723,16 +737,21 @@
}
free(tmp);
- if (!quiet)
- printf("Uploading %s to %s\n", g.gl_pathv[i], abs_dst);
+ resume |= global_aflag;
+ if (!quiet && resume)
+ mprintf("Resuming upload of %s to %s\n",
+ g.gl_pathv[i], abs_dst);
+ else if (!quiet && !resume)
+ mprintf("Uploading %s to %s\n",
+ g.gl_pathv[i], abs_dst);
if (pathname_is_dir(g.gl_pathv[i]) && (rflag || global_rflag)) {
if (upload_dir(conn, g.gl_pathv[i], abs_dst,
- pflag || global_pflag, 1,
+ pflag || global_pflag, 1, resume,
fflag || global_fflag) == -1)
err = -1;
} else {
if (do_upload(conn, g.gl_pathv[i], abs_dst,
- pflag || global_pflag,
+ pflag || global_pflag, resume,
fflag || global_fflag) == -1)
err = -1;
}
@@ -765,7 +784,8 @@
/* sftp ls.1 replacement for directories */
static int
-do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
+do_ls_dir(struct sftp_conn *conn, const char *path,
+ const char *strip_path, int lflag)
{
int n;
u_int c = 1, colspace = 0, columns = 1;
@@ -825,12 +845,12 @@
attrib_to_stat(&d[n]->a, &sb);
lname = ls_file(fname, &sb, 1,
(lflag & LS_SI_UNITS));
- printf("%s\n", lname);
+ mprintf("%s\n", lname);
free(lname);
} else
- printf("%s\n", d[n]->longname);
+ mprintf("%s\n", d[n]->longname);
} else {
- printf("%-*s", colspace, fname);
+ mprintf("%-*s", colspace, fname);
if (c >= columns) {
printf("\n");
c = 1;
@@ -850,24 +870,28 @@
/* sftp ls.1 replacement which handles path globs */
static int
-do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
- int lflag)
+do_globbed_ls(struct sftp_conn *conn, const char *path,
+ const char *strip_path, int lflag)
{
char *fname, *lname;
glob_t g;
- int err;
+ int err, r;
struct winsize ws;
u_int i, c = 1, colspace = 0, columns = 1, m = 0, width = 80;
memset(&g, 0, sizeof(g));
- if (remote_glob(conn, path,
+ if ((r = remote_glob(conn, path,
GLOB_MARK|GLOB_NOCHECK|GLOB_BRACE|GLOB_KEEPSTAT|GLOB_NOSORT,
- NULL, &g) ||
+ NULL, &g)) != 0 ||
(g.gl_pathc && !g.gl_matchc)) {
if (g.gl_pathc)
globfree(&g);
- error("Can't ls: \"%s\" not found", path);
+ if (r == GLOB_NOSPACE) {
+ error("Can't ls: Too many matches for \"%s\"", path);
+ } else {
+ error("Can't ls: \"%s\" not found", path);
+ }
return -1;
}
@@ -907,10 +931,10 @@
}
lname = ls_file(fname, g.gl_statv[i], 1,
(lflag & LS_SI_UNITS));
- printf("%s\n", lname);
+ mprintf("%s\n", lname);
free(lname);
} else {
- printf("%-*s", colspace, fname);
+ mprintf("%-*s", colspace, fname);
if (c >= columns) {
printf("\n");
c = 1;
@@ -931,7 +955,7 @@
}
static int
-do_df(struct sftp_conn *conn, char *path, int hflag, int iflag)
+do_df(struct sftp_conn *conn, const char *path, int hflag, int iflag)
{
struct sftp_statvfs st;
char s_used[FMT_SCALED_STRSIZE];
@@ -1186,8 +1210,9 @@
}
static int
-parse_args(const char **cpp, int *ignore_errors, int *aflag, int *fflag,
- int *hflag, int *iflag, int *lflag, int *pflag, int *rflag, int *sflag,
+parse_args(const char **cpp, int *ignore_errors, int *aflag,
+ int *fflag, int *hflag, int *iflag, int *lflag, int *pflag,
+ int *rflag, int *sflag,
unsigned long *n_arg, char **path1, char **path2)
{
const char *cmd, *cp = *cpp;
@@ -1239,6 +1264,7 @@
switch (cmdnum) {
case I_GET:
case I_REGET:
+ case I_REPUT:
case I_PUT:
if ((optidx = parse_getput_flags(cmd, argv, argc,
aflag, fflag, pflag, rflag)) == -1)
@@ -1256,11 +1282,6 @@
/* Destination is not globbed */
undo_glob_escape(*path2);
}
- if (*aflag && cmdnum == I_PUT) {
- /* XXX implement resume for uploads */
- error("Resume is not supported for uploads");
- return -1;
- }
break;
case I_LINK:
if ((optidx = parse_link_flags(cmd, argv, argc, sflag)) == -1)
@@ -1382,12 +1403,13 @@
int err_abort)
{
char *path1, *path2, *tmp;
- int ignore_errors = 0, aflag = 0, fflag = 0, hflag = 0, iflag = 0;
+ int ignore_errors = 0, aflag = 0, fflag = 0, hflag = 0,
+ iflag = 0;
int lflag = 0, pflag = 0, rflag = 0, sflag = 0;
int cmdnum, i;
unsigned long n_arg = 0;
Attrib a, *aa;
- char path_buf[MAXPATHLEN];
+ char path_buf[PATH_MAX];
int err = 0;
glob_t g;
@@ -1415,9 +1437,12 @@
err = process_get(conn, path1, path2, *pwd, pflag,
rflag, aflag, fflag);
break;
+ case I_REPUT:
+ aflag = 1;
+ /* FALLTHROUGH */
case I_PUT:
err = process_put(conn, path1, path2, *pwd, pflag,
- rflag, fflag);
+ rflag, aflag, fflag);
break;
case I_RENAME:
path1 = make_absolute(path1, *pwd);
@@ -1437,7 +1462,7 @@
remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
if (!quiet)
- printf("Removing %s\n", g.gl_pathv[i]);
+ mprintf("Removing %s\n", g.gl_pathv[i]);
err = do_rm(conn, g.gl_pathv[i]);
if (err != 0 && err_abort)
break;
@@ -1503,6 +1528,9 @@
err = do_df(conn, path1, hflag, iflag);
break;
case I_LCHDIR:
+ tmp = tilde_expand_filename(path1, getuid());
+ free(path1);
+ path1 = tmp;
if (chdir(path1) == -1) {
error("Couldn't change local directory to "
"\"%s\": %s", path1, strerror(errno));
@@ -1534,7 +1562,8 @@
remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
if (!quiet)
- printf("Changing mode on %s\n", g.gl_pathv[i]);
+ mprintf("Changing mode on %s\n",
+ g.gl_pathv[i]);
err = do_setstat(conn, g.gl_pathv[i], &a);
if (err != 0 && err_abort)
break;
@@ -1564,12 +1593,12 @@
aa->flags &= SSH2_FILEXFER_ATTR_UIDGID;
if (cmdnum == I_CHOWN) {
if (!quiet)
- printf("Changing owner on %s\n",
+ mprintf("Changing owner on %s\n",
g.gl_pathv[i]);
aa->uid = n_arg;
} else {
if (!quiet)
- printf("Changing group on %s\n",
+ mprintf("Changing group on %s\n",
g.gl_pathv[i]);
aa->gid = n_arg;
}
@@ -1579,7 +1608,7 @@
}
break;
case I_PWD:
- printf("Remote working directory: %s\n", *pwd);
+ mprintf("Remote working directory: %s\n", *pwd);
break;
case I_LPWD:
if (!getcwd(path_buf, sizeof(path_buf))) {
@@ -1587,7 +1616,7 @@
err = -1;
break;
}
- printf("Local working directory: %s\n", path_buf);
+ mprintf("Local working directory: %s\n", path_buf);
break;
case I_QUIT:
/* Processed below */
@@ -1656,7 +1685,7 @@
for (y = 0; list[y]; y++) {
llen = strlen(list[y]);
tmp = llen > len ? list[y] + len : "";
- printf("%-*s", colspace, tmp);
+ mprintf("%-*s", colspace, tmp);
if (m >= columns) {
printf("\n");
m = 1;
@@ -1834,6 +1863,7 @@
pwdlen = tmplen + 1; /* track last seen '/' */
}
free(tmp);
+ tmp = NULL;
if (g.gl_matchc == 0)
goto out;
@@ -1841,7 +1871,6 @@
if (g.gl_matchc > 1)
complete_display(g.gl_pathv, pwdlen);
- tmp = NULL;
/* Don't try to extend globs */
if (file == NULL || hadglob)
goto out;
@@ -1904,7 +1933,7 @@
lf = el_line(el);
if (g.gl_matchc == 1) {
i = 0;
- if (!terminated)
+ if (!terminated && quote != '\0')
ins[i++] = quote;
if (*(lf->cursor - 1) != '/' &&
(lastarg || *(lf->cursor) != ' '))
@@ -1936,7 +1965,7 @@
/* Figure out which argument the cursor points to */
cursor = lf->cursor - lf->buffer;
- line = (char *)xmalloc(cursor + 1);
+ line = xmalloc(cursor + 1);
memcpy(line, lf->buffer, cursor);
line[cursor] = '\0';
argv = makeargv(line, &carg, 1, "e, &terminated);
@@ -1944,7 +1973,7 @@
/* Get all the arguments on the line */
len = lf->lastchar - lf->buffer;
- line = (char *)xmalloc(len + 1);
+ line = xmalloc(len + 1);
memcpy(line, lf->buffer, len);
line[len] = '\0';
argv = makeargv(line, &argc, 1, NULL, NULL);
@@ -2040,7 +2069,7 @@
if (remote_is_dir(conn, dir) && file2 == NULL) {
if (!quiet)
- printf("Changing to: %s\n", dir);
+ mprintf("Changing to: %s\n", dir);
snprintf(cmd, sizeof cmd, "cd \"%s\"", dir);
if (parse_dispatch_command(conn, cmd,
&remote_path, 1) != 0) {
@@ -2065,8 +2094,8 @@
free(dir);
}
- setlinebuf(stdout);
- setlinebuf(infile);
+ setvbuf(stdout, NULL, _IOLBF, 0);
+ setvbuf(infile, NULL, _IOLBF, 0);
interactive = !batchmode && isatty(STDIN_FILENO);
err = 0;
@@ -2084,7 +2113,7 @@
break;
}
if (!interactive) { /* Echo command */
- printf("sftp> %s", cmd);
+ mprintf("sftp> %s", cmd);
if (strlen(cmd) > 0 &&
cmd[strlen(cmd) - 1] != '\n')
printf("\n");
@@ -2226,6 +2255,7 @@
size_t num_requests = DEFAULT_NUM_REQUESTS;
long long limit_kbps = 0;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
setlocale(LC_CTYPE, "");
Modified: trunk/crypto/openssh/ssh-add.0
===================================================================
--- trunk/crypto/openssh/ssh-add.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-add.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,10 +1,10 @@
-SSH-ADD(1) OpenBSD Reference Manual SSH-ADD(1)
+SSH-ADD(1) General Commands Manual SSH-ADD(1)
NAME
- ssh-add - adds private key identities to the authentication agent
+ ssh-add M-bM-^@M-^S adds private key identities to the authentication agent
SYNOPSIS
- ssh-add [-cDdkLlXx] [-t life] [file ...]
+ ssh-add [-cDdkLlXx] [-E fingerprint_hash] [-t life] [file ...]
ssh-add -s pkcs11
ssh-add -e pkcs11
@@ -29,9 +29,9 @@
-c Indicates that added identities should be subject to confirmation
before being used for authentication. Confirmation is performed
- by the SSH_ASKPASS program mentioned below. Successful
- confirmation is signaled by a zero exit status from the
- SSH_ASKPASS program, rather than text entered into the requester.
+ by ssh-askpass(1). Successful confirmation is signaled by a zero
+ exit status from ssh-askpass(1), rather than text entered into
+ the requester.
-D Deletes all identities from the agent.
@@ -43,6 +43,11 @@
certificates to be removed from the agent. If no public key is
found at a given path, ssh-add will append .pub and retry.
+ -E fingerprint_hash
+ Specifies the hash algorithm used when displaying key
+ fingerprints. Valid options are: M-bM-^@M-^\md5M-bM-^@M-^] and M-bM-^@M-^\sha256M-bM-^@M-^]. The
+ default is M-bM-^@M-^\sha256M-bM-^@M-^].
+
-e pkcs11
Remove keys provided by the PKCS#11 shared library pkcs11.
@@ -73,10 +78,11 @@
the current terminal if it was run from a terminal. If ssh-add
does not have a terminal associated with it but DISPLAY and
SSH_ASKPASS are set, it will execute the program specified by
- SSH_ASKPASS and open an X11 window to read the passphrase. This
- is particularly useful when calling ssh-add from a .xsession or
- related script. (Note that on some machines it may be necessary
- to redirect the input from /dev/null to make this work.)
+ SSH_ASKPASS (by default M-bM-^@M-^\ssh-askpassM-bM-^@M-^]) and open an X11 window to
+ read the passphrase. This is particularly useful when calling
+ ssh-add from a .xsession or related script. (Note that on some
+ machines it may be necessary to redirect the input from /dev/null
+ to make this work.)
SSH_AUTH_SOCK
Identifies the path of a UNIX-domain socket used to communicate
@@ -96,7 +102,7 @@
the user.
~/.ssh/id_ed25519
- Contains the protocol version 2 ED25519 authentication identity
+ Contains the protocol version 2 Ed25519 authentication identity
of the user.
~/.ssh/id_rsa
@@ -111,7 +117,7 @@
ssh-add is unable to contact the authentication agent.
SEE ALSO
- ssh(1), ssh-agent(1), ssh-keygen(1), sshd(8)
+ ssh(1), ssh-agent(1), ssh-askpass(1), ssh-keygen(1), sshd(8)
AUTHORS
OpenSSH is a derivative of the original and free ssh 1.2.12 release by
@@ -120,4 +126,4 @@
created OpenSSH. Markus Friedl contributed the support for SSH protocol
versions 1.5 and 2.0.
-OpenBSD 5.5 December 7, 2013 OpenBSD 5.5
+OpenBSD 6.0 March 30, 2015 OpenBSD 6.0
Modified: trunk/crypto/openssh/ssh-add.1
===================================================================
--- trunk/crypto/openssh/ssh-add.1 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-add.1 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-add.1,v 1.59 2013/12/07 11:58:46 naddy Exp $
+.\" $OpenBSD: ssh-add.1,v 1.62 2015/03/30 18:28:37 jmc Exp $
.\"
.\" Author: Tatu Ylonen <ylo at cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: December 7 2013 $
+.Dd $Mdocdate: March 30 2015 $
.Dt SSH-ADD 1
.Os
.Sh NAME
@@ -44,6 +44,7 @@
.Sh SYNOPSIS
.Nm ssh-add
.Op Fl cDdkLlXx
+.Op Fl E Ar fingerprint_hash
.Op Fl t Ar life
.Op Ar
.Nm ssh-add
@@ -87,12 +88,11 @@
.It Fl c
Indicates that added identities should be subject to confirmation before
being used for authentication.
-Confirmation is performed by the
-.Ev SSH_ASKPASS
-program mentioned below.
-Successful confirmation is signaled by a zero exit status from the
-.Ev SSH_ASKPASS
-program, rather than text entered into the requester.
+Confirmation is performed by
+.Xr ssh-askpass 1 .
+Successful confirmation is signaled by a zero exit status from
+.Xr ssh-askpass 1 ,
+rather than text entered into the requester.
.It Fl D
Deletes all identities from the agent.
.It Fl d
@@ -108,6 +108,14 @@
will append
.Pa .pub
and retry.
+.It Fl E Ar fingerprint_hash
+Specifies the hash algorithm used when displaying key fingerprints.
+Valid options are:
+.Dq md5
+and
+.Dq sha256 .
+The default is
+.Dq sha256 .
.It Fl e Ar pkcs11
Remove keys provided by the PKCS#11 shared library
.Ar pkcs11 .
@@ -147,6 +155,8 @@
.Ev SSH_ASKPASS
are set, it will execute the program specified by
.Ev SSH_ASKPASS
+(by default
+.Dq ssh-askpass )
and open an X11 window to read the passphrase.
This is particularly useful when calling
.Nm
@@ -171,7 +181,7 @@
.It Pa ~/.ssh/id_ecdsa
Contains the protocol version 2 ECDSA authentication identity of the user.
.It Pa ~/.ssh/id_ed25519
-Contains the protocol version 2 ED25519 authentication identity of the user.
+Contains the protocol version 2 Ed25519 authentication identity of the user.
.It Pa ~/.ssh/id_rsa
Contains the protocol version 2 RSA authentication identity of the user.
.El
@@ -188,6 +198,7 @@
.Sh SEE ALSO
.Xr ssh 1 ,
.Xr ssh-agent 1 ,
+.Xr ssh-askpass 1 ,
.Xr ssh-keygen 1 ,
.Xr sshd 8
.Sh AUTHORS
Modified: trunk/crypto/openssh/ssh-add.c
===================================================================
--- trunk/crypto/openssh/ssh-add.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-add.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.109 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.128 2016/02/15 09:47:49 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -39,11 +39,11 @@
#include <sys/types.h>
#include <sys/stat.h>
-#include <sys/param.h>
#include <openssl/evp.h>
#include "openbsd-compat/openssl-compat.h"
+#include <errno.h>
#include <fcntl.h>
#include <pwd.h>
#include <stdarg.h>
@@ -51,17 +51,20 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
#include "xmalloc.h"
#include "ssh.h"
#include "rsa.h"
#include "log.h"
-#include "key.h"
-#include "buffer.h"
+#include "sshkey.h"
+#include "sshbuf.h"
#include "authfd.h"
#include "authfile.h"
#include "pathnames.h"
#include "misc.h"
+#include "ssherr.h"
+#include "digest.h"
/* argv0 */
extern char *__progname;
@@ -68,16 +71,22 @@
/* Default files to add */
static char *default_files[] = {
+#ifdef WITH_OPENSSL
_PATH_SSH_CLIENT_ID_RSA,
_PATH_SSH_CLIENT_ID_DSA,
#ifdef OPENSSL_HAS_ECC
_PATH_SSH_CLIENT_ID_ECDSA,
#endif
+#endif /* WITH_OPENSSL */
_PATH_SSH_CLIENT_ID_ED25519,
+#ifdef WITH_SSH1
_PATH_SSH_CLIENT_IDENTITY,
+#endif
NULL
};
+static int fingerprint_hash = SSH_FP_HASH_DEFAULT;
+
/* Default lifetime (0 == forever) */
static int lifetime = 0;
@@ -84,7 +93,7 @@
/* User has to confirm key use */
static int confirm = 0;
-/* we keep a cache of one passphrases */
+/* we keep a cache of one passphrase */
static char *pass = NULL;
static void
clear_pass(void)
@@ -97,22 +106,22 @@
}
static int
-delete_file(AuthenticationConnection *ac, const char *filename, int key_only)
+delete_file(int agent_fd, const char *filename, int key_only)
{
- Key *public = NULL, *cert = NULL;
+ struct sshkey *public, *cert = NULL;
char *certpath = NULL, *comment = NULL;
- int ret = -1;
+ int r, ret = -1;
- public = key_load_public(filename, &comment);
- if (public == NULL) {
- printf("Bad key file %s\n", filename);
+ if ((r = sshkey_load_public(filename, &public, &comment)) != 0) {
+ printf("Bad key file %s: %s\n", filename, ssh_err(r));
return -1;
}
- if (ssh_remove_identity(ac, public)) {
+ if ((r = ssh_remove_identity(agent_fd, public)) == 0) {
fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
ret = 0;
} else
- fprintf(stderr, "Could not remove identity: %s\n", filename);
+ fprintf(stderr, "Could not remove identity \"%s\": %s\n",
+ filename, ssh_err(r));
if (key_only)
goto out;
@@ -121,24 +130,28 @@
free(comment);
comment = NULL;
xasprintf(&certpath, "%s-cert.pub", filename);
- if ((cert = key_load_public(certpath, &comment)) == NULL)
+ if ((r = sshkey_load_public(certpath, &cert, &comment)) != 0) {
+ if (r != SSH_ERR_SYSTEM_ERROR || errno != ENOENT)
+ error("Failed to load certificate \"%s\": %s",
+ certpath, ssh_err(r));
goto out;
- if (!key_equal_public(cert, public))
+ }
+
+ if (!sshkey_equal_public(cert, public))
fatal("Certificate %s does not match private key %s",
certpath, filename);
- if (ssh_remove_identity(ac, cert)) {
+ if ((r = ssh_remove_identity(agent_fd, cert)) == 0) {
fprintf(stderr, "Identity removed: %s (%s)\n", certpath,
comment);
ret = 0;
} else
- fprintf(stderr, "Could not remove identity: %s\n", certpath);
+ fprintf(stderr, "Could not remove identity \"%s\": %s\n",
+ certpath, ssh_err(r));
out:
- if (cert != NULL)
- key_free(cert);
- if (public != NULL)
- key_free(public);
+ sshkey_free(cert);
+ sshkey_free(public);
free(certpath);
free(comment);
@@ -147,14 +160,14 @@
/* Send a request to remove all identities. */
static int
-delete_all(AuthenticationConnection *ac)
+delete_all(int agent_fd)
{
int ret = -1;
- if (ssh_remove_all_identities(ac, 1))
+ if (ssh_remove_all_identities(agent_fd, 2) == 0)
ret = 0;
- /* ignore error-code for ssh2 */
- ssh_remove_all_identities(ac, 2);
+ /* ignore error-code for ssh1 */
+ ssh_remove_all_identities(agent_fd, 1);
if (ret == 0)
fprintf(stderr, "All identities removed.\n");
@@ -165,13 +178,13 @@
}
static int
-add_file(AuthenticationConnection *ac, const char *filename, int key_only)
+add_file(int agent_fd, const char *filename, int key_only)
{
- Key *private, *cert;
+ struct sshkey *private, *cert;
char *comment = NULL;
char msg[1024], *certpath = NULL;
- int fd, perms_ok, ret = -1;
- Buffer keyblob;
+ int r, fd, ret = -1;
+ struct sshbuf *keyblob;
if (strcmp(filename, "-") == 0) {
fd = STDIN_FILENO;
@@ -186,15 +199,17 @@
* will occur multiple times, so check perms first and bail if wrong.
*/
if (fd != STDIN_FILENO) {
- perms_ok = key_perm_ok(fd, filename);
- if (!perms_ok) {
+ if (sshkey_perm_ok(fd, filename) != 0) {
close(fd);
return -1;
}
}
- buffer_init(&keyblob);
- if (!key_load_file(fd, filename, &keyblob)) {
- buffer_free(&keyblob);
+ if ((keyblob = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshkey_load_file(fd, keyblob)) != 0) {
+ fprintf(stderr, "Error loading key \"%s\": %s\n",
+ filename, ssh_err(r));
+ sshbuf_free(keyblob);
close(fd);
return -1;
}
@@ -201,38 +216,54 @@
close(fd);
/* At first, try empty passphrase */
- private = key_parse_private(&keyblob, filename, "", &comment);
- if (comment == NULL)
- comment = xstrdup(filename);
+ if ((r = sshkey_parse_private_fileblob(keyblob, "", &private,
+ &comment)) != 0 && r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
+ fprintf(stderr, "Error loading key \"%s\": %s\n",
+ filename, ssh_err(r));
+ goto fail_load;
+ }
/* try last */
- if (private == NULL && pass != NULL)
- private = key_parse_private(&keyblob, filename, pass, NULL);
+ if (private == NULL && pass != NULL) {
+ if ((r = sshkey_parse_private_fileblob(keyblob, pass, &private,
+ &comment)) != 0 && r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
+ fprintf(stderr, "Error loading key \"%s\": %s\n",
+ filename, ssh_err(r));
+ goto fail_load;
+ }
+ }
if (private == NULL) {
/* clear passphrase since it did not work */
clear_pass();
- snprintf(msg, sizeof msg, "Enter passphrase for %.200s: ",
- comment);
+ snprintf(msg, sizeof msg, "Enter passphrase for %s%s: ",
+ filename, confirm ? " (will confirm each use)" : "");
for (;;) {
pass = read_passphrase(msg, RP_ALLOW_STDIN);
- if (strcmp(pass, "") == 0) {
+ if (strcmp(pass, "") == 0)
+ goto fail_load;
+ if ((r = sshkey_parse_private_fileblob(keyblob, pass,
+ &private, &comment)) == 0)
+ break;
+ else if (r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
+ fprintf(stderr,
+ "Error loading key \"%s\": %s\n",
+ filename, ssh_err(r));
+ fail_load:
clear_pass();
- free(comment);
- buffer_free(&keyblob);
+ sshbuf_free(keyblob);
return -1;
}
- private = key_parse_private(&keyblob, filename, pass,
- &comment);
- if (private != NULL)
- break;
clear_pass();
snprintf(msg, sizeof msg,
- "Bad passphrase, try again for %.200s: ", comment);
+ "Bad passphrase, try again for %s%s: ", filename,
+ confirm ? " (will confirm each use)" : "");
}
}
- buffer_free(&keyblob);
+ if (comment == NULL || *comment == '\0')
+ comment = xstrdup(filename);
+ sshbuf_free(keyblob);
- if (ssh_add_identity_constrained(ac, private, comment, lifetime,
- confirm)) {
+ if ((r = ssh_add_identity_constrained(agent_fd, private, comment,
+ lifetime, confirm)) == 0) {
fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
ret = 0;
if (lifetime != 0)
@@ -242,7 +273,8 @@
fprintf(stderr,
"The user must confirm each use of the key\n");
} else {
- fprintf(stderr, "Could not add identity: %s\n", filename);
+ fprintf(stderr, "Could not add identity \"%s\": %s\n",
+ filename, ssh_err(r));
}
/* Skip trying to load the cert if requested */
@@ -251,29 +283,38 @@
/* Now try to add the certificate flavour too */
xasprintf(&certpath, "%s-cert.pub", filename);
- if ((cert = key_load_public(certpath, NULL)) == NULL)
+ if ((r = sshkey_load_public(certpath, &cert, NULL)) != 0) {
+ if (r != SSH_ERR_SYSTEM_ERROR || errno != ENOENT)
+ error("Failed to load certificate \"%s\": %s",
+ certpath, ssh_err(r));
goto out;
+ }
- if (!key_equal_public(cert, private)) {
+ if (!sshkey_equal_public(cert, private)) {
error("Certificate %s does not match private key %s",
certpath, filename);
- key_free(cert);
+ sshkey_free(cert);
goto out;
}
/* Graft with private bits */
- if (key_to_certified(private, key_cert_is_legacy(cert)) != 0) {
- error("%s: key_to_certified failed", __func__);
- key_free(cert);
+ if ((r = sshkey_to_certified(private)) != 0) {
+ error("%s: sshkey_to_certified: %s", __func__, ssh_err(r));
+ sshkey_free(cert);
goto out;
}
- key_cert_copy(cert, private);
- key_free(cert);
+ if ((r = sshkey_cert_copy(cert, private)) != 0) {
+ error("%s: key_cert_copy: %s", __func__, ssh_err(r));
+ sshkey_free(cert);
+ goto out;
+ }
+ sshkey_free(cert);
- if (!ssh_add_identity_constrained(ac, private, comment,
- lifetime, confirm)) {
- error("Certificate %s (%s) add failed", certpath,
- private->cert->key_id);
+ if ((r = ssh_add_identity_constrained(agent_fd, private, comment,
+ lifetime, confirm)) != 0) {
+ error("Certificate %s (%s) add failed: %s", certpath,
+ private->cert->key_id, ssh_err(r));
+ goto out;
}
fprintf(stderr, "Certificate added: %s (%s)\n", certpath,
private->cert->key_id);
@@ -282,19 +323,18 @@
if (confirm != 0)
fprintf(stderr, "The user must confirm each use of the key\n");
out:
- if (certpath != NULL)
- free(certpath);
+ free(certpath);
free(comment);
- key_free(private);
+ sshkey_free(private);
return ret;
}
static int
-update_card(AuthenticationConnection *ac, int add, const char *id)
+update_card(int agent_fd, int add, const char *id)
{
char *pin = NULL;
- int ret = -1;
+ int r, ret = -1;
if (add) {
if ((pin = read_passphrase("Enter passphrase for PKCS#11: ",
@@ -302,14 +342,14 @@
return -1;
}
- if (ssh_update_card(ac, add, id, pin == NULL ? "" : pin,
- lifetime, confirm)) {
+ if ((r = ssh_update_card(agent_fd, add, id, pin == NULL ? "" : pin,
+ lifetime, confirm)) == 0) {
fprintf(stderr, "Card %s: %s\n",
add ? "added" : "removed", id);
ret = 0;
} else {
- fprintf(stderr, "Could not %s card: %s\n",
- add ? "add" : "remove", id);
+ fprintf(stderr, "Could not %s card \"%s\": %s\n",
+ add ? "add" : "remove", id, ssh_err(r));
ret = -1;
}
free(pin);
@@ -317,32 +357,48 @@
}
static int
-list_identities(AuthenticationConnection *ac, int do_fp)
+list_identities(int agent_fd, int do_fp)
{
- Key *key;
- char *comment, *fp;
- int had_identities = 0;
- int version;
+ char *fp;
+ int r, had_identities = 0;
+ struct ssh_identitylist *idlist;
+ size_t i;
+#ifdef WITH_SSH1
+ int version = 1;
+#else
+ int version = 2;
+#endif
- for (version = 1; version <= 2; version++) {
- for (key = ssh_get_first_identity(ac, &comment, version);
- key != NULL;
- key = ssh_get_next_identity(ac, &comment, version)) {
+ for (; version <= 2; version++) {
+ if ((r = ssh_fetch_identitylist(agent_fd, version,
+ &idlist)) != 0) {
+ if (r != SSH_ERR_AGENT_NO_IDENTITIES)
+ fprintf(stderr, "error fetching identities for "
+ "protocol %d: %s\n", version, ssh_err(r));
+ continue;
+ }
+ for (i = 0; i < idlist->nkeys; i++) {
had_identities = 1;
if (do_fp) {
- fp = key_fingerprint(key, SSH_FP_MD5,
- SSH_FP_HEX);
- printf("%d %s %s (%s)\n",
- key_size(key), fp, comment, key_type(key));
+ fp = sshkey_fingerprint(idlist->keys[i],
+ fingerprint_hash, SSH_FP_DEFAULT);
+ printf("%u %s %s (%s)\n",
+ sshkey_size(idlist->keys[i]),
+ fp == NULL ? "(null)" : fp,
+ idlist->comments[i],
+ sshkey_type(idlist->keys[i]));
free(fp);
} else {
- if (!key_write(key, stdout))
- fprintf(stderr, "key_write failed");
- fprintf(stdout, " %s\n", comment);
+ if ((r = sshkey_write(idlist->keys[i],
+ stdout)) != 0) {
+ fprintf(stderr, "sshkey_write: %s\n",
+ ssh_err(r));
+ continue;
+ }
+ fprintf(stdout, " %s\n", idlist->comments[i]);
}
- key_free(key);
- free(comment);
}
+ ssh_free_identitylist(idlist);
}
if (!had_identities) {
printf("The agent has no identities.\n");
@@ -352,10 +408,10 @@
}
static int
-lock_agent(AuthenticationConnection *ac, int lock)
+lock_agent(int agent_fd, int lock)
{
char prompt[100], *p1, *p2;
- int passok = 1, ret = -1;
+ int r, passok = 1, ret = -1;
strlcpy(prompt, "Enter lock password: ", sizeof(prompt));
p1 = read_passphrase(prompt, RP_ALLOW_STDIN);
@@ -369,11 +425,15 @@
explicit_bzero(p2, strlen(p2));
free(p2);
}
- if (passok && ssh_lock_agent(ac, lock, p1)) {
- fprintf(stderr, "Agent %slocked.\n", lock ? "" : "un");
- ret = 0;
- } else
- fprintf(stderr, "Failed to %slock agent.\n", lock ? "" : "un");
+ if (passok) {
+ if ((r = ssh_lock_agent(agent_fd, lock, p1)) == 0) {
+ fprintf(stderr, "Agent %slocked.\n", lock ? "" : "un");
+ ret = 0;
+ } else {
+ fprintf(stderr, "Failed to %slock agent: %s\n",
+ lock ? "" : "un", ssh_err(r));
+ }
+ }
explicit_bzero(p1, strlen(p1));
free(p1);
return (ret);
@@ -380,13 +440,13 @@
}
static int
-do_file(AuthenticationConnection *ac, int deleting, int key_only, char *file)
+do_file(int agent_fd, int deleting, int key_only, char *file)
{
if (deleting) {
- if (delete_file(ac, file, key_only) == -1)
+ if (delete_file(agent_fd, file, key_only) == -1)
return -1;
} else {
- if (add_file(ac, file, key_only) == -1)
+ if (add_file(agent_fd, file, key_only) == -1)
return -1;
}
return 0;
@@ -398,6 +458,7 @@
fprintf(stderr, "usage: %s [options] [file ...]\n", __progname);
fprintf(stderr, "Options:\n");
fprintf(stderr, " -l List fingerprints of all identities.\n");
+ fprintf(stderr, " -E hash Specify hash algorithm used for fingerprints.\n");
fprintf(stderr, " -L List public key parameters of all identities.\n");
fprintf(stderr, " -k Load only keys and not certificates.\n");
fprintf(stderr, " -c Require confirmation to sign using identities\n");
@@ -415,10 +476,12 @@
{
extern char *optarg;
extern int optind;
- AuthenticationConnection *ac = NULL;
+ int agent_fd;
char *pkcs11provider = NULL;
- int i, ch, deleting = 0, ret = 0, key_only = 0;
+ int r, i, ch, deleting = 0, ret = 0, key_only = 0;
+ int xflag = 0, lflag = 0, Dflag = 0;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
@@ -425,30 +488,47 @@
__progname = ssh_get_progname(argv[0]);
seed_rng();
+#ifdef WITH_OPENSSL
OpenSSL_add_all_algorithms();
+#endif
- /* At first, get a connection to the authentication agent. */
- ac = ssh_get_authentication_connection();
- if (ac == NULL) {
- fprintf(stderr,
- "Could not open a connection to your authentication agent.\n");
+ setvbuf(stdout, NULL, _IOLBF, 0);
+
+ /* First, get a connection to the authentication agent. */
+ switch (r = ssh_get_authentication_socket(&agent_fd)) {
+ case 0:
+ break;
+ case SSH_ERR_AGENT_NOT_PRESENT:
+ fprintf(stderr, "Could not open a connection to your "
+ "authentication agent.\n");
exit(2);
+ default:
+ fprintf(stderr, "Error connecting to agent: %s\n", ssh_err(r));
+ exit(2);
}
- while ((ch = getopt(argc, argv, "klLcdDxXe:s:t:")) != -1) {
+
+ while ((ch = getopt(argc, argv, "klLcdDxXE:e:s:t:")) != -1) {
switch (ch) {
+ case 'E':
+ fingerprint_hash = ssh_digest_alg_by_name(optarg);
+ if (fingerprint_hash == -1)
+ fatal("Invalid hash algorithm \"%s\"", optarg);
+ break;
case 'k':
key_only = 1;
break;
case 'l':
case 'L':
- if (list_identities(ac, ch == 'l' ? 1 : 0) == -1)
- ret = 1;
- goto done;
+ if (lflag != 0)
+ fatal("-%c flag already specified", lflag);
+ lflag = ch;
+ break;
case 'x':
case 'X':
- if (lock_agent(ac, ch == 'x' ? 1 : 0) == -1)
- ret = 1;
- goto done;
+ if (xflag != 0)
+ fatal("-%c flag already specified", xflag);
+ xflag = ch;
+ break;
case 'c':
confirm = 1;
break;
@@ -456,9 +536,8 @@
deleting = 1;
break;
case 'D':
- if (delete_all(ac) == -1)
- ret = 1;
- goto done;
+ Dflag = 1;
+ break;
case 's':
pkcs11provider = optarg;
break;
@@ -479,15 +558,32 @@
goto done;
}
}
+
+ if ((xflag != 0) + (lflag != 0) + (Dflag != 0) > 1)
+ fatal("Invalid combination of actions");
+ else if (xflag) {
+ if (lock_agent(agent_fd, xflag == 'x' ? 1 : 0) == -1)
+ ret = 1;
+ goto done;
+ } else if (lflag) {
+ if (list_identities(agent_fd, lflag == 'l' ? 1 : 0) == -1)
+ ret = 1;
+ goto done;
+ } else if (Dflag) {
+ if (delete_all(agent_fd) == -1)
+ ret = 1;
+ goto done;
+ }
+
argc -= optind;
argv += optind;
if (pkcs11provider != NULL) {
- if (update_card(ac, !deleting, pkcs11provider) == -1)
+ if (update_card(agent_fd, !deleting, pkcs11provider) == -1)
ret = 1;
goto done;
}
if (argc == 0) {
- char buf[MAXPATHLEN];
+ char buf[PATH_MAX];
struct passwd *pw;
struct stat st;
int count = 0;
@@ -504,7 +600,7 @@
default_files[i]);
if (stat(buf, &st) < 0)
continue;
- if (do_file(ac, deleting, key_only, buf) == -1)
+ if (do_file(agent_fd, deleting, key_only, buf) == -1)
ret = 1;
else
count++;
@@ -513,7 +609,8 @@
ret = 1;
} else {
for (i = 0; i < argc; i++) {
- if (do_file(ac, deleting, key_only, argv[i]) == -1)
+ if (do_file(agent_fd, deleting, key_only,
+ argv[i]) == -1)
ret = 1;
}
}
@@ -520,6 +617,6 @@
clear_pass();
done:
- ssh_close_authentication_connection(ac);
+ ssh_close_authentication_socket(agent_fd);
return ret;
}
Modified: trunk/crypto/openssh/ssh-agent.0
===================================================================
--- trunk/crypto/openssh/ssh-agent.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-agent.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,21 +1,28 @@
-SSH-AGENT(1) OpenBSD Reference Manual SSH-AGENT(1)
+SSH-AGENT(1) General Commands Manual SSH-AGENT(1)
NAME
- ssh-agent - authentication agent
+ ssh-agent M-bM-^@M-^S authentication agent
SYNOPSIS
- ssh-agent [-c | -s] [-d] [-a bind_address] [-t life] [command [arg ...]]
+ ssh-agent [-c | -s] [-Dd] [-a bind_address] [-E fingerprint_hash]
+ [-t life] [command [arg ...]]
ssh-agent [-c | -s] -k
DESCRIPTION
ssh-agent is a program to hold private keys used for public key
- authentication (RSA, DSA, ECDSA, ED25519). The idea is that ssh-agent is
- started in the beginning of an X-session or a login session, and all
- other windows or programs are started as clients to the ssh-agent
- program. Through use of environment variables the agent can be located
- and automatically used for authentication when logging in to other
- machines using ssh(1).
+ authentication (RSA, DSA, ECDSA, Ed25519). ssh-agent is usually started
+ in the beginning of an X-session or a login session, and all other
+ windows or programs are started as clients to the ssh-agent program.
+ Through use of environment variables the agent can be located and
+ automatically used for authentication when logging in to other machines
+ using ssh(1).
+ The agent initially does not have any private keys. Keys are added using
+ ssh(1) (see AddKeysToAgent in ssh_config(5) for details) or ssh-add(1).
+ Multiple identities may be stored in ssh-agent concurrently and ssh(1)
+ will automatically use them if present. ssh-add(1) is also used to
+ remove keys from ssh-agent and to query the keys that are held in one.
+
The options are as follows:
-a bind_address
@@ -25,9 +32,17 @@
-c Generate C-shell commands on stdout. This is the default if
SHELL looks like it's a csh style of shell.
+ -D Foreground mode. When this option is specified ssh-agent will
+ not fork.
+
-d Debug mode. When this option is specified ssh-agent will not
- fork.
+ fork and will write debug information to standard error.
+ -E fingerprint_hash
+ Specifies the hash algorithm used when displaying key
+ fingerprints. Valid options are: M-bM-^@M-^\md5M-bM-^@M-^] and M-bM-^@M-^\sha256M-bM-^@M-^]. The
+ default is M-bM-^@M-^\sha256M-bM-^@M-^].
+
-k Kill the current agent (given by the SSH_AGENT_PID environment
variable).
@@ -41,20 +56,9 @@
for an identity with ssh-add(1) overrides this value. Without
this option the default maximum lifetime is forever.
- If a commandline is given, this is executed as a subprocess of the agent.
- When the command dies, so does the agent.
+ If a command line is given, this is executed as a subprocess of the
+ agent. When the command dies, so does the agent.
- The agent initially does not have any private keys. Keys are added using
- ssh-add(1). When executed without arguments, ssh-add(1) adds the files
- ~/.ssh/id_rsa, ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and
- ~/.ssh/identity. If the identity has a passphrase, ssh-add(1) asks for
- the passphrase on the terminal if it has one or from a small X11 program
- if running under X11. If neither of these is the case then the
- authentication will fail. It then sends the identity to the agent.
- Several identities can be stored in the agent; the agent can
- automatically use any of these identities. ssh-add -l displays the
- identities currently held by the agent.
-
The idea is that the agent is run in the user's local PC, laptop, or
terminal. Authentication data need not be stored on any other machine,
and authentication passphrases never go over the network. However, the
@@ -89,26 +93,6 @@
terminates.
FILES
- ~/.ssh/identity
- Contains the protocol version 1 RSA authentication identity of
- the user.
-
- ~/.ssh/id_dsa
- Contains the protocol version 2 DSA authentication identity of
- the user.
-
- ~/.ssh/id_ecdsa
- Contains the protocol version 2 ECDSA authentication identity of
- the user.
-
- ~/.ssh/id_ed25519
- Contains the protocol version 2 ED25519 authentication identity
- of the user.
-
- ~/.ssh/id_rsa
- Contains the protocol version 2 RSA authentication identity of
- the user.
-
$TMPDIR/ssh-XXXXXXXXXX/agent.<ppid>
UNIX-domain sockets used to contain the connection to the
authentication agent. These sockets should only be readable by
@@ -125,4 +109,4 @@
created OpenSSH. Markus Friedl contributed the support for SSH protocol
versions 1.5 and 2.0.
-OpenBSD 5.5 December 7, 2013 OpenBSD 5.5
+OpenBSD 6.0 November 15, 2015 OpenBSD 6.0
Modified: trunk/crypto/openssh/ssh-agent.1
===================================================================
--- trunk/crypto/openssh/ssh-agent.1 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-agent.1 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-agent.1,v 1.54 2013/12/07 11:58:46 naddy Exp $
+.\" $OpenBSD: ssh-agent.1,v 1.62 2015/11/15 23:54:15 jmc Exp $
.\"
.\" Author: Tatu Ylonen <ylo at cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -34,7 +34,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: December 7 2013 $
+.Dd $Mdocdate: November 15 2015 $
.Dt SSH-AGENT 1
.Os
.Sh NAME
@@ -43,8 +43,9 @@
.Sh SYNOPSIS
.Nm ssh-agent
.Op Fl c | s
-.Op Fl d
+.Op Fl \&Dd
.Op Fl a Ar bind_address
+.Op Fl E Ar fingerprint_hash
.Op Fl t Ar life
.Op Ar command Op Ar arg ...
.Nm ssh-agent
@@ -53,10 +54,9 @@
.Sh DESCRIPTION
.Nm
is a program to hold private keys used for public key authentication
-(RSA, DSA, ECDSA, ED25519).
-The idea is that
+(RSA, DSA, ECDSA, Ed25519).
.Nm
-is started in the beginning of an X-session or a login session, and
+is usually started in the beginning of an X-session or a login session, and
all other windows or programs are started as clients to the ssh-agent
program.
Through use of environment variables the agent can be located
@@ -64,6 +64,26 @@
machines using
.Xr ssh 1 .
.Pp
+The agent initially does not have any private keys.
+Keys are added using
+.Xr ssh 1
+(see
+.Cm AddKeysToAgent
+in
+.Xr ssh_config 5
+for details)
+or
+.Xr ssh-add 1 .
+Multiple identities may be stored in
+.Nm
+concurrently and
+.Xr ssh 1
+will automatically use them if present.
+.Xr ssh-add 1
+is also used to remove keys from
+.Nm
+and to query the keys that are held in one.
+.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl a Ar bind_address
@@ -79,11 +99,24 @@
This is the default if
.Ev SHELL
looks like it's a csh style of shell.
+.It Fl D
+Foreground mode.
+When this option is specified
+.Nm
+will not fork.
.It Fl d
Debug mode.
When this option is specified
.Nm
-will not fork.
+will not fork and will write debug information to standard error.
+.It Fl E Ar fingerprint_hash
+Specifies the hash algorithm used when displaying key fingerprints.
+Valid options are:
+.Dq md5
+and
+.Dq sha256 .
+The default is
+.Dq sha256 .
.It Fl k
Kill the current agent (given by the
.Ev SSH_AGENT_PID
@@ -104,32 +137,9 @@
Without this option the default maximum lifetime is forever.
.El
.Pp
-If a commandline is given, this is executed as a subprocess of the agent.
+If a command line is given, this is executed as a subprocess of the agent.
When the command dies, so does the agent.
.Pp
-The agent initially does not have any private keys.
-Keys are added using
-.Xr ssh-add 1 .
-When executed without arguments,
-.Xr ssh-add 1
-adds the files
-.Pa ~/.ssh/id_rsa ,
-.Pa ~/.ssh/id_dsa ,
-.Pa ~/.ssh/id_ecdsa ,
-.Pa ~/.ssh/id_ed25519
-and
-.Pa ~/.ssh/identity .
-If the identity has a passphrase,
-.Xr ssh-add 1
-asks for the passphrase on the terminal if it has one or from a small X11
-program if running under X11.
-If neither of these is the case then the authentication will fail.
-It then sends the identity to the agent.
-Several identities can be stored in the
-agent; the agent can automatically use any of these identities.
-.Ic ssh-add -l
-displays the identities currently held by the agent.
-.Pp
The idea is that the agent is run in the user's local PC, laptop, or
terminal.
Authentication data need not be stored on any other
@@ -185,16 +195,6 @@
line terminates.
.Sh FILES
.Bl -tag -width Ds
-.It Pa ~/.ssh/identity
-Contains the protocol version 1 RSA authentication identity of the user.
-.It Pa ~/.ssh/id_dsa
-Contains the protocol version 2 DSA authentication identity of the user.
-.It Pa ~/.ssh/id_ecdsa
-Contains the protocol version 2 ECDSA authentication identity of the user.
-.It Pa ~/.ssh/id_ed25519
-Contains the protocol version 2 ED25519 authentication identity of the user.
-.It Pa ~/.ssh/id_rsa
-Contains the protocol version 2 RSA authentication identity of the user.
.It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.\*(Ltppid\*(Gt
.Ux Ns -domain
sockets used to contain the connection to the authentication agent.
Modified: trunk/crypto/openssh/ssh-agent.c
===================================================================
--- trunk/crypto/openssh/ssh-agent.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-agent.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.183 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.213 2016/05/02 08:49:03 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -36,6 +36,7 @@
#include "includes.h"
+#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
#include <sys/param.h>
#include <sys/resource.h>
@@ -49,11 +50,14 @@
#endif
#include "openbsd-compat/sys-queue.h"
+#ifdef WITH_OPENSSL
#include <openssl/evp.h>
#include "openbsd-compat/openssl-compat.h"
+#endif
#include <errno.h>
#include <fcntl.h>
+#include <limits.h>
#ifdef HAVE_PATHS_H
# include <paths.h>
#endif
@@ -64,26 +68,26 @@
#include <time.h>
#include <string.h>
#include <unistd.h>
+#ifdef HAVE_UTIL_H
+# include <util.h>
+#endif
#include "xmalloc.h"
#include "ssh.h"
#include "rsa.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshbuf.h"
+#include "sshkey.h"
#include "authfd.h"
#include "compat.h"
#include "log.h"
#include "misc.h"
#include "digest.h"
+#include "ssherr.h"
#ifdef ENABLE_PKCS11
#include "ssh-pkcs11.h"
#endif
-#if defined(HAVE_SYS_PRCTL_H)
-#include <sys/prctl.h> /* For prctl() and PR_SET_DUMPABLE */
-#endif
-
typedef enum {
AUTH_UNUSED,
AUTH_SOCKET,
@@ -93,9 +97,9 @@
typedef struct {
int fd;
sock_type type;
- Buffer input;
- Buffer output;
- Buffer request;
+ struct sshbuf *input;
+ struct sshbuf *output;
+ struct sshbuf *request;
} SocketEntry;
u_int sockets_alloc = 0;
@@ -103,7 +107,7 @@
typedef struct identity {
TAILQ_ENTRY(identity) next;
- Key *key;
+ struct sshkey *key;
char *comment;
char *provider;
time_t death;
@@ -124,13 +128,20 @@
pid_t parent_pid = -1;
time_t parent_alive_interval = 0;
+/* pid of process for which cleanup_socket is applicable */
+pid_t cleanup_pid = 0;
+
/* pathname and directory for AUTH_SOCKET */
-char socket_name[MAXPATHLEN];
-char socket_dir[MAXPATHLEN];
+char socket_name[PATH_MAX];
+char socket_dir[PATH_MAX];
/* locking */
+#define LOCK_SIZE 32
+#define LOCK_SALT_SIZE 16
+#define LOCK_ROUNDS 1
int locked = 0;
-char *lock_passwd = NULL;
+u_char lock_pwhash[LOCK_SIZE];
+u_char lock_salt[LOCK_SALT_SIZE];
extern char *__progname;
@@ -137,6 +148,8 @@
/* Default lifetime in seconds (0 == forever) */
static long lifetime = 0;
+static int fingerprint_hash = SSH_FP_HASH_DEFAULT;
+
static void
close_socket(SocketEntry *e)
{
@@ -143,9 +156,9 @@
close(e->fd);
e->fd = -1;
e->type = AUTH_UNUSED;
- buffer_free(&e->input);
- buffer_free(&e->output);
- buffer_free(&e->request);
+ sshbuf_free(e->input);
+ sshbuf_free(e->output);
+ sshbuf_free(e->request);
}
static void
@@ -171,7 +184,7 @@
static void
free_identity(Identity *id)
{
- key_free(id->key);
+ sshkey_free(id->key);
free(id->provider);
free(id->comment);
free(id);
@@ -179,13 +192,13 @@
/* return matching private key for given public key */
static Identity *
-lookup_identity(Key *key, int version)
+lookup_identity(struct sshkey *key, int version)
{
Identity *id;
Idtab *tab = idtab_lookup(version);
TAILQ_FOREACH(id, &tab->idlist, next) {
- if (key_equal(key, id->key))
+ if (sshkey_equal(key, id->key))
return (id);
}
return (NULL);
@@ -198,8 +211,9 @@
char *p;
int ret = -1;
- p = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
- if (ask_permission("Allow use of key %s?\nKey fingerprint %s.",
+ p = sshkey_fingerprint(id->key, fingerprint_hash, SSH_FP_DEFAULT);
+ if (p != NULL &&
+ ask_permission("Allow use of key %s?\nKey fingerprint %s.",
id->comment, p))
ret = 0;
free(p);
@@ -207,6 +221,17 @@
return (ret);
}
+static void
+send_status(SocketEntry *e, int success)
+{
+ int r;
+
+ if ((r = sshbuf_put_u32(e->output, 1)) != 0 ||
+ (r = sshbuf_put_u8(e->output, success ?
+ SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+}
+
/* send list of supported public keys to 'client' */
static void
process_request_identities(SocketEntry *e, int version)
@@ -213,31 +238,51 @@
{
Idtab *tab = idtab_lookup(version);
Identity *id;
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
- buffer_init(&msg);
- buffer_put_char(&msg, (version == 1) ?
- SSH_AGENT_RSA_IDENTITIES_ANSWER : SSH2_AGENT_IDENTITIES_ANSWER);
- buffer_put_int(&msg, tab->nentries);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg, (version == 1) ?
+ SSH_AGENT_RSA_IDENTITIES_ANSWER :
+ SSH2_AGENT_IDENTITIES_ANSWER)) != 0 ||
+ (r = sshbuf_put_u32(msg, tab->nentries)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
TAILQ_FOREACH(id, &tab->idlist, next) {
if (id->key->type == KEY_RSA1) {
- buffer_put_int(&msg, BN_num_bits(id->key->rsa->n));
- buffer_put_bignum(&msg, id->key->rsa->e);
- buffer_put_bignum(&msg, id->key->rsa->n);
+#ifdef WITH_SSH1
+ if ((r = sshbuf_put_u32(msg,
+ BN_num_bits(id->key->rsa->n))) != 0 ||
+ (r = sshbuf_put_bignum1(msg,
+ id->key->rsa->e)) != 0 ||
+ (r = sshbuf_put_bignum1(msg,
+ id->key->rsa->n)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
+#endif
} else {
u_char *blob;
- u_int blen;
- key_to_blob(id->key, &blob, &blen);
- buffer_put_string(&msg, blob, blen);
+ size_t blen;
+
+ if ((r = sshkey_to_blob(id->key, &blob, &blen)) != 0) {
+ error("%s: sshkey_to_blob: %s", __func__,
+ ssh_err(r));
+ continue;
+ }
+ if ((r = sshbuf_put_string(msg, blob, blen)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
free(blob);
}
- buffer_put_cstring(&msg, id->comment);
+ if ((r = sshbuf_put_cstring(msg, id->comment)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
}
- buffer_put_int(&e->output, buffer_len(&msg));
- buffer_append(&e->output, buffer_ptr(&msg), buffer_len(&msg));
- buffer_free(&msg);
+ if ((r = sshbuf_put_stringb(e->output, msg)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ sshbuf_free(msg);
}
+#ifdef WITH_SSH1
/* ssh1 only */
static void
process_authentication_challenge1(SocketEntry *e)
@@ -246,40 +291,48 @@
u_int response_type;
BIGNUM *challenge;
Identity *id;
- int i, len;
- Buffer msg;
+ int r, len;
+ struct sshbuf *msg;
struct ssh_digest_ctx *md;
- Key *key;
+ struct sshkey *key;
- buffer_init(&msg);
- key = key_new(KEY_RSA1);
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((key = sshkey_new(KEY_RSA1)) == NULL)
+ fatal("%s: sshkey_new failed", __func__);
if ((challenge = BN_new()) == NULL)
- fatal("process_authentication_challenge1: BN_new failed");
+ fatal("%s: BN_new failed", __func__);
- (void) buffer_get_int(&e->request); /* ignored */
- buffer_get_bignum(&e->request, key->rsa->e);
- buffer_get_bignum(&e->request, key->rsa->n);
- buffer_get_bignum(&e->request, challenge);
+ if ((r = sshbuf_get_u32(e->request, NULL)) != 0 || /* ignored */
+ (r = sshbuf_get_bignum1(e->request, key->rsa->e)) != 0 ||
+ (r = sshbuf_get_bignum1(e->request, key->rsa->n)) != 0 ||
+ (r = sshbuf_get_bignum1(e->request, challenge)))
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
/* Only protocol 1.1 is supported */
- if (buffer_len(&e->request) == 0)
+ if (sshbuf_len(e->request) == 0)
goto failure;
- buffer_get(&e->request, session_id, 16);
- response_type = buffer_get_int(&e->request);
+ if ((r = sshbuf_get(e->request, session_id, sizeof(session_id))) != 0 ||
+ (r = sshbuf_get_u32(e->request, &response_type)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (response_type != 1)
goto failure;
id = lookup_identity(key, 1);
if (id != NULL && (!id->confirm || confirm_key(id) == 0)) {
- Key *private = id->key;
+ struct sshkey *private = id->key;
/* Decrypt the challenge using the private key. */
- if (rsa_private_decrypt(challenge, challenge, private->rsa) <= 0)
- goto failure;
+ if ((r = rsa_private_decrypt(challenge, challenge,
+ private->rsa) != 0)) {
+ fatal("%s: rsa_public_encrypt: %s", __func__,
+ ssh_err(r));
+ goto failure; /* XXX ? */
+ }
- /* The response is MD5 of decrypted challenge plus session id. */
+ /* The response is MD5 of decrypted challenge plus session id */
len = BN_num_bytes(challenge);
if (len <= 0 || len > 32) {
- logit("process_authentication_challenge: bad challenge length %d", len);
+ logit("%s: bad challenge length %d", __func__, len);
goto failure;
}
memset(buf, 0, 32);
@@ -292,67 +345,92 @@
ssh_digest_free(md);
/* Send the response. */
- buffer_put_char(&msg, SSH_AGENT_RSA_RESPONSE);
- for (i = 0; i < 16; i++)
- buffer_put_char(&msg, mdbuf[i]);
+ if ((r = sshbuf_put_u8(msg, SSH_AGENT_RSA_RESPONSE)) != 0 ||
+ (r = sshbuf_put(msg, mdbuf, sizeof(mdbuf))) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
goto send;
}
-failure:
+ failure:
/* Unknown identity or protocol error. Send failure. */
- buffer_put_char(&msg, SSH_AGENT_FAILURE);
-send:
- buffer_put_int(&e->output, buffer_len(&msg));
- buffer_append(&e->output, buffer_ptr(&msg), buffer_len(&msg));
- key_free(key);
+ if ((r = sshbuf_put_u8(msg, SSH_AGENT_FAILURE)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ send:
+ if ((r = sshbuf_put_stringb(e->output, msg)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ sshkey_free(key);
BN_clear_free(challenge);
- buffer_free(&msg);
+ sshbuf_free(msg);
}
+#endif
+static char *
+agent_decode_alg(struct sshkey *key, u_int flags)
+{
+ if (key->type == KEY_RSA) {
+ if (flags & SSH_AGENT_RSA_SHA2_256)
+ return "rsa-sha2-256";
+ else if (flags & SSH_AGENT_RSA_SHA2_512)
+ return "rsa-sha2-512";
+ }
+ return NULL;
+}
+
/* ssh2 only */
static void
process_sign_request2(SocketEntry *e)
{
u_char *blob, *data, *signature = NULL;
- u_int blen, dlen, slen = 0;
- extern int datafellows;
- int odatafellows;
- int ok = -1, flags;
- Buffer msg;
- Key *key;
+ size_t blen, dlen, slen = 0;
+ u_int compat = 0, flags;
+ int r, ok = -1;
+ struct sshbuf *msg;
+ struct sshkey *key;
+ struct identity *id;
- datafellows = 0;
-
- blob = buffer_get_string(&e->request, &blen);
- data = buffer_get_string(&e->request, &dlen);
-
- flags = buffer_get_int(&e->request);
- odatafellows = datafellows;
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_get_string(e->request, &blob, &blen)) != 0 ||
+ (r = sshbuf_get_string(e->request, &data, &dlen)) != 0 ||
+ (r = sshbuf_get_u32(e->request, &flags)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (flags & SSH_AGENT_OLD_SIGNATURE)
- datafellows = SSH_BUG_SIGBLOB;
-
- key = key_from_blob(blob, blen);
- if (key != NULL) {
- Identity *id = lookup_identity(key, 2);
- if (id != NULL && (!id->confirm || confirm_key(id) == 0))
- ok = key_sign(id->key, &signature, &slen, data, dlen);
- key_free(key);
+ compat = SSH_BUG_SIGBLOB;
+ if ((r = sshkey_from_blob(blob, blen, &key)) != 0) {
+ error("%s: cannot parse key blob: %s", __func__, ssh_err(r));
+ goto send;
}
- buffer_init(&msg);
+ if ((id = lookup_identity(key, 2)) == NULL) {
+ verbose("%s: %s key not found", __func__, sshkey_type(key));
+ goto send;
+ }
+ if (id->confirm && confirm_key(id) != 0) {
+ verbose("%s: user refused key", __func__);
+ goto send;
+ }
+ if ((r = sshkey_sign(id->key, &signature, &slen,
+ data, dlen, agent_decode_alg(key, flags), compat)) != 0) {
+ error("%s: sshkey_sign: %s", __func__, ssh_err(r));
+ goto send;
+ }
+ /* Success */
+ ok = 0;
+ send:
+ sshkey_free(key);
if (ok == 0) {
- buffer_put_char(&msg, SSH2_AGENT_SIGN_RESPONSE);
- buffer_put_string(&msg, signature, slen);
- } else {
- buffer_put_char(&msg, SSH_AGENT_FAILURE);
- }
- buffer_put_int(&e->output, buffer_len(&msg));
- buffer_append(&e->output, buffer_ptr(&msg),
- buffer_len(&msg));
- buffer_free(&msg);
+ if ((r = sshbuf_put_u8(msg, SSH2_AGENT_SIGN_RESPONSE)) != 0 ||
+ (r = sshbuf_put_string(msg, signature, slen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ } else if ((r = sshbuf_put_u8(msg, SSH_AGENT_FAILURE)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
+ if ((r = sshbuf_put_stringb(e->output, msg)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
+ sshbuf_free(msg);
free(data);
free(blob);
free(signature);
- datafellows = odatafellows;
}
/* shared */
@@ -359,25 +437,38 @@
static void
process_remove_identity(SocketEntry *e, int version)
{
- u_int blen, bits;
- int success = 0;
- Key *key = NULL;
+ size_t blen;
+ int r, success = 0;
+ struct sshkey *key = NULL;
u_char *blob;
+#ifdef WITH_SSH1
+ u_int bits;
+#endif /* WITH_SSH1 */
switch (version) {
+#ifdef WITH_SSH1
case 1:
- key = key_new(KEY_RSA1);
- bits = buffer_get_int(&e->request);
- buffer_get_bignum(&e->request, key->rsa->e);
- buffer_get_bignum(&e->request, key->rsa->n);
+ if ((key = sshkey_new(KEY_RSA1)) == NULL) {
+ error("%s: sshkey_new failed", __func__);
+ return;
+ }
+ if ((r = sshbuf_get_u32(e->request, &bits)) != 0 ||
+ (r = sshbuf_get_bignum1(e->request, key->rsa->e)) != 0 ||
+ (r = sshbuf_get_bignum1(e->request, key->rsa->n)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
- if (bits != key_size(key))
- logit("Warning: identity keysize mismatch: actual %u, announced %u",
- key_size(key), bits);
+ if (bits != sshkey_size(key))
+ logit("Warning: identity keysize mismatch: "
+ "actual %u, announced %u",
+ sshkey_size(key), bits);
break;
+#endif /* WITH_SSH1 */
case 2:
- blob = buffer_get_string(&e->request, &blen);
- key = key_from_blob(blob, blen);
+ if ((r = sshbuf_get_string(e->request, &blob, &blen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if ((r = sshkey_from_blob(blob, blen, &key)) != 0)
+ error("%s: sshkey_from_blob failed: %s",
+ __func__, ssh_err(r));
free(blob);
break;
}
@@ -401,11 +492,9 @@
tab->nentries--;
success = 1;
}
- key_free(key);
+ sshkey_free(key);
}
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output,
- success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
+ send_status(e, success);
}
static void
@@ -425,8 +514,7 @@
tab->nentries = 0;
/* Send success. */
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
+ send_status(e, 1);
}
/* removes expired keys and returns number of seconds until the next expiry */
@@ -460,68 +548,106 @@
return (deadline - now);
}
+/*
+ * XXX this and the corresponding serialisation function probably belongs
+ * in key.c
+ */
+#ifdef WITH_SSH1
+static int
+agent_decode_rsa1(struct sshbuf *m, struct sshkey **kp)
+{
+ struct sshkey *k = NULL;
+ int r = SSH_ERR_INTERNAL_ERROR;
+
+ *kp = NULL;
+ if ((k = sshkey_new_private(KEY_RSA1)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+
+ if ((r = sshbuf_get_u32(m, NULL)) != 0 || /* ignored */
+ (r = sshbuf_get_bignum1(m, k->rsa->n)) != 0 ||
+ (r = sshbuf_get_bignum1(m, k->rsa->e)) != 0 ||
+ (r = sshbuf_get_bignum1(m, k->rsa->d)) != 0 ||
+ (r = sshbuf_get_bignum1(m, k->rsa->iqmp)) != 0 ||
+ /* SSH1 and SSL have p and q swapped */
+ (r = sshbuf_get_bignum1(m, k->rsa->q)) != 0 || /* p */
+ (r = sshbuf_get_bignum1(m, k->rsa->p)) != 0) /* q */
+ goto out;
+
+ /* Generate additional parameters */
+ if ((r = rsa_generate_additional_parameters(k->rsa)) != 0)
+ goto out;
+ /* enable blinding */
+ if (RSA_blinding_on(k->rsa, NULL) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+
+ r = 0; /* success */
+ out:
+ if (r == 0)
+ *kp = k;
+ else
+ sshkey_free(k);
+ return r;
+}
+#endif /* WITH_SSH1 */
+
static void
process_add_identity(SocketEntry *e, int version)
{
Idtab *tab = idtab_lookup(version);
Identity *id;
- int type, success = 0, confirm = 0;
- char *comment;
+ int success = 0, confirm = 0;
+ u_int seconds;
+ char *comment = NULL;
time_t death = 0;
- Key *k = NULL;
+ struct sshkey *k = NULL;
+ u_char ctype;
+ int r = SSH_ERR_INTERNAL_ERROR;
switch (version) {
+#ifdef WITH_SSH1
case 1:
- k = key_new_private(KEY_RSA1);
- (void) buffer_get_int(&e->request); /* ignored */
- buffer_get_bignum(&e->request, k->rsa->n);
- buffer_get_bignum(&e->request, k->rsa->e);
- buffer_get_bignum(&e->request, k->rsa->d);
- buffer_get_bignum(&e->request, k->rsa->iqmp);
-
- /* SSH and SSL have p and q swapped */
- buffer_get_bignum(&e->request, k->rsa->q); /* p */
- buffer_get_bignum(&e->request, k->rsa->p); /* q */
-
- /* Generate additional parameters */
- rsa_generate_additional_parameters(k->rsa);
-
- /* enable blinding */
- if (RSA_blinding_on(k->rsa, NULL) != 1) {
- error("process_add_identity: RSA_blinding_on failed");
- key_free(k);
- goto send;
- }
+ r = agent_decode_rsa1(e->request, &k);
break;
+#endif /* WITH_SSH1 */
case 2:
- k = key_private_deserialize(&e->request);
- if (k == NULL) {
- buffer_clear(&e->request);
- goto send;
- }
+ r = sshkey_private_deserialize(e->request, &k);
break;
}
- comment = buffer_get_string(&e->request, NULL);
- if (k == NULL) {
- free(comment);
- goto send;
+ if (r != 0 || k == NULL ||
+ (r = sshbuf_get_cstring(e->request, &comment, NULL)) != 0) {
+ error("%s: decode private key: %s", __func__, ssh_err(r));
+ goto err;
}
- while (buffer_len(&e->request)) {
- switch ((type = buffer_get_char(&e->request))) {
+
+ while (sshbuf_len(e->request)) {
+ if ((r = sshbuf_get_u8(e->request, &ctype)) != 0) {
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ goto err;
+ }
+ switch (ctype) {
case SSH_AGENT_CONSTRAIN_LIFETIME:
- death = monotime() + buffer_get_int(&e->request);
+ if ((r = sshbuf_get_u32(e->request, &seconds)) != 0) {
+ error("%s: bad lifetime constraint: %s",
+ __func__, ssh_err(r));
+ goto err;
+ }
+ death = monotime() + seconds;
break;
case SSH_AGENT_CONSTRAIN_CONFIRM:
confirm = 1;
break;
default:
- error("process_add_identity: "
- "Unknown constraint type %d", type);
+ error("%s: Unknown constraint %d", __func__, ctype);
+ err:
+ sshbuf_reset(e->request);
free(comment);
- key_free(k);
+ sshkey_free(k);
goto send;
}
}
+
success = 1;
if (lifetime && !death)
death = monotime() + lifetime;
@@ -532,7 +658,7 @@
/* Increment the number of identities. */
tab->nentries++;
} else {
- key_free(k);
+ sshkey_free(k);
free(id->comment);
}
id->comment = comment;
@@ -539,9 +665,7 @@
id->death = death;
id->confirm = confirm;
send:
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output,
- success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
+ send_status(e, success);
}
/* XXX todo: encrypt sensitive data with passphrase */
@@ -548,42 +672,66 @@
static void
process_lock_agent(SocketEntry *e, int lock)
{
- int success = 0;
+ int r, success = 0, delay;
char *passwd;
+ u_char passwdhash[LOCK_SIZE];
+ static u_int fail_count = 0;
+ size_t pwlen;
- passwd = buffer_get_string(&e->request, NULL);
- if (locked && !lock && strcmp(passwd, lock_passwd) == 0) {
- locked = 0;
- explicit_bzero(lock_passwd, strlen(lock_passwd));
- free(lock_passwd);
- lock_passwd = NULL;
- success = 1;
+ if ((r = sshbuf_get_cstring(e->request, &passwd, &pwlen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (pwlen == 0) {
+ debug("empty password not supported");
+ } else if (locked && !lock) {
+ if (bcrypt_pbkdf(passwd, pwlen, lock_salt, sizeof(lock_salt),
+ passwdhash, sizeof(passwdhash), LOCK_ROUNDS) < 0)
+ fatal("bcrypt_pbkdf");
+ if (timingsafe_bcmp(passwdhash, lock_pwhash, LOCK_SIZE) == 0) {
+ debug("agent unlocked");
+ locked = 0;
+ fail_count = 0;
+ explicit_bzero(lock_pwhash, sizeof(lock_pwhash));
+ success = 1;
+ } else {
+ /* delay in 0.1s increments up to 10s */
+ if (fail_count < 100)
+ fail_count++;
+ delay = 100000 * fail_count;
+ debug("unlock failed, delaying %0.1lf seconds",
+ (double)delay/1000000);
+ usleep(delay);
+ }
+ explicit_bzero(passwdhash, sizeof(passwdhash));
} else if (!locked && lock) {
+ debug("agent locked");
locked = 1;
- lock_passwd = xstrdup(passwd);
+ arc4random_buf(lock_salt, sizeof(lock_salt));
+ if (bcrypt_pbkdf(passwd, pwlen, lock_salt, sizeof(lock_salt),
+ lock_pwhash, sizeof(lock_pwhash), LOCK_ROUNDS) < 0)
+ fatal("bcrypt_pbkdf");
success = 1;
}
- explicit_bzero(passwd, strlen(passwd));
+ explicit_bzero(passwd, pwlen);
free(passwd);
-
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output,
- success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
+ send_status(e, success);
}
static void
no_identities(SocketEntry *e, u_int type)
{
- Buffer msg;
+ struct sshbuf *msg;
+ int r;
- buffer_init(&msg);
- buffer_put_char(&msg,
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_u8(msg,
(type == SSH_AGENTC_REQUEST_RSA_IDENTITIES) ?
- SSH_AGENT_RSA_IDENTITIES_ANSWER : SSH2_AGENT_IDENTITIES_ANSWER);
- buffer_put_int(&msg, 0);
- buffer_put_int(&e->output, buffer_len(&msg));
- buffer_append(&e->output, buffer_ptr(&msg), buffer_len(&msg));
- buffer_free(&msg);
+ SSH_AGENT_RSA_IDENTITIES_ANSWER :
+ SSH2_AGENT_IDENTITIES_ANSWER)) != 0 ||
+ (r = sshbuf_put_u32(msg, 0)) != 0 ||
+ (r = sshbuf_put_stringb(e->output, msg)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ sshbuf_free(msg);
}
#ifdef ENABLE_PKCS11
@@ -591,19 +739,27 @@
process_add_smartcard_key(SocketEntry *e)
{
char *provider = NULL, *pin;
- int i, type, version, count = 0, success = 0, confirm = 0;
+ int r, i, version, count = 0, success = 0, confirm = 0;
+ u_int seconds;
time_t death = 0;
- Key **keys = NULL, *k;
+ u_char type;
+ struct sshkey **keys = NULL, *k;
Identity *id;
Idtab *tab;
- provider = buffer_get_string(&e->request, NULL);
- pin = buffer_get_string(&e->request, NULL);
+ if ((r = sshbuf_get_cstring(e->request, &provider, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(e->request, &pin, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
- while (buffer_len(&e->request)) {
- switch ((type = buffer_get_char(&e->request))) {
+ while (sshbuf_len(e->request)) {
+ if ((r = sshbuf_get_u8(e->request, &type)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ switch (type) {
case SSH_AGENT_CONSTRAIN_LIFETIME:
- death = monotime() + buffer_get_int(&e->request);
+ if ((r = sshbuf_get_u32(e->request, &seconds)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
+ death = monotime() + seconds;
break;
case SSH_AGENT_CONSTRAIN_CONFIRM:
confirm = 1;
@@ -633,7 +789,7 @@
tab->nentries++;
success = 1;
} else {
- key_free(k);
+ sshkey_free(k);
}
keys[i] = NULL;
}
@@ -641,9 +797,7 @@
free(pin);
free(provider);
free(keys);
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output,
- success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
+ send_status(e, success);
}
static void
@@ -650,12 +804,13 @@
process_remove_smartcard_key(SocketEntry *e)
{
char *provider = NULL, *pin = NULL;
- int version, success = 0;
+ int r, version, success = 0;
Identity *id, *nxt;
Idtab *tab;
- provider = buffer_get_string(&e->request, NULL);
- pin = buffer_get_string(&e->request, NULL);
+ if ((r = sshbuf_get_cstring(e->request, &provider, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(e->request, &pin, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
free(pin);
for (version = 1; version < 3; version++) {
@@ -678,9 +833,7 @@
error("process_remove_smartcard_key:"
" pkcs11_del_provider failed");
free(provider);
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output,
- success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
+ send_status(e, success);
}
#endif /* ENABLE_PKCS11 */
@@ -689,30 +842,31 @@
static void
process_message(SocketEntry *e)
{
- u_int msg_len, type;
- u_char *cp;
+ u_int msg_len;
+ u_char type;
+ const u_char *cp;
+ int r;
- if (buffer_len(&e->input) < 5)
+ if (sshbuf_len(e->input) < 5)
return; /* Incomplete message. */
- cp = buffer_ptr(&e->input);
- msg_len = get_u32(cp);
+ cp = sshbuf_ptr(e->input);
+ msg_len = PEEK_U32(cp);
if (msg_len > 256 * 1024) {
close_socket(e);
return;
}
- if (buffer_len(&e->input) < msg_len + 4)
+ if (sshbuf_len(e->input) < msg_len + 4)
return;
/* move the current input to e->request */
- buffer_consume(&e->input, 4);
- buffer_clear(&e->request);
- buffer_append(&e->request, buffer_ptr(&e->input), msg_len);
- buffer_consume(&e->input, msg_len);
- type = buffer_get_char(&e->request);
+ sshbuf_reset(e->request);
+ if ((r = sshbuf_get_stringb(e->input, e->request)) != 0 ||
+ (r = sshbuf_get_u8(e->request, &type)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
/* check wheter agent is locked */
if (locked && type != SSH_AGENTC_UNLOCK) {
- buffer_clear(&e->request);
+ sshbuf_reset(e->request);
switch (type) {
case SSH_AGENTC_REQUEST_RSA_IDENTITIES:
case SSH2_AGENTC_REQUEST_IDENTITIES:
@@ -721,8 +875,7 @@
break;
default:
/* send a fail message for all other request types */
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output, SSH_AGENT_FAILURE);
+ send_status(e, 0);
}
return;
}
@@ -733,6 +886,7 @@
case SSH_AGENTC_UNLOCK:
process_lock_agent(e, type == SSH_AGENTC_LOCK);
break;
+#ifdef WITH_SSH1
/* ssh1 */
case SSH_AGENTC_RSA_CHALLENGE:
process_authentication_challenge1(e);
@@ -747,8 +901,9 @@
case SSH_AGENTC_REMOVE_RSA_IDENTITY:
process_remove_identity(e, 1);
break;
+#endif
case SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES:
- process_remove_all_identities(e, 1);
+ process_remove_all_identities(e, 1); /* safe for !WITH_SSH1 */
break;
/* ssh2 */
case SSH2_AGENTC_SIGN_REQUEST:
@@ -779,9 +934,8 @@
default:
/* Unknown message. Respond with failure. */
error("Unknown message %d", type);
- buffer_clear(&e->request);
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output, SSH_AGENT_FAILURE);
+ sshbuf_reset(e->request);
+ send_status(e, 0);
break;
}
}
@@ -799,22 +953,28 @@
for (i = 0; i < sockets_alloc; i++)
if (sockets[i].type == AUTH_UNUSED) {
sockets[i].fd = fd;
- buffer_init(&sockets[i].input);
- buffer_init(&sockets[i].output);
- buffer_init(&sockets[i].request);
+ if ((sockets[i].input = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((sockets[i].output = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((sockets[i].request = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
sockets[i].type = type;
return;
}
old_alloc = sockets_alloc;
new_alloc = sockets_alloc + 10;
- sockets = xrealloc(sockets, new_alloc, sizeof(sockets[0]));
+ sockets = xreallocarray(sockets, new_alloc, sizeof(sockets[0]));
for (i = old_alloc; i < new_alloc; i++)
sockets[i].type = AUTH_UNUSED;
sockets_alloc = new_alloc;
sockets[old_alloc].fd = fd;
- buffer_init(&sockets[old_alloc].input);
- buffer_init(&sockets[old_alloc].output);
- buffer_init(&sockets[old_alloc].request);
+ if ((sockets[old_alloc].input = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((sockets[old_alloc].output = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((sockets[old_alloc].request = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
sockets[old_alloc].type = type;
}
@@ -860,7 +1020,7 @@
case AUTH_SOCKET:
case AUTH_CONNECTION:
FD_SET(sockets[i].fd, *fdrp);
- if (buffer_len(&sockets[i].output) > 0)
+ if (sshbuf_len(sockets[i].output) > 0)
FD_SET(sockets[i].fd, *fdwp);
break;
default:
@@ -887,7 +1047,7 @@
struct sockaddr_un sunaddr;
socklen_t slen;
char buf[1024];
- int len, sock;
+ int len, sock, r;
u_int i, orig_alloc;
uid_t euid;
gid_t egid;
@@ -923,11 +1083,11 @@
}
break;
case AUTH_CONNECTION:
- if (buffer_len(&sockets[i].output) > 0 &&
+ if (sshbuf_len(sockets[i].output) > 0 &&
FD_ISSET(sockets[i].fd, writeset)) {
len = write(sockets[i].fd,
- buffer_ptr(&sockets[i].output),
- buffer_len(&sockets[i].output));
+ sshbuf_ptr(sockets[i].output),
+ sshbuf_len(sockets[i].output));
if (len == -1 && (errno == EAGAIN ||
errno == EWOULDBLOCK ||
errno == EINTR))
@@ -936,7 +1096,10 @@
close_socket(&sockets[i]);
break;
}
- buffer_consume(&sockets[i].output, len);
+ if ((r = sshbuf_consume(sockets[i].output,
+ len)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
}
if (FD_ISSET(sockets[i].fd, readset)) {
len = read(sockets[i].fd, buf, sizeof(buf));
@@ -948,7 +1111,11 @@
close_socket(&sockets[i]);
break;
}
- buffer_append(&sockets[i].input, buf, len);
+ if ((r = sshbuf_put(sockets[i].input,
+ buf, len)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
+ explicit_bzero(buf, sizeof(buf));
process_message(&sockets[i]);
}
break;
@@ -960,6 +1127,9 @@
static void
cleanup_socket(void)
{
+ if (cleanup_pid != 0 && getpid() != cleanup_pid)
+ return;
+ debug("%s: cleanup", __func__);
if (socket_name[0])
unlink(socket_name);
if (socket_dir[0])
@@ -1001,15 +1171,10 @@
static void
usage(void)
{
- fprintf(stderr, "usage: %s [options] [command [arg ...]]\n",
- __progname);
- fprintf(stderr, "Options:\n");
- fprintf(stderr, " -c Generate C-shell commands on stdout.\n");
- fprintf(stderr, " -s Generate Bourne shell commands on stdout.\n");
- fprintf(stderr, " -k Kill the current agent.\n");
- fprintf(stderr, " -d Debug mode.\n");
- fprintf(stderr, " -a socket Bind agent socket to given name.\n");
- fprintf(stderr, " -t life Default identity lifetime (seconds).\n");
+ fprintf(stderr,
+ "usage: ssh-agent [-c | -s] [-Dd] [-a bind_address] [-E fingerprint_hash]\n"
+ " [-t life] [command [arg ...]]\n"
+ " ssh-agent [-c | -s] -k\n");
exit(1);
}
@@ -1016,16 +1181,14 @@
int
main(int ac, char **av)
{
- int c_flag = 0, d_flag = 0, k_flag = 0, s_flag = 0;
+ int c_flag = 0, d_flag = 0, D_flag = 0, k_flag = 0, s_flag = 0;
int sock, fd, ch, result, saved_errno;
u_int nalloc;
char *shell, *format, *pidstr, *agentsocket = NULL;
fd_set *readsetp = NULL, *writesetp = NULL;
- struct sockaddr_un sunaddr;
#ifdef HAVE_SETRLIMIT
struct rlimit rlim;
#endif
- int prev_mask;
extern int optind;
extern char *optarg;
pid_t pid;
@@ -1032,7 +1195,9 @@
char pidstrbuf[1 + 3 * sizeof pid];
struct timeval *tvp = NULL;
size_t len;
+ mode_t prev_mask;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
@@ -1040,18 +1205,22 @@
setegid(getgid());
setgid(getgid());
-#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
- /* Disable ptrace on Linux without sgid bit */
- prctl(PR_SET_DUMPABLE, 0);
-#endif
+ platform_disable_tracing(0); /* strict=no */
+#ifdef WITH_OPENSSL
OpenSSL_add_all_algorithms();
+#endif
__progname = ssh_get_progname(av[0]);
seed_rng();
- while ((ch = getopt(ac, av, "cdksa:t:")) != -1) {
+ while ((ch = getopt(ac, av, "cDdksE:a:t:")) != -1) {
switch (ch) {
+ case 'E':
+ fingerprint_hash = ssh_digest_alg_by_name(optarg);
+ if (fingerprint_hash == -1)
+ fatal("Invalid hash algorithm \"%s\"", optarg);
+ break;
case 'c':
if (s_flag)
usage();
@@ -1066,10 +1235,15 @@
s_flag++;
break;
case 'd':
- if (d_flag)
+ if (d_flag || D_flag)
usage();
d_flag++;
break;
+ case 'D':
+ if (d_flag || D_flag)
+ usage();
+ D_flag++;
+ break;
case 'a':
agentsocket = optarg;
break;
@@ -1086,7 +1260,7 @@
ac -= optind;
av += optind;
- if (ac > 0 && (c_flag || k_flag || s_flag || d_flag))
+ if (ac > 0 && (c_flag || k_flag || s_flag || d_flag || D_flag))
usage();
if (ac == 0 && !c_flag && !s_flag) {
@@ -1142,38 +1316,28 @@
* Create socket early so it will exist before command gets run from
* the parent.
*/
- sock = socket(AF_UNIX, SOCK_STREAM, 0);
+ prev_mask = umask(0177);
+ sock = unix_listener(socket_name, SSH_LISTEN_BACKLOG, 0);
if (sock < 0) {
- perror("socket");
+ /* XXX - unix_listener() calls error() not perror() */
*socket_name = '\0'; /* Don't unlink any existing file */
cleanup_exit(1);
}
- memset(&sunaddr, 0, sizeof(sunaddr));
- sunaddr.sun_family = AF_UNIX;
- strlcpy(sunaddr.sun_path, socket_name, sizeof(sunaddr.sun_path));
- prev_mask = umask(0177);
- if (bind(sock, (struct sockaddr *) &sunaddr, sizeof(sunaddr)) < 0) {
- perror("bind");
- *socket_name = '\0'; /* Don't unlink any existing file */
- umask(prev_mask);
- cleanup_exit(1);
- }
umask(prev_mask);
- if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
- perror("listen");
- cleanup_exit(1);
- }
/*
* Fork, and have the parent execute the command, if any, or present
* the socket data. The child continues as the authentication agent.
*/
- if (d_flag) {
- log_init(__progname, SYSLOG_LEVEL_DEBUG1, SYSLOG_FACILITY_AUTH, 1);
+ if (D_flag || d_flag) {
+ log_init(__progname,
+ d_flag ? SYSLOG_LEVEL_DEBUG3 : SYSLOG_LEVEL_INFO,
+ SYSLOG_FACILITY_AUTH, 1);
format = c_flag ? "setenv %s %s;\n" : "%s=%s; export %s;\n";
printf(format, SSH_AUTHSOCKET_ENV_NAME, socket_name,
SSH_AUTHSOCKET_ENV_NAME);
printf("echo Agent pid %ld;\n", (long)parent_pid);
+ fflush(stdout);
goto skip;
}
pid = fork();
@@ -1231,6 +1395,8 @@
skip:
+ cleanup_pid = getpid();
+
#ifdef ENABLE_PKCS11
pkcs11_init(0);
#endif
@@ -1239,11 +1405,15 @@
parent_alive_interval = 10;
idtab_init();
signal(SIGPIPE, SIG_IGN);
- signal(SIGINT, d_flag ? cleanup_handler : SIG_IGN);
+ signal(SIGINT, (d_flag | D_flag) ? cleanup_handler : SIG_IGN);
signal(SIGHUP, cleanup_handler);
signal(SIGTERM, cleanup_handler);
nalloc = 0;
+ if (pledge("stdio cpath unix id proc exec", NULL) == -1)
+ fatal("%s: pledge: %s", __progname, strerror(errno));
+ platform_pledge_agent();
+
while (1) {
prepare_select(&readsetp, &writesetp, &max_fd, &nalloc, &tvp);
result = select(max_fd + 1, readsetp, writesetp, NULL, tvp);
Modified: trunk/crypto/openssh/ssh-dss.c
===================================================================
--- trunk/crypto/openssh/ssh-dss.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-dss.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-dss.c,v 1.31 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: ssh-dss.c,v 1.35 2016/04/21 06:08:02 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -25,165 +25,196 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
#include <openssl/bn.h>
+#include <openssl/dsa.h>
#include <openssl/evp.h>
#include <stdarg.h>
#include <string.h>
-#include "xmalloc.h"
-#include "buffer.h"
+#include "sshbuf.h"
#include "compat.h"
-#include "log.h"
-#include "key.h"
+#include "ssherr.h"
#include "digest.h"
+#define SSHKEY_INTERNAL
+#include "sshkey.h"
#define INTBLOB_LEN 20
#define SIGBLOB_LEN (2*INTBLOB_LEN)
int
-ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
- const u_char *data, u_int datalen)
+ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, u_int compat)
{
- DSA_SIG *sig;
+ DSA_SIG *sig = NULL;
u_char digest[SSH_DIGEST_MAX_LENGTH], sigblob[SIGBLOB_LEN];
- u_int rlen, slen, len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
- Buffer b;
+ size_t rlen, slen, len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
+ struct sshbuf *b = NULL;
+ int ret = SSH_ERR_INVALID_ARGUMENT;
- if (key == NULL || key_type_plain(key->type) != KEY_DSA ||
- key->dsa == NULL) {
- error("%s: no DSA key", __func__);
- return -1;
- }
+ if (lenp != NULL)
+ *lenp = 0;
+ if (sigp != NULL)
+ *sigp = NULL;
- if (ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen,
- digest, sizeof(digest)) != 0) {
- error("%s: ssh_digest_memory failed", __func__);
- return -1;
- }
+ if (key == NULL || key->dsa == NULL ||
+ sshkey_type_plain(key->type) != KEY_DSA)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (dlen == 0)
+ return SSH_ERR_INTERNAL_ERROR;
- sig = DSA_do_sign(digest, dlen, key->dsa);
- explicit_bzero(digest, sizeof(digest));
+ if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen,
+ digest, sizeof(digest))) != 0)
+ goto out;
- if (sig == NULL) {
- error("ssh_dss_sign: sign failed");
- return -1;
+ if ((sig = DSA_do_sign(digest, dlen, key->dsa)) == NULL) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
}
rlen = BN_num_bytes(sig->r);
slen = BN_num_bytes(sig->s);
if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
- error("bad sig size %u %u", rlen, slen);
- DSA_SIG_free(sig);
- return -1;
+ ret = SSH_ERR_INTERNAL_ERROR;
+ goto out;
}
explicit_bzero(sigblob, SIGBLOB_LEN);
- BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
- BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
- DSA_SIG_free(sig);
+ BN_bn2bin(sig->r, sigblob + SIGBLOB_LEN - INTBLOB_LEN - rlen);
+ BN_bn2bin(sig->s, sigblob + SIGBLOB_LEN - slen);
- if (datafellows & SSH_BUG_SIGBLOB) {
- if (lenp != NULL)
- *lenp = SIGBLOB_LEN;
+ if (compat & SSH_BUG_SIGBLOB) {
if (sigp != NULL) {
- *sigp = xmalloc(SIGBLOB_LEN);
+ if ((*sigp = malloc(SIGBLOB_LEN)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(*sigp, sigblob, SIGBLOB_LEN);
}
+ if (lenp != NULL)
+ *lenp = SIGBLOB_LEN;
+ ret = 0;
} else {
/* ietf-drafts */
- buffer_init(&b);
- buffer_put_cstring(&b, "ssh-dss");
- buffer_put_string(&b, sigblob, SIGBLOB_LEN);
- len = buffer_len(&b);
+ if ((b = sshbuf_new()) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((ret = sshbuf_put_cstring(b, "ssh-dss")) != 0 ||
+ (ret = sshbuf_put_string(b, sigblob, SIGBLOB_LEN)) != 0)
+ goto out;
+ len = sshbuf_len(b);
+ if (sigp != NULL) {
+ if ((*sigp = malloc(len)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ memcpy(*sigp, sshbuf_ptr(b), len);
+ }
if (lenp != NULL)
*lenp = len;
- if (sigp != NULL) {
- *sigp = xmalloc(len);
- memcpy(*sigp, buffer_ptr(&b), len);
- }
- buffer_free(&b);
+ ret = 0;
}
- return 0;
+ out:
+ explicit_bzero(digest, sizeof(digest));
+ if (sig != NULL)
+ DSA_SIG_free(sig);
+ sshbuf_free(b);
+ return ret;
}
+
int
-ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
- const u_char *data, u_int datalen)
+ssh_dss_verify(const struct sshkey *key,
+ const u_char *signature, size_t signaturelen,
+ const u_char *data, size_t datalen, u_int compat)
{
- DSA_SIG *sig;
- u_char digest[SSH_DIGEST_MAX_LENGTH], *sigblob;
- u_int len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
- int rlen, ret;
- Buffer b;
+ DSA_SIG *sig = NULL;
+ u_char digest[SSH_DIGEST_MAX_LENGTH], *sigblob = NULL;
+ size_t len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
+ int ret = SSH_ERR_INTERNAL_ERROR;
+ struct sshbuf *b = NULL;
+ char *ktype = NULL;
- if (key == NULL || key_type_plain(key->type) != KEY_DSA ||
- key->dsa == NULL) {
- error("%s: no DSA key", __func__);
- return -1;
- }
+ if (key == NULL || key->dsa == NULL ||
+ sshkey_type_plain(key->type) != KEY_DSA ||
+ signature == NULL || signaturelen == 0)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (dlen == 0)
+ return SSH_ERR_INTERNAL_ERROR;
/* fetch signature */
- if (datafellows & SSH_BUG_SIGBLOB) {
- sigblob = xmalloc(signaturelen);
+ if (compat & SSH_BUG_SIGBLOB) {
+ if ((sigblob = malloc(signaturelen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
memcpy(sigblob, signature, signaturelen);
len = signaturelen;
} else {
/* ietf-drafts */
- char *ktype;
- buffer_init(&b);
- buffer_append(&b, signature, signaturelen);
- ktype = buffer_get_cstring(&b, NULL);
+ if ((b = sshbuf_from(signature, signaturelen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
+ sshbuf_get_string(b, &sigblob, &len) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
if (strcmp("ssh-dss", ktype) != 0) {
- error("%s: cannot handle type %s", __func__, ktype);
- buffer_free(&b);
- free(ktype);
- return -1;
+ ret = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
}
- free(ktype);
- sigblob = buffer_get_string(&b, &len);
- rlen = buffer_len(&b);
- buffer_free(&b);
- if (rlen != 0) {
- error("%s: remaining bytes in signature %d",
- __func__, rlen);
- free(sigblob);
- return -1;
+ if (sshbuf_len(b) != 0) {
+ ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
+ goto out;
}
}
if (len != SIGBLOB_LEN) {
- fatal("bad sigbloblen %u != SIGBLOB_LEN", len);
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
/* parse signature */
- if ((sig = DSA_SIG_new()) == NULL)
- fatal("%s: DSA_SIG_new failed", __func__);
- if ((sig->r = BN_new()) == NULL)
- fatal("%s: BN_new failed", __func__);
- if ((sig->s = BN_new()) == NULL)
- fatal("ssh_dss_verify: BN_new failed");
+ if ((sig = DSA_SIG_new()) == NULL ||
+ (sig->r = BN_new()) == NULL ||
+ (sig->s = BN_new()) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
if ((BN_bin2bn(sigblob, INTBLOB_LEN, sig->r) == NULL) ||
- (BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s) == NULL))
- fatal("%s: BN_bin2bn failed", __func__);
+ (BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s) == NULL)) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
- /* clean up */
- explicit_bzero(sigblob, len);
- free(sigblob);
+ /* sha1 the data */
+ if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen,
+ digest, sizeof(digest))) != 0)
+ goto out;
- /* sha1 the data */
- if (ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen,
- digest, sizeof(digest)) != 0) {
- error("%s: digest_memory failed", __func__);
- return -1;
+ switch (DSA_do_verify(digest, dlen, sig, key->dsa)) {
+ case 1:
+ ret = 0;
+ break;
+ case 0:
+ ret = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
+ default:
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
}
- ret = DSA_do_verify(digest, dlen, sig, key->dsa);
+ out:
explicit_bzero(digest, sizeof(digest));
-
- DSA_SIG_free(sig);
-
- debug("%s: signature %s", __func__,
- ret == 1 ? "correct" : ret == 0 ? "incorrect" : "error");
+ if (sig != NULL)
+ DSA_SIG_free(sig);
+ sshbuf_free(b);
+ free(ktype);
+ if (sigblob != NULL) {
+ explicit_bzero(sigblob, len);
+ free(sigblob);
+ }
return ret;
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/ssh-ecdsa.c
===================================================================
--- trunk/crypto/openssh/ssh-ecdsa.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-ecdsa.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-ecdsa.c,v 1.10 2014/02/03 23:28:00 djm Exp $ */
+/* $OpenBSD: ssh-ecdsa.c,v 1.13 2016/04/21 06:08:02 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -26,7 +26,7 @@
#include "includes.h"
-#ifdef OPENSSL_HAS_ECC
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
#include <sys/types.h>
@@ -37,142 +37,153 @@
#include <string.h>
-#include "xmalloc.h"
-#include "buffer.h"
-#include "compat.h"
-#include "log.h"
-#include "key.h"
+#include "sshbuf.h"
+#include "ssherr.h"
#include "digest.h"
+#define SSHKEY_INTERNAL
+#include "sshkey.h"
+/* ARGSUSED */
int
-ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
- const u_char *data, u_int datalen)
+ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, u_int compat)
{
- ECDSA_SIG *sig;
+ ECDSA_SIG *sig = NULL;
int hash_alg;
u_char digest[SSH_DIGEST_MAX_LENGTH];
- u_int len, dlen;
- Buffer b, bb;
+ size_t len, dlen;
+ struct sshbuf *b = NULL, *bb = NULL;
+ int ret = SSH_ERR_INTERNAL_ERROR;
- if (key == NULL || key_type_plain(key->type) != KEY_ECDSA ||
- key->ecdsa == NULL) {
- error("%s: no ECDSA key", __func__);
- return -1;
- }
+ if (lenp != NULL)
+ *lenp = 0;
+ if (sigp != NULL)
+ *sigp = NULL;
- hash_alg = key_ec_nid_to_hash_alg(key->ecdsa_nid);
- if ((dlen = ssh_digest_bytes(hash_alg)) == 0) {
- error("%s: bad hash algorithm %d", __func__, hash_alg);
- return -1;
- }
- if (ssh_digest_memory(hash_alg, data, datalen,
- digest, sizeof(digest)) != 0) {
- error("%s: digest_memory failed", __func__);
- return -1;
- }
+ if (key == NULL || key->ecdsa == NULL ||
+ sshkey_type_plain(key->type) != KEY_ECDSA)
+ return SSH_ERR_INVALID_ARGUMENT;
- sig = ECDSA_do_sign(digest, dlen, key->ecdsa);
- explicit_bzero(digest, sizeof(digest));
+ if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 ||
+ (dlen = ssh_digest_bytes(hash_alg)) == 0)
+ return SSH_ERR_INTERNAL_ERROR;
+ if ((ret = ssh_digest_memory(hash_alg, data, datalen,
+ digest, sizeof(digest))) != 0)
+ goto out;
- if (sig == NULL) {
- error("%s: sign failed", __func__);
- return -1;
+ if ((sig = ECDSA_do_sign(digest, dlen, key->ecdsa)) == NULL) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
}
- buffer_init(&bb);
- buffer_put_bignum2(&bb, sig->r);
- buffer_put_bignum2(&bb, sig->s);
- ECDSA_SIG_free(sig);
-
- buffer_init(&b);
- buffer_put_cstring(&b, key_ssh_name_plain(key));
- buffer_put_string(&b, buffer_ptr(&bb), buffer_len(&bb));
- buffer_free(&bb);
- len = buffer_len(&b);
+ if ((bb = sshbuf_new()) == NULL || (b = sshbuf_new()) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((ret = sshbuf_put_bignum2(bb, sig->r)) != 0 ||
+ (ret = sshbuf_put_bignum2(bb, sig->s)) != 0)
+ goto out;
+ if ((ret = sshbuf_put_cstring(b, sshkey_ssh_name_plain(key))) != 0 ||
+ (ret = sshbuf_put_stringb(b, bb)) != 0)
+ goto out;
+ len = sshbuf_len(b);
+ if (sigp != NULL) {
+ if ((*sigp = malloc(len)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ memcpy(*sigp, sshbuf_ptr(b), len);
+ }
if (lenp != NULL)
*lenp = len;
- if (sigp != NULL) {
- *sigp = xmalloc(len);
- memcpy(*sigp, buffer_ptr(&b), len);
- }
- buffer_free(&b);
+ ret = 0;
+ out:
+ explicit_bzero(digest, sizeof(digest));
+ sshbuf_free(b);
+ sshbuf_free(bb);
+ if (sig != NULL)
+ ECDSA_SIG_free(sig);
+ return ret;
+}
- return 0;
-}
+/* ARGSUSED */
int
-ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- const u_char *data, u_int datalen)
+ssh_ecdsa_verify(const struct sshkey *key,
+ const u_char *signature, size_t signaturelen,
+ const u_char *data, size_t datalen, u_int compat)
{
- ECDSA_SIG *sig;
+ ECDSA_SIG *sig = NULL;
int hash_alg;
- u_char digest[SSH_DIGEST_MAX_LENGTH], *sigblob;
- u_int len, dlen;
- int rlen, ret;
- Buffer b, bb;
- char *ktype;
+ u_char digest[SSH_DIGEST_MAX_LENGTH];
+ size_t dlen;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+ struct sshbuf *b = NULL, *sigbuf = NULL;
+ char *ktype = NULL;
- if (key == NULL || key_type_plain(key->type) != KEY_ECDSA ||
- key->ecdsa == NULL) {
- error("%s: no ECDSA key", __func__);
- return -1;
- }
+ if (key == NULL || key->ecdsa == NULL ||
+ sshkey_type_plain(key->type) != KEY_ECDSA ||
+ signature == NULL || signaturelen == 0)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 ||
+ (dlen = ssh_digest_bytes(hash_alg)) == 0)
+ return SSH_ERR_INTERNAL_ERROR;
+
/* fetch signature */
- buffer_init(&b);
- buffer_append(&b, signature, signaturelen);
- ktype = buffer_get_string(&b, NULL);
- if (strcmp(key_ssh_name_plain(key), ktype) != 0) {
- error("%s: cannot handle type %s", __func__, ktype);
- buffer_free(&b);
- free(ktype);
- return -1;
+ if ((b = sshbuf_from(signature, signaturelen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
+ sshbuf_froms(b, &sigbuf) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
- free(ktype);
- sigblob = buffer_get_string(&b, &len);
- rlen = buffer_len(&b);
- buffer_free(&b);
- if (rlen != 0) {
- error("%s: remaining bytes in signature %d", __func__, rlen);
- free(sigblob);
- return -1;
+ if (strcmp(sshkey_ssh_name_plain(key), ktype) != 0) {
+ ret = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
}
+ if (sshbuf_len(b) != 0) {
+ ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
+ goto out;
+ }
/* parse signature */
- if ((sig = ECDSA_SIG_new()) == NULL)
- fatal("%s: ECDSA_SIG_new failed", __func__);
-
- buffer_init(&bb);
- buffer_append(&bb, sigblob, len);
- buffer_get_bignum2(&bb, sig->r);
- buffer_get_bignum2(&bb, sig->s);
- if (buffer_len(&bb) != 0)
- fatal("%s: remaining bytes in inner sigblob", __func__);
- buffer_free(&bb);
-
- /* clean up */
- explicit_bzero(sigblob, len);
- free(sigblob);
-
- /* hash the data */
- hash_alg = key_ec_nid_to_hash_alg(key->ecdsa_nid);
- if ((dlen = ssh_digest_bytes(hash_alg)) == 0) {
- error("%s: bad hash algorithm %d", __func__, hash_alg);
- return -1;
+ if ((sig = ECDSA_SIG_new()) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
}
- if (ssh_digest_memory(hash_alg, data, datalen,
- digest, sizeof(digest)) != 0) {
- error("%s: digest_memory failed", __func__);
- return -1;
+ if (sshbuf_get_bignum2(sigbuf, sig->r) != 0 ||
+ sshbuf_get_bignum2(sigbuf, sig->s) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
+ if (sshbuf_len(sigbuf) != 0) {
+ ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
+ goto out;
+ }
+ if ((ret = ssh_digest_memory(hash_alg, data, datalen,
+ digest, sizeof(digest))) != 0)
+ goto out;
- ret = ECDSA_do_verify(digest, dlen, sig, key->ecdsa);
+ switch (ECDSA_do_verify(digest, dlen, sig, key->ecdsa)) {
+ case 1:
+ ret = 0;
+ break;
+ case 0:
+ ret = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
+ default:
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+
+ out:
explicit_bzero(digest, sizeof(digest));
-
- ECDSA_SIG_free(sig);
-
- debug("%s: signature %s", __func__,
- ret == 1 ? "correct" : ret == 0 ? "incorrect" : "error");
+ sshbuf_free(sigbuf);
+ sshbuf_free(b);
+ if (sig != NULL)
+ ECDSA_SIG_free(sig);
+ free(ktype);
return ret;
}
-#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
Modified: trunk/crypto/openssh/ssh-ed25519.c
===================================================================
--- trunk/crypto/openssh/ssh-ed25519.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-ed25519.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-ed25519.c,v 1.3 2014/02/23 20:03:42 djm Exp $ */
+/* $OpenBSD: ssh-ed25519.c,v 1.7 2016/04/21 06:08:02 djm Exp $ */
/*
* Copyright (c) 2013 Markus Friedl <markus at openbsd.org>
*
@@ -18,132 +18,150 @@
#include "includes.h"
#include <sys/types.h>
+#include <limits.h>
#include "crypto_api.h"
-#include <limits.h>
#include <string.h>
#include <stdarg.h>
-#include "xmalloc.h"
#include "log.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshbuf.h"
+#define SSHKEY_INTERNAL
+#include "sshkey.h"
+#include "ssherr.h"
#include "ssh.h"
int
-ssh_ed25519_sign(const Key *key, u_char **sigp, u_int *lenp,
- const u_char *data, u_int datalen)
+ssh_ed25519_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, u_int compat)
{
- u_char *sig;
- u_int slen, len;
+ u_char *sig = NULL;
+ size_t slen = 0, len;
unsigned long long smlen;
- int ret;
- Buffer b;
+ int r, ret;
+ struct sshbuf *b = NULL;
- if (key == NULL || key_type_plain(key->type) != KEY_ED25519 ||
- key->ed25519_sk == NULL) {
- error("%s: no ED25519 key", __func__);
- return -1;
- }
+ if (lenp != NULL)
+ *lenp = 0;
+ if (sigp != NULL)
+ *sigp = NULL;
- if (datalen >= UINT_MAX - crypto_sign_ed25519_BYTES) {
- error("%s: datalen %u too long", __func__, datalen);
- return -1;
- }
+ if (key == NULL ||
+ sshkey_type_plain(key->type) != KEY_ED25519 ||
+ key->ed25519_sk == NULL ||
+ datalen >= INT_MAX - crypto_sign_ed25519_BYTES)
+ return SSH_ERR_INVALID_ARGUMENT;
smlen = slen = datalen + crypto_sign_ed25519_BYTES;
- sig = xmalloc(slen);
+ if ((sig = malloc(slen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
if ((ret = crypto_sign_ed25519(sig, &smlen, data, datalen,
key->ed25519_sk)) != 0 || smlen <= datalen) {
- error("%s: crypto_sign_ed25519 failed: %d", __func__, ret);
- free(sig);
- return -1;
+ r = SSH_ERR_INVALID_ARGUMENT; /* XXX better error? */
+ goto out;
}
/* encode signature */
- buffer_init(&b);
- buffer_put_cstring(&b, "ssh-ed25519");
- buffer_put_string(&b, sig, smlen - datalen);
- len = buffer_len(&b);
+ if ((b = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_put_cstring(b, "ssh-ed25519")) != 0 ||
+ (r = sshbuf_put_string(b, sig, smlen - datalen)) != 0)
+ goto out;
+ len = sshbuf_len(b);
+ if (sigp != NULL) {
+ if ((*sigp = malloc(len)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ memcpy(*sigp, sshbuf_ptr(b), len);
+ }
if (lenp != NULL)
*lenp = len;
- if (sigp != NULL) {
- *sigp = xmalloc(len);
- memcpy(*sigp, buffer_ptr(&b), len);
+ /* success */
+ r = 0;
+ out:
+ sshbuf_free(b);
+ if (sig != NULL) {
+ explicit_bzero(sig, slen);
+ free(sig);
}
- buffer_free(&b);
- explicit_bzero(sig, slen);
- free(sig);
- return 0;
+ return r;
}
int
-ssh_ed25519_verify(const Key *key, const u_char *signature, u_int signaturelen,
- const u_char *data, u_int datalen)
+ssh_ed25519_verify(const struct sshkey *key,
+ const u_char *signature, size_t signaturelen,
+ const u_char *data, size_t datalen, u_int compat)
{
- Buffer b;
- char *ktype;
- u_char *sigblob, *sm, *m;
- u_int len;
- unsigned long long smlen, mlen;
- int rlen, ret;
+ struct sshbuf *b = NULL;
+ char *ktype = NULL;
+ const u_char *sigblob;
+ u_char *sm = NULL, *m = NULL;
+ size_t len;
+ unsigned long long smlen = 0, mlen = 0;
+ int r, ret;
- if (key == NULL || key_type_plain(key->type) != KEY_ED25519 ||
- key->ed25519_pk == NULL) {
- error("%s: no ED25519 key", __func__);
- return -1;
- }
- buffer_init(&b);
- buffer_append(&b, signature, signaturelen);
- ktype = buffer_get_cstring(&b, NULL);
+ if (key == NULL ||
+ sshkey_type_plain(key->type) != KEY_ED25519 ||
+ key->ed25519_pk == NULL ||
+ datalen >= INT_MAX - crypto_sign_ed25519_BYTES ||
+ signature == NULL || signaturelen == 0)
+ return SSH_ERR_INVALID_ARGUMENT;
+
+ if ((b = sshbuf_from(signature, signaturelen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_get_cstring(b, &ktype, NULL)) != 0 ||
+ (r = sshbuf_get_string_direct(b, &sigblob, &len)) != 0)
+ goto out;
if (strcmp("ssh-ed25519", ktype) != 0) {
- error("%s: cannot handle type %s", __func__, ktype);
- buffer_free(&b);
- free(ktype);
- return -1;
+ r = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
}
- free(ktype);
- sigblob = buffer_get_string(&b, &len);
- rlen = buffer_len(&b);
- buffer_free(&b);
- if (rlen != 0) {
- error("%s: remaining bytes in signature %d", __func__, rlen);
- free(sigblob);
- return -1;
+ if (sshbuf_len(b) != 0) {
+ r = SSH_ERR_UNEXPECTED_TRAILING_DATA;
+ goto out;
}
if (len > crypto_sign_ed25519_BYTES) {
- error("%s: len %u > crypto_sign_ed25519_BYTES %u", __func__,
- len, crypto_sign_ed25519_BYTES);
- free(sigblob);
- return -1;
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
+ if (datalen >= SIZE_MAX - len) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
smlen = len + datalen;
- sm = xmalloc(smlen);
+ mlen = smlen;
+ if ((sm = malloc(smlen)) == NULL || (m = malloc(mlen)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memcpy(sm, sigblob, len);
memcpy(sm+len, data, datalen);
- mlen = smlen;
- m = xmalloc(mlen);
if ((ret = crypto_sign_ed25519_open(m, &mlen, sm, smlen,
key->ed25519_pk)) != 0) {
debug2("%s: crypto_sign_ed25519_open failed: %d",
__func__, ret);
}
- if (ret == 0 && mlen != datalen) {
- debug2("%s: crypto_sign_ed25519_open "
- "mlen != datalen (%llu != %u)", __func__, mlen, datalen);
- ret = -1;
+ if (ret != 0 || mlen != datalen) {
+ r = SSH_ERR_SIGNATURE_INVALID;
+ goto out;
}
/* XXX compare 'm' and 'data' ? */
-
- explicit_bzero(sigblob, len);
- explicit_bzero(sm, smlen);
- explicit_bzero(m, smlen); /* NB. mlen may be invalid if ret != 0 */
- free(sigblob);
- free(sm);
- free(m);
- debug("%s: signature %scorrect", __func__, (ret != 0) ? "in" : "");
-
- /* translate return code carefully */
- return (ret == 0) ? 1 : -1;
+ /* success */
+ r = 0;
+ out:
+ if (sm != NULL) {
+ explicit_bzero(sm, smlen);
+ free(sm);
+ }
+ if (m != NULL) {
+ explicit_bzero(m, smlen); /* NB mlen may be invalid if r != 0 */
+ free(m);
+ }
+ sshbuf_free(b);
+ free(ktype);
+ return r;
}
Modified: trunk/crypto/openssh/ssh-keygen.0
===================================================================
--- trunk/crypto/openssh/ssh-keygen.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keygen.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,17 +1,17 @@
-SSH-KEYGEN(1) OpenBSD Reference Manual SSH-KEYGEN(1)
+SSH-KEYGEN(1) General Commands Manual SSH-KEYGEN(1)
NAME
- ssh-keygen - authentication key generation, management and conversion
+ ssh-keygen M-bM-^@M-^S authentication key generation, management and conversion
SYNOPSIS
- ssh-keygen [-q] [-b bits] [-t type] [-N new_passphrase] [-C comment]
- [-f output_keyfile]
+ ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa | rsa1]
+ [-N new_passphrase] [-C comment] [-f output_keyfile]
ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
ssh-keygen -i [-m key_format] [-f input_keyfile]
ssh-keygen -e [-m key_format] [-f input_keyfile]
ssh-keygen -y [-f input_keyfile]
ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]
- ssh-keygen -l [-f input_keyfile]
+ ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]
ssh-keygen -B [-f input_keyfile]
ssh-keygen -D pkcs11
ssh-keygen -F hostname [-f known_hosts_file] [-l]
@@ -31,8 +31,11 @@
DESCRIPTION
ssh-keygen generates, manages and converts authentication keys for
- ssh(1). ssh-keygen can create RSA keys for use by SSH protocol version 1
- and DSA, ECDSA, ED25519 or RSA keys for use by SSH protocol version 2.
+ ssh(1). ssh-keygen can create keys for use by SSH protocol versions 1
+ and 2. Protocol 1 should not be used and is only offered to support
+ legacy devices. It suffers from a number of cryptographic weaknesses and
+ doesn't support many of the advanced features available for protocol 2.
+
The type of key to be generated is specified with the -t option. If
invoked without any arguments, ssh-keygen will generate an RSA key for
use in SSH protocol 2 connections.
@@ -52,7 +55,7 @@
Normally this program generates the key and asks for a file in which to
store the private key. The public key is stored in a file with the same
- name but ``.pub'' appended. The program also asks for a passphrase. The
+ name but M-bM-^@M-^\.pubM-bM-^@M-^] appended. The program also asks for a passphrase. The
passphrase may be empty to indicate no passphrase (host keys must have an
empty passphrase), or it may be a string of arbitrary length. A
passphrase is similar to a password, except it can be a phrase with a
@@ -68,11 +71,11 @@
or forgotten, a new key must be generated and the corresponding public
key copied to other machines.
- For RSA1 keys, there is also a comment field in the key file that is only
- for convenience to the user to help identify the key. The comment can
- tell what the key is for, or whatever is useful. The comment is
- initialized to ``user at host'' when the key is created, but can be changed
- using the -c option.
+ For RSA1 keys and keys stored in the newer OpenSSH format, there is also
+ a comment field in the key file that is only for convenience to the user
+ to help identify the key. The comment can tell what the key is for, or
+ whatever is useful. The comment is initialized to M-bM-^@M-^\user at hostM-bM-^@M-^] when the
+ key is created, but can be changed using the -c option.
After a key is generated, instructions below detail where the keys should
be placed to be activated.
@@ -101,13 +104,13 @@
-b bits
Specifies the number of bits in the key to create. For RSA keys,
- the minimum size is 768 bits and the default is 2048 bits.
+ the minimum size is 1024 bits and the default is 2048 bits.
Generally, 2048 bits is considered sufficient. DSA keys must be
exactly 1024 bits as specified by FIPS 186-2. For ECDSA keys,
the -b flag determines the key length by selecting from one of
three elliptic curve sizes: 256, 384 or 521 bits. Attempting to
use bit lengths other than these three values for ECDSA keys will
- fail. ED25519 keys have a fixed length and the -b flag will be
+ fail. Ed25519 keys have a fixed length and the -b flag will be
ignored.
-C comment
@@ -114,9 +117,10 @@
Provides a new comment.
-c Requests changing the comment in the private and public key
- files. This operation is only supported for RSA1 keys. The
- program will prompt for the file containing the private keys, for
- the passphrase if the key has one, and for the new comment.
+ files. This operation is only supported for RSA1 keys and keys
+ stored in the newer OpenSSH format. The program will prompt for
+ the file containing the private keys, for the passphrase if the
+ key has one, and for the new comment.
-D pkcs11
Download the RSA public keys provided by the PKCS#11 shared
@@ -124,9 +128,14 @@
indicates that a CA key resides in a PKCS#11 token (see the
CERTIFICATES section for details).
+ -E fingerprint_hash
+ Specifies the hash algorithm used when displaying key
+ fingerprints. Valid options are: M-bM-^@M-^\md5M-bM-^@M-^] and M-bM-^@M-^\sha256M-bM-^@M-^]. The
+ default is M-bM-^@M-^\sha256M-bM-^@M-^].
+
-e This option will read a private or public OpenSSH key file and
print to stdout the key in one of the formats specified by the -m
- option. The default export format is ``RFC4716''. This option
+ option. The default export format is M-bM-^@M-^\RFC4716M-bM-^@M-^]. This option
allows exporting OpenSSH keys for use by other programs,
including several commercial SSH implementations.
@@ -164,7 +173,9 @@
-i This option will read an unencrypted private (or public) key file
in the format specified by the -m option and print an OpenSSH
- compatible private (or public) key to stdout.
+ compatible private (or public) key to stdout. This option allows
+ importing keys from other software, including several commercial
+ SSH implementations. The default import format is M-bM-^@M-^\RFC4716M-bM-^@M-^].
-J num_lines
Exit after screening the specified number of lines while
@@ -178,9 +189,7 @@
Write the last line processed to the file checkpt while
performing DH candidate screening using the -T option. This will
be used to skip lines in the input file that have already been
- processed if the job is restarted. This option allows importing
- keys from other software, including several commercial SSH
- implementations. The default import format is ``RFC4716''.
+ processed if the job is restarted.
-k Generate a KRL file. In this mode, ssh-keygen will generate a
KRL file at the location specified via the -f flag that revokes
@@ -189,12 +198,12 @@
file or using the format described in the KEY REVOCATION LISTS
section.
- -L Prints the contents of a certificate.
+ -L Prints the contents of one or more certificates.
-l Show fingerprint of specified public key file. Private RSA1 keys
are also supported. For RSA and DSA keys ssh-keygen tries to
find the matching public key file and prints its fingerprint. If
- combined with -v, an ASCII art representation of the key is
+ combined with -v, a visual ASCII art representation of the key is
supplied with the fingerprint.
-M memory
@@ -203,10 +212,10 @@
-m key_format
Specify a key format for the -i (import) or -e (export)
- conversion options. The supported key formats are: ``RFC4716''
- (RFC 4716/SSH2 public or private key), ``PKCS8'' (PEM PKCS8
- public key) or ``PEM'' (PEM public key). The default conversion
- format is ``RFC4716''.
+ conversion options. The supported key formats are: M-bM-^@M-^\RFC4716M-bM-^@M-^]
+ (RFC 4716/SSH2 public or private key), M-bM-^@M-^\PKCS8M-bM-^@M-^] (PEM PKCS8 public
+ key) or M-bM-^@M-^\PEMM-bM-^@M-^] (PEM public key). The default conversion format is
+ M-bM-^@M-^\RFC4716M-bM-^@M-^].
-N new_passphrase
Provides the new passphrase.
@@ -270,11 +279,11 @@
At present, no options are valid for host keys.
- -o Causes ssh-keygen to save SSH protocol 2 private keys using the
- new OpenSSH format rather than the more compatible PEM format.
- The new format has increased resistance to brute-force password
- cracking but is not supported by versions of OpenSSH prior to
- 6.5. Ed25519 keys always use the new private key format.
+ -o Causes ssh-keygen to save private keys using the new OpenSSH
+ format rather than the more compatible PEM format. The new
+ format has increased resistance to brute-force password cracking
+ but is not supported by versions of OpenSSH prior to 6.5.
+ Ed25519 keys always use the new private key format.
-P passphrase
Provides the (old) passphrase.
@@ -313,10 +322,10 @@
Test DH group exchange candidate primes (generated using the -G
option) for safety.
- -t type
+ -t dsa | ecdsa | ed25519 | rsa | rsa1
Specifies the type of key to create. The possible values are
- ``rsa1'' for protocol version 1 and ``dsa'', ``ecdsa'',
- ``ed25519'', or ``rsa'' for protocol version 2.
+ M-bM-^@M-^\rsa1M-bM-^@M-^] for protocol version 1 and M-bM-^@M-^\dsaM-bM-^@M-^], M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ed25519M-bM-^@M-^], or
+ M-bM-^@M-^\rsaM-bM-^@M-^] for protocol version 2.
-u Update a KRL. When specified with -k, keys listed via the
command line are added to the existing KRL rather than a new KRL
@@ -335,12 +344,11 @@
as a YYYYMMDD date, a YYYYMMDDHHMMSS time or a relative time
starting with a plus character.
- For example: ``+52w1d'' (valid from now to 52 weeks and one day
- from now), ``-4w:+4w'' (valid from four weeks ago to four weeks
- from now), ``20100101123000:20110101123000'' (valid from 12:30
- PM, January 1st, 2010 to 12:30 PM, January 1st, 2011),
- ``-1d:20110101'' (valid from yesterday to midnight, January 1st,
- 2011).
+ For example: M-bM-^@M-^\+52w1dM-bM-^@M-^] (valid from now to 52 weeks and one day
+ from now), M-bM-^@M-^\-4w:+4wM-bM-^@M-^] (valid from four weeks ago to four weeks
+ from now), M-bM-^@M-^\20100101123000:20110101123000M-bM-^@M-^] (valid from 12:30 PM,
+ January 1st, 2010 to 12:30 PM, January 1st, 2011), M-bM-^@M-^\-1d:20110101M-bM-^@M-^]
+ (valid from yesterday to midnight, January 1st, 2011).
-v Verbose mode. Causes ssh-keygen to print debugging messages
about its progress. This is helpful for debugging moduli
@@ -422,7 +430,7 @@
providing the token library using -D and identifying the CA key by
providing its public half as an argument to -s:
- $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id host_key.pub
+ $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id user_key.pub
In all cases, key_id is a "key identifier" that is logged by the server
when the certificate is used for authentication.
@@ -433,7 +441,7 @@
principals:
$ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub
- $ ssh-keygen -s ca_key -I key_id -h -n host.domain user_key.pub
+ $ ssh-keygen -s ca_key -I key_id -h -n host.domain host_key.pub
Additional limitations on the validity and use of user certificates may
be specified through certificate options. A certificate option may
@@ -498,7 +506,7 @@
It is also possible, given a KRL, to test whether it revokes a particular
key (or keys). The -Q flag will query an existing KRL, testing each key
- specified on the commandline. If any key listed on the command line has
+ specified on the command line. If any key listed on the command line has
been revoked (or an error encountered) then ssh-keygen will exit with a
non-zero exit status. A zero exit status will only be returned if no key
was revoked.
@@ -524,7 +532,7 @@
~/.ssh/id_ecdsa
~/.ssh/id_ed25519
~/.ssh/id_rsa
- Contains the protocol version 2 DSA, ECDSA, ED25519 or RSA
+ Contains the protocol version 2 DSA, ECDSA, Ed25519 or RSA
authentication identity of the user. This file should not be
readable by anyone but the user. It is possible to specify a
passphrase when generating the key; that passphrase will be used
@@ -537,7 +545,7 @@
~/.ssh/id_ecdsa.pub
~/.ssh/id_ed25519.pub
~/.ssh/id_rsa.pub
- Contains the protocol version 2 DSA, ECDSA, ED25519 or RSA public
+ Contains the protocol version 2 DSA, ECDSA, Ed25519 or RSA public
key for authentication. The contents of this file should be
added to ~/.ssh/authorized_keys on all machines where the user
wishes to log in using public key authentication. There is no
@@ -559,4 +567,4 @@
created OpenSSH. Markus Friedl contributed the support for SSH protocol
versions 1.5 and 2.0.
-OpenBSD 5.5 February 5, 2014 OpenBSD 5.5
+OpenBSD 6.0 June 16, 2016 OpenBSD 6.0
Modified: trunk/crypto/openssh/ssh-keygen.1
===================================================================
--- trunk/crypto/openssh/ssh-keygen.1 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keygen.1 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keygen.1,v 1.120 2014/02/05 20:13:25 naddy Exp $
+.\" $OpenBSD: ssh-keygen.1,v 1.133 2016/06/16 06:10:45 jmc Exp $
.\"
.\" Author: Tatu Ylonen <ylo at cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: February 5 2014 $
+.Dd $Mdocdate: June 16 2016 $
.Dt SSH-KEYGEN 1
.Os
.Sh NAME
@@ -46,7 +46,7 @@
.Nm ssh-keygen
.Op Fl q
.Op Fl b Ar bits
-.Op Fl t Ar type
+.Op Fl t Cm dsa | ecdsa | ed25519 | rsa | rsa1
.Op Fl N Ar new_passphrase
.Op Fl C Ar comment
.Op Fl f Ar output_keyfile
@@ -73,6 +73,8 @@
.Op Fl f Ar keyfile
.Nm ssh-keygen
.Fl l
+.Op Fl v
+.Op Fl E Ar fingerprint_hash
.Op Fl f Ar input_keyfile
.Nm ssh-keygen
.Fl B
@@ -139,8 +141,12 @@
generates, manages and converts authentication keys for
.Xr ssh 1 .
.Nm
-can create RSA keys for use by SSH protocol version 1 and
-DSA, ECDSA, ED25519 or RSA keys for use by SSH protocol version 2.
+can create keys for use by SSH protocol versions 1 and 2.
+Protocol 1 should not be used
+and is only offered to support legacy devices.
+It suffers from a number of cryptographic weaknesses
+and doesn't support many of the advanced features available for protocol 2.
+.Pp
The type of key to be generated is specified with the
.Fl t
option.
@@ -201,7 +207,7 @@
If the passphrase is lost or forgotten, a new key must be generated
and the corresponding public key copied to other machines.
.Pp
-For RSA1 keys,
+For RSA1 keys and keys stored in the newer OpenSSH format,
there is also a comment field in the key file that is only for
convenience to the user to help identify the key.
The comment can tell what the key is for, or whatever is useful.
@@ -242,7 +248,7 @@
Show the bubblebabble digest of specified private or public key file.
.It Fl b Ar bits
Specifies the number of bits in the key to create.
-For RSA keys, the minimum size is 768 bits and the default is 2048 bits.
+For RSA keys, the minimum size is 1024 bits and the default is 2048 bits.
Generally, 2048 bits is considered sufficient.
DSA keys must be exactly 1024 bits as specified by FIPS 186-2.
For ECDSA keys, the
@@ -251,7 +257,7 @@
curve sizes: 256, 384 or 521 bits.
Attempting to use bit lengths other than these three values for ECDSA keys
will fail.
-ED25519 keys have a fixed length and the
+Ed25519 keys have a fixed length and the
.Fl b
flag will be ignored.
.It Fl C Ar comment
@@ -258,7 +264,8 @@
Provides a new comment.
.It Fl c
Requests changing the comment in the private and public key files.
-This operation is only supported for RSA1 keys.
+This operation is only supported for RSA1 keys and keys stored in the
+newer OpenSSH format.
The program will prompt for the file containing the private keys, for
the passphrase if the key has one, and for the new comment.
.It Fl D Ar pkcs11
@@ -269,6 +276,14 @@
this option indicates that a CA key resides in a PKCS#11 token (see the
.Sx CERTIFICATES
section for details).
+.It Fl E Ar fingerprint_hash
+Specifies the hash algorithm used when displaying key fingerprints.
+Valid options are:
+.Dq md5
+and
+.Dq sha256 .
+The default is
+.Dq sha256 .
.It Fl e
This option will read a private or public OpenSSH key file and
print to stdout the key in one of the formats specified by the
@@ -332,6 +347,10 @@
.Fl m
option and print an OpenSSH compatible private
(or public) key to stdout.
+This option allows importing keys from other software, including several
+commercial SSH implementations.
+The default import format is
+.Dq RFC4716 .
.It Fl J Ar num_lines
Exit after screening the specified number of lines
while performing DH candidate screening using the
@@ -350,10 +369,6 @@
option.
This will be used to skip lines in the input file that have already been
processed if the job is restarted.
-This option allows importing keys from other software, including several
-commercial SSH implementations.
-The default import format is
-.Dq RFC4716 .
.It Fl k
Generate a KRL file.
In this mode,
@@ -366,7 +381,7 @@
.Sx KEY REVOCATION LISTS
section.
.It Fl L
-Prints the contents of a certificate.
+Prints the contents of one or more certificates.
.It Fl l
Show fingerprint of specified public key file.
Private RSA1 keys are also supported.
@@ -375,7 +390,8 @@
tries to find the matching public key file and prints its fingerprint.
If combined with
.Fl v ,
-an ASCII art representation of the key is supplied with the fingerprint.
+a visual ASCII art representation of the key is supplied with the
+fingerprint.
.It Fl M Ar memory
Specify the amount of memory to use (in megabytes) when generating
candidate moduli for DH-GEX.
@@ -464,7 +480,7 @@
.It Fl o
Causes
.Nm
-to save SSH protocol 2 private keys using the new OpenSSH format rather than
+to save private keys using the new OpenSSH format rather than
the more compatible PEM format.
The new format has increased resistance to brute-force password cracking
but is not supported by versions of OpenSSH prior to 6.5.
@@ -514,7 +530,7 @@
Test DH group exchange candidate primes (generated using the
.Fl G
option) for safety.
-.It Fl t Ar type
+.It Fl t Cm dsa | ecdsa | ed25519 | rsa | rsa1
Specifies the type of key to create.
The possible values are
.Dq rsa1
@@ -670,7 +686,7 @@
to
.Fl s :
.Pp
-.Dl $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id host_key.pub
+.Dl $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id user_key.pub
.Pp
In all cases,
.Ar key_id
@@ -683,7 +699,7 @@
To generate a certificate for a specified set of principals:
.Pp
.Dl $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub
-.Dl "$ ssh-keygen -s ca_key -I key_id -h -n host.domain user_key.pub"
+.Dl "$ ssh-keygen -s ca_key -I key_id -h -n host.domain host_key.pub"
.Pp
Additional limitations on the validity and use of user certificates may
be specified through certificate options.
@@ -771,7 +787,7 @@
(or keys).
The
.Fl Q
-flag will query an existing KRL, testing each key specified on the commandline.
+flag will query an existing KRL, testing each key specified on the command line.
If any key listed on the command line has been revoked (or an error encountered)
then
.Nm
@@ -803,7 +819,7 @@
.It Pa ~/.ssh/id_ecdsa
.It Pa ~/.ssh/id_ed25519
.It Pa ~/.ssh/id_rsa
-Contains the protocol version 2 DSA, ECDSA, ED25519 or RSA
+Contains the protocol version 2 DSA, ECDSA, Ed25519 or RSA
authentication identity of the user.
This file should not be readable by anyone but the user.
It is possible to
@@ -819,7 +835,7 @@
.It Pa ~/.ssh/id_ecdsa.pub
.It Pa ~/.ssh/id_ed25519.pub
.It Pa ~/.ssh/id_rsa.pub
-Contains the protocol version 2 DSA, ECDSA, ED25519 or RSA
+Contains the protocol version 2 DSA, ECDSA, Ed25519 or RSA
public key for authentication.
The contents of this file should be added to
.Pa ~/.ssh/authorized_keys
Modified: trunk/crypto/openssh/ssh-keygen.c
===================================================================
--- trunk/crypto/openssh/ssh-keygen.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keygen.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.241 2014/02/05 20:13:25 naddy Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.290 2016/05/02 09:36:42 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1994 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -17,11 +17,12 @@
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
-#include <sys/param.h>
+#ifdef WITH_OPENSSL
#include <openssl/evp.h>
#include <openssl/pem.h>
#include "openbsd-compat/openssl-compat.h"
+#endif
#include <errno.h>
#include <fcntl.h>
@@ -35,13 +36,14 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
#include "xmalloc.h"
-#include "key.h"
+#include "sshkey.h"
#include "rsa.h"
#include "authfile.h"
#include "uuencode.h"
-#include "buffer.h"
+#include "sshbuf.h"
#include "pathnames.h"
#include "log.h"
#include "misc.h"
@@ -50,10 +52,18 @@
#include "dns.h"
#include "ssh.h"
#include "ssh2.h"
+#include "ssherr.h"
#include "ssh-pkcs11.h"
#include "atomicio.h"
#include "krl.h"
+#include "digest.h"
+#ifdef WITH_OPENSSL
+# define DEFAULT_KEY_TYPE_NAME "rsa"
+#else
+# define DEFAULT_KEY_TYPE_NAME "ed25519"
+#endif
+
/* Number of bits in the RSA/DSA key. This value can be set on the command line. */
#define DEFAULT_BITS 2048
#define DEFAULT_BITS_DSA 1024
@@ -90,6 +100,9 @@
int print_fingerprint = 0;
int print_bubblebabble = 0;
+/* Hash algorithm to use for fingerprints. */
+int fingerprint_hash = SSH_FP_HASH_DEFAULT;
+
/* The identity file name, given on the command line or entered by the user. */
char identity_file[1024];
int have_identity = 0;
@@ -165,43 +178,51 @@
/* argv0 */
extern char *__progname;
-char hostname[MAXHOSTNAMELEN];
+char hostname[NI_MAXHOST];
+#ifdef WITH_OPENSSL
/* moduli.c */
int gen_candidates(FILE *, u_int32_t, u_int32_t, BIGNUM *);
int prime_test(FILE *, FILE *, u_int32_t, u_int32_t, char *, unsigned long,
unsigned long);
+#endif
static void
-type_bits_valid(int type, u_int32_t *bitsp)
+type_bits_valid(int type, const char *name, u_int32_t *bitsp)
{
- u_int maxbits;
+#ifdef WITH_OPENSSL
+ u_int maxbits, nid;
+#endif
- if (type == KEY_UNSPEC) {
- fprintf(stderr, "unknown key type %s\n", key_type_name);
- exit(1);
- }
+ if (type == KEY_UNSPEC)
+ fatal("unknown key type %s", key_type_name);
if (*bitsp == 0) {
+#ifdef WITH_OPENSSL
if (type == KEY_DSA)
*bitsp = DEFAULT_BITS_DSA;
- else if (type == KEY_ECDSA)
- *bitsp = DEFAULT_BITS_ECDSA;
- else
+ else if (type == KEY_ECDSA) {
+ if (name != NULL &&
+ (nid = sshkey_ecdsa_nid_from_name(name)) > 0)
+ *bitsp = sshkey_curve_nid_to_bits(nid);
+ if (*bitsp == 0)
+ *bitsp = DEFAULT_BITS_ECDSA;
+ } else
+#endif
*bitsp = DEFAULT_BITS;
}
+#ifdef WITH_OPENSSL
maxbits = (type == KEY_DSA) ?
OPENSSL_DSA_MAX_MODULUS_BITS : OPENSSL_RSA_MAX_MODULUS_BITS;
- if (*bitsp > maxbits) {
- fprintf(stderr, "key bits exceeds maximum %d\n", maxbits);
- exit(1);
- }
+ if (*bitsp > maxbits)
+ fatal("key bits exceeds maximum %d", maxbits);
if (type == KEY_DSA && *bitsp != 1024)
fatal("DSA keys must be 1024 bits");
- else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 768)
- fatal("Key must at least be 768 bits");
- else if (type == KEY_ECDSA && key_ecdsa_bits_to_nid(*bitsp) == -1)
+ else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 1024)
+ fatal("Key must at least be 1024 bits");
+ else if (type == KEY_ECDSA && sshkey_ecdsa_bits_to_nid(*bitsp) == -1)
fatal("Invalid ECDSA key length - valid lengths are "
"256, 384 or 521 bits");
+#endif
}
static void
@@ -213,12 +234,11 @@
if (key_type_name == NULL)
name = _PATH_SSH_CLIENT_ID_RSA;
else {
- switch (key_type_from_name(key_type_name)) {
+ switch (sshkey_type_from_name(key_type_name)) {
case KEY_RSA1:
name = _PATH_SSH_CLIENT_IDENTITY;
break;
case KEY_DSA_CERT:
- case KEY_DSA_CERT_V00:
case KEY_DSA:
name = _PATH_SSH_CLIENT_ID_DSA;
break;
@@ -229,7 +249,6 @@
break;
#endif
case KEY_RSA_CERT:
- case KEY_RSA_CERT_V00:
case KEY_RSA:
name = _PATH_SSH_CLIENT_ID_RSA;
break;
@@ -238,13 +257,13 @@
name = _PATH_SSH_CLIENT_ID_ED25519;
break;
default:
- fprintf(stderr, "bad key type\n");
- exit(1);
- break;
+ fatal("bad key type");
}
}
- snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);
- fprintf(stderr, "%s (%s): ", prompt, identity_file);
+ snprintf(identity_file, sizeof(identity_file),
+ "%s/%s", pw->pw_dir, name);
+ printf("%s (%s): ", prompt, identity_file);
+ fflush(stdout);
if (fgets(buf, sizeof(buf), stdin) == NULL)
exit(1);
buf[strcspn(buf, "\n")] = '\0';
@@ -253,23 +272,26 @@
have_identity = 1;
}
-static Key *
+static struct sshkey *
load_identity(char *filename)
{
char *pass;
- Key *prv;
+ struct sshkey *prv;
+ int r;
- prv = key_load_private(filename, "", NULL);
- if (prv == NULL) {
- if (identity_passphrase)
- pass = xstrdup(identity_passphrase);
- else
- pass = read_passphrase("Enter passphrase: ",
- RP_ALLOW_STDIN);
- prv = key_load_private(filename, pass, NULL);
- explicit_bzero(pass, strlen(pass));
- free(pass);
- }
+ if ((r = sshkey_load_private(filename, "", &prv, NULL)) == 0)
+ return prv;
+ if (r != SSH_ERR_KEY_WRONG_PASSPHRASE)
+ fatal("Load key \"%s\": %s", filename, ssh_err(r));
+ if (identity_passphrase)
+ pass = xstrdup(identity_passphrase);
+ else
+ pass = read_passphrase("Enter passphrase: ", RP_ALLOW_STDIN);
+ r = sshkey_load_private(filename, pass, &prv, NULL);
+ explicit_bzero(pass, strlen(pass));
+ free(pass);
+ if (r != 0)
+ fatal("Load key \"%s\": %s", filename, ssh_err(r));
return prv;
}
@@ -278,25 +300,23 @@
#define SSH_COM_PRIVATE_BEGIN "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"
#define SSH_COM_PRIVATE_KEY_MAGIC 0x3f6ff9eb
+#ifdef WITH_OPENSSL
static void
-do_convert_to_ssh2(struct passwd *pw, Key *k)
+do_convert_to_ssh2(struct passwd *pw, struct sshkey *k)
{
- u_int len;
+ size_t len;
u_char *blob;
char comment[61];
+ int r;
- if (k->type == KEY_RSA1) {
- fprintf(stderr, "version 1 keys are not supported\n");
- exit(1);
- }
- if (key_to_blob(k, &blob, &len) <= 0) {
- fprintf(stderr, "key_to_blob failed\n");
- exit(1);
- }
+ if (k->type == KEY_RSA1)
+ fatal("version 1 keys are not supported");
+ if ((r = sshkey_to_blob(k, &blob, &len)) != 0)
+ fatal("key_to_blob failed: %s", ssh_err(r));
/* Comment + surrounds must fit into 72 chars (RFC 4716 sec 3.3) */
snprintf(comment, sizeof(comment),
"%u-bit %s, converted by %s@%s from OpenSSH",
- key_size(k), key_type(k),
+ sshkey_size(k), sshkey_type(k),
pw->pw_name, hostname);
fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
@@ -303,15 +323,15 @@
fprintf(stdout, "Comment: \"%s\"\n", comment);
dump_base64(stdout, blob, len);
fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
- key_free(k);
+ sshkey_free(k);
free(blob);
exit(0);
}
static void
-do_convert_to_pkcs8(Key *k)
+do_convert_to_pkcs8(struct sshkey *k)
{
- switch (key_type_plain(k->type)) {
+ switch (sshkey_type_plain(k->type)) {
case KEY_RSA1:
case KEY_RSA:
if (!PEM_write_RSA_PUBKEY(stdout, k->rsa))
@@ -328,15 +348,15 @@
break;
#endif
default:
- fatal("%s: unsupported key type %s", __func__, key_type(k));
+ fatal("%s: unsupported key type %s", __func__, sshkey_type(k));
}
exit(0);
}
static void
-do_convert_to_pem(Key *k)
+do_convert_to_pem(struct sshkey *k)
{
- switch (key_type_plain(k->type)) {
+ switch (sshkey_type_plain(k->type)) {
case KEY_RSA1:
case KEY_RSA:
if (!PEM_write_RSAPublicKey(stdout, k->rsa))
@@ -350,7 +370,7 @@
#endif
/* XXX ECDSA? */
default:
- fatal("%s: unsupported key type %s", __func__, key_type(k));
+ fatal("%s: unsupported key type %s", __func__, sshkey_type(k));
}
exit(0);
}
@@ -358,20 +378,16 @@
static void
do_convert_to(struct passwd *pw)
{
- Key *k;
+ struct sshkey *k;
struct stat st;
+ int r;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
if (stat(identity_file, &st) < 0)
fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
- if ((k = key_load_public(identity_file, NULL)) == NULL) {
- if ((k = load_identity(identity_file)) == NULL) {
- fprintf(stderr, "load failed\n");
- exit(1);
- }
- }
-
+ if ((r = sshkey_load_public(identity_file, &k, NULL)) != 0)
+ k = load_identity(identity_file);
switch (convert_format) {
case FMT_RFC4716:
do_convert_to_ssh2(pw, k);
@@ -388,51 +404,63 @@
exit(0);
}
+/*
+ * This is almost exactly the bignum1 encoding, but with 32 bit for length
+ * instead of 16.
+ */
static void
-buffer_get_bignum_bits(Buffer *b, BIGNUM *value)
+buffer_get_bignum_bits(struct sshbuf *b, BIGNUM *value)
{
- u_int bignum_bits = buffer_get_int(b);
- u_int bytes = (bignum_bits + 7) / 8;
+ u_int bytes, bignum_bits;
+ int r;
- if (buffer_len(b) < bytes)
- fatal("buffer_get_bignum_bits: input buffer too small: "
- "need %d have %d", bytes, buffer_len(b));
- if (BN_bin2bn(buffer_ptr(b), bytes, value) == NULL)
- fatal("buffer_get_bignum_bits: BN_bin2bn failed");
- buffer_consume(b, bytes);
+ if ((r = sshbuf_get_u32(b, &bignum_bits)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ bytes = (bignum_bits + 7) / 8;
+ if (sshbuf_len(b) < bytes)
+ fatal("%s: input buffer too small: need %d have %zu",
+ __func__, bytes, sshbuf_len(b));
+ if (BN_bin2bn(sshbuf_ptr(b), bytes, value) == NULL)
+ fatal("%s: BN_bin2bn failed", __func__);
+ if ((r = sshbuf_consume(b, bytes)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
}
-static Key *
+static struct sshkey *
do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
{
- Buffer b;
- Key *key = NULL;
+ struct sshbuf *b;
+ struct sshkey *key = NULL;
char *type, *cipher;
- u_char *sig, data[] = "abcde12345";
- int magic, rlen, ktype, i1, i2, i3, i4;
- u_int slen;
+ u_char e1, e2, e3, *sig = NULL, data[] = "abcde12345";
+ int r, rlen, ktype;
+ u_int magic, i1, i2, i3, i4;
+ size_t slen;
u_long e;
- buffer_init(&b);
- buffer_append(&b, blob, blen);
+ if ((b = sshbuf_from(blob, blen)) == NULL)
+ fatal("%s: sshbuf_from failed", __func__);
+ if ((r = sshbuf_get_u32(b, &magic)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
- magic = buffer_get_int(&b);
if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {
- error("bad magic 0x%x != 0x%x", magic, SSH_COM_PRIVATE_KEY_MAGIC);
- buffer_free(&b);
+ error("bad magic 0x%x != 0x%x", magic,
+ SSH_COM_PRIVATE_KEY_MAGIC);
+ sshbuf_free(b);
return NULL;
}
- i1 = buffer_get_int(&b);
- type = buffer_get_string(&b, NULL);
- cipher = buffer_get_string(&b, NULL);
- i2 = buffer_get_int(&b);
- i3 = buffer_get_int(&b);
- i4 = buffer_get_int(&b);
+ if ((r = sshbuf_get_u32(b, &i1)) != 0 ||
+ (r = sshbuf_get_cstring(b, &type, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(b, &cipher, NULL)) != 0 ||
+ (r = sshbuf_get_u32(b, &i2)) != 0 ||
+ (r = sshbuf_get_u32(b, &i3)) != 0 ||
+ (r = sshbuf_get_u32(b, &i4)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
debug("ignore (%d %d %d %d)", i1, i2, i3, i4);
if (strcmp(cipher, "none") != 0) {
error("unsupported cipher %s", cipher);
free(cipher);
- buffer_free(&b);
+ sshbuf_free(b);
free(type);
return NULL;
}
@@ -443,54 +471,64 @@
} else if (strstr(type, "rsa")) {
ktype = KEY_RSA;
} else {
- buffer_free(&b);
+ sshbuf_free(b);
free(type);
return NULL;
}
- key = key_new_private(ktype);
+ if ((key = sshkey_new_private(ktype)) == NULL)
+ fatal("key_new_private failed");
free(type);
switch (key->type) {
case KEY_DSA:
- buffer_get_bignum_bits(&b, key->dsa->p);
- buffer_get_bignum_bits(&b, key->dsa->g);
- buffer_get_bignum_bits(&b, key->dsa->q);
- buffer_get_bignum_bits(&b, key->dsa->pub_key);
- buffer_get_bignum_bits(&b, key->dsa->priv_key);
+ buffer_get_bignum_bits(b, key->dsa->p);
+ buffer_get_bignum_bits(b, key->dsa->g);
+ buffer_get_bignum_bits(b, key->dsa->q);
+ buffer_get_bignum_bits(b, key->dsa->pub_key);
+ buffer_get_bignum_bits(b, key->dsa->priv_key);
break;
case KEY_RSA:
- e = buffer_get_char(&b);
+ if ((r = sshbuf_get_u8(b, &e1)) != 0 ||
+ (e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) ||
+ (e1 < 30 && (r = sshbuf_get_u8(b, &e3)) != 0))
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ e = e1;
debug("e %lx", e);
if (e < 30) {
e <<= 8;
- e += buffer_get_char(&b);
+ e += e2;
debug("e %lx", e);
e <<= 8;
- e += buffer_get_char(&b);
+ e += e3;
debug("e %lx", e);
}
if (!BN_set_word(key->rsa->e, e)) {
- buffer_free(&b);
- key_free(key);
+ sshbuf_free(b);
+ sshkey_free(key);
return NULL;
}
- buffer_get_bignum_bits(&b, key->rsa->d);
- buffer_get_bignum_bits(&b, key->rsa->n);
- buffer_get_bignum_bits(&b, key->rsa->iqmp);
- buffer_get_bignum_bits(&b, key->rsa->q);
- buffer_get_bignum_bits(&b, key->rsa->p);
- rsa_generate_additional_parameters(key->rsa);
+ buffer_get_bignum_bits(b, key->rsa->d);
+ buffer_get_bignum_bits(b, key->rsa->n);
+ buffer_get_bignum_bits(b, key->rsa->iqmp);
+ buffer_get_bignum_bits(b, key->rsa->q);
+ buffer_get_bignum_bits(b, key->rsa->p);
+ if ((r = rsa_generate_additional_parameters(key->rsa)) != 0)
+ fatal("generate RSA parameters failed: %s", ssh_err(r));
break;
}
- rlen = buffer_len(&b);
+ rlen = sshbuf_len(b);
if (rlen != 0)
error("do_convert_private_ssh2_from_blob: "
"remaining bytes in key blob %d", rlen);
- buffer_free(&b);
+ sshbuf_free(b);
/* try the key */
- key_sign(key, &sig, &slen, data, sizeof(data));
- key_verify(key, sig, slen, data, sizeof(data));
+ if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 ||
+ sshkey_verify(key, sig, slen, data, sizeof(data), 0) != 0) {
+ sshkey_free(key);
+ free(sig);
+ return NULL;
+ }
free(sig);
return key;
}
@@ -503,17 +541,13 @@
line[0] = '\0';
while ((c = fgetc(fp)) != EOF) {
- if (pos >= len - 1) {
- fprintf(stderr, "input line too long.\n");
- exit(1);
- }
+ if (pos >= len - 1)
+ fatal("input line too long.");
switch (c) {
case '\r':
c = fgetc(fp);
- if (c != EOF && c != '\n' && ungetc(c, fp) == EOF) {
- fprintf(stderr, "unget: %s\n", strerror(errno));
- exit(1);
- }
+ if (c != EOF && c != '\n' && ungetc(c, fp) == EOF)
+ fatal("unget: %s", strerror(errno));
return pos;
case '\n':
return pos;
@@ -526,14 +560,13 @@
}
static void
-do_convert_from_ssh2(struct passwd *pw, Key **k, int *private)
+do_convert_from_ssh2(struct passwd *pw, struct sshkey **k, int *private)
{
- int blen;
+ int r, blen, escaped = 0;
u_int len;
char line[1024];
u_char blob[8096];
char encoded[8096];
- int escaped = 0;
FILE *fp;
if ((fp = fopen(identity_file, "r")) == NULL)
@@ -566,22 +599,17 @@
(encoded[len-3] == '='))
encoded[len-3] = '\0';
blen = uudecode(encoded, blob, sizeof(blob));
- if (blen < 0) {
- fprintf(stderr, "uudecode failed.\n");
- exit(1);
- }
- *k = *private ?
- do_convert_private_ssh2_from_blob(blob, blen) :
- key_from_blob(blob, blen);
- if (*k == NULL) {
- fprintf(stderr, "decode blob failed.\n");
- exit(1);
- }
+ if (blen < 0)
+ fatal("uudecode failed.");
+ if (*private)
+ *k = do_convert_private_ssh2_from_blob(blob, blen);
+ else if ((r = sshkey_from_blob(blob, blen, k)) != 0)
+ fatal("decode blob failed: %s", ssh_err(r));
fclose(fp);
}
static void
-do_convert_from_pkcs8(Key **k, int *private)
+do_convert_from_pkcs8(struct sshkey **k, int *private)
{
EVP_PKEY *pubkey;
FILE *fp;
@@ -595,21 +623,24 @@
fclose(fp);
switch (EVP_PKEY_type(pubkey->type)) {
case EVP_PKEY_RSA:
- *k = key_new(KEY_UNSPEC);
+ if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("sshkey_new failed");
(*k)->type = KEY_RSA;
(*k)->rsa = EVP_PKEY_get1_RSA(pubkey);
break;
case EVP_PKEY_DSA:
- *k = key_new(KEY_UNSPEC);
+ if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("sshkey_new failed");
(*k)->type = KEY_DSA;
(*k)->dsa = EVP_PKEY_get1_DSA(pubkey);
break;
#ifdef OPENSSL_HAS_ECC
case EVP_PKEY_EC:
- *k = key_new(KEY_UNSPEC);
+ if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("sshkey_new failed");
(*k)->type = KEY_ECDSA;
(*k)->ecdsa = EVP_PKEY_get1_EC_KEY(pubkey);
- (*k)->ecdsa_nid = key_ecdsa_key_to_nid((*k)->ecdsa);
+ (*k)->ecdsa_nid = sshkey_ecdsa_key_to_nid((*k)->ecdsa);
break;
#endif
default:
@@ -621,7 +652,7 @@
}
static void
-do_convert_from_pem(Key **k, int *private)
+do_convert_from_pem(struct sshkey **k, int *private)
{
FILE *fp;
RSA *rsa;
@@ -632,7 +663,8 @@
if ((fp = fopen(identity_file, "r")) == NULL)
fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
if ((rsa = PEM_read_RSAPublicKey(fp, NULL, NULL, NULL)) != NULL) {
- *k = key_new(KEY_UNSPEC);
+ if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("sshkey_new failed");
(*k)->type = KEY_RSA;
(*k)->rsa = rsa;
fclose(fp);
@@ -641,7 +673,8 @@
#if notyet /* OpenSSH 0.9.8 lacks this function */
rewind(fp);
if ((dsa = PEM_read_DSAPublicKey(fp, NULL, NULL, NULL)) != NULL) {
- *k = key_new(KEY_UNSPEC);
+ if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("sshkey_new failed");
(*k)->type = KEY_DSA;
(*k)->dsa = dsa;
fclose(fp);
@@ -655,8 +688,8 @@
static void
do_convert_from(struct passwd *pw)
{
- Key *k = NULL;
- int private = 0, ok = 0;
+ struct sshkey *k = NULL;
+ int r, private = 0, ok = 0;
struct stat st;
if (!have_identity)
@@ -678,11 +711,12 @@
fatal("%s: unknown key format %d", __func__, convert_format);
}
- if (!private)
- ok = key_write(k, stdout);
+ if (!private) {
+ if ((r = sshkey_write(k, stdout)) == 0)
+ ok = 1;
if (ok)
fprintf(stdout, "\n");
- else {
+ } else {
switch (k->type) {
case KEY_DSA:
ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL,
@@ -700,38 +734,32 @@
break;
default:
fatal("%s: unsupported key type %s", __func__,
- key_type(k));
+ sshkey_type(k));
}
}
- if (!ok) {
- fprintf(stderr, "key write failed\n");
- exit(1);
- }
- key_free(k);
+ if (!ok)
+ fatal("key write failed");
+ sshkey_free(k);
exit(0);
}
+#endif
static void
do_print_public(struct passwd *pw)
{
- Key *prv;
+ struct sshkey *prv;
struct stat st;
+ int r;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
- if (stat(identity_file, &st) < 0) {
- perror(identity_file);
- exit(1);
- }
+ if (stat(identity_file, &st) < 0)
+ fatal("%s: %s", identity_file, strerror(errno));
prv = load_identity(identity_file);
- if (prv == NULL) {
- fprintf(stderr, "load failed\n");
- exit(1);
- }
- if (!key_write(prv, stdout))
- fprintf(stderr, "key_write failed");
- key_free(prv);
+ if ((r = sshkey_write(prv, stdout)) != 0)
+ error("key_write failed: %s", ssh_err(r));
+ sshkey_free(prv);
fprintf(stdout, "\n");
exit(0);
}
@@ -740,14 +768,14 @@
do_download(struct passwd *pw)
{
#ifdef ENABLE_PKCS11
- Key **keys = NULL;
+ struct sshkey **keys = NULL;
int i, nkeys;
- enum fp_rep rep;
- enum fp_type fptype;
+ enum sshkey_fp_rep rep;
+ int fptype;
char *fp, *ra;
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
- rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+ fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
+ rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
pkcs11_init(0);
nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys);
@@ -755,20 +783,22 @@
fatal("cannot read public key from pkcs11");
for (i = 0; i < nkeys; i++) {
if (print_fingerprint) {
- fp = key_fingerprint(keys[i], fptype, rep);
- ra = key_fingerprint(keys[i], SSH_FP_MD5,
+ fp = sshkey_fingerprint(keys[i], fptype, rep);
+ ra = sshkey_fingerprint(keys[i], fingerprint_hash,
SSH_FP_RANDOMART);
- printf("%u %s %s (PKCS11 key)\n", key_size(keys[i]),
- fp, key_type(keys[i]));
+ if (fp == NULL || ra == NULL)
+ fatal("%s: sshkey_fingerprint fail", __func__);
+ printf("%u %s %s (PKCS11 key)\n", sshkey_size(keys[i]),
+ fp, sshkey_type(keys[i]));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
free(ra);
free(fp);
} else {
- key_write(keys[i], stdout);
+ (void) sshkey_write(keys[i], stdout); /* XXX check */
fprintf(stdout, "\n");
}
- key_free(keys[i]);
+ sshkey_free(keys[i]);
}
free(keys);
pkcs11_terminate();
@@ -778,111 +808,162 @@
#endif /* ENABLE_PKCS11 */
}
+static struct sshkey *
+try_read_key(char **cpp)
+{
+ struct sshkey *ret;
+ int r;
+
+ if ((ret = sshkey_new(KEY_RSA1)) == NULL)
+ fatal("sshkey_new failed");
+ /* Try RSA1 */
+ if ((r = sshkey_read(ret, cpp)) == 0)
+ return ret;
+ /* Try modern */
+ sshkey_free(ret);
+ if ((ret = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("sshkey_new failed");
+ if ((r = sshkey_read(ret, cpp)) == 0)
+ return ret;
+ /* Not a key */
+ sshkey_free(ret);
+ return NULL;
+}
+
static void
+fingerprint_one_key(const struct sshkey *public, const char *comment)
+{
+ char *fp = NULL, *ra = NULL;
+ enum sshkey_fp_rep rep;
+ int fptype;
+
+ fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
+ rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
+ fp = sshkey_fingerprint(public, fptype, rep);
+ ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART);
+ if (fp == NULL || ra == NULL)
+ fatal("%s: sshkey_fingerprint failed", __func__);
+ printf("%u %s %s (%s)\n", sshkey_size(public), fp,
+ comment ? comment : "no comment", sshkey_type(public));
+ if (log_level >= SYSLOG_LEVEL_VERBOSE)
+ printf("%s\n", ra);
+ free(ra);
+ free(fp);
+}
+
+static void
+fingerprint_private(const char *path)
+{
+ struct stat st;
+ char *comment = NULL;
+ struct sshkey *public = NULL;
+ int r;
+
+ if (stat(identity_file, &st) < 0)
+ fatal("%s: %s", path, strerror(errno));
+ if ((r = sshkey_load_public(path, &public, &comment)) != 0) {
+ debug("load public \"%s\": %s", path, ssh_err(r));
+ if ((r = sshkey_load_private(path, NULL,
+ &public, &comment)) != 0) {
+ debug("load private \"%s\": %s", path, ssh_err(r));
+ fatal("%s is not a key file.", path);
+ }
+ }
+
+ fingerprint_one_key(public, comment);
+ sshkey_free(public);
+ free(comment);
+}
+
+static void
do_fingerprint(struct passwd *pw)
{
FILE *f;
- Key *public;
- char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra;
- int i, skip = 0, num = 0, invalid = 1;
- enum fp_rep rep;
- enum fp_type fptype;
- struct stat st;
+ struct sshkey *public = NULL;
+ char *comment = NULL, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
+ int i, invalid = 1;
+ const char *path;
+ u_long lnum = 0;
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
- rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
-
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
- if (stat(identity_file, &st) < 0) {
- perror(identity_file);
- exit(1);
- }
- public = key_load_public(identity_file, &comment);
- if (public != NULL) {
- fp = key_fingerprint(public, fptype, rep);
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
- printf("%u %s %s (%s)\n", key_size(public), fp, comment,
- key_type(public));
- if (log_level >= SYSLOG_LEVEL_VERBOSE)
- printf("%s\n", ra);
- key_free(public);
- free(comment);
- free(ra);
- free(fp);
- exit(0);
- }
- if (comment) {
- free(comment);
- comment = NULL;
- }
+ path = identity_file;
- if ((f = fopen(identity_file, "r")) == NULL)
- fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
+ if (strcmp(identity_file, "-") == 0) {
+ f = stdin;
+ path = "(stdin)";
+ } else if ((f = fopen(path, "r")) == NULL)
+ fatal("%s: %s: %s", __progname, path, strerror(errno));
- while (fgets(line, sizeof(line), f)) {
- if ((cp = strchr(line, '\n')) == NULL) {
- error("line %d too long: %.40s...",
- num + 1, line);
- skip = 1;
+ while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
+ cp = line;
+ cp[strcspn(cp, "\n")] = '\0';
+ /* Trim leading space and comments */
+ cp = line + strspn(line, " \t");
+ if (*cp == '#' || *cp == '\0')
continue;
+
+ /*
+ * Input may be plain keys, private keys, authorized_keys
+ * or known_hosts.
+ */
+
+ /*
+ * Try private keys first. Assume a key is private if
+ * "SSH PRIVATE KEY" appears on the first line and we're
+ * not reading from stdin (XXX support private keys on stdin).
+ */
+ if (lnum == 1 && strcmp(identity_file, "-") != 0 &&
+ strstr(cp, "PRIVATE KEY") != NULL) {
+ fclose(f);
+ fingerprint_private(path);
+ exit(0);
}
- num++;
- if (skip) {
- skip = 0;
+
+ /*
+ * If it's not a private key, then this must be prepared to
+ * accept a public key prefixed with a hostname or options.
+ * Try a bare key first, otherwise skip the leading stuff.
+ */
+ if ((public = try_read_key(&cp)) == NULL) {
+ i = strtol(cp, &ep, 10);
+ if (i == 0 || ep == NULL ||
+ (*ep != ' ' && *ep != '\t')) {
+ int quoted = 0;
+
+ comment = cp;
+ for (; *cp && (quoted || (*cp != ' ' &&
+ *cp != '\t')); cp++) {
+ if (*cp == '\\' && cp[1] == '"')
+ cp++; /* Skip both */
+ else if (*cp == '"')
+ quoted = !quoted;
+ }
+ if (!*cp)
+ continue;
+ *cp++ = '\0';
+ }
+ }
+ /* Retry after parsing leading hostname/key options */
+ if (public == NULL && (public = try_read_key(&cp)) == NULL) {
+ debug("%s:%lu: not a public key", path, lnum);
continue;
}
- *cp = '\0';
- /* Skip leading whitespace, empty and comment lines. */
- for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
+ /* Find trailing comment, if any */
+ for (; *cp == ' ' || *cp == '\t'; cp++)
;
- if (!*cp || *cp == '\n' || *cp == '#')
- continue;
- i = strtol(cp, &ep, 10);
- if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {
- int quoted = 0;
+ if (*cp != '\0' && *cp != '#')
comment = cp;
- for (; *cp && (quoted || (*cp != ' ' &&
- *cp != '\t')); cp++) {
- if (*cp == '\\' && cp[1] == '"')
- cp++; /* Skip both */
- else if (*cp == '"')
- quoted = !quoted;
- }
- if (!*cp)
- continue;
- *cp++ = '\0';
- }
- ep = cp;
- public = key_new(KEY_RSA1);
- if (key_read(public, &cp) != 1) {
- cp = ep;
- key_free(public);
- public = key_new(KEY_UNSPEC);
- if (key_read(public, &cp) != 1) {
- key_free(public);
- continue;
- }
- }
- comment = *cp ? cp : comment;
- fp = key_fingerprint(public, fptype, rep);
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
- printf("%u %s %s (%s)\n", key_size(public), fp,
- comment ? comment : "no comment", key_type(public));
- if (log_level >= SYSLOG_LEVEL_VERBOSE)
- printf("%s\n", ra);
- free(ra);
- free(fp);
- key_free(public);
- invalid = 0;
+
+ fingerprint_one_key(public, comment);
+ sshkey_free(public);
+ invalid = 0; /* One good key in the file is sufficient */
}
fclose(f);
- if (invalid) {
- printf("%s is not a public key file.\n", identity_file);
- exit(1);
- }
+ if (invalid)
+ fatal("%s is not a public key file.", path);
exit(0);
}
@@ -894,12 +975,16 @@
char *key_type_display;
char *path;
} key_types[] = {
+#ifdef WITH_OPENSSL
+#ifdef WITH_SSH1
{ "rsa1", "RSA1", _PATH_HOST_KEY_FILE },
+#endif /* WITH_SSH1 */
{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
{ "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
#ifdef OPENSSL_HAS_ECC
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE },
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE },
{ NULL, NULL, NULL }
};
@@ -906,9 +991,9 @@
int first = 0;
struct stat st;
- Key *private, *public;
+ struct sshkey *private, *public;
char comment[1024];
- int i, type, fd;
+ int i, type, fd, r;
FILE *f;
for (i = 0; key_types[i].key_type; i++) {
@@ -915,7 +1000,7 @@
if (stat(key_types[i].path, &st) == 0)
continue;
if (errno != ENOENT) {
- printf("Could not stat %s: %s", key_types[i].path,
+ error("Could not stat %s: %s", key_types[i].path,
strerror(errno));
first = 0;
continue;
@@ -927,53 +1012,56 @@
}
printf("%s ", key_types[i].key_type_display);
fflush(stdout);
- type = key_type_from_name(key_types[i].key_type);
+ type = sshkey_type_from_name(key_types[i].key_type);
strlcpy(identity_file, key_types[i].path, sizeof(identity_file));
bits = 0;
- type_bits_valid(type, &bits);
- private = key_generate(type, bits);
- if (private == NULL) {
- fprintf(stderr, "key_generate failed\n");
+ type_bits_valid(type, NULL, &bits);
+ if ((r = sshkey_generate(type, bits, &private)) != 0) {
+ error("key_generate failed: %s", ssh_err(r));
first = 0;
continue;
}
- public = key_from_private(private);
+ if ((r = sshkey_from_private(private, &public)) != 0)
+ fatal("sshkey_from_private failed: %s", ssh_err(r));
snprintf(comment, sizeof comment, "%s@%s", pw->pw_name,
hostname);
- if (!key_save_private(private, identity_file, "", comment,
- use_new_format, new_format_cipher, rounds)) {
- printf("Saving the key failed: %s.\n", identity_file);
- key_free(private);
- key_free(public);
+ if ((r = sshkey_save_private(private, identity_file, "",
+ comment, use_new_format, new_format_cipher, rounds)) != 0) {
+ error("Saving key \"%s\" failed: %s",
+ identity_file, ssh_err(r));
+ sshkey_free(private);
+ sshkey_free(public);
first = 0;
continue;
}
- key_free(private);
+ sshkey_free(private);
strlcat(identity_file, ".pub", sizeof(identity_file));
fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
if (fd == -1) {
- printf("Could not save your public key in %s\n",
+ error("Could not save your public key in %s",
identity_file);
- key_free(public);
+ sshkey_free(public);
first = 0;
continue;
}
f = fdopen(fd, "w");
if (f == NULL) {
- printf("fdopen %s failed\n", identity_file);
- key_free(public);
+ error("fdopen %s failed", identity_file);
+ close(fd);
+ sshkey_free(public);
first = 0;
continue;
}
- if (!key_write(public, f)) {
- fprintf(stderr, "write key failed\n");
- key_free(public);
+ if ((r = sshkey_write(public, f)) != 0) {
+ error("write key failed: %s", ssh_err(r));
+ fclose(f);
+ sshkey_free(public);
first = 0;
continue;
}
fprintf(f, " %s\n", comment);
fclose(f);
- key_free(public);
+ sshkey_free(public);
}
if (first != 0)
@@ -980,44 +1068,129 @@
printf("\n");
}
-static void
-printhost(FILE *f, const char *name, Key *public, int ca, int hash)
+struct known_hosts_ctx {
+ const char *host; /* Hostname searched for in find/delete case */
+ FILE *out; /* Output file, stdout for find_hosts case */
+ int has_unhashed; /* When hashing, original had unhashed hosts */
+ int found_key; /* For find/delete, host was found */
+ int invalid; /* File contained invalid items; don't delete */
+};
+
+static int
+known_hosts_hash(struct hostkey_foreach_line *l, void *_ctx)
{
- if (print_fingerprint) {
- enum fp_rep rep;
- enum fp_type fptype;
- char *fp, *ra;
+ struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx;
+ char *hashed, *cp, *hosts, *ohosts;
+ int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts);
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
- rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
- fp = key_fingerprint(public, fptype, rep);
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
- printf("%u %s %s (%s)\n", key_size(public), fp, name,
- key_type(public));
- if (log_level >= SYSLOG_LEVEL_VERBOSE)
- printf("%s\n", ra);
- free(ra);
- free(fp);
- } else {
- if (hash && (name = host_hash(name, NULL, 0)) == NULL)
- fatal("hash_host failed");
- fprintf(f, "%s%s%s ", ca ? CA_MARKER : "", ca ? " " : "", name);
- if (!key_write(public, f))
- fatal("key_write failed");
- fprintf(f, "\n");
+ switch (l->status) {
+ case HKF_STATUS_OK:
+ case HKF_STATUS_MATCHED:
+ /*
+ * Don't hash hosts already already hashed, with wildcard
+ * characters or a CA/revocation marker.
+ */
+ if ((l->match & HKF_MATCH_HOST_HASHED) != 0 ||
+ has_wild || l->marker != MRK_NONE) {
+ fprintf(ctx->out, "%s\n", l->line);
+ if (has_wild && !find_host) {
+ logit("%s:%ld: ignoring host name "
+ "with wildcard: %.64s", l->path,
+ l->linenum, l->hosts);
+ }
+ return 0;
+ }
+ /*
+ * Split any comma-separated hostnames from the host list,
+ * hash and store separately.
+ */
+ ohosts = hosts = xstrdup(l->hosts);
+ while ((cp = strsep(&hosts, ",")) != NULL && *cp != '\0') {
+ if ((hashed = host_hash(cp, NULL, 0)) == NULL)
+ fatal("hash_host failed");
+ fprintf(ctx->out, "%s %s\n", hashed, l->rawkey);
+ ctx->has_unhashed = 1;
+ }
+ free(ohosts);
+ return 0;
+ case HKF_STATUS_INVALID:
+ /* Retain invalid lines, but mark file as invalid. */
+ ctx->invalid = 1;
+ logit("%s:%ld: invalid line", l->path, l->linenum);
+ /* FALLTHROUGH */
+ default:
+ fprintf(ctx->out, "%s\n", l->line);
+ return 0;
}
+ /* NOTREACHED */
+ return -1;
}
+static int
+known_hosts_find_delete(struct hostkey_foreach_line *l, void *_ctx)
+{
+ struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx;
+ enum sshkey_fp_rep rep;
+ int fptype;
+ char *fp;
+
+ fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
+ rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
+
+ if (l->status == HKF_STATUS_MATCHED) {
+ if (delete_host) {
+ if (l->marker != MRK_NONE) {
+ /* Don't remove CA and revocation lines */
+ fprintf(ctx->out, "%s\n", l->line);
+ } else {
+ /*
+ * Hostname matches and has no CA/revoke
+ * marker, delete it by *not* writing the
+ * line to ctx->out.
+ */
+ ctx->found_key = 1;
+ if (!quiet)
+ printf("# Host %s found: line %ld\n",
+ ctx->host, l->linenum);
+ }
+ return 0;
+ } else if (find_host) {
+ ctx->found_key = 1;
+ if (!quiet) {
+ printf("# Host %s found: line %ld %s\n",
+ ctx->host,
+ l->linenum, l->marker == MRK_CA ? "CA" :
+ (l->marker == MRK_REVOKE ? "REVOKED" : ""));
+ }
+ if (hash_hosts)
+ known_hosts_hash(l, ctx);
+ else if (print_fingerprint) {
+ fp = sshkey_fingerprint(l->key, fptype, rep);
+ printf("%s %s %s %s\n", ctx->host,
+ sshkey_type(l->key), fp, l->comment);
+ free(fp);
+ } else
+ fprintf(ctx->out, "%s\n", l->line);
+ return 0;
+ }
+ } else if (delete_host) {
+ /* Retain non-matching hosts when deleting */
+ if (l->status == HKF_STATUS_INVALID) {
+ ctx->invalid = 1;
+ logit("%s:%ld: invalid line", l->path, l->linenum);
+ }
+ fprintf(ctx->out, "%s\n", l->line);
+ }
+ return 0;
+}
+
static void
do_known_hosts(struct passwd *pw, const char *name)
{
- FILE *in, *out = stdout;
- Key *pub;
- char *cp, *cp2, *kp, *kp2;
- char line[16*1024], tmp[MAXPATHLEN], old[MAXPATHLEN];
- int c, skip = 0, inplace = 0, num = 0, invalid = 0, has_unhashed = 0;
- int ca;
- int found_key = 0;
+ char *cp, tmp[PATH_MAX], old[PATH_MAX];
+ int r, fd, oerrno, inplace = 0;
+ struct known_hosts_ctx ctx;
+ u_int foreach_options;
if (!have_identity) {
cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);
@@ -1027,9 +1200,11 @@
free(cp);
have_identity = 1;
}
- if ((in = fopen(identity_file, "r")) == NULL)
- fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
+ memset(&ctx, 0, sizeof(ctx));
+ ctx.out = stdout;
+ ctx.host = name;
+
/*
* Find hosts goes to stdout, hash and deletions happen in-place
* A corner case is ssh-keygen -HF foo, which should go to stdout
@@ -1041,166 +1216,43 @@
strlcat(old, ".old", sizeof(old)) >= sizeof(old))
fatal("known_hosts path too long");
umask(077);
- if ((c = mkstemp(tmp)) == -1)
+ if ((fd = mkstemp(tmp)) == -1)
fatal("mkstemp: %s", strerror(errno));
- if ((out = fdopen(c, "w")) == NULL) {
- c = errno;
+ if ((ctx.out = fdopen(fd, "w")) == NULL) {
+ oerrno = errno;
unlink(tmp);
- fatal("fdopen: %s", strerror(c));
+ fatal("fdopen: %s", strerror(oerrno));
}
inplace = 1;
}
- while (fgets(line, sizeof(line), in)) {
- if ((cp = strchr(line, '\n')) == NULL) {
- error("line %d too long: %.40s...", num + 1, line);
- skip = 1;
- invalid = 1;
- continue;
- }
- num++;
- if (skip) {
- skip = 0;
- continue;
- }
- *cp = '\0';
+ /* XXX support identity_file == "-" for stdin */
+ foreach_options = find_host ? HKF_WANT_MATCH : 0;
+ foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0;
+ if ((r = hostkeys_foreach(identity_file,
+ hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx,
+ name, NULL, foreach_options)) != 0) {
+ if (inplace)
+ unlink(tmp);
+ fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
+ }
- /* Skip leading whitespace, empty and comment lines. */
- for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
- ;
- if (!*cp || *cp == '\n' || *cp == '#') {
- if (inplace)
- fprintf(out, "%s\n", cp);
- continue;
- }
- /* Check whether this is a CA key */
- if (strncasecmp(cp, CA_MARKER, sizeof(CA_MARKER) - 1) == 0 &&
- (cp[sizeof(CA_MARKER) - 1] == ' ' ||
- cp[sizeof(CA_MARKER) - 1] == '\t')) {
- ca = 1;
- cp += sizeof(CA_MARKER);
- } else
- ca = 0;
+ if (inplace)
+ fclose(ctx.out);
- /* Find the end of the host name portion. */
- for (kp = cp; *kp && *kp != ' ' && *kp != '\t'; kp++)
- ;
-
- if (*kp == '\0' || *(kp + 1) == '\0') {
- error("line %d missing key: %.40s...",
- num, line);
- invalid = 1;
- continue;
- }
- *kp++ = '\0';
- kp2 = kp;
-
- pub = key_new(KEY_RSA1);
- if (key_read(pub, &kp) != 1) {
- kp = kp2;
- key_free(pub);
- pub = key_new(KEY_UNSPEC);
- if (key_read(pub, &kp) != 1) {
- error("line %d invalid key: %.40s...",
- num, line);
- key_free(pub);
- invalid = 1;
- continue;
- }
- }
-
- if (*cp == HASH_DELIM) {
- if (find_host || delete_host) {
- cp2 = host_hash(name, cp, strlen(cp));
- if (cp2 == NULL) {
- error("line %d: invalid hashed "
- "name: %.64s...", num, line);
- invalid = 1;
- continue;
- }
- c = (strcmp(cp2, cp) == 0);
- if (find_host && c) {
- if (!quiet)
- printf("# Host %s found: "
- "line %d type %s%s\n", name,
- num, key_type(pub),
- ca ? " (CA key)" : "");
- printhost(out, cp, pub, ca, 0);
- found_key = 1;
- }
- if (delete_host) {
- if (!c && !ca)
- printhost(out, cp, pub, ca, 0);
- else
- printf("# Host %s found: "
- "line %d type %s\n", name,
- num, key_type(pub));
- }
- } else if (hash_hosts)
- printhost(out, cp, pub, ca, 0);
- } else {
- if (find_host || delete_host) {
- c = (match_hostname(name, cp,
- strlen(cp)) == 1);
- if (find_host && c) {
- if (!quiet)
- printf("# Host %s found: "
- "line %d type %s%s\n", name,
- num, key_type(pub),
- ca ? " (CA key)" : "");
- printhost(out, name, pub,
- ca, hash_hosts && !ca);
- found_key = 1;
- }
- if (delete_host) {
- if (!c && !ca)
- printhost(out, cp, pub, ca, 0);
- else
- printf("# Host %s found: "
- "line %d type %s\n", name,
- num, key_type(pub));
- }
- } else if (hash_hosts) {
- for (cp2 = strsep(&cp, ",");
- cp2 != NULL && *cp2 != '\0';
- cp2 = strsep(&cp, ",")) {
- if (ca) {
- fprintf(stderr, "Warning: "
- "ignoring CA key for host: "
- "%.64s\n", cp2);
- printhost(out, cp2, pub, ca, 0);
- } else if (strcspn(cp2, "*?!") !=
- strlen(cp2)) {
- fprintf(stderr, "Warning: "
- "ignoring host name with "
- "metacharacters: %.64s\n",
- cp2);
- printhost(out, cp2, pub, ca, 0);
- } else
- printhost(out, cp2, pub, ca, 1);
- }
- has_unhashed = 1;
- }
- }
- key_free(pub);
- }
- fclose(in);
-
- if (invalid) {
- fprintf(stderr, "%s is not a valid known_hosts file.\n",
- identity_file);
+ if (ctx.invalid) {
+ error("%s is not a valid known_hosts file.", identity_file);
if (inplace) {
- fprintf(stderr, "Not replacing existing known_hosts "
- "file because of errors\n");
- fclose(out);
+ error("Not replacing existing known_hosts "
+ "file because of errors");
unlink(tmp);
}
exit(1);
- }
-
- if (inplace) {
- fclose(out);
-
+ } else if (delete_host && !ctx.found_key) {
+ logit("Host %s not found in %s", name, identity_file);
+ if (inplace)
+ unlink(tmp);
+ } else if (inplace) {
/* Backup existing file */
if (unlink(old) == -1 && errno != ENOENT)
fatal("unlink %.100s: %s", old, strerror(errno));
@@ -1216,17 +1268,16 @@
exit(1);
}
- fprintf(stderr, "%s updated.\n", identity_file);
- fprintf(stderr, "Original contents retained as %s\n", old);
- if (has_unhashed) {
- fprintf(stderr, "WARNING: %s contains unhashed "
- "entries\n", old);
- fprintf(stderr, "Delete this file to ensure privacy "
- "of hostnames\n");
+ printf("%s updated.\n", identity_file);
+ printf("Original contents retained as %s\n", old);
+ if (ctx.has_unhashed) {
+ logit("WARNING: %s contains unhashed entries", old);
+ logit("Delete this file to ensure privacy "
+ "of hostnames");
}
}
- exit (find_host && !found_key);
+ exit (find_host && !ctx.found_key);
}
/*
@@ -1239,17 +1290,16 @@
char *comment;
char *old_passphrase, *passphrase1, *passphrase2;
struct stat st;
- Key *private;
+ struct sshkey *private;
+ int r;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
- if (stat(identity_file, &st) < 0) {
- perror(identity_file);
- exit(1);
- }
+ if (stat(identity_file, &st) < 0)
+ fatal("%s: %s", identity_file, strerror(errno));
/* Try to load the file with empty passphrase. */
- private = key_load_private(identity_file, "", &comment);
- if (private == NULL) {
+ r = sshkey_load_private(identity_file, "", &private, &comment);
+ if (r == SSH_ERR_KEY_WRONG_PASSPHRASE) {
if (identity_passphrase)
old_passphrase = xstrdup(identity_passphrase);
else
@@ -1256,16 +1306,18 @@
old_passphrase =
read_passphrase("Enter old passphrase: ",
RP_ALLOW_STDIN);
- private = key_load_private(identity_file, old_passphrase,
- &comment);
+ r = sshkey_load_private(identity_file, old_passphrase,
+ &private, &comment);
explicit_bzero(old_passphrase, strlen(old_passphrase));
free(old_passphrase);
- if (private == NULL) {
- printf("Bad passphrase.\n");
- exit(1);
- }
+ if (r != 0)
+ goto badkey;
+ } else if (r != 0) {
+ badkey:
+ fatal("Failed to load key %s: %s", identity_file, ssh_err(r));
}
- printf("Key has comment '%s'\n", comment);
+ if (comment)
+ printf("Key has comment '%s'\n", comment);
/* Ask the new passphrase (twice). */
if (identity_new_passphrase) {
@@ -1293,12 +1345,13 @@
}
/* Save the file using the new passphrase. */
- if (!key_save_private(private, identity_file, passphrase1, comment,
- use_new_format, new_format_cipher, rounds)) {
- printf("Saving the key failed: %s.\n", identity_file);
+ if ((r = sshkey_save_private(private, identity_file, passphrase1,
+ comment, use_new_format, new_format_cipher, rounds)) != 0) {
+ error("Saving key \"%s\" failed: %s.",
+ identity_file, ssh_err(r));
explicit_bzero(passphrase1, strlen(passphrase1));
free(passphrase1);
- key_free(private);
+ sshkey_free(private);
free(comment);
exit(1);
}
@@ -1305,7 +1358,7 @@
/* Destroy the passphrase and the copy of the key in memory. */
explicit_bzero(passphrase1, strlen(passphrase1));
free(passphrase1);
- key_free(private); /* Destroys contents */
+ sshkey_free(private); /* Destroys contents */
free(comment);
printf("Your identification has been saved with the new passphrase.\n");
@@ -1318,9 +1371,10 @@
static int
do_print_resource_record(struct passwd *pw, char *fname, char *hname)
{
- Key *public;
+ struct sshkey *public;
char *comment = NULL;
struct stat st;
+ int r;
if (fname == NULL)
fatal("%s: no filename", __func__);
@@ -1327,21 +1381,15 @@
if (stat(fname, &st) < 0) {
if (errno == ENOENT)
return 0;
- perror(fname);
- exit(1);
+ fatal("%s: %s", fname, strerror(errno));
}
- public = key_load_public(fname, &comment);
- if (public != NULL) {
- export_dns_rr(hname, public, stdout, print_generic);
- key_free(public);
- free(comment);
- return 1;
- }
- if (comment)
- free(comment);
-
- printf("failed to read v2 public key from %s.\n", fname);
- exit(1);
+ if ((r = sshkey_load_public(fname, &public, &comment)) != 0)
+ fatal("Failed to read v2 public key from \"%s\": %s.",
+ fname, ssh_err(r));
+ export_dns_rr(hname, public, stdout, print_generic);
+ sshkey_free(public);
+ free(comment);
+ return 1;
}
/*
@@ -1351,20 +1399,23 @@
do_change_comment(struct passwd *pw)
{
char new_comment[1024], *comment, *passphrase;
- Key *private;
- Key *public;
+ struct sshkey *private;
+ struct sshkey *public;
struct stat st;
FILE *f;
- int fd;
+ int r, fd;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
- if (stat(identity_file, &st) < 0) {
- perror(identity_file);
- exit(1);
- }
- private = key_load_private(identity_file, "", &comment);
- if (private == NULL) {
+ if (stat(identity_file, &st) < 0)
+ fatal("%s: %s", identity_file, strerror(errno));
+ if ((r = sshkey_load_private(identity_file, "",
+ &private, &comment)) == 0)
+ passphrase = xstrdup("");
+ else if (r != SSH_ERR_KEY_WRONG_PASSPHRASE)
+ fatal("Cannot load private key \"%s\": %s.",
+ identity_file, ssh_err(r));
+ else {
if (identity_passphrase)
passphrase = xstrdup(identity_passphrase);
else if (identity_new_passphrase)
@@ -1373,19 +1424,21 @@
passphrase = read_passphrase("Enter passphrase: ",
RP_ALLOW_STDIN);
/* Try to load using the passphrase. */
- private = key_load_private(identity_file, passphrase, &comment);
- if (private == NULL) {
+ if ((r = sshkey_load_private(identity_file, passphrase,
+ &private, &comment)) != 0) {
explicit_bzero(passphrase, strlen(passphrase));
free(passphrase);
- printf("Bad passphrase.\n");
- exit(1);
+ fatal("Cannot load private key \"%s\": %s.",
+ identity_file, ssh_err(r));
}
- } else {
- passphrase = xstrdup("");
}
- if (private->type != KEY_RSA1) {
- fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
- key_free(private);
+
+ if (private->type != KEY_RSA1 && private->type != KEY_ED25519 &&
+ !use_new_format) {
+ error("Comments are only supported for RSA1 or keys stored in "
+ "the new format (-o).");
+ explicit_bzero(passphrase, strlen(passphrase));
+ sshkey_free(private);
exit(1);
}
printf("Key now has comment '%s'\n", comment);
@@ -1397,7 +1450,7 @@
fflush(stdout);
if (!fgets(new_comment, sizeof(new_comment), stdin)) {
explicit_bzero(passphrase, strlen(passphrase));
- key_free(private);
+ sshkey_free(private);
exit(1);
}
new_comment[strcspn(new_comment, "\n")] = '\0';
@@ -1404,34 +1457,32 @@
}
/* Save the file using the new passphrase. */
- if (!key_save_private(private, identity_file, passphrase, new_comment,
- use_new_format, new_format_cipher, rounds)) {
- printf("Saving the key failed: %s.\n", identity_file);
+ if ((r = sshkey_save_private(private, identity_file, passphrase,
+ new_comment, use_new_format, new_format_cipher, rounds)) != 0) {
+ error("Saving key \"%s\" failed: %s",
+ identity_file, ssh_err(r));
explicit_bzero(passphrase, strlen(passphrase));
free(passphrase);
- key_free(private);
+ sshkey_free(private);
free(comment);
exit(1);
}
explicit_bzero(passphrase, strlen(passphrase));
free(passphrase);
- public = key_from_private(private);
- key_free(private);
+ if ((r = sshkey_from_private(private, &public)) != 0)
+ fatal("key_from_private failed: %s", ssh_err(r));
+ sshkey_free(private);
strlcat(identity_file, ".pub", sizeof(identity_file));
fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
- if (fd == -1) {
- printf("Could not save your public key in %s\n", identity_file);
- exit(1);
- }
+ if (fd == -1)
+ fatal("Could not save your public key in %s", identity_file);
f = fdopen(fd, "w");
- if (f == NULL) {
- printf("fdopen %s failed\n", identity_file);
- exit(1);
- }
- if (!key_write(public, f))
- fprintf(stderr, "write key failed\n");
- key_free(public);
+ if (f == NULL)
+ fatal("fdopen %s failed: %s", identity_file, strerror(errno));
+ if ((r = sshkey_write(public, f)) != 0)
+ fatal("write key failed: %s", ssh_err(r));
+ sshkey_free(public);
fprintf(f, " %s\n", new_comment);
fclose(f);
@@ -1441,73 +1492,40 @@
exit(0);
}
-static const char *
-fmt_validity(u_int64_t valid_from, u_int64_t valid_to)
+static void
+add_flag_option(struct sshbuf *c, const char *name)
{
- char from[32], to[32];
- static char ret[64];
- time_t tt;
- struct tm *tm;
+ int r;
- *from = *to = '\0';
- if (valid_from == 0 && valid_to == 0xffffffffffffffffULL)
- return "forever";
-
- if (valid_from != 0) {
- /* XXX revisit INT_MAX in 2038 :) */
- tt = valid_from > INT_MAX ? INT_MAX : valid_from;
- tm = localtime(&tt);
- strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm);
- }
- if (valid_to != 0xffffffffffffffffULL) {
- /* XXX revisit INT_MAX in 2038 :) */
- tt = valid_to > INT_MAX ? INT_MAX : valid_to;
- tm = localtime(&tt);
- strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm);
- }
-
- if (valid_from == 0) {
- snprintf(ret, sizeof(ret), "before %s", to);
- return ret;
- }
- if (valid_to == 0xffffffffffffffffULL) {
- snprintf(ret, sizeof(ret), "after %s", from);
- return ret;
- }
-
- snprintf(ret, sizeof(ret), "from %s to %s", from, to);
- return ret;
-}
-
-static void
-add_flag_option(Buffer *c, const char *name)
-{
debug3("%s: %s", __func__, name);
- buffer_put_cstring(c, name);
- buffer_put_string(c, NULL, 0);
+ if ((r = sshbuf_put_cstring(c, name)) != 0 ||
+ (r = sshbuf_put_string(c, NULL, 0)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
}
static void
-add_string_option(Buffer *c, const char *name, const char *value)
+add_string_option(struct sshbuf *c, const char *name, const char *value)
{
- Buffer b;
+ struct sshbuf *b;
+ int r;
debug3("%s: %s=%s", __func__, name, value);
- buffer_init(&b);
- buffer_put_cstring(&b, value);
+ if ((b = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_cstring(b, value)) != 0 ||
+ (r = sshbuf_put_cstring(c, name)) != 0 ||
+ (r = sshbuf_put_stringb(c, b)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
- buffer_put_cstring(c, name);
- buffer_put_string(c, buffer_ptr(&b), buffer_len(&b));
-
- buffer_free(&b);
+ sshbuf_free(b);
}
#define OPTIONS_CRITICAL 1
#define OPTIONS_EXTENSIONS 2
static void
-prepare_options_buf(Buffer *c, int which)
+prepare_options_buf(struct sshbuf *c, int which)
{
- buffer_clear(c);
+ sshbuf_reset(c);
if ((which & OPTIONS_CRITICAL) != 0 &&
certflags_command != NULL)
add_string_option(c, "force-command", certflags_command);
@@ -1531,15 +1549,16 @@
add_string_option(c, "source-address", certflags_src_addr);
}
-static Key *
+static struct sshkey *
load_pkcs11_key(char *path)
{
#ifdef ENABLE_PKCS11
- Key **keys = NULL, *public, *private = NULL;
- int i, nkeys;
+ struct sshkey **keys = NULL, *public, *private = NULL;
+ int r, i, nkeys;
- if ((public = key_load_public(path, NULL)) == NULL)
- fatal("Couldn't load CA public key \"%s\"", path);
+ if ((r = sshkey_load_public(path, &public, NULL)) != 0)
+ fatal("Couldn't load CA public key \"%s\": %s",
+ path, ssh_err(r));
nkeys = pkcs11_add_provider(pkcs11provider, identity_passphrase, &keys);
debug3("%s: %d keys", __func__, nkeys);
@@ -1546,14 +1565,14 @@
if (nkeys <= 0)
fatal("cannot read public key from pkcs11");
for (i = 0; i < nkeys; i++) {
- if (key_equal_public(public, keys[i])) {
+ if (sshkey_equal_public(public, keys[i])) {
private = keys[i];
continue;
}
- key_free(keys[i]);
+ sshkey_free(keys[i]);
}
free(keys);
- key_free(public);
+ sshkey_free(public);
return private;
#else
fatal("no pkcs11 support");
@@ -1563,41 +1582,29 @@
static void
do_ca_sign(struct passwd *pw, int argc, char **argv)
{
- int i, fd;
+ int r, i, fd;
u_int n;
- Key *ca, *public;
- char *otmp, *tmp, *cp, *out, *comment, **plist = NULL;
+ struct sshkey *ca, *public;
+ char valid[64], *otmp, *tmp, *cp, *out, *comment, **plist = NULL;
FILE *f;
- int v00 = 0; /* legacy keys */
- if (key_type_name != NULL) {
- switch (key_type_from_name(key_type_name)) {
- case KEY_RSA_CERT_V00:
- case KEY_DSA_CERT_V00:
- v00 = 1;
- break;
- case KEY_UNSPEC:
- if (strcasecmp(key_type_name, "v00") == 0) {
- v00 = 1;
- break;
- } else if (strcasecmp(key_type_name, "v01") == 0)
- break;
- /* FALLTHROUGH */
- default:
- fprintf(stderr, "unknown key type %s\n", key_type_name);
- exit(1);
- }
- }
-
+#ifdef ENABLE_PKCS11
pkcs11_init(1);
+#endif
tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
if (pkcs11provider != NULL) {
if ((ca = load_pkcs11_key(tmp)) == NULL)
fatal("No PKCS#11 key matching %s found", ca_key_path);
- } else if ((ca = load_identity(tmp)) == NULL)
- fatal("Couldn't load CA key \"%s\"", tmp);
+ } else
+ ca = load_identity(tmp);
free(tmp);
+ if (key_type_name != NULL &&
+ sshkey_type_from_name(key_type_name) != ca->type) {
+ fatal("CA key type %s doesn't match specified %s",
+ sshkey_ssh_name(ca), key_type_name);
+ }
+
for (i = 0; i < argc; i++) {
/* Split list of principals */
n = 0;
@@ -1605,7 +1612,7 @@
otmp = tmp = xstrdup(cert_principals);
plist = NULL;
for (; (cp = strsep(&tmp, ",")) != NULL; n++) {
- plist = xrealloc(plist, n + 1, sizeof(*plist));
+ plist = xreallocarray(plist, n + 1, sizeof(*plist));
if (*(plist[n] = xstrdup(cp)) == '\0')
fatal("Empty principal name");
}
@@ -1613,16 +1620,18 @@
}
tmp = tilde_expand_filename(argv[i], pw->pw_uid);
- if ((public = key_load_public(tmp, &comment)) == NULL)
- fatal("%s: unable to open \"%s\"", __func__, tmp);
+ if ((r = sshkey_load_public(tmp, &public, &comment)) != 0)
+ fatal("%s: unable to open \"%s\": %s",
+ __func__, tmp, ssh_err(r));
if (public->type != KEY_RSA && public->type != KEY_DSA &&
public->type != KEY_ECDSA && public->type != KEY_ED25519)
fatal("%s: key \"%s\" type %s cannot be certified",
- __func__, tmp, key_type(public));
+ __func__, tmp, sshkey_type(public));
/* Prepare certificate to sign */
- if (key_to_certified(public, v00) != 0)
- fatal("Could not upgrade key %s to certificate", tmp);
+ if ((r = sshkey_to_certified(public)) != 0)
+ fatal("Could not upgrade key %s to certificate: %s",
+ tmp, ssh_err(r));
public->cert->type = cert_key_type;
public->cert->serial = (u_int64_t)cert_serial;
public->cert->key_id = xstrdup(cert_key_id);
@@ -1630,19 +1639,15 @@
public->cert->principals = plist;
public->cert->valid_after = cert_valid_from;
public->cert->valid_before = cert_valid_to;
- if (v00) {
- prepare_options_buf(&public->cert->critical,
- OPTIONS_CRITICAL|OPTIONS_EXTENSIONS);
- } else {
- prepare_options_buf(&public->cert->critical,
- OPTIONS_CRITICAL);
- prepare_options_buf(&public->cert->extensions,
- OPTIONS_EXTENSIONS);
- }
- public->cert->signature_key = key_from_private(ca);
+ prepare_options_buf(public->cert->critical, OPTIONS_CRITICAL);
+ prepare_options_buf(public->cert->extensions,
+ OPTIONS_EXTENSIONS);
+ if ((r = sshkey_from_private(ca,
+ &public->cert->signature_key)) != 0)
+ fatal("key_from_private (ca key): %s", ssh_err(r));
- if (key_certify(public, ca) != 0)
- fatal("Couldn't not certify key %s", tmp);
+ if ((r = sshkey_certify(public, ca, key_type_name)) != 0)
+ fatal("Couldn't certify key %s: %s", tmp, ssh_err(r));
if ((cp = strrchr(tmp, '.')) != NULL && strcmp(cp, ".pub") == 0)
*cp = '\0';
@@ -1654,25 +1659,30 @@
strerror(errno));
if ((f = fdopen(fd, "w")) == NULL)
fatal("%s: fdopen: %s", __func__, strerror(errno));
- if (!key_write(public, f))
- fatal("Could not write certified key to %s", out);
+ if ((r = sshkey_write(public, f)) != 0)
+ fatal("Could not write certified key to %s: %s",
+ out, ssh_err(r));
fprintf(f, " %s\n", comment);
fclose(f);
if (!quiet) {
+ sshkey_format_cert_validity(public->cert,
+ valid, sizeof(valid));
logit("Signed %s key %s: id \"%s\" serial %llu%s%s "
- "valid %s", key_cert_type(public),
+ "valid %s", sshkey_cert_type(public),
out, public->cert->key_id,
(unsigned long long)public->cert->serial,
cert_principals != NULL ? " for " : "",
cert_principals != NULL ? cert_principals : "",
- fmt_validity(cert_valid_from, cert_valid_to));
+ valid);
}
- key_free(public);
+ sshkey_free(public);
free(out);
}
+#ifdef ENABLE_PKCS11
pkcs11_terminate();
+#endif
exit(0);
}
@@ -1698,7 +1708,7 @@
char buf[32], *fmt;
/*
- * POSIX strptime says "The application shall ensure that there
+ * POSIX strptime says "The application shall ensure that there
* is white-space or other non-alphanumeric characters between
* any two conversion specifications" so arrange things this way.
*/
@@ -1818,23 +1828,22 @@
}
static void
-show_options(const Buffer *optbuf, int v00, int in_critical)
+show_options(struct sshbuf *optbuf, int in_critical)
{
- char *name;
- u_char *data;
- u_int dlen;
- Buffer options, option;
+ char *name, *arg;
+ struct sshbuf *options, *option = NULL;
+ int r;
- buffer_init(&options);
- buffer_append(&options, buffer_ptr(optbuf), buffer_len(optbuf));
-
- buffer_init(&option);
- while (buffer_len(&options) != 0) {
- name = buffer_get_string(&options, NULL);
- data = buffer_get_string_ptr(&options, &dlen);
- buffer_append(&option, data, dlen);
+ if ((options = sshbuf_fromb(optbuf)) == NULL)
+ fatal("%s: sshbuf_fromb failed", __func__);
+ while (sshbuf_len(options) != 0) {
+ sshbuf_free(option);
+ option = NULL;
+ if ((r = sshbuf_get_cstring(options, &name, NULL)) != 0 ||
+ (r = sshbuf_froms(options, &option)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
printf(" %s", name);
- if ((v00 || !in_critical) &&
+ if (!in_critical &&
(strcmp(name, "permit-X11-forwarding") == 0 ||
strcmp(name, "permit-agent-forwarding") == 0 ||
strcmp(name, "permit-port-forwarding") == 0 ||
@@ -1841,60 +1850,48 @@
strcmp(name, "permit-pty") == 0 ||
strcmp(name, "permit-user-rc") == 0))
printf("\n");
- else if ((v00 || in_critical) &&
+ else if (in_critical &&
(strcmp(name, "force-command") == 0 ||
strcmp(name, "source-address") == 0)) {
- data = buffer_get_string(&option, NULL);
- printf(" %s\n", data);
- free(data);
+ if ((r = sshbuf_get_cstring(option, &arg, NULL)) != 0)
+ fatal("%s: buffer error: %s",
+ __func__, ssh_err(r));
+ printf(" %s\n", arg);
+ free(arg);
} else {
- printf(" UNKNOWN OPTION (len %u)\n",
- buffer_len(&option));
- buffer_clear(&option);
+ printf(" UNKNOWN OPTION (len %zu)\n",
+ sshbuf_len(option));
+ sshbuf_reset(option);
}
free(name);
- if (buffer_len(&option) != 0)
+ if (sshbuf_len(option) != 0)
fatal("Option corrupt: extra data at end");
}
- buffer_free(&option);
- buffer_free(&options);
+ sshbuf_free(option);
+ sshbuf_free(options);
}
static void
-do_show_cert(struct passwd *pw)
+print_cert(struct sshkey *key)
{
- Key *key;
- struct stat st;
- char *key_fp, *ca_fp;
- u_int i, v00;
+ char valid[64], *key_fp, *ca_fp;
+ u_int i;
- if (!have_identity)
- ask_filename(pw, "Enter file in which the key is");
- if (stat(identity_file, &st) < 0)
- fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
- if ((key = key_load_public(identity_file, NULL)) == NULL)
- fatal("%s is not a public key", identity_file);
- if (!key_is_cert(key))
- fatal("%s is not a certificate", identity_file);
- v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
+ key_fp = sshkey_fingerprint(key, fingerprint_hash, SSH_FP_DEFAULT);
+ ca_fp = sshkey_fingerprint(key->cert->signature_key,
+ fingerprint_hash, SSH_FP_DEFAULT);
+ if (key_fp == NULL || ca_fp == NULL)
+ fatal("%s: sshkey_fingerprint fail", __func__);
+ sshkey_format_cert_validity(key->cert, valid, sizeof(valid));
- key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
- ca_fp = key_fingerprint(key->cert->signature_key,
- SSH_FP_MD5, SSH_FP_HEX);
-
- printf("%s:\n", identity_file);
- printf(" Type: %s %s certificate\n", key_ssh_name(key),
- key_cert_type(key));
- printf(" Public key: %s %s\n", key_type(key), key_fp);
+ printf(" Type: %s %s certificate\n", sshkey_ssh_name(key),
+ sshkey_cert_type(key));
+ printf(" Public key: %s %s\n", sshkey_type(key), key_fp);
printf(" Signing CA: %s %s\n",
- key_type(key->cert->signature_key), ca_fp);
+ sshkey_type(key->cert->signature_key), ca_fp);
printf(" Key ID: \"%s\"\n", key->cert->key_id);
- if (!v00) {
- printf(" Serial: %llu\n",
- (unsigned long long)key->cert->serial);
- }
- printf(" Valid: %s\n",
- fmt_validity(key->cert->valid_after, key->cert->valid_before));
+ printf(" Serial: %llu\n", (unsigned long long)key->cert->serial);
+ printf(" Valid: %s\n", valid);
printf(" Principals: ");
if (key->cert->nprincipals == 0)
printf("(none)\n");
@@ -1905,48 +1902,100 @@
printf("\n");
}
printf(" Critical Options: ");
- if (buffer_len(&key->cert->critical) == 0)
+ if (sshbuf_len(key->cert->critical) == 0)
printf("(none)\n");
else {
printf("\n");
- show_options(&key->cert->critical, v00, 1);
+ show_options(key->cert->critical, 1);
}
- if (!v00) {
- printf(" Extensions: ");
- if (buffer_len(&key->cert->extensions) == 0)
- printf("(none)\n");
- else {
- printf("\n");
- show_options(&key->cert->extensions, v00, 0);
+ printf(" Extensions: ");
+ if (sshbuf_len(key->cert->extensions) == 0)
+ printf("(none)\n");
+ else {
+ printf("\n");
+ show_options(key->cert->extensions, 0);
+ }
+}
+
+static void
+do_show_cert(struct passwd *pw)
+{
+ struct sshkey *key = NULL;
+ struct stat st;
+ int r, is_stdin = 0, ok = 0;
+ FILE *f;
+ char *cp, line[SSH_MAX_PUBKEY_BYTES];
+ const char *path;
+ u_long lnum = 0;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (strcmp(identity_file, "-") != 0 && stat(identity_file, &st) < 0)
+ fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
+
+ path = identity_file;
+ if (strcmp(path, "-") == 0) {
+ f = stdin;
+ path = "(stdin)";
+ is_stdin = 1;
+ } else if ((f = fopen(identity_file, "r")) == NULL)
+ fatal("fopen %s: %s", identity_file, strerror(errno));
+
+ while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
+ sshkey_free(key);
+ key = NULL;
+ /* Trim leading space and comments */
+ cp = line + strspn(line, " \t");
+ if (*cp == '#' || *cp == '\0')
+ continue;
+ if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("key_new");
+ if ((r = sshkey_read(key, &cp)) != 0) {
+ error("%s:%lu: invalid key: %s", path,
+ lnum, ssh_err(r));
+ continue;
}
+ if (!sshkey_is_cert(key)) {
+ error("%s:%lu is not a certificate", path, lnum);
+ continue;
+ }
+ ok = 1;
+ if (!is_stdin && lnum == 1)
+ printf("%s:\n", path);
+ else
+ printf("%s:%lu:\n", path, lnum);
+ print_cert(key);
}
- exit(0);
+ sshkey_free(key);
+ fclose(f);
+ exit(ok ? 0 : 1);
}
static void
load_krl(const char *path, struct ssh_krl **krlp)
{
- Buffer krlbuf;
- int fd;
+ struct sshbuf *krlbuf;
+ int r, fd;
- buffer_init(&krlbuf);
+ if ((krlbuf = sshbuf_new()) == NULL)
+ fatal("sshbuf_new failed");
if ((fd = open(path, O_RDONLY)) == -1)
fatal("open %s: %s", path, strerror(errno));
- if (!key_load_file(fd, path, &krlbuf))
- fatal("Unable to load KRL");
+ if ((r = sshkey_load_file(fd, krlbuf)) != 0)
+ fatal("Unable to load KRL: %s", ssh_err(r));
close(fd);
/* XXX check sigs */
- if (ssh_krl_from_blob(&krlbuf, krlp, NULL, 0) != 0 ||
+ if ((r = ssh_krl_from_blob(krlbuf, krlp, NULL, 0)) != 0 ||
*krlp == NULL)
- fatal("Invalid KRL file");
- buffer_free(&krlbuf);
+ fatal("Invalid KRL file: %s", ssh_err(r));
+ sshbuf_free(krlbuf);
}
static void
-update_krl_from_file(struct passwd *pw, const char *file, const Key *ca,
- struct ssh_krl *krl)
+update_krl_from_file(struct passwd *pw, const char *file, int wild_ca,
+ const struct sshkey *ca, struct ssh_krl *krl)
{
- Key *key = NULL;
+ struct sshkey *key = NULL;
u_long lnum = 0;
char *path, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
unsigned long long serial, serial2;
@@ -1985,7 +2034,7 @@
if (*cp == '\0')
continue;
if (strncasecmp(cp, "serial:", 7) == 0) {
- if (ca == NULL) {
+ if (ca == NULL && !wild_ca) {
fatal("revoking certificates by serial number "
"requires specification of a CA key");
}
@@ -2022,7 +2071,7 @@
__func__);
}
} else if (strncasecmp(cp, "id:", 3) == 0) {
- if (ca == NULL) {
+ if (ca == NULL && !wild_ca) {
fatal("revoking certificates by key ID "
"requires specification of a CA key");
}
@@ -2045,10 +2094,11 @@
* Parsing will fail if it isn't.
*/
}
- if ((key = key_new(KEY_UNSPEC)) == NULL)
+ if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
fatal("key_new");
- if (key_read(key, &cp) != 1)
- fatal("%s:%lu: invalid key", path, lnum);
+ if ((r = sshkey_read(key, &cp)) != 0)
+ fatal("%s:%lu: invalid key: %s",
+ path, lnum, ssh_err(r));
if (was_explicit_key)
r = ssh_krl_revoke_key_explicit(krl, key);
else if (was_sha1)
@@ -2056,8 +2106,9 @@
else
r = ssh_krl_revoke_key(krl, key);
if (r != 0)
- fatal("%s: revoke key failed", __func__);
- key_free(key);
+ fatal("%s: revoke key failed: %s",
+ __func__, ssh_err(r));
+ sshkey_free(key);
}
}
if (strcmp(path, "-") != 0)
@@ -2070,10 +2121,10 @@
{
struct ssh_krl *krl;
struct stat sb;
- Key *ca = NULL;
- int fd, i;
+ struct sshkey *ca = NULL;
+ int fd, i, r, wild_ca = 0;
char *tmp;
- Buffer kbuf;
+ struct sshbuf *kbuf;
if (*identity_file == '\0')
fatal("KRL generation requires an output file");
@@ -2085,10 +2136,15 @@
fatal("KRL \"%s\" does not exist", identity_file);
}
if (ca_key_path != NULL) {
- tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
- if ((ca = key_load_public(tmp, NULL)) == NULL)
- fatal("Cannot load CA public key %s", tmp);
- free(tmp);
+ if (strcasecmp(ca_key_path, "none") == 0)
+ wild_ca = 1;
+ else {
+ tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
+ if ((r = sshkey_load_public(tmp, &ca, NULL)) != 0)
+ fatal("Cannot load CA public key %s: %s",
+ tmp, ssh_err(r));
+ free(tmp);
+ }
}
if (updating)
@@ -2102,21 +2158,21 @@
ssh_krl_set_comment(krl, identity_comment);
for (i = 0; i < argc; i++)
- update_krl_from_file(pw, argv[i], ca, krl);
+ update_krl_from_file(pw, argv[i], wild_ca, ca, krl);
- buffer_init(&kbuf);
- if (ssh_krl_to_blob(krl, &kbuf, NULL, 0) != 0)
+ if ((kbuf = sshbuf_new()) == NULL)
+ fatal("sshbuf_new failed");
+ if (ssh_krl_to_blob(krl, kbuf, NULL, 0) != 0)
fatal("Couldn't generate KRL");
if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
fatal("open %s: %s", identity_file, strerror(errno));
- if (atomicio(vwrite, fd, buffer_ptr(&kbuf), buffer_len(&kbuf)) !=
- buffer_len(&kbuf))
+ if (atomicio(vwrite, fd, (void *)sshbuf_ptr(kbuf), sshbuf_len(kbuf)) !=
+ sshbuf_len(kbuf))
fatal("write %s: %s", identity_file, strerror(errno));
close(fd);
- buffer_free(&kbuf);
+ sshbuf_free(kbuf);
ssh_krl_free(krl);
- if (ca != NULL)
- key_free(ca);
+ sshkey_free(ca);
}
static void
@@ -2125,14 +2181,15 @@
int i, r, ret = 0;
char *comment;
struct ssh_krl *krl;
- Key *k;
+ struct sshkey *k;
if (*identity_file == '\0')
fatal("KRL checking requires an input file");
load_krl(identity_file, &krl);
for (i = 0; i < argc; i++) {
- if ((k = key_load_public(argv[i], &comment)) == NULL)
- fatal("Cannot load public key %s", argv[i]);
+ if ((r = sshkey_load_public(argv[i], &k, &comment)) != 0)
+ fatal("Cannot load public key %s: %s",
+ argv[i], ssh_err(r));
r = ssh_krl_check_key(krl, k);
printf("%s%s%s%s: %s\n", argv[i],
*comment ? " (" : "", comment, *comment ? ")" : "",
@@ -2139,7 +2196,7 @@
r == 0 ? "ok" : "REVOKED");
if (r != 0)
ret = 1;
- key_free(k);
+ sshkey_free(k);
free(comment);
}
ssh_krl_free(krl);
@@ -2149,56 +2206,37 @@
static void
usage(void)
{
- fprintf(stderr, "usage: %s [options]\n", __progname);
- fprintf(stderr, "Options:\n");
- fprintf(stderr, " -A Generate non-existent host keys for all key types.\n");
- fprintf(stderr, " -a number Number of KDF rounds for new key format or moduli primality tests.\n");
- fprintf(stderr, " -B Show bubblebabble digest of key file.\n");
- fprintf(stderr, " -b bits Number of bits in the key to create.\n");
- fprintf(stderr, " -C comment Provide new comment.\n");
- fprintf(stderr, " -c Change comment in private and public key files.\n");
+ fprintf(stderr,
+ "usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa | rsa1]\n"
+ " [-N new_passphrase] [-C comment] [-f output_keyfile]\n"
+ " ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]\n"
+ " ssh-keygen -i [-m key_format] [-f input_keyfile]\n"
+ " ssh-keygen -e [-m key_format] [-f input_keyfile]\n"
+ " ssh-keygen -y [-f input_keyfile]\n"
+ " ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]\n"
+ " ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n"
+ " ssh-keygen -B [-f input_keyfile]\n");
#ifdef ENABLE_PKCS11
- fprintf(stderr, " -D pkcs11 Download public key from pkcs11 token.\n");
+ fprintf(stderr,
+ " ssh-keygen -D pkcs11\n");
#endif
- fprintf(stderr, " -e Export OpenSSH to foreign format key file.\n");
- fprintf(stderr, " -F hostname Find hostname in known hosts file.\n");
- fprintf(stderr, " -f filename Filename of the key file.\n");
- fprintf(stderr, " -G file Generate candidates for DH-GEX moduli.\n");
- fprintf(stderr, " -g Use generic DNS resource record format.\n");
- fprintf(stderr, " -H Hash names in known_hosts file.\n");
- fprintf(stderr, " -h Generate host certificate instead of a user certificate.\n");
- fprintf(stderr, " -I key_id Key identifier to include in certificate.\n");
- fprintf(stderr, " -i Import foreign format to OpenSSH key file.\n");
- fprintf(stderr, " -J number Screen this number of moduli lines.\n");
- fprintf(stderr, " -j number Start screening moduli at specified line.\n");
- fprintf(stderr, " -K checkpt Write checkpoints to this file.\n");
- fprintf(stderr, " -k Generate a KRL file.\n");
- fprintf(stderr, " -L Print the contents of a certificate.\n");
- fprintf(stderr, " -l Show fingerprint of key file.\n");
- fprintf(stderr, " -M memory Amount of memory (MB) to use for generating DH-GEX moduli.\n");
- fprintf(stderr, " -m key_fmt Conversion format for -e/-i (PEM|PKCS8|RFC4716).\n");
- fprintf(stderr, " -N phrase Provide new passphrase.\n");
- fprintf(stderr, " -n name,... User/host principal names to include in certificate\n");
- fprintf(stderr, " -O option Specify a certificate option.\n");
- fprintf(stderr, " -o Enforce new private key format.\n");
- fprintf(stderr, " -P phrase Provide old passphrase.\n");
- fprintf(stderr, " -p Change passphrase of private key file.\n");
- fprintf(stderr, " -Q Test whether key(s) are revoked in KRL.\n");
- fprintf(stderr, " -q Quiet.\n");
- fprintf(stderr, " -R hostname Remove host from known_hosts file.\n");
- fprintf(stderr, " -r hostname Print DNS resource record.\n");
- fprintf(stderr, " -S start Start point (hex) for generating DH-GEX moduli.\n");
- fprintf(stderr, " -s ca_key Certify keys with CA key.\n");
- fprintf(stderr, " -T file Screen candidates for DH-GEX moduli.\n");
- fprintf(stderr, " -t type Specify type of key to create.\n");
- fprintf(stderr, " -u Update KRL rather than creating a new one.\n");
- fprintf(stderr, " -V from:to Specify certificate validity interval.\n");
- fprintf(stderr, " -v Verbose.\n");
- fprintf(stderr, " -W gen Generator to use for generating DH-GEX moduli.\n");
- fprintf(stderr, " -y Read private key file and print public key.\n");
- fprintf(stderr, " -Z cipher Specify a cipher for new private key format.\n");
- fprintf(stderr, " -z serial Specify a serial number.\n");
-
+ fprintf(stderr,
+ " ssh-keygen -F hostname [-f known_hosts_file] [-l]\n"
+ " ssh-keygen -H [-f known_hosts_file]\n"
+ " ssh-keygen -R hostname [-f known_hosts_file]\n"
+ " ssh-keygen -r hostname [-f input_keyfile] [-g]\n"
+#ifdef WITH_OPENSSL
+ " ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point]\n"
+ " ssh-keygen -T output_file -f input_file [-v] [-a rounds] [-J num_lines]\n"
+ " [-j start_line] [-K checkpt] [-W generator]\n"
+#endif
+ " ssh-keygen -s ca_key -I certificate_identity [-h] [-n principals]\n"
+ " [-O option] [-V validity_interval] [-z serial_number] file ...\n"
+ " ssh-keygen -L [-f input_keyfile]\n"
+ " ssh-keygen -A\n"
+ " ssh-keygen -k -f krl_file [-u] [-s ca_public] [-z version_number]\n"
+ " file ...\n"
+ " ssh-keygen -Q -f krl_file file ...\n");
exit(1);
}
@@ -2208,30 +2246,36 @@
int
main(int argc, char **argv)
{
- char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;
- char *checkpoint = NULL;
- char out_file[MAXPATHLEN], *ep, *rr_hostname = NULL;
- Key *private, *public;
+ char dotsshdir[PATH_MAX], comment[1024], *passphrase1, *passphrase2;
+ char *rr_hostname = NULL, *ep, *fp, *ra;
+ struct sshkey *private, *public;
struct passwd *pw;
struct stat st;
- int opt, type, fd;
+ int r, opt, type, fd;
+ int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0;
+ FILE *f;
+ const char *errstr;
+#ifdef WITH_OPENSSL
+ /* Moduli generation/screening */
+ char out_file[PATH_MAX], *checkpoint = NULL;
u_int32_t memory = 0, generator_wanted = 0;
int do_gen_candidates = 0, do_screen_candidates = 0;
- int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0;
unsigned long start_lineno = 0, lines_to_process = 0;
BIGNUM *start = NULL;
- FILE *f;
- const char *errstr;
+#endif
extern int optind;
extern char *optarg;
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
__progname = ssh_get_progname(argv[0]);
+#ifdef WITH_OPENSSL
OpenSSL_add_all_algorithms();
+#endif
log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
seed_rng();
@@ -2238,18 +2282,15 @@
/* we need this for the home * directory. */
pw = getpwuid(getuid());
- if (!pw) {
- printf("No user exists for uid %lu\n", (u_long)getuid());
- exit(1);
- }
- if (gethostname(hostname, sizeof(hostname)) < 0) {
- perror("gethostname");
- exit(1);
- }
+ if (!pw)
+ fatal("No user exists for uid %lu", (u_long)getuid());
+ if (gethostname(hostname, sizeof(hostname)) < 0)
+ fatal("gethostname: %s", strerror(errno));
- /* Remaining characters: EUYdw */
+ /* Remaining characters: UYdw */
while ((opt = getopt(argc, argv, "ABHLQXceghiklopquvxy"
- "C:D:F:G:I:J:K:M:N:O:P:R:S:T:V:W:Z:a:b:f:g:j:m:n:r:s:t:z:")) != -1) {
+ "C:D:E:F:G:I:J:K:M:N:O:P:R:S:T:V:W:Z:"
+ "a:b:f:g:j:m:n:r:s:t:z:")) != -1) {
switch (opt) {
case 'A':
gen_all_hostkeys = 1;
@@ -2260,6 +2301,11 @@
fatal("Bits has bad value %s (%s)",
optarg, errstr);
break;
+ case 'E':
+ fingerprint_hash = ssh_digest_alg_by_name(optarg);
+ if (fingerprint_hash == -1)
+ fatal("Invalid hash algorithm \"%s\"", optarg);
+ break;
case 'F':
find_host = 1;
rr_hostname = optarg;
@@ -2270,12 +2316,6 @@
case 'I':
cert_key_id = optarg;
break;
- case 'J':
- lines_to_process = strtoul(optarg, NULL, 10);
- break;
- case 'j':
- start_lineno = strtoul(optarg, NULL, 10);
- break;
case 'R':
delete_host = 1;
rr_hostname = optarg;
@@ -2317,8 +2357,8 @@
change_comment = 1;
break;
case 'f':
- if (strlcpy(identity_file, optarg, sizeof(identity_file)) >=
- sizeof(identity_file))
+ if (strlcpy(identity_file, optarg,
+ sizeof(identity_file)) >= sizeof(identity_file))
fatal("Identity filename too long");
have_identity = 1;
break;
@@ -2390,6 +2430,24 @@
case 'r':
rr_hostname = optarg;
break;
+ case 'a':
+ rounds = (int)strtonum(optarg, 1, INT_MAX, &errstr);
+ if (errstr)
+ fatal("Invalid number: %s (%s)",
+ optarg, errstr);
+ break;
+ case 'V':
+ parse_cert_times(optarg);
+ break;
+ case 'z':
+ errno = 0;
+ cert_serial = strtoull(optarg, &ep, 10);
+ if (*optarg < '0' || *optarg > '9' || *ep != '\0' ||
+ (errno == ERANGE && cert_serial == ULLONG_MAX))
+ fatal("Invalid serial number \"%s\"", optarg);
+ break;
+#ifdef WITH_OPENSSL
+ /* Moduli generation/screening */
case 'W':
generator_wanted = (u_int32_t)strtonum(optarg, 1,
UINT_MAX, &errstr);
@@ -2397,12 +2455,6 @@
fatal("Desired generator has bad value: %s (%s)",
optarg, errstr);
break;
- case 'a':
- rounds = (int)strtonum(optarg, 1, INT_MAX, &errstr);
- if (errstr)
- fatal("Invalid number: %s (%s)",
- optarg, errstr);
- break;
case 'M':
memory = (u_int32_t)strtonum(optarg, 1, UINT_MAX, &errstr);
if (errstr)
@@ -2421,7 +2473,7 @@
fatal("Output filename too long");
break;
case 'K':
- if (strlen(optarg) >= MAXPATHLEN)
+ if (strlen(optarg) >= PATH_MAX)
fatal("Checkpoint filename too long");
checkpoint = xstrdup(optarg);
break;
@@ -2430,16 +2482,7 @@
if (BN_hex2bn(&start, optarg) == 0)
fatal("Invalid start point.");
break;
- case 'V':
- parse_cert_times(optarg);
- break;
- case 'z':
- errno = 0;
- cert_serial = strtoull(optarg, &ep, 10);
- if (*optarg < '0' || *optarg > '9' || *ep != '\0' ||
- (errno == ERANGE && cert_serial == ULLONG_MAX))
- fatal("Invalid serial number \"%s\"", optarg);
- break;
+#endif /* WITH_OPENSSL */
case '?':
default:
usage();
@@ -2454,19 +2497,19 @@
if (ca_key_path != NULL) {
if (argc < 1 && !gen_krl) {
- printf("Too few arguments.\n");
+ error("Too few arguments.");
usage();
}
} else if (argc > 0 && !gen_krl && !check_krl) {
- printf("Too many arguments.\n");
+ error("Too many arguments.");
usage();
}
if (change_passphrase && change_comment) {
- printf("Can only have one of -p and -c.\n");
+ error("Can only have one of -p and -c.");
usage();
}
if (print_fingerprint && (delete_host || hash_hosts)) {
- printf("Cannot use -l with -H or -R.\n");
+ error("Cannot use -l with -H or -R.");
usage();
}
if (gen_krl) {
@@ -2494,10 +2537,12 @@
do_change_passphrase(pw);
if (change_comment)
do_change_comment(pw);
+#ifdef WITH_OPENSSL
if (convert_to)
do_convert_to(pw);
if (convert_from)
do_convert_from(pw);
+#endif
if (print_public)
do_print_public(pw);
if (rr_hostname != NULL) {
@@ -2506,10 +2551,8 @@
if (have_identity) {
n = do_print_resource_record(pw,
identity_file, rr_hostname);
- if (n == 0) {
- perror(identity_file);
- exit(1);
- }
+ if (n == 0)
+ fatal("%s: %s", identity_file, strerror(errno));
exit(0);
} else {
@@ -2519,7 +2562,8 @@
_PATH_HOST_DSA_KEY_FILE, rr_hostname);
n += do_print_resource_record(pw,
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname);
-
+ n += do_print_resource_record(pw,
+ _PATH_HOST_ED25519_KEY_FILE, rr_hostname);
if (n == 0)
fatal("no keys found.");
exit(0);
@@ -2526,6 +2570,7 @@
}
}
+#ifdef WITH_OPENSSL
if (do_gen_candidates) {
FILE *out = fopen(out_file, "w");
@@ -2565,6 +2610,7 @@
fatal("modulus screening failed");
return (0);
}
+#endif
if (gen_all_hostkeys) {
do_gen_all_hostkeys(pw);
@@ -2572,19 +2618,18 @@
}
if (key_type_name == NULL)
- key_type_name = "rsa";
+ key_type_name = DEFAULT_KEY_TYPE_NAME;
- type = key_type_from_name(key_type_name);
- type_bits_valid(type, &bits);
+ type = sshkey_type_from_name(key_type_name);
+ type_bits_valid(type, key_type_name, &bits);
if (!quiet)
- printf("Generating public/private %s key pair.\n", key_type_name);
- private = key_generate(type, bits);
- if (private == NULL) {
- fprintf(stderr, "key_generate failed\n");
- exit(1);
- }
- public = key_from_private(private);
+ printf("Generating public/private %s key pair.\n",
+ key_type_name);
+ if ((r = sshkey_generate(type, bits, &private)) != 0)
+ fatal("key_generate failed");
+ if ((r = sshkey_from_private(private, &public)) != 0)
+ fatal("key_from_private failed: %s\n", ssh_err(r));
if (!have_identity)
ask_filename(pw, "Enter file in which to save the key");
@@ -2652,9 +2697,10 @@
}
/* Save the key with the given passphrase and comment. */
- if (!key_save_private(private, identity_file, passphrase1, comment,
- use_new_format, new_format_cipher, rounds)) {
- printf("Saving the key failed: %s.\n", identity_file);
+ if ((r = sshkey_save_private(private, identity_file, passphrase1,
+ comment, use_new_format, new_format_cipher, rounds)) != 0) {
+ error("Saving key \"%s\" failed: %s",
+ identity_file, ssh_err(r));
explicit_bzero(passphrase1, strlen(passphrase1));
free(passphrase1);
exit(1);
@@ -2664,31 +2710,29 @@
free(passphrase1);
/* Clear the private key and the random number generator. */
- key_free(private);
+ sshkey_free(private);
if (!quiet)
printf("Your identification has been saved in %s.\n", identity_file);
strlcat(identity_file, ".pub", sizeof(identity_file));
- fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
- if (fd == -1) {
- printf("Could not save your public key in %s\n", identity_file);
- exit(1);
- }
- f = fdopen(fd, "w");
- if (f == NULL) {
- printf("fdopen %s failed\n", identity_file);
- exit(1);
- }
- if (!key_write(public, f))
- fprintf(stderr, "write key failed\n");
+ if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
+ fatal("Unable to save public key to %s: %s",
+ identity_file, strerror(errno));
+ if ((f = fdopen(fd, "w")) == NULL)
+ fatal("fdopen %s failed: %s", identity_file, strerror(errno));
+ if ((r = sshkey_write(public, f)) != 0)
+ error("write key failed: %s", ssh_err(r));
fprintf(f, " %s\n", comment);
fclose(f);
if (!quiet) {
- char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);
- char *ra = key_fingerprint(public, SSH_FP_MD5,
+ fp = sshkey_fingerprint(public, fingerprint_hash,
+ SSH_FP_DEFAULT);
+ ra = sshkey_fingerprint(public, fingerprint_hash,
SSH_FP_RANDOMART);
+ if (fp == NULL || ra == NULL)
+ fatal("sshkey_fingerprint failed");
printf("Your public key has been saved in %s.\n",
identity_file);
printf("The key fingerprint is:\n");
@@ -2699,6 +2743,6 @@
free(fp);
}
- key_free(public);
+ sshkey_free(public);
exit(0);
}
Modified: trunk/crypto/openssh/ssh-keyscan.0
===================================================================
--- trunk/crypto/openssh/ssh-keyscan.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keyscan.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,10 +1,10 @@
-SSH-KEYSCAN(1) OpenBSD Reference Manual SSH-KEYSCAN(1)
+SSH-KEYSCAN(1) General Commands Manual SSH-KEYSCAN(1)
NAME
- ssh-keyscan - gather ssh public keys
+ ssh-keyscan M-bM-^@M-^S gather ssh public keys
SYNOPSIS
- ssh-keyscan [-46Hv] [-f file] [-p port] [-T timeout] [-t type]
+ ssh-keyscan [-46cHv] [-f file] [-p port] [-T timeout] [-t type]
[host | addrlist namelist] ...
DESCRIPTION
@@ -26,11 +26,12 @@
-6 Forces ssh-keyscan to use IPv6 addresses only.
+ -c Request certificates from target hosts instead of plain keys.
+
-f file
- Read hosts or ``addrlist namelist'' pairs from file, one per
- line. If - is supplied instead of a filename, ssh-keyscan will
- read hosts or ``addrlist namelist'' pairs from the standard
- input.
+ Read hosts or M-bM-^@M-^\addrlist namelistM-bM-^@M-^] pairs from file, one per line.
+ If - is supplied instead of a filename, ssh-keyscan will read
+ hosts or M-bM-^@M-^\addrlist namelistM-bM-^@M-^] pairs from the standard input.
-H Hash all hostnames and addresses in the output. Hashed names may
be used normally by ssh and sshd, but they do not reveal
@@ -48,10 +49,10 @@
-t type
Specifies the type of the key to fetch from the scanned hosts.
- The possible values are ``rsa1'' for protocol version 1 and
- ``dsa'', ``ecdsa'', ``ed25519'', or ``rsa'' for protocol version
- 2. Multiple values may be specified by separating them with
- commas. The default is to fetch ``rsa'' and ``ecdsa'' keys.
+ The possible values are M-bM-^@M-^\rsa1M-bM-^@M-^] for protocol version 1 and M-bM-^@M-^\dsaM-bM-^@M-^],
+ M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ed25519M-bM-^@M-^], or M-bM-^@M-^\rsaM-bM-^@M-^] for protocol version 2. Multiple
+ values may be specified by separating them with commas. The
+ default is to fetch M-bM-^@M-^\rsaM-bM-^@M-^], M-bM-^@M-^\ecdsaM-bM-^@M-^], and M-bM-^@M-^\ed25519M-bM-^@M-^] keys.
-v Verbose mode. Causes ssh-keyscan to print debugging messages
about its progress.
@@ -69,16 +70,16 @@
1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4
- Output format for rsa1 keys:
+ Output format for RSA1 keys:
host-or-namelist bits exponent modulus
- Output format for rsa, dsa and ecdsa keys:
+ Output format for RSA, DSA, ECDSA, and Ed25519 keys:
host-or-namelist keytype base64-encoded-key
- Where keytype is either ``ecdsa-sha2-nistp256'', ``ecdsa-sha2-nistp384'',
- ``ecdsa-sha2-nistp521'', ``ssh-ed25519'', ``ssh-dss'' or ``ssh-rsa''.
+ Where keytype is either M-bM-^@M-^\ecdsa-sha2-nistp256M-bM-^@M-^], M-bM-^@M-^\ecdsa-sha2-nistp384M-bM-^@M-^],
+ M-bM-^@M-^\ecdsa-sha2-nistp521M-bM-^@M-^], M-bM-^@M-^\ssh-ed25519M-bM-^@M-^], M-bM-^@M-^\ssh-dssM-bM-^@M-^] or M-bM-^@M-^\ssh-rsaM-bM-^@M-^].
/etc/ssh/ssh_known_hosts
@@ -90,7 +91,7 @@
Find all hosts from the file ssh_hosts which have new or different keys
from those in the sorted file ssh_known_hosts:
- $ ssh-keyscan -t rsa,dsa,ecdsa -f ssh_hosts | \
+ $ ssh-keyscan -t rsa,dsa,ecdsa,ed25519 -f ssh_hosts | \
sort -u - ssh_known_hosts | diff ssh_known_hosts -
SEE ALSO
@@ -107,4 +108,4 @@
This is because it opens a connection to the ssh port, reads the public
key, and drops the connection as soon as it gets the key.
-OpenBSD 5.5 January 28, 2014 OpenBSD 5.5
+OpenBSD 6.0 November 8, 2015 OpenBSD 6.0
Modified: trunk/crypto/openssh/ssh-keyscan.1
===================================================================
--- trunk/crypto/openssh/ssh-keyscan.1 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keyscan.1 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keyscan.1,v 1.34 2014/01/28 14:13:39 jmc Exp $
+.\" $OpenBSD: ssh-keyscan.1,v 1.38 2015/11/08 23:24:03 jmc Exp $
.\"
.\" Copyright 1995, 1996 by David Mazieres <dm at lcs.mit.edu>.
.\"
@@ -6,7 +6,7 @@
.\" permitted provided that due credit is given to the author and the
.\" OpenBSD project by leaving this copyright notice intact.
.\"
-.Dd $Mdocdate: January 28 2014 $
+.Dd $Mdocdate: November 8 2015 $
.Dt SSH-KEYSCAN 1
.Os
.Sh NAME
@@ -15,7 +15,7 @@
.Sh SYNOPSIS
.Nm ssh-keyscan
.Bk -words
-.Op Fl 46Hv
+.Op Fl 46cHv
.Op Fl f Ar file
.Op Fl p Ar port
.Op Fl T Ar timeout
@@ -54,6 +54,8 @@
Forces
.Nm
to use IPv6 addresses only.
+.It Fl c
+Request certificates from target hosts instead of plain keys.
.It Fl f Ar file
Read hosts or
.Dq addrlist namelist
@@ -98,9 +100,10 @@
for protocol version 2.
Multiple values may be specified by separating them with commas.
The default is to fetch
-.Dq rsa
+.Dq rsa ,
+.Dq ecdsa ,
and
-.Dq ecdsa
+.Dq ed25519
keys.
.It Fl v
Verbose mode.
@@ -124,12 +127,12 @@
1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4
.Ed
.Pp
-Output format for rsa1 keys:
+Output format for RSA1 keys:
.Bd -literal
host-or-namelist bits exponent modulus
.Ed
.Pp
-Output format for rsa, dsa and ecdsa keys:
+Output format for RSA, DSA, ECDSA, and Ed25519 keys:
.Bd -literal
host-or-namelist keytype base64-encoded-key
.Ed
@@ -158,7 +161,7 @@
which have new or different keys from those in the sorted file
.Pa ssh_known_hosts :
.Bd -literal
-$ ssh-keyscan -t rsa,dsa,ecdsa -f ssh_hosts | \e
+$ ssh-keyscan -t rsa,dsa,ecdsa,ed25519 -f ssh_hosts | \e
sort -u - ssh_known_hosts | diff ssh_known_hosts -
.Ed
.Sh SEE ALSO
Modified: trunk/crypto/openssh/ssh-keyscan.c
===================================================================
--- trunk/crypto/openssh/ssh-keyscan.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keyscan.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keyscan.c,v 1.89 2013/12/06 13:39:49 markus Exp $ */
+/* $OpenBSD: ssh-keyscan.c,v 1.106 2016/05/02 10:26:04 djm Exp $ */
/*
* Copyright 1995, 1996 by David Mazieres <dm at lcs.mit.edu>.
*
@@ -9,6 +9,7 @@
#include "includes.h"
+#include <sys/types.h>
#include "openbsd-compat/sys-queue.h"
#include <sys/resource.h>
#ifdef HAVE_SYS_TIME_H
@@ -22,7 +23,6 @@
#include <netdb.h>
#include <errno.h>
-#include <setjmp.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
@@ -33,8 +33,8 @@
#include "xmalloc.h"
#include "ssh.h"
#include "ssh1.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshbuf.h"
+#include "sshkey.h"
#include "cipher.h"
#include "kex.h"
#include "compat.h"
@@ -45,6 +45,8 @@
#include "atomicio.h"
#include "misc.h"
#include "hostfile.h"
+#include "ssherr.h"
+#include "ssh_api.h"
/* Flag indicating whether IPv4 or IPv6. This can be set on the command line.
Default value is AF_UNSPEC means both IPv4 and IPv6. */
@@ -58,7 +60,8 @@
#define KT_ECDSA 8
#define KT_ED25519 16
-int get_keytypes = KT_RSA|KT_ECDSA;/* Get RSA and ECDSA keys by default */
+int get_cert = 0;
+int get_keytypes = KT_RSA|KT_ECDSA|KT_ED25519;
int hash_hosts = 0; /* Hash hostname on output */
@@ -74,10 +77,9 @@
fd_set *read_wait;
size_t read_wait_nfdset;
int ncon;
-int nonfatal_fatal = 0;
-jmp_buf kexjmp;
-Key *kexjmp_key;
+struct ssh *active_state = NULL; /* XXX needed for linking */
+
/*
* Keep a connection structure for each file descriptor. The state
* associated with file descriptor n is held in fdcon[n].
@@ -93,12 +95,13 @@
int c_len; /* Total bytes which must be read. */
int c_off; /* Length of data read so far. */
int c_keytype; /* Only one of KT_RSA1, KT_DSA, or KT_RSA */
+ sig_atomic_t c_done; /* SSH2 done */
char *c_namebase; /* Address to free for c_name and c_namelist */
char *c_name; /* Hostname of connection for errors */
char *c_namelist; /* Pointer to other possible addresses */
char *c_output_name; /* Hostname of connection for output */
char *c_data; /* Data read from this fd */
- Kex *c_kex; /* The key-exchange struct for ssh2 */
+ struct ssh *c_ssh; /* SSH-connection */
struct timeval c_tv; /* Time at which connection gets aborted */
TAILQ_ENTRY(Connection) c_link; /* List of connections in timeout order. */
} con;
@@ -106,6 +109,8 @@
TAILQ_HEAD(conlist, Connection) tq; /* Timeout Queue */
con *fdcon;
+static void keyprint(con *c, struct sshkey *key);
+
static int
fdlim_get(int hard)
{
@@ -182,45 +187,62 @@
return (tok);
}
-static Key *
+#ifdef WITH_SSH1
+static struct sshkey *
keygrab_ssh1(con *c)
{
- static Key *rsa;
- static Buffer msg;
+ static struct sshkey *rsa;
+ static struct sshbuf *msg;
+ int r;
+ u_char type;
if (rsa == NULL) {
- buffer_init(&msg);
- rsa = key_new(KEY_RSA1);
+ if ((rsa = sshkey_new(KEY_RSA1)) == NULL) {
+ error("%s: sshkey_new failed", __func__);
+ return NULL;
+ }
+ if ((msg = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
}
- buffer_append(&msg, c->c_data, c->c_plen);
- buffer_consume(&msg, 8 - (c->c_plen & 7)); /* padding */
- if (buffer_get_char(&msg) != (int) SSH_SMSG_PUBLIC_KEY) {
+ if ((r = sshbuf_put(msg, c->c_data, c->c_plen)) != 0 ||
+ (r = sshbuf_consume(msg, 8 - (c->c_plen & 7))) != 0 || /* padding */
+ (r = sshbuf_get_u8(msg, &type)) != 0)
+ goto buf_err;
+ if (type != (int) SSH_SMSG_PUBLIC_KEY) {
error("%s: invalid packet type", c->c_name);
- buffer_clear(&msg);
+ sshbuf_reset(msg);
return NULL;
}
- buffer_consume(&msg, 8); /* cookie */
+ if ((r = sshbuf_consume(msg, 8)) != 0 || /* cookie */
+ /* server key */
+ (r = sshbuf_get_u32(msg, NULL)) != 0 ||
+ (r = sshbuf_get_bignum1(msg, NULL)) != 0 ||
+ (r = sshbuf_get_bignum1(msg, NULL)) != 0 ||
+ /* host key */
+ (r = sshbuf_get_u32(msg, NULL)) != 0 ||
+ (r = sshbuf_get_bignum1(msg, rsa->rsa->e)) != 0 ||
+ (r = sshbuf_get_bignum1(msg, rsa->rsa->n)) != 0) {
+ buf_err:
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ sshbuf_reset(msg);
+ return NULL;
+ }
- /* server key */
- (void) buffer_get_int(&msg);
- buffer_get_bignum(&msg, rsa->rsa->e);
- buffer_get_bignum(&msg, rsa->rsa->n);
+ sshbuf_reset(msg);
- /* host key */
- (void) buffer_get_int(&msg);
- buffer_get_bignum(&msg, rsa->rsa->e);
- buffer_get_bignum(&msg, rsa->rsa->n);
-
- buffer_clear(&msg);
-
return (rsa);
}
+#endif
static int
-hostjump(Key *hostkey)
+key_print_wrapper(struct sshkey *hostkey, struct ssh *ssh)
{
- kexjmp_key = hostkey;
- longjmp(kexjmp, 1);
+ con *c;
+
+ if ((c = ssh_get_app_data(ssh)) != NULL)
+ keyprint(c, hostkey);
+ /* always abort key exchange */
+ return -1;
}
static int
@@ -239,56 +261,99 @@
return 0;
}
-static Key *
+static void
keygrab_ssh2(con *c)
{
- int j;
+ char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
+ int r;
- packet_set_connection(c->c_fd, c->c_fd);
enable_compat20();
- myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
- c->c_keytype == KT_DSA ? "ssh-dss" :
- (c->c_keytype == KT_RSA ? "ssh-rsa" :
- (c->c_keytype == KT_ED25519 ? "ssh-ed25519" :
- "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521"));
- c->c_kex = kex_setup(myproposal);
- c->c_kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
- c->c_kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
- c->c_kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
- c->c_kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
- c->c_kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
- c->c_kex->kex[KEX_C25519_SHA256] = kexc25519_client;
- c->c_kex->verify_host_key = hostjump;
-
- if (!(j = setjmp(kexjmp))) {
- nonfatal_fatal = 1;
- dispatch_run(DISPATCH_BLOCK, &c->c_kex->done, c->c_kex);
- fprintf(stderr, "Impossible! dispatch_run() returned!\n");
+ switch (c->c_keytype) {
+ case KT_DSA:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "ssh-dss-cert-v01 at openssh.com" : "ssh-dss";
+ break;
+ case KT_RSA:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "ssh-rsa-cert-v01 at openssh.com" : "ssh-rsa";
+ break;
+ case KT_ED25519:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "ssh-ed25519-cert-v01 at openssh.com" : "ssh-ed25519";
+ break;
+ case KT_ECDSA:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "ecdsa-sha2-nistp256-cert-v01 at openssh.com,"
+ "ecdsa-sha2-nistp384-cert-v01 at openssh.com,"
+ "ecdsa-sha2-nistp521-cert-v01 at openssh.com" :
+ "ecdsa-sha2-nistp256,"
+ "ecdsa-sha2-nistp384,"
+ "ecdsa-sha2-nistp521";
+ break;
+ default:
+ fatal("unknown key type %d", c->c_keytype);
+ break;
+ }
+ if ((r = kex_setup(c->c_ssh, myproposal)) != 0) {
+ free(c->c_ssh);
+ fprintf(stderr, "kex_setup: %s\n", ssh_err(r));
exit(1);
}
- nonfatal_fatal = 0;
- free(c->c_kex);
- c->c_kex = NULL;
- packet_close();
-
- return j < 0? NULL : kexjmp_key;
+#ifdef WITH_OPENSSL
+ c->c_ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
+ c->c_ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
+ c->c_ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_client;
+ c->c_ssh->kex->kex[KEX_DH_GRP16_SHA512] = kexdh_client;
+ c->c_ssh->kex->kex[KEX_DH_GRP18_SHA512] = kexdh_client;
+ c->c_ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
+ c->c_ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
+# ifdef OPENSSL_HAS_ECC
+ c->c_ssh->kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
+# endif
+#endif
+ c->c_ssh->kex->kex[KEX_C25519_SHA256] = kexc25519_client;
+ ssh_set_verify_host_key_callback(c->c_ssh, key_print_wrapper);
+ /*
+ * do the key-exchange until an error occurs or until
+ * the key_print_wrapper() callback sets c_done.
+ */
+ ssh_dispatch_run(c->c_ssh, DISPATCH_BLOCK, &c->c_done, c->c_ssh);
}
static void
-keyprint(con *c, Key *key)
+keyprint_one(char *host, struct sshkey *key)
{
- char *host = c->c_output_name ? c->c_output_name : c->c_name;
+ char *hostport;
- if (!key)
- return;
if (hash_hosts && (host = host_hash(host, NULL, 0)) == NULL)
fatal("host_hash failed");
- fprintf(stdout, "%s ", host);
- key_write(key, stdout);
+ hostport = put_host_port(host, ssh_port);
+ if (!get_cert)
+ fprintf(stdout, "%s ", hostport);
+ sshkey_write(key, stdout);
fputs("\n", stdout);
+ free(hostport);
}
+static void
+keyprint(con *c, struct sshkey *key)
+{
+ char *hosts = c->c_output_name ? c->c_output_name : c->c_name;
+ char *host, *ohosts;
+
+ if (key == NULL)
+ return;
+ if (get_cert || (!hash_hosts && ssh_port == SSH_DEFAULT_PORT)) {
+ keyprint_one(hosts, key);
+ return;
+ }
+ ohosts = hosts = xstrdup(hosts);
+ while ((host = strsep(&hosts, ",")) != NULL)
+ keyprint_one(host, key);
+ free(ohosts);
+}
+
static int
tcpconnect(char *host)
{
@@ -300,8 +365,10 @@
memset(&hints, 0, sizeof(hints));
hints.ai_family = IPv4or6;
hints.ai_socktype = SOCK_STREAM;
- if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
- fatal("getaddrinfo %s: %s", host, ssh_gai_strerror(gaierr));
+ if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
+ error("getaddrinfo %s: %s", host, ssh_gai_strerror(gaierr));
+ return -1;
+ }
for (ai = aitop; ai; ai = ai->ai_next) {
s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
if (s < 0) {
@@ -343,6 +410,7 @@
if (fdcon[s].c_status)
fatal("conalloc: attempt to reuse fdno %d", s);
+ debug3("%s: oname %s kt %d", __func__, oname, keytype);
fdcon[s].c_fd = s;
fdcon[s].c_status = CS_CON;
fdcon[s].c_namebase = namebase;
@@ -373,6 +441,11 @@
free(fdcon[s].c_data);
fdcon[s].c_status = CS_UNUSED;
fdcon[s].c_keytype = 0;
+ if (fdcon[s].c_ssh) {
+ ssh_packet_close(fdcon[s].c_ssh);
+ free(fdcon[s].c_ssh);
+ fdcon[s].c_ssh = NULL;
+ }
TAILQ_REMOVE(&tq, &fdcon[s], c_link);
FD_CLR(s, read_wait);
ncon--;
@@ -440,11 +513,15 @@
return;
}
*cp = '\0';
+ if ((c->c_ssh = ssh_packet_set_connection(NULL, s, s)) == NULL)
+ fatal("ssh_packet_set_connection failed");
+ ssh_packet_set_timeout(c->c_ssh, timeout, 1);
+ ssh_set_app_data(c->c_ssh, c); /* back link */
if (sscanf(buf, "SSH-%d.%d-%[^\n]\n",
&remote_major, &remote_minor, remote_version) == 3)
- compat_datafellows(remote_version);
+ c->c_ssh->compat = compat_datafellows(remote_version);
else
- datafellows = 0;
+ c->c_ssh->compat = 0;
if (c->c_keytype != KT_RSA1) {
if (!ssh2_capable(remote_major, remote_minor)) {
debug("%s doesn't support ssh2", c->c_name);
@@ -456,7 +533,7 @@
confree(s);
return;
}
- fprintf(stderr, "# %s %s\n", c->c_name, chop(buf));
+ fprintf(stderr, "# %s:%d %s\n", c->c_name, ssh_port, chop(buf));
n = snprintf(buf, sizeof buf, "SSH-%d.%d-OpenSSH-keyscan\r\n",
c->c_keytype == KT_RSA1? PROTOCOL_MAJOR_1 : PROTOCOL_MAJOR_2,
c->c_keytype == KT_RSA1? PROTOCOL_MINOR_1 : PROTOCOL_MINOR_2);
@@ -471,7 +548,7 @@
return;
}
if (c->c_keytype != KT_RSA1) {
- keyprint(c, keygrab_ssh2(c));
+ keygrab_ssh2(c);
confree(s);
return;
}
@@ -506,10 +583,12 @@
c->c_data = xmalloc(c->c_len);
c->c_status = CS_KEYS;
break;
+#ifdef WITH_SSH1
case CS_KEYS:
keyprint(c, keygrab_ssh1(c));
confree(s);
return;
+#endif
default:
fatal("conread: invalid status %d", c->c_status);
break;
@@ -595,10 +674,7 @@
va_start(args, fmt);
do_log(SYSLOG_LEVEL_FATAL, fmt, args);
va_end(args);
- if (nonfatal_fatal)
- longjmp(kexjmp, -1);
- else
- exit(255);
+ exit(255);
}
static void
@@ -605,7 +681,7 @@
usage(void)
{
fprintf(stderr,
- "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]\n"
+ "usage: %s [-46cHv] [-f file] [-p port] [-T timeout] [-t type]\n"
"\t\t [host | addrlist namelist] ...\n",
__progname);
exit(1);
@@ -623,6 +699,7 @@
extern int optind;
extern char *optarg;
+ ssh_malloc_init(); /* must be called before any mallocs */
__progname = ssh_get_progname(argv[0]);
seed_rng();
TAILQ_INIT(&tq);
@@ -633,11 +710,14 @@
if (argc <= 1)
usage();
- while ((opt = getopt(argc, argv, "Hv46p:T:t:f:")) != -1) {
+ while ((opt = getopt(argc, argv, "cHv46p:T:t:f:")) != -1) {
switch (opt) {
case 'H':
hash_hosts = 1;
break;
+ case 'c':
+ get_cert = 1;
+ break;
case 'p':
ssh_port = a2port(optarg);
if (ssh_port <= 0) {
@@ -671,7 +751,7 @@
get_keytypes = 0;
tname = strtok(optarg, ",");
while (tname) {
- int type = key_type_from_name(tname);
+ int type = sshkey_type_from_name(tname);
switch (type) {
case KEY_RSA1:
get_keytypes |= KT_RSA1;
Modified: trunk/crypto/openssh/ssh-keysign.0
===================================================================
--- trunk/crypto/openssh/ssh-keysign.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keysign.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-SSH-KEYSIGN(8) OpenBSD System Manager's Manual SSH-KEYSIGN(8)
+SSH-KEYSIGN(8) System Manager's Manual SSH-KEYSIGN(8)
NAME
- ssh-keysign - ssh helper program for host-based authentication
+ ssh-keysign M-bM-^@M-^S ssh helper program for host-based authentication
SYNOPSIS
ssh-keysign
@@ -8,12 +8,11 @@
DESCRIPTION
ssh-keysign is used by ssh(1) to access the local host keys and generate
- the digital signature required during host-based authentication with SSH
- protocol version 2.
+ the digital signature required during host-based authentication.
ssh-keysign is disabled by default and can only be enabled in the global
client configuration file /etc/ssh/ssh_config by setting EnableSSHKeysign
- to ``yes''.
+ to M-bM-^@M-^\yesM-bM-^@M-^].
ssh-keysign is not intended to be invoked by the user, but from ssh(1).
See ssh(1) and sshd(8) for more information about host-based
@@ -50,4 +49,4 @@
AUTHORS
Markus Friedl <markus at openbsd.org>
-OpenBSD 5.5 December 7, 2013 OpenBSD 5.5
+OpenBSD 6.0 February 17, 2016 OpenBSD 6.0
Modified: trunk/crypto/openssh/ssh-keysign.8
===================================================================
--- trunk/crypto/openssh/ssh-keysign.8 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keysign.8 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keysign.8,v 1.14 2013/12/07 11:58:46 naddy Exp $
+.\" $OpenBSD: ssh-keysign.8,v 1.15 2016/02/17 07:38:19 jmc Exp $
.\"
.\" Copyright (c) 2002 Markus Friedl. All rights reserved.
.\"
@@ -22,7 +22,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: December 7 2013 $
+.Dd $Mdocdate: February 17 2016 $
.Dt SSH-KEYSIGN 8
.Os
.Sh NAME
@@ -35,7 +35,7 @@
is used by
.Xr ssh 1
to access the local host keys and generate the digital signature
-required during host-based authentication with SSH protocol version 2.
+required during host-based authentication.
.Pp
.Nm
is disabled by default and can only be enabled in the
Modified: trunk/crypto/openssh/ssh-keysign.c
===================================================================
--- trunk/crypto/openssh/ssh-keysign.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-keysign.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keysign.c,v 1.39 2013/12/06 13:39:49 markus Exp $ */
+/* $OpenBSD: ssh-keysign.c,v 1.52 2016/02/15 09:47:49 dtucker Exp $ */
/*
* Copyright (c) 2002 Markus Friedl. All rights reserved.
*
@@ -34,18 +34,21 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <errno.h>
+#ifdef WITH_OPENSSL
#include <openssl/evp.h>
#include <openssl/rand.h>
#include <openssl/rsa.h>
+#endif
#include "xmalloc.h"
#include "log.h"
-#include "key.h"
+#include "sshkey.h"
#include "ssh.h"
#include "ssh2.h"
#include "misc.h"
-#include "buffer.h"
+#include "sshbuf.h"
#include "authfile.h"
#include "msg.h"
#include "canohost.h"
@@ -52,7 +55,13 @@
#include "pathnames.h"
#include "readconf.h"
#include "uidswap.h"
+#include "sshkey.h"
+#include "ssherr.h"
+struct ssh *active_state = NULL; /* XXX needed for linking */
+
+extern char *__progname;
+
/* XXX readconf.c needs these */
uid_t original_real_uid;
@@ -59,62 +68,73 @@
extern char *__progname;
static int
-valid_request(struct passwd *pw, char *host, Key **ret, u_char *data,
- u_int datalen)
+valid_request(struct passwd *pw, char *host, struct sshkey **ret,
+ u_char *data, size_t datalen)
{
- Buffer b;
- Key *key = NULL;
- u_char *pkblob;
- u_int blen, len;
- char *pkalg, *p;
- int pktype, fail;
+ struct sshbuf *b;
+ struct sshkey *key = NULL;
+ u_char type, *pkblob;
+ char *p;
+ size_t blen, len;
+ char *pkalg, *luser;
+ int r, pktype, fail;
+ if (ret != NULL)
+ *ret = NULL;
fail = 0;
- buffer_init(&b);
- buffer_append(&b, data, datalen);
+ if ((b = sshbuf_from(data, datalen)) == NULL)
+ fatal("%s: sshbuf_from failed", __func__);
/* session id, currently limited to SHA1 (20 bytes) or SHA256 (32) */
- p = buffer_get_string(&b, &len);
+ if ((r = sshbuf_get_string(b, NULL, &len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (len != 20 && len != 32)
fail++;
- free(p);
- if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
+ if ((r = sshbuf_get_u8(b, &type)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (type != SSH2_MSG_USERAUTH_REQUEST)
fail++;
/* server user */
- buffer_skip_string(&b);
+ if ((r = sshbuf_skip_string(b)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
/* service */
- p = buffer_get_string(&b, NULL);
+ if ((r = sshbuf_get_cstring(b, &p, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (strcmp("ssh-connection", p) != 0)
fail++;
free(p);
/* method */
- p = buffer_get_string(&b, NULL);
+ if ((r = sshbuf_get_cstring(b, &p, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
if (strcmp("hostbased", p) != 0)
fail++;
free(p);
/* pubkey */
- pkalg = buffer_get_string(&b, NULL);
- pkblob = buffer_get_string(&b, &blen);
+ if ((r = sshbuf_get_cstring(b, &pkalg, NULL)) != 0 ||
+ (r = sshbuf_get_string(b, &pkblob, &blen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
- pktype = key_type_from_name(pkalg);
+ pktype = sshkey_type_from_name(pkalg);
if (pktype == KEY_UNSPEC)
fail++;
- else if ((key = key_from_blob(pkblob, blen)) == NULL)
+ else if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+ error("%s: bad key blob: %s", __func__, ssh_err(r));
fail++;
- else if (key->type != pktype)
+ } else if (key->type != pktype)
fail++;
free(pkalg);
free(pkblob);
/* client host name, handle trailing dot */
- p = buffer_get_string(&b, &len);
- debug2("valid_request: check expect chost %s got %s", host, p);
+ if ((r = sshbuf_get_cstring(b, &p, &len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ debug2("%s: check expect chost %s got %s", __func__, host, p);
if (strlen(host) != len - 1)
fail++;
else if (p[len - 1] != '.')
@@ -124,22 +144,23 @@
free(p);
/* local user */
- p = buffer_get_string(&b, NULL);
+ if ((r = sshbuf_get_cstring(b, &luser, NULL)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
- if (strcmp(pw->pw_name, p) != 0)
+ if (strcmp(pw->pw_name, luser) != 0)
fail++;
- free(p);
+ free(luser);
/* end of message */
- if (buffer_len(&b) != 0)
+ if (sshbuf_len(b) != 0)
fail++;
- buffer_free(&b);
+ sshbuf_free(b);
- debug3("valid_request: fail %d", fail);
+ debug3("%s: fail %d", __func__, fail);
if (fail && key != NULL)
- key_free(key);
- else
+ sshkey_free(key);
+ else if (ret != NULL)
*ret = key;
return (fail ? -1 : 0);
@@ -148,17 +169,23 @@
int
main(int argc, char **argv)
{
- Buffer b;
+ struct sshbuf *b;
Options options;
#define NUM_KEYTYPES 4
- Key *keys[NUM_KEYTYPES], *key = NULL;
+ struct sshkey *keys[NUM_KEYTYPES], *key = NULL;
struct passwd *pw;
- int key_fd[NUM_KEYTYPES], i, found, version = 2, fd;
- u_char *signature, *data;
- char *host;
- u_int slen, dlen;
+ int r, key_fd[NUM_KEYTYPES], i, found, version = 2, fd;
+ u_char *signature, *data, rver;
+ char *host, *fp;
+ size_t slen, dlen;
+#ifdef WITH_OPENSSL
u_int32_t rnd[256];
+#endif
+ ssh_malloc_init(); /* must be called before any mallocs */
+ if (pledge("stdio rpath getpw dns id", NULL) != 0)
+ fatal("%s: pledge: %s", __progname, strerror(errno));
+
/* Ensure that stdin and stdout are connected */
if ((fd = open(_PATH_DEVNULL, O_RDWR)) < 2)
exit(1);
@@ -167,6 +194,7 @@
close(fd);
i = 0;
+ /* XXX This really needs to read sshd_config for the paths */
key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY);
key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY);
@@ -187,7 +215,7 @@
/* verify that ssh-keysign is enabled by the admin */
initialize_options(&options);
- (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", &options, 0);
+ (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "", &options, 0);
fill_default_options(&options);
if (options.enable_ssh_keysign != 1)
fatal("ssh-keysign not enabled in %s",
@@ -200,10 +228,11 @@
if (found == 0)
fatal("could not open any host key");
+#ifdef WITH_OPENSSL
OpenSSL_add_all_algorithms();
- for (i = 0; i < 256; i++)
- rnd[i] = arc4random();
+ arc4random_buf(rnd, sizeof(rnd));
RAND_seed(rnd, sizeof(rnd));
+#endif
found = 0;
for (i = 0; i < NUM_KEYTYPES; i++) {
@@ -210,27 +239,39 @@
keys[i] = NULL;
if (key_fd[i] == -1)
continue;
- keys[i] = key_load_private_pem(key_fd[i], KEY_UNSPEC,
- NULL, NULL);
+ r = sshkey_load_private_type_fd(key_fd[i], KEY_UNSPEC,
+ NULL, &key, NULL);
close(key_fd[i]);
- if (keys[i] != NULL)
+ if (r != 0)
+ debug("parse key %d: %s", i, ssh_err(r));
+ else if (key != NULL) {
+ keys[i] = key;
found = 1;
+ }
}
if (!found)
fatal("no hostkey found");
- buffer_init(&b);
- if (ssh_msg_recv(STDIN_FILENO, &b) < 0)
+ if (pledge("stdio dns", NULL) != 0)
+ fatal("%s: pledge: %s", __progname, strerror(errno));
+
+ if ((b = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __progname);
+ if (ssh_msg_recv(STDIN_FILENO, b) < 0)
fatal("ssh_msg_recv failed");
- if (buffer_get_char(&b) != version)
- fatal("bad version");
- fd = buffer_get_int(&b);
- if ((fd == STDIN_FILENO) || (fd == STDOUT_FILENO))
+ if ((r = sshbuf_get_u8(b, &rver)) != 0)
+ fatal("%s: buffer error: %s", __progname, ssh_err(r));
+ if (rver != version)
+ fatal("bad version: received %d, expected %d", rver, version);
+ if ((r = sshbuf_get_u32(b, (u_int *)&fd)) != 0)
+ fatal("%s: buffer error: %s", __progname, ssh_err(r));
+ if (fd < 0 || fd == STDIN_FILENO || fd == STDOUT_FILENO)
fatal("bad fd");
if ((host = get_local_name(fd)) == NULL)
fatal("cannot get local name for fd");
- data = buffer_get_string(&b, &dlen);
+ if ((r = sshbuf_get_string(b, &data, &dlen)) != 0)
+ fatal("%s: buffer error: %s", __progname, ssh_err(r));
if (valid_request(pw, host, &key, data, dlen) < 0)
fatal("not a valid request");
free(host);
@@ -238,22 +279,29 @@
found = 0;
for (i = 0; i < NUM_KEYTYPES; i++) {
if (keys[i] != NULL &&
- key_equal_public(key, keys[i])) {
+ sshkey_equal_public(key, keys[i])) {
found = 1;
break;
}
}
- if (!found)
- fatal("no matching hostkey found");
+ if (!found) {
+ if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL)
+ fatal("%s: sshkey_fingerprint failed", __progname);
+ fatal("no matching hostkey found for key %s %s",
+ sshkey_type(key), fp ? fp : "");
+ }
- if (key_sign(keys[i], &signature, &slen, data, dlen) != 0)
- fatal("key_sign failed");
+ if ((r = sshkey_sign(keys[i], &signature, &slen, data, dlen, NULL, 0))
+ != 0)
+ fatal("sshkey_sign failed: %s", ssh_err(r));
free(data);
/* send reply */
- buffer_clear(&b);
- buffer_put_string(&b, signature, slen);
- if (ssh_msg_send(STDOUT_FILENO, version, &b) == -1)
+ sshbuf_reset(b);
+ if ((r = sshbuf_put_string(b, signature, slen)) != 0)
+ fatal("%s: buffer error: %s", __progname, ssh_err(r));
+ if (ssh_msg_send(STDOUT_FILENO, version, b) == -1)
fatal("ssh_msg_send failed");
return (0);
Modified: trunk/crypto/openssh/ssh-pkcs11-client.c
===================================================================
--- trunk/crypto/openssh/ssh-pkcs11-client.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-pkcs11-client.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11-client.c,v 1.4 2013/05/17 00:13:14 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11-client.c,v 1.6 2015/12/11 00:20:04 mmcc Exp $ */
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
*
@@ -30,6 +30,8 @@
#include <unistd.h>
#include <errno.h>
+#include <openssl/rsa.h>
+
#include "pathnames.h"
#include "xmalloc.h"
#include "buffer.h"
@@ -171,7 +173,7 @@
close(pair[0]);
close(pair[1]);
execlp(_PATH_SSH_PKCS11_HELPER, _PATH_SSH_PKCS11_HELPER,
- (char *) 0);
+ (char *)NULL);
fprintf(stderr, "exec: %s: %s\n", _PATH_SSH_PKCS11_HELPER,
strerror(errno));
_exit(1);
Modified: trunk/crypto/openssh/ssh-pkcs11-helper.0
===================================================================
--- trunk/crypto/openssh/ssh-pkcs11-helper.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-pkcs11-helper.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-SSH-PKCS11-HELPER(8) OpenBSD System Manager's Manual SSH-PKCS11-HELPER(8)
+SSH-PKCS11-HELPER(8) System Manager's Manual SSH-PKCS11-HELPER(8)
NAME
- ssh-pkcs11-helper - ssh-agent helper program for PKCS#11 support
+ ssh-pkcs11-helper M-bM-^@M-^S ssh-agent helper program for PKCS#11 support
SYNOPSIS
ssh-pkcs11-helper
@@ -22,4 +22,4 @@
AUTHORS
Markus Friedl <markus at openbsd.org>
-OpenBSD 5.5 July 16, 2013 OpenBSD 5.5
+OpenBSD 6.0 July 16, 2013 OpenBSD 6.0
Modified: trunk/crypto/openssh/ssh-pkcs11-helper.c
===================================================================
--- trunk/crypto/openssh/ssh-pkcs11-helper.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-pkcs11-helper.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11-helper.c,v 1.7 2013/12/02 02:56:17 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11-helper.c,v 1.12 2016/02/15 09:47:49 dtucker Exp $ */
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
*
@@ -169,7 +169,7 @@
{
u_char *blob, *data, *signature = NULL;
u_int blen, dlen, slen = 0;
- int ok = -1, ret;
+ int ok = -1;
Key *key, *found;
Buffer msg;
@@ -179,6 +179,9 @@
if ((key = key_from_blob(blob, blen)) != NULL) {
if ((found = lookup_key(key)) != NULL) {
+#ifdef WITH_OPENSSL
+ int ret;
+
slen = RSA_size(key->rsa);
signature = xmalloc(slen);
if ((ret = RSA_private_encrypt(dlen, data, signature,
@@ -186,6 +189,7 @@
slen = ret;
ok = 0;
}
+#endif /* WITH_OPENSSL */
}
key_free(key);
}
@@ -276,6 +280,7 @@
extern char *__progname;
+ ssh_malloc_init(); /* must be called before any mallocs */
TAILQ_INIT(&pkcs11_keylist);
pkcs11_init(0);
@@ -297,8 +302,8 @@
buffer_init(&oqueue);
set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
- rset = (fd_set *)xmalloc(set_size);
- wset = (fd_set *)xmalloc(set_size);
+ rset = xmalloc(set_size);
+ wset = xmalloc(set_size);
for (;;) {
memset(rset, 0, set_size);
Modified: trunk/crypto/openssh/ssh-pkcs11.c
===================================================================
--- trunk/crypto/openssh/ssh-pkcs11.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-pkcs11.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.11 2013/11/13 13:48:20 markus Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.22 2016/02/12 00:20:30 djm Exp $ */
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
*
@@ -38,7 +38,7 @@
#include "log.h"
#include "misc.h"
-#include "key.h"
+#include "sshkey.h"
#include "ssh-pkcs11.h"
#include "xmalloc.h"
@@ -237,7 +237,7 @@
{CKA_ID, NULL, 0},
{CKA_SIGN, NULL, sizeof(true_val) }
};
- char *pin, prompt[1024];
+ char *pin = NULL, prompt[1024];
int rval = -1;
key_filter[0].pValue = &private_key_class;
@@ -255,21 +255,30 @@
si = &k11->provider->slotinfo[k11->slotidx];
if ((si->token.flags & CKF_LOGIN_REQUIRED) && !si->logged_in) {
if (!pkcs11_interactive) {
- error("need pin");
+ error("need pin entry%s", (si->token.flags &
+ CKF_PROTECTED_AUTHENTICATION_PATH) ?
+ " on reader keypad" : "");
return (-1);
}
- snprintf(prompt, sizeof(prompt), "Enter PIN for '%s': ",
- si->token.label);
- pin = read_passphrase(prompt, RP_ALLOW_EOF);
- if (pin == NULL)
- return (-1); /* bail out */
- if ((rv = f->C_Login(si->session, CKU_USER,
- (u_char *)pin, strlen(pin))) != CKR_OK) {
+ if (si->token.flags & CKF_PROTECTED_AUTHENTICATION_PATH)
+ verbose("Deferring PIN entry to reader keypad.");
+ else {
+ snprintf(prompt, sizeof(prompt),
+ "Enter PIN for '%s': ", si->token.label);
+ pin = read_passphrase(prompt, RP_ALLOW_EOF);
+ if (pin == NULL)
+ return (-1); /* bail out */
+ }
+ rv = f->C_Login(si->session, CKU_USER, (u_char *)pin,
+ (pin != NULL) ? strlen(pin) : 0);
+ if (pin != NULL) {
+ explicit_bzero(pin, strlen(pin));
free(pin);
+ }
+ if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
error("C_Login failed: %lu", rv);
return (-1);
}
- free(pin);
si->logged_in = 1;
}
key_filter[1].pValue = k11->keyid;
@@ -313,8 +322,10 @@
k11->slotidx = slotidx;
/* identify key object on smartcard */
k11->keyid_len = keyid_attrib->ulValueLen;
- k11->keyid = xmalloc(k11->keyid_len);
- memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
+ if (k11->keyid_len > 0) {
+ k11->keyid = xmalloc(k11->keyid_len);
+ memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
+ }
k11->orig_finish = def->finish;
memcpy(&k11->rsa_method, def, sizeof(k11->rsa_method));
k11->rsa_method.name = "pkcs11";
@@ -366,8 +377,9 @@
return (-1);
}
if (login_required && pin) {
- if ((rv = f->C_Login(session, CKU_USER,
- (u_char *)pin, strlen(pin))) != CKR_OK) {
+ rv = f->C_Login(session, CKU_USER,
+ (u_char *)pin, strlen(pin));
+ if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
error("C_Login failed: %lu", rv);
if ((rv = f->C_CloseSession(session)) != CKR_OK)
error("C_CloseSession failed: %lu", rv);
@@ -385,12 +397,12 @@
* keysp points to an (possibly empty) array with *nkeys keys.
*/
static int pkcs11_fetch_keys_filter(struct pkcs11_provider *, CK_ULONG,
- CK_ATTRIBUTE [], CK_ATTRIBUTE [3], Key ***, int *)
+ CK_ATTRIBUTE [], CK_ATTRIBUTE [3], struct sshkey ***, int *)
__attribute__((__bounded__(__minbytes__,4, 3 * sizeof(CK_ATTRIBUTE))));
static int
pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
- Key ***keysp, int *nkeys)
+ struct sshkey ***keysp, int *nkeys)
{
CK_OBJECT_CLASS pubkey_class = CKO_PUBLIC_KEY;
CK_OBJECT_CLASS cert_class = CKO_CERTIFICATE;
@@ -422,12 +434,12 @@
}
static int
-pkcs11_key_included(Key ***keysp, int *nkeys, Key *key)
+pkcs11_key_included(struct sshkey ***keysp, int *nkeys, struct sshkey *key)
{
int i;
for (i = 0; i < *nkeys; i++)
- if (key_equal(key, (*keysp)[i]))
+ if (sshkey_equal(key, (*keysp)[i]))
return (1);
return (0);
}
@@ -435,9 +447,9 @@
static int
pkcs11_fetch_keys_filter(struct pkcs11_provider *p, CK_ULONG slotidx,
CK_ATTRIBUTE filter[], CK_ATTRIBUTE attribs[3],
- Key ***keysp, int *nkeys)
+ struct sshkey ***keysp, int *nkeys)
{
- Key *key;
+ struct sshkey *key;
RSA *rsa;
X509 *x509;
EVP_PKEY *evp;
@@ -471,15 +483,23 @@
error("C_GetAttributeValue failed: %lu", rv);
continue;
}
- /* check that none of the attributes are zero length */
- if (attribs[0].ulValueLen == 0 ||
- attribs[1].ulValueLen == 0 ||
+ /*
+ * Allow CKA_ID (always first attribute) to be empty, but
+ * ensure that none of the others are zero length.
+ * XXX assumes CKA_ID is always first.
+ */
+ if (attribs[1].ulValueLen == 0 ||
attribs[2].ulValueLen == 0) {
continue;
}
/* allocate buffers for attributes */
- for (i = 0; i < 3; i++)
- attribs[i].pValue = xmalloc(attribs[i].ulValueLen);
+ for (i = 0; i < 3; i++) {
+ if (attribs[i].ulValueLen > 0) {
+ attribs[i].pValue = xmalloc(
+ attribs[i].ulValueLen);
+ }
+ }
+
/*
* retrieve ID, modulus and public exponent of RSA key,
* or ID, subject and value for certificates.
@@ -517,16 +537,16 @@
}
if (rsa && rsa->n && rsa->e &&
pkcs11_rsa_wrap(p, slotidx, &attribs[0], rsa) == 0) {
- key = key_new(KEY_UNSPEC);
+ key = sshkey_new(KEY_UNSPEC);
key->rsa = rsa;
key->type = KEY_RSA;
- key->flags |= KEY_FLAG_EXT;
+ key->flags |= SSHKEY_FLAG_EXT;
if (pkcs11_key_included(keysp, nkeys, key)) {
- key_free(key);
+ sshkey_free(key);
} else {
/* expand key array and add key */
- *keysp = xrealloc(*keysp, *nkeys + 1,
- sizeof(Key *));
+ *keysp = xreallocarray(*keysp, *nkeys + 1,
+ sizeof(struct sshkey *));
(*keysp)[*nkeys] = key;
*nkeys = *nkeys + 1;
debug("have %d keys", *nkeys);
@@ -544,7 +564,7 @@
/* register a new provider, fails if provider already exists */
int
-pkcs11_add_provider(char *provider_id, char *pin, Key ***keyp)
+pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp)
{
int nkeys, need_finalize = 0;
struct pkcs11_provider *p = NULL;
@@ -621,6 +641,11 @@
error("C_GetTokenInfo failed: %lu", rv);
continue;
}
+ if ((token->flags & CKF_TOKEN_INITIALIZED) == 0) {
+ debug2("%s: ignoring uninitialised token in slot %lu",
+ __func__, (unsigned long)i);
+ continue;
+ }
rmspace(token->label, sizeof(token->label));
rmspace(token->manufacturerID, sizeof(token->manufacturerID));
rmspace(token->model, sizeof(token->model));
Modified: trunk/crypto/openssh/ssh-pkcs11.h
===================================================================
--- trunk/crypto/openssh/ssh-pkcs11.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-pkcs11.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.h,v 1.2 2010/02/24 06:12:53 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.h,v 1.4 2015/01/15 09:40:00 djm Exp $ */
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
*
@@ -16,5 +16,9 @@
*/
int pkcs11_init(int);
void pkcs11_terminate(void);
-int pkcs11_add_provider(char *, char *, Key ***);
+int pkcs11_add_provider(char *, char *, struct sshkey ***);
int pkcs11_del_provider(char *);
+
+#if !defined(WITH_OPENSSL) && defined(ENABLE_PKCS11)
+#undef ENABLE_PKCS11
+#endif
Modified: trunk/crypto/openssh/ssh-rsa.c
===================================================================
--- trunk/crypto/openssh/ssh-rsa.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh-rsa.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-rsa.c,v 1.51 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: ssh-rsa.c,v 1.59 2016/04/21 06:08:02 djm Exp $ */
/*
* Copyright (c) 2000, 2003 Markus Friedl <markus at openbsd.org>
*
@@ -17,6 +17,8 @@
#include "includes.h"
+#ifdef WITH_OPENSSL
+
#include <sys/types.h>
#include <openssl/evp.h>
@@ -25,163 +27,208 @@
#include <stdarg.h>
#include <string.h>
-#include "xmalloc.h"
-#include "log.h"
-#include "buffer.h"
-#include "key.h"
+#include "sshbuf.h"
#include "compat.h"
-#include "misc.h"
-#include "ssh.h"
+#include "ssherr.h"
+#define SSHKEY_INTERNAL
+#include "sshkey.h"
#include "digest.h"
-static int openssh_RSA_verify(int, u_char *, u_int, u_char *, u_int, RSA *);
+static int openssh_RSA_verify(int, u_char *, size_t, u_char *, size_t, RSA *);
-/* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */
-int
-ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
- const u_char *data, u_int datalen)
+static const char *
+rsa_hash_alg_ident(int hash_alg)
{
- int hash_alg;
- u_char digest[SSH_DIGEST_MAX_LENGTH], *sig;
- u_int slen, dlen, len;
- int ok, nid;
- Buffer b;
-
- if (key == NULL || key_type_plain(key->type) != KEY_RSA ||
- key->rsa == NULL) {
- error("%s: no RSA key", __func__);
- return -1;
+ switch (hash_alg) {
+ case SSH_DIGEST_SHA1:
+ return "ssh-rsa";
+ case SSH_DIGEST_SHA256:
+ return "rsa-sha2-256";
+ case SSH_DIGEST_SHA512:
+ return "rsa-sha2-512";
}
+ return NULL;
+}
- /* hash the data */
- hash_alg = SSH_DIGEST_SHA1;
- nid = NID_sha1;
- if ((dlen = ssh_digest_bytes(hash_alg)) == 0) {
- error("%s: bad hash algorithm %d", __func__, hash_alg);
+static int
+rsa_hash_alg_from_ident(const char *ident)
+{
+ if (strcmp(ident, "ssh-rsa") == 0)
+ return SSH_DIGEST_SHA1;
+ if (strcmp(ident, "rsa-sha2-256") == 0)
+ return SSH_DIGEST_SHA256;
+ if (strcmp(ident, "rsa-sha2-512") == 0)
+ return SSH_DIGEST_SHA512;
+ return -1;
+}
+
+static int
+rsa_hash_alg_nid(int type)
+{
+ switch (type) {
+ case SSH_DIGEST_SHA1:
+ return NID_sha1;
+ case SSH_DIGEST_SHA256:
+ return NID_sha256;
+ case SSH_DIGEST_SHA512:
+ return NID_sha512;
+ default:
return -1;
}
- if (ssh_digest_memory(hash_alg, data, datalen,
- digest, sizeof(digest)) != 0) {
- error("%s: ssh_digest_memory failed", __func__);
- return -1;
- }
+}
+/* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */
+int
+ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, const char *alg_ident)
+{
+ u_char digest[SSH_DIGEST_MAX_LENGTH], *sig = NULL;
+ size_t slen;
+ u_int dlen, len;
+ int nid, hash_alg, ret = SSH_ERR_INTERNAL_ERROR;
+ struct sshbuf *b = NULL;
+
+ if (lenp != NULL)
+ *lenp = 0;
+ if (sigp != NULL)
+ *sigp = NULL;
+
+ if (alg_ident == NULL || strlen(alg_ident) == 0 ||
+ strncmp(alg_ident, "ssh-rsa-cert", strlen("ssh-rsa-cert")) == 0)
+ hash_alg = SSH_DIGEST_SHA1;
+ else
+ hash_alg = rsa_hash_alg_from_ident(alg_ident);
+ if (key == NULL || key->rsa == NULL || hash_alg == -1 ||
+ sshkey_type_plain(key->type) != KEY_RSA ||
+ BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
+ return SSH_ERR_INVALID_ARGUMENT;
slen = RSA_size(key->rsa);
- sig = xmalloc(slen);
+ if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM)
+ return SSH_ERR_INVALID_ARGUMENT;
- ok = RSA_sign(nid, digest, dlen, sig, &len, key->rsa);
- explicit_bzero(digest, sizeof(digest));
+ /* hash the data */
+ nid = rsa_hash_alg_nid(hash_alg);
+ if ((dlen = ssh_digest_bytes(hash_alg)) == 0)
+ return SSH_ERR_INTERNAL_ERROR;
+ if ((ret = ssh_digest_memory(hash_alg, data, datalen,
+ digest, sizeof(digest))) != 0)
+ goto out;
- if (ok != 1) {
- int ecode = ERR_get_error();
+ if ((sig = malloc(slen)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
- error("%s: RSA_sign failed: %s", __func__,
- ERR_error_string(ecode, NULL));
- free(sig);
- return -1;
+ if (RSA_sign(nid, digest, dlen, sig, &len, key->rsa) != 1) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
}
if (len < slen) {
- u_int diff = slen - len;
- debug("slen %u > len %u", slen, len);
+ size_t diff = slen - len;
memmove(sig + diff, sig, len);
explicit_bzero(sig, diff);
} else if (len > slen) {
- error("%s: slen %u slen2 %u", __func__, slen, len);
- free(sig);
- return -1;
+ ret = SSH_ERR_INTERNAL_ERROR;
+ goto out;
}
/* encode signature */
- buffer_init(&b);
- buffer_put_cstring(&b, "ssh-rsa");
- buffer_put_string(&b, sig, slen);
- len = buffer_len(&b);
+ if ((b = sshbuf_new()) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((ret = sshbuf_put_cstring(b, rsa_hash_alg_ident(hash_alg))) != 0 ||
+ (ret = sshbuf_put_string(b, sig, slen)) != 0)
+ goto out;
+ len = sshbuf_len(b);
+ if (sigp != NULL) {
+ if ((*sigp = malloc(len)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ memcpy(*sigp, sshbuf_ptr(b), len);
+ }
if (lenp != NULL)
*lenp = len;
- if (sigp != NULL) {
- *sigp = xmalloc(len);
- memcpy(*sigp, buffer_ptr(&b), len);
+ ret = 0;
+ out:
+ explicit_bzero(digest, sizeof(digest));
+ if (sig != NULL) {
+ explicit_bzero(sig, slen);
+ free(sig);
}
- buffer_free(&b);
- explicit_bzero(sig, slen);
- free(sig);
-
- return 0;
+ sshbuf_free(b);
+ return ret;
}
int
-ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- const u_char *data, u_int datalen)
+ssh_rsa_verify(const struct sshkey *key,
+ const u_char *sig, size_t siglen, const u_char *data, size_t datalen)
{
- Buffer b;
- int hash_alg;
- char *ktype;
- u_char digest[SSH_DIGEST_MAX_LENGTH], *sigblob;
- u_int len, dlen, modlen;
- int rlen, ret;
+ char *ktype = NULL;
+ int hash_alg, ret = SSH_ERR_INTERNAL_ERROR;
+ size_t len, diff, modlen, dlen;
+ struct sshbuf *b = NULL;
+ u_char digest[SSH_DIGEST_MAX_LENGTH], *osigblob, *sigblob = NULL;
- if (key == NULL || key_type_plain(key->type) != KEY_RSA ||
- key->rsa == NULL) {
- error("%s: no RSA key", __func__);
- return -1;
- }
+ if (key == NULL || key->rsa == NULL ||
+ sshkey_type_plain(key->type) != KEY_RSA ||
+ BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE ||
+ sig == NULL || siglen == 0)
+ return SSH_ERR_INVALID_ARGUMENT;
- if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
- error("%s: RSA modulus too small: %d < minimum %d bits",
- __func__, BN_num_bits(key->rsa->n),
- SSH_RSA_MINIMUM_MODULUS_SIZE);
- return -1;
+ if ((b = sshbuf_from(sig, siglen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (sshbuf_get_cstring(b, &ktype, NULL) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
- buffer_init(&b);
- buffer_append(&b, signature, signaturelen);
- ktype = buffer_get_cstring(&b, NULL);
- if (strcmp("ssh-rsa", ktype) != 0) {
- error("%s: cannot handle type %s", __func__, ktype);
- buffer_free(&b);
- free(ktype);
- return -1;
+ if ((hash_alg = rsa_hash_alg_from_ident(ktype)) == -1) {
+ ret = SSH_ERR_KEY_TYPE_MISMATCH;
+ goto out;
}
- free(ktype);
- sigblob = buffer_get_string(&b, &len);
- rlen = buffer_len(&b);
- buffer_free(&b);
- if (rlen != 0) {
- error("%s: remaining bytes in signature %d", __func__, rlen);
- free(sigblob);
- return -1;
+ if (sshbuf_get_string(b, &sigblob, &len) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
}
+ if (sshbuf_len(b) != 0) {
+ ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
+ goto out;
+ }
/* RSA_verify expects a signature of RSA_size */
modlen = RSA_size(key->rsa);
if (len > modlen) {
- error("%s: len %u > modlen %u", __func__, len, modlen);
- free(sigblob);
- return -1;
+ ret = SSH_ERR_KEY_BITS_MISMATCH;
+ goto out;
} else if (len < modlen) {
- u_int diff = modlen - len;
- debug("%s: add padding: modlen %u > len %u", __func__,
- modlen, len);
- sigblob = xrealloc(sigblob, 1, modlen);
+ diff = modlen - len;
+ osigblob = sigblob;
+ if ((sigblob = realloc(sigblob, modlen)) == NULL) {
+ sigblob = osigblob; /* put it back for clear/free */
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
memmove(sigblob + diff, sigblob, len);
explicit_bzero(sigblob, diff);
len = modlen;
}
- /* hash the data */
- hash_alg = SSH_DIGEST_SHA1;
if ((dlen = ssh_digest_bytes(hash_alg)) == 0) {
- error("%s: bad hash algorithm %d", __func__, hash_alg);
- return -1;
+ ret = SSH_ERR_INTERNAL_ERROR;
+ goto out;
}
- if (ssh_digest_memory(hash_alg, data, datalen,
- digest, sizeof(digest)) != 0) {
- error("%s: ssh_digest_memory failed", __func__);
- return -1;
- }
+ if ((ret = ssh_digest_memory(hash_alg, data, datalen,
+ digest, sizeof(digest))) != 0)
+ goto out;
ret = openssh_RSA_verify(hash_alg, digest, dlen, sigblob, len,
key->rsa);
+ out:
+ if (sigblob != NULL) {
+ explicit_bzero(sigblob, len);
+ free(sigblob);
+ }
+ free(ktype);
+ sshbuf_free(b);
explicit_bzero(digest, sizeof(digest));
- explicit_bzero(sigblob, len);
- free(sigblob);
- debug("%s: signature %scorrect", __func__, (ret == 0) ? "in" : "");
return ret;
}
@@ -190,6 +237,7 @@
* http://www.rsasecurity.com/rsalabs/pkcs/pkcs-1/
* ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.asn
*/
+
/*
* id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
* oiw(14) secsig(3) algorithms(2) 26 }
@@ -203,57 +251,106 @@
0x04, 0x14 /* Octet string, length 0x14 (20), followed by sha1 hash */
};
+/*
+ * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html
+ * id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
+ * organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2)
+ * id-sha256(1) }
+ */
+static const u_char id_sha256[] = {
+ 0x30, 0x31, /* type Sequence, length 0x31 (49) */
+ 0x30, 0x0d, /* type Sequence, length 0x0d (13) */
+ 0x06, 0x09, /* type OID, length 0x09 */
+ 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, /* id-sha256 */
+ 0x05, 0x00, /* NULL */
+ 0x04, 0x20 /* Octet string, length 0x20 (32), followed by sha256 hash */
+};
+
+/*
+ * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html
+ * id-sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
+ * organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2)
+ * id-sha256(3) }
+ */
+static const u_char id_sha512[] = {
+ 0x30, 0x51, /* type Sequence, length 0x51 (81) */
+ 0x30, 0x0d, /* type Sequence, length 0x0d (13) */
+ 0x06, 0x09, /* type OID, length 0x09 */
+ 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, /* id-sha512 */
+ 0x05, 0x00, /* NULL */
+ 0x04, 0x40 /* Octet string, length 0x40 (64), followed by sha512 hash */
+};
+
static int
-openssh_RSA_verify(int hash_alg, u_char *hash, u_int hashlen,
- u_char *sigbuf, u_int siglen, RSA *rsa)
+rsa_hash_alg_oid(int hash_alg, const u_char **oidp, size_t *oidlenp)
{
- u_int ret, rsasize, oidlen = 0, hlen = 0;
- int len, oidmatch, hashmatch;
- const u_char *oid = NULL;
- u_char *decrypted = NULL;
-
- ret = 0;
switch (hash_alg) {
case SSH_DIGEST_SHA1:
- oid = id_sha1;
- oidlen = sizeof(id_sha1);
- hlen = 20;
+ *oidp = id_sha1;
+ *oidlenp = sizeof(id_sha1);
break;
+ case SSH_DIGEST_SHA256:
+ *oidp = id_sha256;
+ *oidlenp = sizeof(id_sha256);
+ break;
+ case SSH_DIGEST_SHA512:
+ *oidp = id_sha512;
+ *oidlenp = sizeof(id_sha512);
+ break;
default:
- goto done;
+ return SSH_ERR_INVALID_ARGUMENT;
}
+ return 0;
+}
+
+static int
+openssh_RSA_verify(int hash_alg, u_char *hash, size_t hashlen,
+ u_char *sigbuf, size_t siglen, RSA *rsa)
+{
+ size_t rsasize = 0, oidlen = 0, hlen = 0;
+ int ret, len, oidmatch, hashmatch;
+ const u_char *oid = NULL;
+ u_char *decrypted = NULL;
+
+ if ((ret = rsa_hash_alg_oid(hash_alg, &oid, &oidlen)) != 0)
+ return ret;
+ ret = SSH_ERR_INTERNAL_ERROR;
+ hlen = ssh_digest_bytes(hash_alg);
if (hashlen != hlen) {
- error("bad hashlen");
+ ret = SSH_ERR_INVALID_ARGUMENT;
goto done;
}
rsasize = RSA_size(rsa);
- if (siglen == 0 || siglen > rsasize) {
- error("bad siglen");
+ if (rsasize <= 0 || rsasize > SSHBUF_MAX_BIGNUM ||
+ siglen == 0 || siglen > rsasize) {
+ ret = SSH_ERR_INVALID_ARGUMENT;
goto done;
}
- decrypted = xmalloc(rsasize);
+ if ((decrypted = malloc(rsasize)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto done;
+ }
if ((len = RSA_public_decrypt(siglen, sigbuf, decrypted, rsa,
RSA_PKCS1_PADDING)) < 0) {
- error("RSA_public_decrypt failed: %s",
- ERR_error_string(ERR_get_error(), NULL));
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
goto done;
}
- if (len < 0 || (u_int)len != hlen + oidlen) {
- error("bad decrypted len: %d != %d + %d", len, hlen, oidlen);
+ if (len < 0 || (size_t)len != hlen + oidlen) {
+ ret = SSH_ERR_INVALID_FORMAT;
goto done;
}
oidmatch = timingsafe_bcmp(decrypted, oid, oidlen) == 0;
hashmatch = timingsafe_bcmp(decrypted + oidlen, hash, hlen) == 0;
- if (!oidmatch) {
- error("oid mismatch");
+ if (!oidmatch || !hashmatch) {
+ ret = SSH_ERR_SIGNATURE_INVALID;
goto done;
}
- if (!hashmatch) {
- error("hash mismatch");
- goto done;
+ ret = 0;
+done:
+ if (decrypted) {
+ explicit_bzero(decrypted, rsasize);
+ free(decrypted);
}
- ret = 1;
-done:
- free(decrypted);
return ret;
}
+#endif /* WITH_OPENSSL */
Modified: trunk/crypto/openssh/ssh.0
===================================================================
--- trunk/crypto/openssh/ssh.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,29 +1,27 @@
-SSH(1) OpenBSD Reference Manual SSH(1)
+SSH(1) General Commands Manual SSH(1)
NAME
- ssh - OpenSSH SSH client (remote login program)
+ ssh M-bM-^@M-^S OpenSSH SSH client (remote login program)
SYNOPSIS
- ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
+ ssh [-1246AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
[-D [bind_address:]port] [-E log_file] [-e escape_char]
[-F configfile] [-I pkcs11] [-i identity_file]
- [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]
- [-O ctl_cmd] [-o option] [-p port]
- [-Q cipher | cipher-auth | mac | kex | key]
- [-R [bind_address:]port:host:hostport] [-S ctl_path] [-W host:port]
- [-w local_tun[:remote_tun]] [user@]hostname [command]
+ [-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]
+ [-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]
+ [-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]]
+ [user@]hostname [command]
DESCRIPTION
ssh (SSH client) is a program for logging into a remote machine and for
- executing commands on a remote machine. It is intended to replace rlogin
- and rsh, and provide secure encrypted communications between two
- untrusted hosts over an insecure network. X11 connections and arbitrary
- TCP ports can also be forwarded over the secure channel.
+ executing commands on a remote machine. It is intended to provide secure
+ encrypted communications between two untrusted hosts over an insecure
+ network. X11 connections, arbitrary TCP ports and UNIX-domain sockets
+ can also be forwarded over the secure channel.
ssh connects and logs into the specified hostname (with optional user
name). The user must prove his/her identity to the remote machine using
- one of several methods depending on the protocol version used (see
- below).
+ one of several methods (see below).
If command is specified, it is executed on the remote host instead of a
login shell.
@@ -58,33 +56,26 @@
address.
-C Requests compression of all data (including stdin, stdout,
- stderr, and data for forwarded X11 and TCP connections). The
- compression algorithm is the same used by gzip(1), and the
- ``level'' can be controlled by the CompressionLevel option for
- protocol version 1. Compression is desirable on modem lines and
- other slow connections, but will only slow down things on fast
- networks. The default value can be set on a host-by-host basis
- in the configuration files; see the Compression option.
+ stderr, and data for forwarded X11, TCP and UNIX-domain
+ connections). The compression algorithm is the same used by
+ gzip(1), and the M-bM-^@M-^\levelM-bM-^@M-^] can be controlled by the
+ CompressionLevel option for protocol version 1. Compression is
+ desirable on modem lines and other slow connections, but will
+ only slow down things on fast networks. The default value can be
+ set on a host-by-host basis in the configuration files; see the
+ Compression option.
-c cipher_spec
Selects the cipher specification for encrypting the session.
Protocol version 1 allows specification of a single cipher. The
- supported values are ``3des'', ``blowfish'', and ``des''. 3des
- (triple-des) is an encrypt-decrypt-encrypt triple with three
- different keys. It is believed to be secure. blowfish is a fast
- block cipher; it appears very secure and is much faster than
- 3des. des is only supported in the ssh client for
- interoperability with legacy protocol 1 implementations that do
- not support the 3des cipher. Its use is strongly discouraged due
- to cryptographic weaknesses. The default is ``3des''.
+ supported values are M-bM-^@M-^\3desM-bM-^@M-^], M-bM-^@M-^\blowfishM-bM-^@M-^], and M-bM-^@M-^\desM-bM-^@M-^]. For protocol
+ version 2, cipher_spec is a comma-separated list of ciphers
+ listed in order of preference. See the Ciphers keyword in
+ ssh_config(5) for more information.
- For protocol version 2, cipher_spec is a comma-separated list of
- ciphers listed in order of preference. See the Ciphers keyword
- in ssh_config(5) for more information.
-
-D [bind_address:]port
- Specifies a local ``dynamic'' application-level port forwarding.
+ Specifies a local M-bM-^@M-^\dynamicM-bM-^@M-^] application-level port forwarding.
This works by allocating a socket to listen to port on the local
side, optionally bound to the specified bind_address. Whenever a
connection is made to this port, the connection is forwarded over
@@ -100,20 +91,20 @@
ports. By default, the local port is bound in accordance with
the GatewayPorts setting. However, an explicit bind_address may
be used to bind the connection to a specific address. The
- bind_address of ``localhost'' indicates that the listening port
- be bound for local use only, while an empty address or `*'
- indicates that the port should be available from all interfaces.
+ bind_address of M-bM-^@M-^\localhostM-bM-^@M-^] indicates that the listening port be
+ bound for local use only, while an empty address or M-bM-^@M-^X*M-bM-^@M-^Y indicates
+ that the port should be available from all interfaces.
-E log_file
Append debug logs to log_file instead of standard error.
-e escape_char
- Sets the escape character for sessions with a pty (default: `~').
+ Sets the escape character for sessions with a pty (default: M-bM-^@M-^X~M-bM-^@M-^Y).
The escape character is only recognized at the beginning of a
- line. The escape character followed by a dot (`.') closes the
+ line. The escape character followed by a dot (M-bM-^@M-^X.M-bM-^@M-^Y) closes the
connection; followed by control-Z suspends the connection; and
followed by itself sends the escape character once. Setting the
- character to ``none'' disables any escapes and makes the session
+ character to M-bM-^@M-^\noneM-bM-^@M-^] disables any escapes and makes the session
fully transparent.
-F configfile
@@ -128,13 +119,18 @@
implies -n. The recommended way to start X11 programs at a
remote site is with something like ssh -f host xterm.
- If the ExitOnForwardFailure configuration option is set to
- ``yes'', then a client started with -f will wait for all remote
- port forwards to be successfully established before placing
- itself in the background.
+ If the ExitOnForwardFailure configuration option is set to M-bM-^@M-^\yesM-bM-^@M-^],
+ then a client started with -f will wait for all remote port
+ forwards to be successfully established before placing itself in
+ the background.
- -g Allows remote hosts to connect to local forwarded ports.
+ -G Causes ssh to print its configuration after evaluating Host and
+ Match blocks and exit.
+ -g Allows remote hosts to connect to local forwarded ports. If used
+ on a multiplexed connection, then this option must be specified
+ on the master process.
+
-I pkcs11
Specify the PKCS#11 shared library ssh should use to communicate
with a PKCS#11 token providing the user's private RSA key.
@@ -146,10 +142,19 @@
~/.ssh/id_ed25519 and ~/.ssh/id_rsa for protocol version 2.
Identity files may also be specified on a per-host basis in the
configuration file. It is possible to have multiple -i options
- (and multiple identities specified in configuration files). ssh
- will also try to load certificate information from the filename
- obtained by appending -cert.pub to identity filenames.
+ (and multiple identities specified in configuration files). If
+ no certificates have been explicitly specified by the
+ CertificateFile directive, ssh will also try to load certificate
+ information from the filename obtained by appending -cert.pub to
+ identity filenames.
+ -J [user@]host[:port]
+ Connect to the target host by first making a ssh connection to
+ the jump host and then establishing a TCP forwarding to the
+ ultimate destination from there. Multiple jump hops may be
+ specified separated by comma characters. This is a shortcut to
+ specify a ProxyJump configuration directive.
+
-K Enables GSSAPI-based authentication and forwarding (delegation)
of GSSAPI credentials to the server.
@@ -157,40 +162,47 @@
server.
-L [bind_address:]port:host:hostport
- Specifies that the given port on the local (client) host is to be
- forwarded to the given host and port on the remote side. This
- works by allocating a socket to listen to port on the local side,
- optionally bound to the specified bind_address. Whenever a
- connection is made to this port, the connection is forwarded over
- the secure channel, and a connection is made to host port
- hostport from the remote machine. Port forwardings can also be
- specified in the configuration file. IPv6 addresses can be
- specified by enclosing the address in square brackets. Only the
- superuser can forward privileged ports. By default, the local
- port is bound in accordance with the GatewayPorts setting.
- However, an explicit bind_address may be used to bind the
- connection to a specific address. The bind_address of
- ``localhost'' indicates that the listening port be bound for
- local use only, while an empty address or `*' indicates that the
- port should be available from all interfaces.
+ -L [bind_address:]port:remote_socket
+ -L local_socket:host:hostport
+ -L local_socket:remote_socket
+ Specifies that connections to the given TCP port or Unix socket
+ on the local (client) host are to be forwarded to the given host
+ and port, or Unix socket, on the remote side. This works by
+ allocating a socket to listen to either a TCP port on the local
+ side, optionally bound to the specified bind_address, or to a
+ Unix socket. Whenever a connection is made to the local port or
+ socket, the connection is forwarded over the secure channel, and
+ a connection is made to either host port hostport, or the Unix
+ socket remote_socket, from the remote machine.
+ Port forwardings can also be specified in the configuration file.
+ Only the superuser can forward privileged ports. IPv6 addresses
+ can be specified by enclosing the address in square brackets.
+
+ By default, the local port is bound in accordance with the
+ GatewayPorts setting. However, an explicit bind_address may be
+ used to bind the connection to a specific address. The
+ bind_address of M-bM-^@M-^\localhostM-bM-^@M-^] indicates that the listening port be
+ bound for local use only, while an empty address or M-bM-^@M-^X*M-bM-^@M-^Y indicates
+ that the port should be available from all interfaces.
+
-l login_name
Specifies the user to log in as on the remote machine. This also
may be specified on a per-host basis in the configuration file.
- -M Places the ssh client into ``master'' mode for connection
- sharing. Multiple -M options places ssh into ``master'' mode
- with confirmation required before slave connections are accepted.
+ -M Places the ssh client into M-bM-^@M-^\masterM-bM-^@M-^] mode for connection sharing.
+ Multiple -M options places ssh into M-bM-^@M-^\masterM-bM-^@M-^] mode with
+ confirmation required before slave connections are accepted.
Refer to the description of ControlMaster in ssh_config(5) for
details.
-m mac_spec
- Additionally, for protocol version 2 a comma-separated list of
- MAC (message authentication code) algorithms can be specified in
- order of preference. See the MACs keyword for more information.
+ A comma-separated list of MAC (message authentication code)
+ algorithms, specified in order of preference. See the MACs
+ keyword for more information.
-N Do not execute a remote command. This is useful for just
- forwarding ports (protocol version 2 only).
+ forwarding ports.
-n Redirects stdin from /dev/null (actually, prevents reading from
stdin). This must be used when ssh is run in the background. A
@@ -205,10 +217,10 @@
-O ctl_cmd
Control an active connection multiplexing master process. When
the -O option is specified, the ctl_cmd argument is interpreted
- and passed to the master process. Valid commands are: ``check''
- (check that the master process is running), ``forward'' (request
- forwardings without command execution), ``cancel'' (cancel
- forwardings), ``exit'' (request the master to exit), and ``stop''
+ and passed to the master process. Valid commands are: M-bM-^@M-^\checkM-bM-^@M-^]
+ (check that the master process is running), M-bM-^@M-^\forwardM-bM-^@M-^] (request
+ forwardings without command execution), M-bM-^@M-^\cancelM-bM-^@M-^] (cancel
+ forwardings), M-bM-^@M-^\exitM-bM-^@M-^] (request the master to exit), and M-bM-^@M-^\stopM-bM-^@M-^]
(request the master to stop accepting further multiplexing
requests).
@@ -219,6 +231,7 @@
of the options listed below, and their possible values, see
ssh_config(5).
+ AddKeysToAgent
AddressFamily
BatchMode
BindAddress
@@ -227,6 +240,7 @@
CanonicalizeHostname
CanonicalizeMaxDots
CanonicalizePermittedCNAMEs
+ CertificateFile
ChallengeResponseAuthentication
CheckHostIP
Cipher
@@ -242,6 +256,7 @@
DynamicForward
EscapeChar
ExitOnForwardFailure
+ FingerprintHash
ForwardAgent
ForwardX11
ForwardX11Timeout
@@ -253,11 +268,14 @@
HashKnownHosts
Host
HostbasedAuthentication
+ HostbasedKeyTypes
HostKeyAlgorithms
HostKeyAlias
HostName
+ IdentitiesOnly
+ IdentityAgent
IdentityFile
- IdentitiesOnly
+ Include
IPQoS
KbdInteractiveAuthentication
KbdInteractiveDevices
@@ -276,7 +294,9 @@
PreferredAuthentications
Protocol
ProxyCommand
+ ProxyJump
ProxyUseFdpass
+ PubkeyAcceptedKeyTypes
PubkeyAuthentication
RekeyLimit
RemoteForward
@@ -286,10 +306,13 @@
SendEnv
ServerAliveInterval
ServerAliveCountMax
+ StreamLocalBindMask
+ StreamLocalBindUnlink
StrictHostKeyChecking
TCPKeepAlive
Tunnel
TunnelDevice
+ UpdateHostKeys
UsePrivilegedPort
User
UserKnownHostsFile
@@ -301,23 +324,30 @@
Port to connect to on the remote host. This can be specified on
a per-host basis in the configuration file.
- -Q cipher | cipher-auth | mac | kex | key
+ -Q query_option
Queries ssh for the algorithms supported for the specified
version 2. The available features are: cipher (supported
symmetric ciphers), cipher-auth (supported symmetric ciphers that
support authenticated encryption), mac (supported message
- integrity codes), kex (key exchange algorithms), key (key types).
+ integrity codes), kex (key exchange algorithms), key (key types),
+ key-cert (certificate key types), key-plain (non-certificate key
+ types), and protocol-version (supported SSH protocol versions).
-q Quiet mode. Causes most warning and diagnostic messages to be
suppressed.
-R [bind_address:]port:host:hostport
- Specifies that the given port on the remote (server) host is to
- be forwarded to the given host and port on the local side. This
- works by allocating a socket to listen to port on the remote
- side, and whenever a connection is made to this port, the
- connection is forwarded over the secure channel, and a connection
- is made to host port hostport from the local machine.
+ -R [bind_address:]port:local_socket
+ -R remote_socket:host:hostport
+ -R remote_socket:local_socket
+ Specifies that connections to the given TCP port or Unix socket
+ on the remote (server) host are to be forwarded to the given host
+ and port, or Unix socket, on the local side. This works by
+ allocating a socket to listen to either a TCP port or to a Unix
+ socket on the remote side. Whenever a connection is made to this
+ port or Unix socket, the connection is forwarded over the secure
+ channel, and a connection is made to either host port hostport,
+ or local_socket, from the local machine.
Port forwardings can also be specified in the configuration file.
Privileged ports can be forwarded only when logging in as root on
@@ -324,15 +354,15 @@
the remote machine. IPv6 addresses can be specified by enclosing
the address in square brackets.
- By default, the listening socket on the server will be bound to
+ By default, TCP listening sockets on the server will be bound to
the loopback interface only. This may be overridden by
specifying a bind_address. An empty bind_address, or the address
- `*', indicates that the remote socket should listen on all
+ M-bM-^@M-^X*M-bM-^@M-^Y, indicates that the remote socket should listen on all
interfaces. Specifying a remote bind_address will only succeed
if the server's GatewayPorts option is enabled (see
sshd_config(5)).
- If the port argument is `0', the listen port will be dynamically
+ If the port argument is M-bM-^@M-^X0M-bM-^@M-^Y, the listen port will be dynamically
allocated on the server and reported to the client at run time.
When used together with -O forward the allocated port will be
printed to the standard output.
@@ -339,19 +369,18 @@
-S ctl_path
Specifies the location of a control socket for connection
- sharing, or the string ``none'' to disable connection sharing.
+ sharing, or the string M-bM-^@M-^\noneM-bM-^@M-^] to disable connection sharing.
Refer to the description of ControlPath and ControlMaster in
ssh_config(5) for details.
-s May be used to request invocation of a subsystem on the remote
- system. Subsystems are a feature of the SSH2 protocol which
- facilitate the use of SSH as a secure transport for other
- applications (eg. sftp(1)). The subsystem is specified as the
- remote command.
+ system. Subsystems facilitate the use of SSH as a secure
+ transport for other applications (e.g. sftp(1)). The subsystem
+ is specified as the remote command.
- -T Disable pseudo-tty allocation.
+ -T Disable pseudo-terminal allocation.
- -t Force pseudo-tty allocation. This can be used to execute
+ -t Force pseudo-terminal allocation. This can be used to execute
arbitrary screen-based programs on a remote machine, which can be
very useful, e.g. when implementing menu services. Multiple -t
options force tty allocation, even if ssh has no local tty.
@@ -366,8 +395,9 @@
-W host:port
Requests that standard input and output on the client be
forwarded to host on port over the secure channel. Implies -N,
- -T, ExitOnForwardFailure and ClearAllForwardings. Works with
- Protocol version 2 only.
+ -T, ExitOnForwardFailure and ClearAllForwardings, though these
+ can be overridden in the configuration file or using -o command
+ line options.
-w local_tun[:remote_tun]
Requests tunnel device forwarding with the specified tun(4)
@@ -375,11 +405,11 @@
(remote_tun).
The devices may be specified by numerical ID or the keyword
- ``any'', which uses the next available tunnel device. If
- remote_tun is not specified, it defaults to ``any''. See also
- the Tunnel and TunnelDevice directives in ssh_config(5). If the
+ M-bM-^@M-^\anyM-bM-^@M-^], which uses the next available tunnel device. If
+ remote_tun is not specified, it defaults to M-bM-^@M-^\anyM-bM-^@M-^]. See also the
+ Tunnel and TunnelDevice directives in ssh_config(5). If the
Tunnel directive is unset, it is set to the default tunnel mode,
- which is ``point-to-point''.
+ which is M-bM-^@M-^\point-to-pointM-bM-^@M-^].
-X Enables X11 forwarding. This can also be specified on a per-host
basis in a configuration file.
@@ -410,20 +440,16 @@
AUTHENTICATION
The OpenSSH SSH client supports SSH protocols 1 and 2. The default is to
use protocol 2 only, though this can be changed via the Protocol option
- in ssh_config(5) or the -1 and -2 options (see above). Both protocols
- support similar authentication methods, but protocol 2 is the default
- since it provides additional mechanisms for confidentiality (the traffic
- is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour) and
- integrity (hmac-md5, hmac-sha1, hmac-sha2-256, hmac-sha2-512, umac-64,
- umac-128, hmac-ripemd160). Protocol 1 lacks a strong mechanism for
- ensuring the integrity of the connection.
+ in ssh_config(5) or the -1 and -2 options (see above). Protocol 1 should
+ not be used and is only offered to support legacy devices. It suffers
+ from a number of cryptographic weaknesses and doesn't support many of the
+ advanced features available for protocol 2.
The methods available for authentication are: GSSAPI-based
authentication, host-based authentication, public key authentication,
challenge-response authentication, and password authentication.
Authentication methods are tried in the order specified above, though
- protocol 2 has a configuration option to change the default order:
- PreferredAuthentications.
+ PreferredAuthentications can be used to change the default order.
Host-based authentication works as follows: If the machine the user logs
in from is listed in /etc/hosts.equiv or /etc/shosts.equiv on the remote
@@ -446,10 +472,8 @@
creates a public/private key pair for authentication purposes. The
server knows the public key, and only the user knows the private key.
ssh implements public key authentication protocol automatically, using
- one of the DSA, ECDSA, ED25519 or RSA algorithms. Protocol 1 is
- restricted to using only RSA keys, but protocol 2 may use any. The
- HISTORY section of ssl(8) contains a brief discussion of the DSA and RSA
- algorithms.
+ one of the DSA, ECDSA, Ed25519 or RSA algorithms. The HISTORY section of
+ ssl(8) contains a brief discussion of the DSA and RSA algorithms.
The file ~/.ssh/authorized_keys lists the public keys that are permitted
for logging in. When the user logs in, the ssh program tells the server
@@ -458,13 +482,12 @@
the corresponding public key is authorized to accept the account.
The user creates his/her key pair by running ssh-keygen(1). This stores
- the private key in ~/.ssh/identity (protocol 1), ~/.ssh/id_dsa (protocol
- 2 DSA), ~/.ssh/id_ecdsa (protocol 2 ECDSA), ~/.ssh/id_ed25519 (protocol 2
- ED25519), or ~/.ssh/id_rsa (protocol 2 RSA) and stores the public key in
- ~/.ssh/identity.pub (protocol 1), ~/.ssh/id_dsa.pub (protocol 2 DSA),
- ~/.ssh/id_ecdsa.pub (protocol 2 ECDSA), ~/.ssh/id_ed25519.pub (protocol 2
- ED25519), or ~/.ssh/id_rsa.pub (protocol 2 RSA) in the user's home
- directory. The user should then copy the public key to
+ the private key in ~/.ssh/identity (protocol 1), ~/.ssh/id_dsa (DSA),
+ ~/.ssh/id_ecdsa (ECDSA), ~/.ssh/id_ed25519 (Ed25519), or ~/.ssh/id_rsa
+ (RSA) and stores the public key in ~/.ssh/identity.pub (protocol 1),
+ ~/.ssh/id_dsa.pub (DSA), ~/.ssh/id_ecdsa.pub (ECDSA),
+ ~/.ssh/id_ed25519.pub (Ed25519), or ~/.ssh/id_rsa.pub (RSA) in the user's
+ home directory. The user should then copy the public key to
~/.ssh/authorized_keys in his/her home directory on the remote machine.
The authorized_keys file corresponds to the conventional ~/.rhosts file,
and has one key per line, though the lines can be very long. After this,
@@ -478,15 +501,13 @@
more information.
The most convenient way to use public key or certificate authentication
- may be with an authentication agent. See ssh-agent(1) for more
- information.
+ may be with an authentication agent. See ssh-agent(1) and (optionally)
+ the AddKeysToAgent directive in ssh_config(5) for more information.
Challenge-response authentication works as follows: The server sends an
- arbitrary "challenge" text, and prompts for a response. Protocol 2
- allows multiple challenges and responses; protocol 1 is restricted to
- just one challenge/response. Examples of challenge-response
- authentication include BSD Authentication (see login.conf(5)) and PAM
- (some non-OpenBSD systems).
+ arbitrary "challenge" text, and prompts for a response. Examples of
+ challenge-response authentication include BSD Authentication (see
+ login.conf(5)) and PAM (some non-OpenBSD systems).
Finally, if other authentication methods fail, ssh prompts the user for a
password. The password is sent to the remote host for checking; however,
@@ -505,18 +526,23 @@
whose host key is not known or has changed.
When the user's identity has been accepted by the server, the server
- either executes the given command, or logs into the machine and gives the
- user a normal shell on the remote machine. All communication with the
+ either executes the given command in a non-interactive session or, if no
+ command has been specified, logs into the machine and gives the user a
+ normal shell as an interactive session. All communication with the
remote command or shell will be automatically encrypted.
- If a pseudo-terminal has been allocated (normal login session), the user
- may use the escape characters noted below.
+ If an interactive session is requested ssh by default will only request a
+ pseudo-terminal (pty) for interactive sessions when the client has one.
+ The flags -T and -t can be used to override this behaviour.
- If no pseudo-tty has been allocated, the session is transparent and can
- be used to reliably transfer binary data. On most systems, setting the
- escape character to ``none'' will also make the session transparent even
- if a tty is used.
+ If a pseudo-terminal has been allocated the user may use the escape
+ characters noted below.
+ If no pseudo-terminal has been allocated, the session is transparent and
+ can be used to reliably transfer binary data. On most systems, setting
+ the escape character to M-bM-^@M-^\noneM-bM-^@M-^] will also make the session transparent
+ even if a tty is used.
+
The session terminates when the command or shell on the remote machine
exits and all X11 and TCP connections have been closed.
@@ -530,7 +556,7 @@
character can be changed in configuration files using the EscapeChar
configuration directive or on the command line by the -e option.
- The supported escapes (assuming the default `~') are:
+ The supported escapes (assuming the default M-bM-^@M-^X~M-bM-^@M-^Y) are:
~. Disconnect.
@@ -543,8 +569,8 @@
~? Display a list of escape characters.
- ~B Send a BREAK to the remote system (only useful for SSH protocol
- version 2 and if the peer supports it).
+ ~B Send a BREAK to the remote system (only useful if the peer
+ supports it).
~C Open command line. Currently this allows the addition of port
forwardings using the -L, -R and -D options (see above). It also
@@ -555,8 +581,8 @@
PermitLocalCommand option is enabled in ssh_config(5). Basic
help is available, using the -h option.
- ~R Request rekeying of the connection (only useful for SSH protocol
- version 2 and if the peer supports it).
+ ~R Request rekeying of the connection (only useful if the peer
+ supports it).
~V Decrease the verbosity (LogLevel) when errors are being written
to stderr.
@@ -579,26 +605,26 @@
same local port, and ssh will encrypt and forward the connection.
The following example tunnels an IRC session from client machine
- ``127.0.0.1'' (localhost) to remote server ``server.example.com'':
+ M-bM-^@M-^\127.0.0.1M-bM-^@M-^] (localhost) to remote server M-bM-^@M-^\server.example.comM-bM-^@M-^]:
$ ssh -f -L 1234:localhost:6667 server.example.com sleep 10
$ irc -c '#users' -p 1234 pinky 127.0.0.1
- This tunnels a connection to IRC server ``server.example.com'', joining
- channel ``#users'', nickname ``pinky'', using port 1234. It doesn't
- matter which port is used, as long as it's greater than 1023 (remember,
- only root can open sockets on privileged ports) and doesn't conflict with
- any ports already in use. The connection is forwarded to port 6667 on
- the remote server, since that's the standard port for IRC services.
+ This tunnels a connection to IRC server M-bM-^@M-^\server.example.comM-bM-^@M-^], joining
+ channel M-bM-^@M-^\#usersM-bM-^@M-^], nickname M-bM-^@M-^\pinkyM-bM-^@M-^], using port 1234. It doesn't matter
+ which port is used, as long as it's greater than 1023 (remember, only
+ root can open sockets on privileged ports) and doesn't conflict with any
+ ports already in use. The connection is forwarded to port 6667 on the
+ remote server, since that's the standard port for IRC services.
- The -f option backgrounds ssh and the remote command ``sleep 10'' is
+ The -f option backgrounds ssh and the remote command M-bM-^@M-^\sleep 10M-bM-^@M-^] is
specified to allow an amount of time (10 seconds, in the example) to
start the service which is to be tunnelled. If no connections are made
within the time specified, ssh will exit.
X11 FORWARDING
- If the ForwardX11 variable is set to ``yes'' (or see the description of
- the -X, -x, and -Y options above) and the user is using X11 (the DISPLAY
+ If the ForwardX11 variable is set to M-bM-^@M-^\yesM-bM-^@M-^] (or see the description of the
+ -X, -x, and -Y options above) and the user is using X11 (the DISPLAY
environment variable is set), the connection to the X11 display is
automatically forwarded to the remote side in such a way that any X11
programs started from the shell (or command) will go through the
@@ -609,7 +635,7 @@
The DISPLAY value set by ssh will point to the server machine, but with a
display number greater than zero. This is normal, and happens because
- ssh creates a ``proxy'' X server on the server machine for forwarding the
+ ssh creates a M-bM-^@M-^\proxyM-bM-^@M-^] X server on the server machine for forwarding the
connections over the encrypted channel.
ssh will also automatically set up Xauthority data on the server machine.
@@ -619,7 +645,7 @@
is opened. The real authentication cookie is never sent to the server
machine (and no cookies are sent in the plain).
- If the ForwardAgent variable is set to ``yes'' (or see the description of
+ If the ForwardAgent variable is set to M-bM-^@M-^\yesM-bM-^@M-^] (or see the description of
the -A and -a options above) and the user is using an authentication
agent, the connection to the agent is automatically forwarded to the
remote side.
@@ -633,17 +659,21 @@
$ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key
If the fingerprint is already known, it can be matched and the key can be
- accepted or rejected. Because of the difficulty of comparing host keys
- just by looking at hex strings, there is also support to compare host
- keys visually, using random art. By setting the VisualHostKey option to
- ``yes'', a small ASCII graphic gets displayed on every login to a server,
- no matter if the session itself is interactive or not. By learning the
- pattern a known server produces, a user can easily find out that the host
- key has changed when a completely different pattern is displayed.
- Because these patterns are not unambiguous however, a pattern that looks
- similar to the pattern remembered only gives a good probability that the
- host key is the same, not guaranteed proof.
+ accepted or rejected. If only legacy (MD5) fingerprints for the server
+ are available, the ssh-keygen(1) -E option may be used to downgrade the
+ fingerprint algorithm to match.
+ Because of the difficulty of comparing host keys just by looking at
+ fingerprint strings, there is also support to compare host keys visually,
+ using random art. By setting the VisualHostKey option to M-bM-^@M-^\yesM-bM-^@M-^], a small
+ ASCII graphic gets displayed on every login to a server, no matter if the
+ session itself is interactive or not. By learning the pattern a known
+ server produces, a user can easily find out that the host key has changed
+ when a completely different pattern is displayed. Because these patterns
+ are not unambiguous however, a pattern that looks similar to the pattern
+ remembered only gives a good probability that the host key is the same,
+ not guaranteed proof.
+
To get a listing of the fingerprints along with their random art for all
known hosts, the following command line can be used:
@@ -655,8 +685,8 @@
able to match the fingerprint with that of the key presented.
In this example, we are connecting a client to a server,
- ``host.example.com''. The SSHFP resource records should first be added
- to the zonefile for host.example.com:
+ M-bM-^@M-^\host.example.comM-bM-^@M-^]. The SSHFP resource records should first be added to
+ the zonefile for host.example.com:
$ ssh-keygen -r host.example.com.
@@ -699,9 +729,9 @@
Client access may be more finely tuned via the /root/.ssh/authorized_keys
file (see below) and the PermitRootLogin server option. The following
- entry would permit connections on tun(4) device 1 from user ``jane'' and
- on tun device 2 from user ``john'', if PermitRootLogin is set to
- ``forced-commands-only'':
+ entry would permit connections on tun(4) device 1 from user M-bM-^@M-^\janeM-bM-^@M-^] and on
+ tun device 2 from user M-bM-^@M-^\johnM-bM-^@M-^], if PermitRootLogin is set to
+ M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^]:
tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... jane
tunnel="2",command="sh /etc/netstart tun2" ssh-rsa ... john
@@ -716,14 +746,14 @@
DISPLAY The DISPLAY variable indicates the location of the
X11 server. It is automatically set by ssh to
- point to a value of the form ``hostname:n'', where
- ``hostname'' indicates the host where the shell
- runs, and `n' is an integer >= 1. ssh uses this
- special value to forward X11 connections over the
- secure channel. The user should normally not set
- DISPLAY explicitly, as that will render the X11
- connection insecure (and will require the user to
- manually copy any required authorization cookies).
+ point to a value of the form M-bM-^@M-^\hostname:nM-bM-^@M-^], where
+ M-bM-^@M-^\hostnameM-bM-^@M-^] indicates the host where the shell runs,
+ and M-bM-^@M-^XnM-bM-^@M-^Y is an integer M-bM-^IM-% 1. ssh uses this special
+ value to forward X11 connections over the secure
+ channel. The user should normally not set DISPLAY
+ explicitly, as that will render the X11 connection
+ insecure (and will require the user to manually
+ copy any required authorization cookies).
HOME Set to the path of the user's home directory.
@@ -772,7 +802,7 @@
USER Set to the name of the user logging in.
Additionally, ssh reads ~/.ssh/environment, and adds lines of the format
- ``VARNAME=value'' to the environment if the file exists and users are
+ M-bM-^@M-^\VARNAME=valueM-bM-^@M-^] to the environment if the file exists and users are
allowed to change their environment. For more information, see the
PermitUserEnvironment option in sshd_config(5).
@@ -799,7 +829,7 @@
for the user, and not accessible by others.
~/.ssh/authorized_keys
- Lists the public keys (DSA, ECDSA, ED25519, RSA) that can be used
+ Lists the public keys (DSA, ECDSA, Ed25519, RSA) that can be used
for logging in as this user. The format of this file is
described in the sshd(8) manual page. This file is not highly
sensitive, but the recommended permissions are read/write for the
@@ -866,12 +896,7 @@
/etc/ssh/ssh_host_ed25519_key
/etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys and are
- used for host-based authentication. If protocol version 1 is
- used, ssh must be setuid root, since the host key is readable
- only by root. For protocol version 2, ssh uses ssh-keysign(8) to
- access the host keys, eliminating the requirement that ssh be
- setuid root when host-based authentication is used. By default
- ssh is not setuid root.
+ used for host-based authentication.
/etc/ssh/ssh_known_hosts
Systemwide list of known host keys. This file should be prepared
@@ -890,7 +915,7 @@
SEE ALSO
scp(1), sftp(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), ssh-keyscan(1),
- tun(4), hosts.equiv(5), ssh_config(5), ssh-keysign(8), sshd(8)
+ tun(4), ssh_config(5), ssh-keysign(8), sshd(8)
STANDARDS
S. Lehtinen and C. Lonvick, The Secure Shell (SSH) Protocol Assigned
@@ -943,4 +968,4 @@
created OpenSSH. Markus Friedl contributed the support for SSH protocol
versions 1.5 and 2.0.
-OpenBSD 5.5 December 7, 2013 OpenBSD 5.5
+OpenBSD 6.0 July 16, 2016 OpenBSD 6.0
Modified: trunk/crypto/openssh/ssh.1
===================================================================
--- trunk/crypto/openssh/ssh.1 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh.1 2016-11-05 20:36:34 UTC (rev 9223)
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh.1,v 1.343 2013/12/07 11:58:46 naddy Exp $
-.Dd $Mdocdate: December 7 2013 $
+.\" $OpenBSD: ssh.1,v 1.376 2016/07/16 06:57:55 jmc Exp $
+.Dd $Mdocdate: July 16 2016 $
.Dt SSH 1
.Os
.Sh NAME
@@ -43,7 +43,7 @@
.Sh SYNOPSIS
.Nm ssh
.Bk -words
-.Op Fl 1246AaCfgKkMNnqsTtVvXxYy
+.Op Fl 1246AaCfGgKkMNnqsTtVvXxYy
.Op Fl b Ar bind_address
.Op Fl c Ar cipher_spec
.Op Fl D Oo Ar bind_address : Oc Ns Ar port
@@ -52,14 +52,15 @@
.Op Fl F Ar configfile
.Op Fl I Ar pkcs11
.Op Fl i Ar identity_file
-.Op Fl L Oo Ar bind_address : Oc Ns Ar port : Ns Ar host : Ns Ar hostport
+.Op Fl J Oo Ar user Ns @ Oc Ns Ar host Ns Op : Ns Ar port
+.Op Fl L Ar address
.Op Fl l Ar login_name
.Op Fl m Ar mac_spec
.Op Fl O Ar ctl_cmd
.Op Fl o Ar option
.Op Fl p Ar port
-.Op Fl Q Cm cipher | cipher-auth | mac | kex | key
-.Op Fl R Oo Ar bind_address : Oc Ns Ar port : Ns Ar host : Ns Ar hostport
+.Op Fl Q Ar query_option
+.Op Fl R Ar address
.Op Fl S Ar ctl_path
.Op Fl W Ar host : Ns Ar port
.Op Fl w Ar local_tun Ns Op : Ns Ar remote_tun
@@ -70,11 +71,11 @@
.Nm
(SSH client) is a program for logging into a remote machine and for
executing commands on a remote machine.
-It is intended to replace rlogin and rsh,
-and provide secure encrypted communications between
+It is intended to provide secure encrypted communications between
two untrusted hosts over an insecure network.
-X11 connections and arbitrary TCP ports
-can also be forwarded over the secure channel.
+X11 connections, arbitrary TCP ports and
+.Ux Ns -domain
+sockets can also be forwarded over the secure channel.
.Pp
.Nm
connects and logs into the specified
@@ -84,7 +85,7 @@
name).
The user must prove
his/her identity to the remote machine using one of several methods
-depending on the protocol version used (see below).
+(see below).
.Pp
If
.Ar command
@@ -92,23 +93,28 @@
it is executed on the remote host instead of a login shell.
.Pp
The options are as follows:
-.Bl -tag -width Ds
+.Pp
+.Bl -tag -width Ds -compact
.It Fl 1
Forces
.Nm
to try protocol version 1 only.
+.Pp
.It Fl 2
Forces
.Nm
to try protocol version 2 only.
+.Pp
.It Fl 4
Forces
.Nm
to use IPv4 addresses only.
+.Pp
.It Fl 6
Forces
.Nm
to use IPv6 addresses only.
+.Pp
.It Fl A
Enables forwarding of the authentication agent connection.
This can also be specified on a per-host basis in a configuration file.
@@ -121,8 +127,10 @@
An attacker cannot obtain key material from the agent,
however they can perform operations on the keys that enable them to
authenticate using the identities loaded into the agent.
+.Pp
.It Fl a
Disables forwarding of the authentication agent connection.
+.Pp
.It Fl b Ar bind_address
Use
.Ar bind_address
@@ -129,9 +137,12 @@
on the local machine as the source address
of the connection.
Only useful on systems with more than one address.
+.Pp
.It Fl C
Requests compression of all data (including stdin, stdout, stderr, and
-data for forwarded X11 and TCP connections).
+data for forwarded X11, TCP and
+.Ux Ns -domain
+connections).
The compression algorithm is the same used by
.Xr gzip 1 ,
and the
@@ -145,6 +156,7 @@
configuration files; see the
.Cm Compression
option.
+.Pp
.It Fl c Ar cipher_spec
Selects the cipher specification for encrypting the session.
.Pp
@@ -154,23 +166,6 @@
.Dq blowfish ,
and
.Dq des .
-.Ar 3des
-(triple-des) is an encrypt-decrypt-encrypt triple with three different keys.
-It is believed to be secure.
-.Ar blowfish
-is a fast block cipher; it appears very secure and is much faster than
-.Ar 3des .
-.Ar des
-is only supported in the
-.Nm
-client for interoperability with legacy protocol 1 implementations
-that do not support the
-.Ar 3des
-cipher.
-Its use is strongly discouraged due to cryptographic weaknesses.
-The default is
-.Dq 3des .
-.Pp
For protocol version 2,
.Ar cipher_spec
is a comma-separated list of ciphers
@@ -180,6 +175,7 @@
keyword in
.Xr ssh_config 5
for more information.
+.Pp
.It Fl D Xo
.Sm off
.Oo Ar bind_address : Oc
@@ -219,10 +215,12 @@
empty address or
.Sq *
indicates that the port should be available from all interfaces.
+.Pp
.It Fl E Ar log_file
Append debug logs to
.Ar log_file
instead of standard error.
+.Pp
.It Fl e Ar escape_char
Sets the escape character for sessions with a pty (default:
.Ql ~ ) .
@@ -235,6 +233,7 @@
Setting the character to
.Dq none
disables any escapes and makes the session fully transparent.
+.Pp
.It Fl F Ar configfile
Specifies an alternative per-user configuration file.
If a configuration file is given on the command line,
@@ -243,6 +242,7 @@
will be ignored.
The default for the per-user configuration file is
.Pa ~/.ssh/config .
+.Pp
.It Fl f
Requests
.Nm
@@ -265,13 +265,27 @@
.Fl f
will wait for all remote port forwards to be successfully established
before placing itself in the background.
+.Pp
+.It Fl G
+Causes
+.Nm
+to print its configuration after evaluating
+.Cm Host
+and
+.Cm Match
+blocks and exit.
+.Pp
.It Fl g
Allows remote hosts to connect to local forwarded ports.
+If used on a multiplexed connection, then this option must be specified
+on the master process.
+.Pp
.It Fl I Ar pkcs11
Specify the PKCS#11 shared library
.Nm
should use to communicate with a PKCS#11 token providing the user's
private RSA key.
+.Pp
.It Fl i Ar identity_file
Selects a file from which the identity (private key) for
public key authentication is read.
@@ -290,16 +304,40 @@
.Fl i
options (and multiple identities specified in
configuration files).
+If no certificates have been explicitly specified by the
+.Cm CertificateFile
+directive,
.Nm
will also try to load certificate information from the filename obtained
by appending
.Pa -cert.pub
to identity filenames.
+.Pp
+.It Fl J Xo
+.Sm off
+.Op Ar user No @
+.Ar host
+.Op : Ar port
+.Sm on
+.Xc
+Connect to the target host by first making a
+.Nm
+connection to the jump
+.Ar host
+and then establishing a TCP forwarding to the ultimate destination from
+there.
+Multiple jump hops may be specified separated by comma characters.
+This is a shortcut to specify a
+.Cm ProxyJump
+configuration directive.
+.Pp
.It Fl K
Enables GSSAPI-based authentication and forwarding (delegation) of GSSAPI
credentials to the server.
+.Pp
.It Fl k
Disables forwarding (delegation) of GSSAPI credentials to the server.
+.Pp
.It Fl L Xo
.Sm off
.Oo Ar bind_address : Oc
@@ -306,22 +344,44 @@
.Ar port : host : hostport
.Sm on
.Xc
-Specifies that the given port on the local (client) host is to be
-forwarded to the given host and port on the remote side.
-This works by allocating a socket to listen to
+.It Fl L Xo
+.Sm off
+.Oo Ar bind_address : Oc
+.Ar port : remote_socket
+.Sm on
+.Xc
+.It Fl L Xo
+.Sm off
+.Ar local_socket : host : hostport
+.Sm on
+.Xc
+.It Fl L Xo
+.Sm off
+.Ar local_socket : remote_socket
+.Sm on
+.Xc
+Specifies that connections to the given TCP port or Unix socket on the local
+(client) host are to be forwarded to the given host and port, or Unix socket,
+on the remote side.
+This works by allocating a socket to listen to either a TCP
.Ar port
on the local side, optionally bound to the specified
-.Ar bind_address .
-Whenever a connection is made to this port, the
+.Ar bind_address ,
+or to a Unix socket.
+Whenever a connection is made to the local port or socket, the
connection is forwarded over the secure channel, and a connection is
-made to
+made to either
.Ar host
port
-.Ar hostport
+.Ar hostport ,
+or the Unix socket
+.Ar remote_socket ,
from the remote machine.
+.Pp
Port forwardings can also be specified in the configuration file.
+Only the superuser can forward privileged ports.
IPv6 addresses can be specified by enclosing the address in square brackets.
-Only the superuser can forward privileged ports.
+.Pp
By default, the local port is bound in accordance with the
.Cm GatewayPorts
setting.
@@ -336,9 +396,11 @@
empty address or
.Sq *
indicates that the port should be available from all interfaces.
+.Pp
.It Fl l Ar login_name
Specifies the user to log in as on the remote machine.
This also may be specified on a per-host basis in the configuration file.
+.Pp
.It Fl M
Places the
.Nm
@@ -357,17 +419,18 @@
in
.Xr ssh_config 5
for details.
+.Pp
.It Fl m Ar mac_spec
-Additionally, for protocol version 2 a comma-separated list of MAC
-(message authentication code) algorithms can
-be specified in order of preference.
+A comma-separated list of MAC (message authentication code) algorithms,
+specified in order of preference.
See the
.Cm MACs
keyword for more information.
+.Pp
.It Fl N
Do not execute a remote command.
-This is useful for just forwarding ports
-(protocol version 2 only).
+This is useful for just forwarding ports.
+.Pp
.It Fl n
Redirects stdin from
.Pa /dev/null
@@ -388,6 +451,7 @@
needs to ask for a password or passphrase; see also the
.Fl f
option.)
+.Pp
.It Fl O Ar ctl_cmd
Control an active connection multiplexing master process.
When the
@@ -406,6 +470,7 @@
(request the master to exit), and
.Dq stop
(request the master to stop accepting further multiplexing requests).
+.Pp
.It Fl o Ar option
Can be used to give options in the format used in the configuration file.
This is useful for specifying options for which there is no separate
@@ -414,6 +479,7 @@
.Xr ssh_config 5 .
.Pp
.Bl -tag -width Ds -offset indent -compact
+.It AddKeysToAgent
.It AddressFamily
.It BatchMode
.It BindAddress
@@ -422,6 +488,7 @@
.It CanonicalizeHostname
.It CanonicalizeMaxDots
.It CanonicalizePermittedCNAMEs
+.It CertificateFile
.It ChallengeResponseAuthentication
.It CheckHostIP
.It Cipher
@@ -437,6 +504,7 @@
.It DynamicForward
.It EscapeChar
.It ExitOnForwardFailure
+.It FingerprintHash
.It ForwardAgent
.It ForwardX11
.It ForwardX11Timeout
@@ -448,11 +516,14 @@
.It HashKnownHosts
.It Host
.It HostbasedAuthentication
+.It HostbasedKeyTypes
.It HostKeyAlgorithms
.It HostKeyAlias
.It HostName
+.It IdentitiesOnly
+.It IdentityAgent
.It IdentityFile
-.It IdentitiesOnly
+.It Include
.It IPQoS
.It KbdInteractiveAuthentication
.It KbdInteractiveDevices
@@ -471,7 +542,9 @@
.It PreferredAuthentications
.It Protocol
.It ProxyCommand
+.It ProxyJump
.It ProxyUseFdpass
+.It PubkeyAcceptedKeyTypes
.It PubkeyAuthentication
.It RekeyLimit
.It RemoteForward
@@ -481,10 +554,13 @@
.It SendEnv
.It ServerAliveInterval
.It ServerAliveCountMax
+.It StreamLocalBindMask
+.It StreamLocalBindUnlink
.It StrictHostKeyChecking
.It TCPKeepAlive
.It Tunnel
.It TunnelDevice
+.It UpdateHostKeys
.It UsePrivilegedPort
.It User
.It UserKnownHostsFile
@@ -492,11 +568,13 @@
.It VisualHostKey
.It XAuthLocation
.El
+.Pp
.It Fl p Ar port
Port to connect to on the remote host.
This can be specified on a
per-host basis in the configuration file.
-.It Fl Q Cm cipher | cipher-auth | mac | kex | key
+.Pp
+.It Fl Q Ar query_option
Queries
.Nm
for the algorithms supported for the specified version 2.
@@ -510,10 +588,18 @@
.Ar kex
(key exchange algorithms),
.Ar key
-(key types).
+(key types),
+.Ar key-cert
+(certificate key types),
+.Ar key-plain
+(non-certificate key types), and
+.Ar protocol-version
+(supported SSH protocol versions).
+.Pp
.It Fl q
Quiet mode.
Causes most warning and diagnostic messages to be suppressed.
+.Pp
.It Fl R Xo
.Sm off
.Oo Ar bind_address : Oc
@@ -520,16 +606,36 @@
.Ar port : host : hostport
.Sm on
.Xc
-Specifies that the given port on the remote (server) host is to be
-forwarded to the given host and port on the local side.
-This works by allocating a socket to listen to
+.It Fl R Xo
+.Sm off
+.Oo Ar bind_address : Oc
+.Ar port : local_socket
+.Sm on
+.Xc
+.It Fl R Xo
+.Sm off
+.Ar remote_socket : host : hostport
+.Sm on
+.Xc
+.It Fl R Xo
+.Sm off
+.Ar remote_socket : local_socket
+.Sm on
+.Xc
+Specifies that connections to the given TCP port or Unix socket on the remote
+(server) host are to be forwarded to the given host and port, or Unix socket,
+on the local side.
+This works by allocating a socket to listen to either a TCP
.Ar port
-on the remote side, and whenever a connection is made to this port, the
-connection is forwarded over the secure channel, and a connection is
-made to
+or to a Unix socket on the remote side.
+Whenever a connection is made to this port or Unix socket, the
+connection is forwarded over the secure channel, and a connection
+is made to either
.Ar host
port
-.Ar hostport
+.Ar hostport ,
+or
+.Ar local_socket ,
from the local machine.
.Pp
Port forwardings can also be specified in the configuration file.
@@ -537,7 +643,7 @@
logging in as root on the remote machine.
IPv6 addresses can be specified by enclosing the address in square brackets.
.Pp
-By default, the listening socket on the server will be bound to the loopback
+By default, TCP listening sockets on the server will be bound to the loopback
interface only.
This may be overridden by specifying a
.Ar bind_address .
@@ -562,6 +668,7 @@
When used together with
.Ic -O forward
the allocated port will be printed to the standard output.
+.Pp
.It Fl S Ar ctl_path
Specifies the location of a control socket for connection sharing,
or the string
@@ -574,16 +681,19 @@
in
.Xr ssh_config 5
for details.
+.Pp
.It Fl s
May be used to request invocation of a subsystem on the remote system.
-Subsystems are a feature of the SSH2 protocol which facilitate the use
-of SSH as a secure transport for other applications (eg.\&
+Subsystems facilitate the use of SSH
+as a secure transport for other applications (e.g.\&
.Xr sftp 1 ) .
The subsystem is specified as the remote command.
+.Pp
.It Fl T
-Disable pseudo-tty allocation.
+Disable pseudo-terminal allocation.
+.Pp
.It Fl t
-Force pseudo-tty allocation.
+Force pseudo-terminal allocation.
This can be used to execute arbitrary
screen-based programs on a remote machine, which can be very useful,
e.g. when implementing menu services.
@@ -592,8 +702,10 @@
options force tty allocation, even if
.Nm
has no local tty.
+.Pp
.It Fl V
Display the version number and exit.
+.Pp
.It Fl v
Verbose mode.
Causes
@@ -605,6 +717,7 @@
.Fl v
options increase the verbosity.
The maximum is 3.
+.Pp
.It Fl W Ar host : Ns Ar port
Requests that standard input and output on the client be forwarded to
.Ar host
@@ -616,8 +729,11 @@
.Fl T ,
.Cm ExitOnForwardFailure
and
-.Cm ClearAllForwardings .
-Works with Protocol version 2 only.
+.Cm ClearAllForwardings ,
+though these can be overridden in the configuration file or using
+.Fl o
+command line options.
+.Pp
.It Fl w Xo
.Ar local_tun Ns Op : Ns Ar remote_tun
.Xc
@@ -647,6 +763,7 @@
.Cm Tunnel
directive is unset, it is set to the default tunnel mode, which is
.Dq point-to-point .
+.Pp
.It Fl X
Enables X11 forwarding.
This can also be specified on a per-host basis in a configuration file.
@@ -667,12 +784,15 @@
directive in
.Xr ssh_config 5
for more information.
+.Pp
.It Fl x
Disables X11 forwarding.
+.Pp
.It Fl Y
Enables trusted X11 forwarding.
Trusted X11 forwardings are not subjected to the X11 SECURITY extension
controls.
+.Pp
.It Fl y
Send log information using the
.Xr syslog 3
@@ -697,15 +817,10 @@
and
.Fl 2
options (see above).
-Both protocols support similar authentication methods,
-but protocol 2 is the default since
-it provides additional mechanisms for confidentiality
-(the traffic is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour)
-and integrity (hmac-md5, hmac-sha1,
-hmac-sha2-256, hmac-sha2-512,
-umac-64, umac-128, hmac-ripemd160).
-Protocol 1 lacks a strong mechanism for ensuring the
-integrity of the connection.
+Protocol 1 should not be used
+and is only offered to support legacy devices.
+It suffers from a number of cryptographic weaknesses
+and doesn't support many of the advanced features available for protocol 2.
.Pp
The methods available for authentication are:
GSSAPI-based authentication,
@@ -714,8 +829,9 @@
challenge-response authentication,
and password authentication.
Authentication methods are tried in the order specified above,
-though protocol 2 has a configuration option to change the default order:
-.Cm PreferredAuthentications .
+though
+.Cm PreferredAuthentications
+can be used to change the default order.
.Pp
Host-based authentication works as follows:
If the machine the user logs in from is listed in
@@ -758,9 +874,7 @@
The server knows the public key, and only the user knows the private key.
.Nm
implements public key authentication protocol automatically,
-using one of the DSA, ECDSA, ED25519 or RSA algorithms.
-Protocol 1 is restricted to using only RSA keys,
-but protocol 2 may use any.
+using one of the DSA, ECDSA, Ed25519 or RSA algorithms.
The HISTORY section of
.Xr ssl 8
contains a brief discussion of the DSA and RSA algorithms.
@@ -782,26 +896,26 @@
.Pa ~/.ssh/identity
(protocol 1),
.Pa ~/.ssh/id_dsa
-(protocol 2 DSA),
+(DSA),
.Pa ~/.ssh/id_ecdsa
-(protocol 2 ECDSA),
+(ECDSA),
.Pa ~/.ssh/id_ed25519
-(protocol 2 ED25519),
+(Ed25519),
or
.Pa ~/.ssh/id_rsa
-(protocol 2 RSA)
+(RSA)
and stores the public key in
.Pa ~/.ssh/identity.pub
(protocol 1),
.Pa ~/.ssh/id_dsa.pub
-(protocol 2 DSA),
+(DSA),
.Pa ~/.ssh/id_ecdsa.pub
-(protocol 2 ECDSA),
+(ECDSA),
.Pa ~/.ssh/id_ed25519.pub
-(protocol 2 ED25519),
+(Ed25519),
or
.Pa ~/.ssh/id_rsa.pub
-(protocol 2 RSA)
+(RSA)
in the user's home directory.
The user should then copy the public key
to
@@ -829,6 +943,10 @@
may be with an authentication agent.
See
.Xr ssh-agent 1
+and (optionally) the
+.Cm AddKeysToAgent
+directive in
+.Xr ssh_config 5
for more information.
.Pp
Challenge-response authentication works as follows:
@@ -835,8 +953,6 @@
The server sends an arbitrary
.Qq challenge
text, and prompts for a response.
-Protocol 2 allows multiple challenges and responses;
-protocol 1 is restricted to just one challenge/response.
Examples of challenge-response authentication include
.Bx
Authentication (see
@@ -873,15 +989,26 @@
host key is not known or has changed.
.Pp
When the user's identity has been accepted by the server, the server
-either executes the given command, or logs into the machine and gives
-the user a normal shell on the remote machine.
+either executes the given command in a non-interactive session or,
+if no command has been specified, logs into the machine and gives
+the user a normal shell as an interactive session.
All communication with
the remote command or shell will be automatically encrypted.
.Pp
-If a pseudo-terminal has been allocated (normal login session), the
+If an interactive session is requested
+.Nm
+by default will only request a pseudo-terminal (pty) for interactive
+sessions when the client has one.
+The flags
+.Fl T
+and
+.Fl t
+can be used to override this behaviour.
+.Pp
+If a pseudo-terminal has been allocated the
user may use the escape characters noted below.
.Pp
-If no pseudo-tty has been allocated,
+If no pseudo-terminal has been allocated,
the session is transparent and can be used to reliably transfer binary data.
On most systems, setting the escape character to
.Dq none
@@ -924,7 +1051,7 @@
Display a list of escape characters.
.It Cm ~B
Send a BREAK to the remote system
-(only useful for SSH protocol version 2 and if the peer supports it).
+(only useful if the peer supports it).
.It Cm ~C
Open command line.
Currently this allows the addition of port forwardings using the
@@ -957,7 +1084,7 @@
option.
.It Cm ~R
Request rekeying of the connection
-(only useful for SSH protocol version 2 and if the peer supports it).
+(only useful if the peer supports it).
.It Cm ~V
Decrease the verbosity
.Pq Ic LogLevel
@@ -1092,8 +1219,13 @@
.Pp
If the fingerprint is already known, it can be matched
and the key can be accepted or rejected.
+If only legacy (MD5) fingerprints for the server are available, the
+.Xr ssh-keygen 1
+.Fl E
+option may be used to downgrade the fingerprint algorithm to match.
+.Pp
Because of the difficulty of comparing host keys
-just by looking at hex strings,
+just by looking at fingerprint strings,
there is also support to compare host keys visually,
using
.Em random art .
@@ -1338,7 +1470,7 @@
and not accessible by others.
.Pp
.It Pa ~/.ssh/authorized_keys
-Lists the public keys (DSA, ECDSA, ED25519, RSA)
+Lists the public keys (DSA, ECDSA, Ed25519, RSA)
that can be used for logging in as this user.
The format of this file is described in the
.Xr sshd 8
@@ -1420,20 +1552,6 @@
.It Pa /etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys
and are used for host-based authentication.
-If protocol version 1 is used,
-.Nm
-must be setuid root, since the host key is readable only by root.
-For protocol version 2,
-.Nm
-uses
-.Xr ssh-keysign 8
-to access the host keys,
-eliminating the requirement that
-.Nm
-be setuid root when host-based authentication is used.
-By default
-.Nm
-is not setuid root.
.Pp
.It Pa /etc/ssh/ssh_known_hosts
Systemwide list of known host keys.
@@ -1465,7 +1583,6 @@
.Xr ssh-keygen 1 ,
.Xr ssh-keyscan 1 ,
.Xr tun 4 ,
-.Xr hosts.equiv 5 ,
.Xr ssh_config 5 ,
.Xr ssh-keysign 8 ,
.Xr sshd 8
Modified: trunk/crypto/openssh/ssh.c
===================================================================
--- trunk/crypto/openssh/ssh.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.401 2014/02/26 20:18:37 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.445 2016/07/17 04:20:16 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -48,7 +48,6 @@
#endif
#include <sys/resource.h>
#include <sys/ioctl.h>
-#include <sys/param.h>
#include <sys/socket.h>
#include <sys/wait.h>
@@ -67,12 +66,16 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
+#include <locale.h>
#include <netinet/in.h>
#include <arpa/inet.h>
+#ifdef WITH_OPENSSL
#include <openssl/evp.h>
#include <openssl/err.h>
+#endif
#include "openbsd-compat/openssl-compat.h"
#include "openbsd-compat/sys-queue.h"
@@ -83,6 +86,7 @@
#include "canohost.h"
#include "compat.h"
#include "cipher.h"
+#include "digest.h"
#include "packet.h"
#include "buffer.h"
#include "channels.h"
@@ -93,9 +97,9 @@
#include "dispatch.h"
#include "clientloop.h"
#include "log.h"
+#include "misc.h"
#include "readconf.h"
#include "sshconnect.h"
-#include "misc.h"
#include "kex.h"
#include "mac.h"
#include "sshpty.h"
@@ -102,8 +106,9 @@
#include "match.h"
#include "msg.h"
#include "uidswap.h"
-#include "roaming.h"
#include "version.h"
+#include "ssherr.h"
+#include "myproposal.h"
#ifdef ENABLE_PKCS11
#include "ssh-pkcs11.h"
@@ -147,10 +152,6 @@
*/
int fork_after_authentication_flag = 0;
-/* forward stdio to remote host and port */
-char *stdio_forward_host = NULL;
-int stdio_forward_port = 0;
-
/*
* General data structure for command line options and options configurable
* in configuration files. See readconf.h.
@@ -196,14 +197,13 @@
usage(void)
{
fprintf(stderr,
-"usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]\n"
+"usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]\n"
" [-D [bind_address:]port] [-E log_file] [-e escape_char]\n"
" [-F configfile] [-I pkcs11] [-i identity_file]\n"
-" [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]\n"
-" [-O ctl_cmd] [-o option] [-p port]\n"
-" [-Q cipher | cipher-auth | mac | kex | key]\n"
-" [-R [bind_address:]port:host:hostport] [-S ctl_path] [-W host:port]\n"
-" [-w local_tun[:remote_tun]] [user@]hostname [command]\n"
+" [-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]\n"
+" [-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]\n"
+" [-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]]\n"
+" [user@]hostname [command]\n"
);
exit(255);
}
@@ -247,7 +247,7 @@
if (port <= 0)
port = default_ssh_port();
- snprintf(strport, sizeof strport, "%u", port);
+ snprintf(strport, sizeof strport, "%d", port);
memset(&hints, 0, sizeof(hints));
hints.ai_family = options.address_family == -1 ?
AF_UNSPEC : options.address_family;
@@ -273,12 +273,66 @@
}
/*
+ * Attempt to resolve a numeric host address / port to a single address.
+ * Returns a canonical address string.
+ * Returns NULL on failure.
+ * NB. this function must operate with a options having undefined members.
+ */
+static struct addrinfo *
+resolve_addr(const char *name, int port, char *caddr, size_t clen)
+{
+ char addr[NI_MAXHOST], strport[NI_MAXSERV];
+ struct addrinfo hints, *res;
+ int gaierr;
+
+ if (port <= 0)
+ port = default_ssh_port();
+ snprintf(strport, sizeof strport, "%u", port);
+ memset(&hints, 0, sizeof(hints));
+ hints.ai_family = options.address_family == -1 ?
+ AF_UNSPEC : options.address_family;
+ hints.ai_socktype = SOCK_STREAM;
+ hints.ai_flags = AI_NUMERICHOST|AI_NUMERICSERV;
+ if ((gaierr = getaddrinfo(name, strport, &hints, &res)) != 0) {
+ debug2("%s: could not resolve name %.100s as address: %s",
+ __func__, name, ssh_gai_strerror(gaierr));
+ return NULL;
+ }
+ if (res == NULL) {
+ debug("%s: getaddrinfo %.100s returned no addresses",
+ __func__, name);
+ return NULL;
+ }
+ if (res->ai_next != NULL) {
+ debug("%s: getaddrinfo %.100s returned multiple addresses",
+ __func__, name);
+ goto fail;
+ }
+ if ((gaierr = getnameinfo(res->ai_addr, res->ai_addrlen,
+ addr, sizeof(addr), NULL, 0, NI_NUMERICHOST)) != 0) {
+ debug("%s: Could not format address for name %.100s: %s",
+ __func__, name, ssh_gai_strerror(gaierr));
+ goto fail;
+ }
+ if (strlcpy(caddr, addr, clen) >= clen) {
+ error("%s: host \"%s\" addr \"%s\" too long (max %lu)",
+ __func__, name, addr, (u_long)clen);
+ if (clen > 0)
+ *caddr = '\0';
+ fail:
+ freeaddrinfo(res);
+ return NULL;
+ }
+ return res;
+}
+
+/*
* Check whether the cname is a permitted replacement for the hostname
* and perform the replacement if it is.
* NB. this function must operate with a options having undefined members.
*/
static int
-check_follow_cname(char **namep, const char *cname)
+check_follow_cname(int direct, char **namep, const char *cname)
{
int i;
struct allowed_cname *rule;
@@ -290,18 +344,16 @@
return 0;
/*
* Don't attempt to canonicalize names that will be interpreted by
- * a proxy unless the user specifically requests so.
+ * a proxy or jump host unless the user specifically requests so.
*/
- if (!option_clear_or_none(options.proxy_command) &&
+ if (!direct &&
options.canonicalize_hostname != SSH_CANONICALISE_ALWAYS)
return 0;
debug3("%s: check \"%s\" CNAME \"%s\"", __func__, *namep, cname);
for (i = 0; i < options.num_permitted_cnames; i++) {
rule = options.permitted_cnames + i;
- if (match_pattern_list(*namep, rule->source_list,
- strlen(rule->source_list), 1) != 1 ||
- match_pattern_list(cname, rule->target_list,
- strlen(rule->target_list), 1) != 1)
+ if (match_pattern_list(*namep, rule->source_list, 1) != 1 ||
+ match_pattern_list(cname, rule->target_list, 1) != 1)
continue;
verbose("Canonicalized DNS aliased hostname "
"\"%s\" => \"%s\"", *namep, cname);
@@ -321,8 +373,8 @@
static struct addrinfo *
resolve_canonicalize(char **hostp, int port)
{
- int i, ndots;
- char *cp, *fullhost, cname_target[NI_MAXHOST];
+ int i, direct, ndots;
+ char *cp, *fullhost, newname[NI_MAXHOST];
struct addrinfo *addrs;
if (options.canonicalize_hostname == SSH_CANONICALISE_NO)
@@ -332,10 +384,36 @@
* Don't attempt to canonicalize names that will be interpreted by
* a proxy unless the user specifically requests so.
*/
- if (!option_clear_or_none(options.proxy_command) &&
+ direct = option_clear_or_none(options.proxy_command) &&
+ options.jump_host == NULL;
+ if (!direct &&
options.canonicalize_hostname != SSH_CANONICALISE_ALWAYS)
return NULL;
+ /* Try numeric hostnames first */
+ if ((addrs = resolve_addr(*hostp, port,
+ newname, sizeof(newname))) != NULL) {
+ debug2("%s: hostname %.100s is address", __func__, *hostp);
+ if (strcasecmp(*hostp, newname) != 0) {
+ debug2("%s: canonicalised address \"%s\" => \"%s\"",
+ __func__, *hostp, newname);
+ free(*hostp);
+ *hostp = xstrdup(newname);
+ }
+ return addrs;
+ }
+
+ /* If domain name is anchored, then resolve it now */
+ if ((*hostp)[strlen(*hostp) - 1] == '.') {
+ debug3("%s: name is fully qualified", __func__);
+ fullhost = xstrdup(*hostp);
+ if ((addrs = resolve_host(fullhost, port, 0,
+ newname, sizeof(newname))) != NULL)
+ goto found;
+ free(fullhost);
+ goto notfound;
+ }
+
/* Don't apply canonicalization to sufficiently-qualified hostnames */
ndots = 0;
for (cp = *hostp; *cp != '\0'; cp++) {
@@ -349,20 +427,21 @@
}
/* Attempt each supplied suffix */
for (i = 0; i < options.num_canonical_domains; i++) {
- *cname_target = '\0';
+ *newname = '\0';
xasprintf(&fullhost, "%s.%s.", *hostp,
options.canonical_domains[i]);
debug3("%s: attempting \"%s\" => \"%s\"", __func__,
*hostp, fullhost);
if ((addrs = resolve_host(fullhost, port, 0,
- cname_target, sizeof(cname_target))) == NULL) {
+ newname, sizeof(newname))) == NULL) {
free(fullhost);
continue;
}
+ found:
/* Remove trailing '.' */
fullhost[strlen(fullhost) - 1] = '\0';
/* Follow CNAME if requested */
- if (!check_follow_cname(&fullhost, cname_target)) {
+ if (!check_follow_cname(direct, &fullhost, newname)) {
debug("Canonicalized hostname \"%s\" => \"%s\"",
*hostp, fullhost);
}
@@ -370,6 +449,7 @@
*hostp = fullhost;
return addrs;
}
+ notfound:
if (!options.canonicalize_fallback_local)
fatal("%s: Could not resolve host \"%s\"", __progname, *hostp);
debug2("%s: host %s not found in any suffix", __func__, *hostp);
@@ -381,15 +461,15 @@
* file if the user specifies a config file on the command line.
*/
static void
-process_config_files(struct passwd *pw)
+process_config_files(const char *host_arg, struct passwd *pw, int post_canon)
{
- char buf[MAXPATHLEN];
+ char buf[PATH_MAX];
int r;
if (config != NULL) {
if (strcasecmp(config, "none") != 0 &&
- !read_config_file(config, pw, host, &options,
- SSHCONF_USERCONF))
+ !read_config_file(config, pw, host, host_arg, &options,
+ SSHCONF_USERCONF | (post_canon ? SSHCONF_POSTCANON : 0)))
fatal("Can't open user config file %.100s: "
"%.100s", config, strerror(errno));
} else {
@@ -396,15 +476,37 @@
r = snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir,
_PATH_SSH_USER_CONFFILE);
if (r > 0 && (size_t)r < sizeof(buf))
- (void)read_config_file(buf, pw, host, &options,
- SSHCONF_CHECKPERM|SSHCONF_USERCONF);
+ (void)read_config_file(buf, pw, host, host_arg,
+ &options, SSHCONF_CHECKPERM | SSHCONF_USERCONF |
+ (post_canon ? SSHCONF_POSTCANON : 0));
/* Read systemwide configuration file after user config. */
- (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, host,
- &options, 0);
+ (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw,
+ host, host_arg, &options,
+ post_canon ? SSHCONF_POSTCANON : 0);
}
}
+/* Rewrite the port number in an addrinfo list of addresses */
+static void
+set_addrinfo_port(struct addrinfo *addrs, int port)
+{
+ struct addrinfo *addr;
+
+ for (addr = addrs; addr != NULL; addr = addr->ai_next) {
+ switch (addr->ai_family) {
+ case AF_INET:
+ ((struct sockaddr_in *)addr->ai_addr)->
+ sin_port = htons(port);
+ break;
+ case AF_INET6:
+ ((struct sockaddr_in6 *)addr->ai_addr)->
+ sin6_port = htons(port);
+ break;
+ }
+ }
+}
+
/*
* Main program for the ssh client.
*/
@@ -411,18 +513,22 @@
int
main(int ac, char **av)
{
- int i, r, opt, exit_status, use_syslog;
- char *p, *cp, *line, *argv0, buf[MAXPATHLEN], *host_arg, *logfile;
+ struct ssh *ssh = NULL;
+ int i, r, opt, exit_status, use_syslog, direct, config_test = 0;
+ char *p, *cp, *line, *argv0, buf[PATH_MAX], *host_arg, *logfile;
char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV];
- char cname[NI_MAXHOST];
+ char cname[NI_MAXHOST], uidstr[32], *conn_hash_hex;
struct stat st;
struct passwd *pw;
int timeout_ms;
extern int optind, optreset;
extern char *optarg;
- Forward fwd;
+ struct Forward fwd;
struct addrinfo *addrs = NULL;
+ struct ssh_digest_ctx *md;
+ u_char conn_hash[SSH_DIGEST_MAX_LENGTH];
+ ssh_malloc_init(); /* must be called before any mallocs */
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
@@ -487,6 +593,8 @@
*/
umask(022);
+ setlocale(LC_CTYPE, "");
+
/*
* Initialize option structure to indicate that no values have been
* set.
@@ -501,7 +609,7 @@
again:
while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx"
- "ACD:E:F:I:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) {
+ "ACD:E:F:GI:J:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) {
switch (opt) {
case '1':
options.protocol = SSH_PROTO_1;
@@ -532,17 +640,20 @@
use_syslog = 1;
break;
case 'E':
- logfile = xstrdup(optarg);
+ logfile = optarg;
break;
+ case 'G':
+ config_test = 1;
+ break;
case 'Y':
options.forward_x11 = 1;
options.forward_x11_trusted = 1;
break;
case 'g':
- options.gateway_ports = 1;
+ options.fwd_opts.gateway_ports = 1;
break;
case 'O':
- if (stdio_forward_host != NULL)
+ if (options.stdio_forward_host != NULL)
fatal("Cannot specify multiplexing "
"command with -W");
else if (muxclient_command != 0)
@@ -579,6 +690,13 @@
cp = key_alg_list(1, 0);
else if (strcmp(optarg, "key-plain") == 0)
cp = key_alg_list(0, 1);
+ else if (strcmp(optarg, "protocol-version") == 0) {
+#ifdef WITH_SSH1
+ cp = xstrdup("1\n2");
+#else
+ cp = xstrdup("2");
+#endif
+ }
if (cp == NULL)
fatal("Unsupported query \"%s\"", optarg);
printf("%s\n", cp);
@@ -599,21 +717,32 @@
options.gss_deleg_creds = 1;
break;
case 'i':
- if (stat(optarg, &st) < 0) {
+ p = tilde_expand_filename(optarg, original_real_uid);
+ if (stat(p, &st) < 0)
fprintf(stderr, "Warning: Identity file %s "
- "not accessible: %s.\n", optarg,
+ "not accessible: %s.\n", p,
strerror(errno));
- break;
- }
- add_identity_file(&options, NULL, optarg, 1);
+ else
+ add_identity_file(&options, NULL, p, 1);
+ free(p);
break;
case 'I':
#ifdef ENABLE_PKCS11
+ free(options.pkcs11_provider);
options.pkcs11_provider = xstrdup(optarg);
#else
fprintf(stderr, "no support for PKCS#11.\n");
#endif
break;
+ case 'J':
+ if (options.jump_host != NULL)
+ fatal("Only a single -J option permitted");
+ if (options.proxy_command != NULL)
+ fatal("Cannot specify -J with ProxyCommand");
+ if (parse_jump(optarg, &options, 1) == -1)
+ fatal("Invalid -J argument");
+ options.proxy_command = xstrdup("none");
+ break;
case 't':
if (options.request_tty == REQUEST_TTY_YES)
options.request_tty = REQUEST_TTY_FORCE;
@@ -625,13 +754,21 @@
debug_flag = 1;
options.log_level = SYSLOG_LEVEL_DEBUG1;
} else {
- if (options.log_level < SYSLOG_LEVEL_DEBUG3)
+ if (options.log_level < SYSLOG_LEVEL_DEBUG3) {
+ debug_flag++;
options.log_level++;
+ }
}
break;
case 'V':
fprintf(stderr, "%s, %s\n",
- SSH_RELEASE, SSLeay_version(SSLEAY_VERSION));
+ SSH_RELEASE,
+#ifdef WITH_OPENSSL
+ SSLeay_version(SSLEAY_VERSION)
+#else
+ "without OpenSSL"
+#endif
+ );
if (opt == 'V')
exit(0);
break;
@@ -646,13 +783,13 @@
}
break;
case 'W':
- if (stdio_forward_host != NULL)
+ if (options.stdio_forward_host != NULL)
fatal("stdio forward already specified");
if (muxclient_command != 0)
fatal("Cannot specify stdio forward with -O");
if (parse_forward(&fwd, optarg, 1, 0)) {
- stdio_forward_host = fwd.listen_host;
- stdio_forward_port = fwd.listen_port;
+ options.stdio_forward_host = fwd.listen_host;
+ options.stdio_forward_port = fwd.listen_port;
free(fwd.connect_host);
} else {
fprintf(stderr,
@@ -662,8 +799,6 @@
}
options.request_tty = REQUEST_TTY_NO;
no_shell_flag = 1;
- options.clear_forwardings = 1;
- options.exit_on_forward_failure = 1;
break;
case 'q':
options.log_level = SYSLOG_LEVEL_QUIET;
@@ -684,31 +819,33 @@
}
break;
case 'c':
- if (ciphers_valid(optarg)) {
+ if (ciphers_valid(*optarg == '+' ?
+ optarg + 1 : optarg)) {
/* SSH2 only */
+ free(options.ciphers);
options.ciphers = xstrdup(optarg);
options.cipher = SSH_CIPHER_INVALID;
- } else {
- /* SSH1 only */
- options.cipher = cipher_number(optarg);
- if (options.cipher == -1) {
- fprintf(stderr,
- "Unknown cipher type '%s'\n",
- optarg);
- exit(255);
- }
- if (options.cipher == SSH_CIPHER_3DES)
- options.ciphers = "3des-cbc";
- else if (options.cipher == SSH_CIPHER_BLOWFISH)
- options.ciphers = "blowfish-cbc";
- else
- options.ciphers = (char *)-1;
+ break;
}
+ /* SSH1 only */
+ options.cipher = cipher_number(optarg);
+ if (options.cipher == -1) {
+ fprintf(stderr, "Unknown cipher type '%s'\n",
+ optarg);
+ exit(255);
+ }
+ if (options.cipher == SSH_CIPHER_3DES)
+ options.ciphers = xstrdup("3des-cbc");
+ else if (options.cipher == SSH_CIPHER_BLOWFISH)
+ options.ciphers = xstrdup("blowfish-cbc");
+ else
+ options.ciphers = xstrdup(KEX_CLIENT_ENCRYPT);
break;
case 'm':
- if (mac_valid(optarg))
+ if (mac_valid(optarg)) {
+ free(options.macs);
options.macs = xstrdup(optarg);
- else {
+ } else {
fprintf(stderr, "Unknown mac type '%s'\n",
optarg);
exit(255);
@@ -776,9 +913,9 @@
break;
case 'o':
line = xstrdup(optarg);
- if (process_config_line(&options, pw, host ? host : "",
- line, "command-line", 0, NULL, SSHCONF_USERCONF)
- != 0)
+ if (process_config_line(&options, pw,
+ host ? host : "", host ? host : "", line,
+ "command-line", 0, NULL, SSHCONF_USERCONF) != 0)
exit(255);
free(line);
break;
@@ -786,8 +923,7 @@
subsystem_flag = 1;
break;
case 'S':
- if (options.control_path != NULL)
- free(options.control_path);
+ free(options.control_path);
options.control_path = xstrdup(optarg);
break;
case 'b':
@@ -828,8 +964,10 @@
host_arg = xstrdup(host);
+#ifdef WITH_OPENSSL
OpenSSL_add_all_algorithms();
ERR_load_crypto_strings();
+#endif
/* Initialize the command to execute on remote host. */
buffer_init(&command);
@@ -867,19 +1005,23 @@
*/
if (use_syslog && logfile != NULL)
fatal("Can't specify both -y and -E");
- if (logfile != NULL) {
+ if (logfile != NULL)
log_redirect_stderr_to(logfile);
- free(logfile);
- }
log_init(argv0,
options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level,
SYSLOG_FACILITY_USER, !use_syslog);
if (debug_flag)
- logit("%s, %s", SSH_VERSION, SSLeay_version(SSLEAY_VERSION));
+ logit("%s, %s", SSH_RELEASE,
+#ifdef WITH_OPENSSL
+ SSLeay_version(SSLEAY_VERSION)
+#else
+ "without OpenSSL"
+#endif
+ );
/* Parse the configuration files */
- process_config_files(pw);
+ process_config_files(host_arg, pw, 0);
/* Hostname canonicalisation needs a few options filled. */
fill_default_options_for_canonicalization(&options);
@@ -891,6 +1033,8 @@
"h", host, (char *)NULL);
free(host);
host = cp;
+ free(options.hostname);
+ options.hostname = xstrdup(host);
}
/* If canonicalization requested then try to apply it */
@@ -911,27 +1055,77 @@
* has specifically requested canonicalisation for this case via
* CanonicalizeHostname=always
*/
- if (addrs == NULL && options.num_permitted_cnames != 0 &&
- (option_clear_or_none(options.proxy_command) ||
- options.canonicalize_hostname == SSH_CANONICALISE_ALWAYS)) {
- if ((addrs = resolve_host(host, options.port, 1,
- cname, sizeof(cname))) == NULL)
- cleanup_exit(255); /* resolve_host logs the error */
- check_follow_cname(&host, cname);
+ direct = option_clear_or_none(options.proxy_command) &&
+ options.jump_host == NULL;
+ if (addrs == NULL && options.num_permitted_cnames != 0 && (direct ||
+ options.canonicalize_hostname == SSH_CANONICALISE_ALWAYS)) {
+ if ((addrs = resolve_host(host, options.port,
+ option_clear_or_none(options.proxy_command),
+ cname, sizeof(cname))) == NULL) {
+ /* Don't fatal proxied host names not in the DNS */
+ if (option_clear_or_none(options.proxy_command))
+ cleanup_exit(255); /* logged in resolve_host */
+ } else
+ check_follow_cname(direct, &host, cname);
}
/*
- * If the target hostname has changed as a result of canonicalisation
- * then re-parse the configuration files as new stanzas may match.
+ * If canonicalisation is enabled then re-parse the configuration
+ * files as new stanzas may match.
*/
- if (strcasecmp(host_arg, host) != 0) {
- debug("Hostname has changed; re-reading configuration");
- process_config_files(pw);
+ if (options.canonicalize_hostname != 0) {
+ debug("Re-reading configuration after hostname "
+ "canonicalisation");
+ free(options.hostname);
+ options.hostname = xstrdup(host);
+ process_config_files(host_arg, pw, 1);
+ /*
+ * Address resolution happens early with canonicalisation
+ * enabled and the port number may have changed since, so
+ * reset it in address list
+ */
+ if (addrs != NULL && options.port > 0)
+ set_addrinfo_port(addrs, options.port);
}
/* Fill configuration defaults. */
fill_default_options(&options);
+ /*
+ * If ProxyJump option specified, then construct a ProxyCommand now.
+ */
+ if (options.jump_host != NULL) {
+ char port_s[8];
+
+ /* Consistency check */
+ if (options.proxy_command != NULL)
+ fatal("inconsistent options: ProxyCommand+ProxyJump");
+ /* Never use FD passing for ProxyJump */
+ options.proxy_use_fdpass = 0;
+ snprintf(port_s, sizeof(port_s), "%d", options.jump_port);
+ xasprintf(&options.proxy_command,
+ "ssh%s%s%s%s%s%s%s%s%s%.*s -W %%h:%%p %s",
+ /* Optional "-l user" argument if jump_user set */
+ options.jump_user == NULL ? "" : " -l ",
+ options.jump_user == NULL ? "" : options.jump_user,
+ /* Optional "-p port" argument if jump_port set */
+ options.jump_port <= 0 ? "" : " -p ",
+ options.jump_port <= 0 ? "" : port_s,
+ /* Optional additional jump hosts ",..." */
+ options.jump_extra == NULL ? "" : " -J ",
+ options.jump_extra == NULL ? "" : options.jump_extra,
+ /* Optional "-F" argumment if -F specified */
+ config == NULL ? "" : " -F ",
+ config == NULL ? "" : config,
+ /* Optional "-v" arguments if -v set */
+ debug_flag ? " -" : "",
+ debug_flag, "vvv",
+ /* Mandatory hostname */
+ options.jump_host);
+ debug("Setting implicit ProxyCommand from ProxyJump: %s",
+ options.proxy_command);
+ }
+
if (options.port == 0)
options.port = default_ssh_port();
channel_set_af(options.address_family);
@@ -943,6 +1137,14 @@
strcmp(options.proxy_command, "-") == 0 &&
options.proxy_use_fdpass)
fatal("ProxyCommand=- and ProxyUseFDPass are incompatible");
+ if (options.control_persist &&
+ options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK) {
+ debug("UpdateHostKeys=ask is incompatible with ControlPersist; "
+ "disabling");
+ options.update_hostkeys = 0;
+ }
+ if (options.connection_attempts <= 0)
+ fatal("Invalid number of ConnectionAttempts");
#ifndef HAVE_CYGWIN
if (original_effective_uid != 0)
options.use_privileged_port = 0;
@@ -981,13 +1183,31 @@
strlcpy(shorthost, thishost, sizeof(shorthost));
shorthost[strcspn(thishost, ".")] = '\0';
snprintf(portstr, sizeof(portstr), "%d", options.port);
+ snprintf(uidstr, sizeof(uidstr), "%d", pw->pw_uid);
+ if ((md = ssh_digest_start(SSH_DIGEST_SHA1)) == NULL ||
+ ssh_digest_update(md, thishost, strlen(thishost)) < 0 ||
+ ssh_digest_update(md, host, strlen(host)) < 0 ||
+ ssh_digest_update(md, portstr, strlen(portstr)) < 0 ||
+ ssh_digest_update(md, options.user, strlen(options.user)) < 0 ||
+ ssh_digest_final(md, conn_hash, sizeof(conn_hash)) < 0)
+ fatal("%s: mux digest failed", __func__);
+ ssh_digest_free(md);
+ conn_hash_hex = tohex(conn_hash, ssh_digest_bytes(SSH_DIGEST_SHA1));
+
if (options.local_command != NULL) {
debug3("expanding LocalCommand: %s", options.local_command);
cp = options.local_command;
- options.local_command = percent_expand(cp, "d", pw->pw_dir,
- "h", host, "l", thishost, "n", host_arg, "r", options.user,
- "p", portstr, "u", pw->pw_name, "L", shorthost,
+ options.local_command = percent_expand(cp,
+ "C", conn_hash_hex,
+ "L", shorthost,
+ "d", pw->pw_dir,
+ "h", host,
+ "l", thishost,
+ "n", host_arg,
+ "p", portstr,
+ "r", options.user,
+ "u", pw->pw_name,
(char *)NULL);
debug3("expanded LocalCommand: %s", options.local_command);
free(cp);
@@ -997,12 +1217,26 @@
cp = tilde_expand_filename(options.control_path,
original_real_uid);
free(options.control_path);
- options.control_path = percent_expand(cp, "h", host,
- "l", thishost, "n", host_arg, "r", options.user,
- "p", portstr, "u", pw->pw_name, "L", shorthost,
+ options.control_path = percent_expand(cp,
+ "C", conn_hash_hex,
+ "L", shorthost,
+ "h", host,
+ "l", thishost,
+ "n", host_arg,
+ "p", portstr,
+ "r", options.user,
+ "u", pw->pw_name,
+ "i", uidstr,
(char *)NULL);
free(cp);
}
+ free(conn_hash_hex);
+
+ if (config_test) {
+ dump_client_config(&options, host);
+ exit(0);
+ }
+
if (muxclient_command != 0 && options.control_path == NULL)
fatal("No ControlPath specified for \"-O\" command");
if (options.control_path != NULL)
@@ -1013,6 +1247,7 @@
* have yet resolved the hostname. Do so now.
*/
if (addrs == NULL && options.proxy_command == NULL) {
+ debug2("resolving \"%s\" port %d", host, options.port);
if ((addrs = resolve_host(host, options.port, 1,
cname, sizeof(cname))) == NULL)
cleanup_exit(255); /* resolve_host logs the error */
@@ -1033,6 +1268,8 @@
packet_set_timeout(options.server_alive_interval,
options.server_alive_count_max);
+ ssh = active_state; /* XXX */
+
if (timeout_ms > 0)
debug3("timeout: %d ms remain after connect", timeout_ms);
@@ -1056,28 +1293,30 @@
sensitive_data.keys[i] = NULL;
PRIV_START;
+#if WITH_SSH1
sensitive_data.keys[0] = key_load_private_type(KEY_RSA1,
_PATH_HOST_KEY_FILE, "", NULL, NULL);
- sensitive_data.keys[1] = key_load_private_cert(KEY_DSA,
- _PATH_HOST_DSA_KEY_FILE, "", NULL);
+#endif
#ifdef OPENSSL_HAS_ECC
- sensitive_data.keys[2] = key_load_private_cert(KEY_ECDSA,
+ sensitive_data.keys[1] = key_load_private_cert(KEY_ECDSA,
_PATH_HOST_ECDSA_KEY_FILE, "", NULL);
#endif
+ sensitive_data.keys[2] = key_load_private_cert(KEY_ED25519,
+ _PATH_HOST_ED25519_KEY_FILE, "", NULL);
sensitive_data.keys[3] = key_load_private_cert(KEY_RSA,
_PATH_HOST_RSA_KEY_FILE, "", NULL);
- sensitive_data.keys[4] = key_load_private_cert(KEY_ED25519,
- _PATH_HOST_ED25519_KEY_FILE, "", NULL);
- sensitive_data.keys[5] = key_load_private_type(KEY_DSA,
- _PATH_HOST_DSA_KEY_FILE, "", NULL, NULL);
+ sensitive_data.keys[4] = key_load_private_cert(KEY_DSA,
+ _PATH_HOST_DSA_KEY_FILE, "", NULL);
#ifdef OPENSSL_HAS_ECC
- sensitive_data.keys[6] = key_load_private_type(KEY_ECDSA,
+ sensitive_data.keys[5] = key_load_private_type(KEY_ECDSA,
_PATH_HOST_ECDSA_KEY_FILE, "", NULL, NULL);
#endif
+ sensitive_data.keys[6] = key_load_private_type(KEY_ED25519,
+ _PATH_HOST_ED25519_KEY_FILE, "", NULL, NULL);
sensitive_data.keys[7] = key_load_private_type(KEY_RSA,
_PATH_HOST_RSA_KEY_FILE, "", NULL, NULL);
- sensitive_data.keys[8] = key_load_private_type(KEY_ED25519,
- _PATH_HOST_ED25519_KEY_FILE, "", NULL, NULL);
+ sensitive_data.keys[8] = key_load_private_type(KEY_DSA,
+ _PATH_HOST_DSA_KEY_FILE, "", NULL, NULL);
PRIV_END;
if (options.hostbased_authentication == 1 &&
@@ -1086,26 +1325,26 @@
sensitive_data.keys[6] == NULL &&
sensitive_data.keys[7] == NULL &&
sensitive_data.keys[8] == NULL) {
+#ifdef OPENSSL_HAS_ECC
sensitive_data.keys[1] = key_load_cert(
- _PATH_HOST_DSA_KEY_FILE);
-#ifdef OPENSSL_HAS_ECC
- sensitive_data.keys[2] = key_load_cert(
_PATH_HOST_ECDSA_KEY_FILE);
#endif
+ sensitive_data.keys[2] = key_load_cert(
+ _PATH_HOST_ED25519_KEY_FILE);
sensitive_data.keys[3] = key_load_cert(
_PATH_HOST_RSA_KEY_FILE);
sensitive_data.keys[4] = key_load_cert(
- _PATH_HOST_ED25519_KEY_FILE);
+ _PATH_HOST_DSA_KEY_FILE);
+#ifdef OPENSSL_HAS_ECC
sensitive_data.keys[5] = key_load_public(
- _PATH_HOST_DSA_KEY_FILE, NULL);
-#ifdef OPENSSL_HAS_ECC
- sensitive_data.keys[6] = key_load_public(
_PATH_HOST_ECDSA_KEY_FILE, NULL);
#endif
+ sensitive_data.keys[6] = key_load_public(
+ _PATH_HOST_ED25519_KEY_FILE, NULL);
sensitive_data.keys[7] = key_load_public(
_PATH_HOST_RSA_KEY_FILE, NULL);
sensitive_data.keys[8] = key_load_public(
- _PATH_HOST_ED25519_KEY_FILE, NULL);
+ _PATH_HOST_DSA_KEY_FILE, NULL);
sensitive_data.external_keysign = 1;
}
}
@@ -1143,6 +1382,23 @@
/* load options.identity_files */
load_public_identity_files();
+ /* optionally set the SSH_AUTHSOCKET_ENV_NAME varibale */
+ if (options.identity_agent &&
+ strcmp(options.identity_agent, SSH_AUTHSOCKET_ENV_NAME) != 0) {
+ if (strcmp(options.identity_agent, "none") == 0) {
+ unsetenv(SSH_AUTHSOCKET_ENV_NAME);
+ } else {
+ p = tilde_expand_filename(options.identity_agent,
+ original_real_uid);
+ cp = percent_expand(p, "d", pw->pw_dir,
+ "u", pw->pw_name, "l", thishost, "h", host,
+ "r", options.user, (char *)NULL);
+ setenv(SSH_AUTHSOCKET_ENV_NAME, cp, 1);
+ free(cp);
+ free(p);
+ }
+ }
+
/* Expand ~ in known host file names. */
tilde_expand_paths(options.system_hostfiles,
options.num_system_hostfiles);
@@ -1157,7 +1413,7 @@
if (packet_connection_is_on_socket()) {
verbose("Authenticated to %s ([%s]:%d).", host,
- get_remote_ipaddr(), get_remote_port());
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
} else {
verbose("Authenticated to %s (via proxy).", host);
}
@@ -1182,6 +1438,10 @@
options.identity_keys[i] = NULL;
}
}
+ for (i = 0; i < options.num_certificate_files; i++) {
+ free(options.certificate_files[i]);
+ options.certificate_files[i] = NULL;
+ }
exit_status = compat20 ? ssh_session2() : ssh_session();
packet_close();
@@ -1199,7 +1459,7 @@
control_persist_detach(void)
{
pid_t pid;
- int devnull;
+ int devnull, keep_stderr;
debug("%s: backgrounding master process", __func__);
@@ -1230,8 +1490,10 @@
error("%s: open(\"/dev/null\"): %s", __func__,
strerror(errno));
} else {
+ keep_stderr = log_is_on_stderr() && debug_flag;
if (dup2(devnull, STDIN_FILENO) == -1 ||
- dup2(devnull, STDOUT_FILENO) == -1)
+ dup2(devnull, STDOUT_FILENO) == -1 ||
+ (!keep_stderr && dup2(devnull, STDERR_FILENO) == -1))
error("%s: dup2: %s", __func__, strerror(errno));
if (devnull > STDERR_FILENO)
close(devnull);
@@ -1256,13 +1518,17 @@
static void
ssh_confirm_remote_forward(int type, u_int32_t seq, void *ctxt)
{
- Forward *rfwd = (Forward *)ctxt;
+ struct Forward *rfwd = (struct Forward *)ctxt;
/* XXX verbose() on failure? */
- debug("remote forward %s for: listen %d, connect %s:%d",
+ debug("remote forward %s for: listen %s%s%d, connect %s:%d",
type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
- rfwd->listen_port, rfwd->connect_host, rfwd->connect_port);
- if (rfwd->listen_port == 0) {
+ rfwd->listen_path ? rfwd->listen_path :
+ rfwd->listen_host ? rfwd->listen_host : "",
+ (rfwd->listen_path || rfwd->listen_host) ? ":" : "",
+ rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path :
+ rfwd->connect_host, rfwd->connect_port);
+ if (rfwd->listen_path == NULL && rfwd->listen_port == 0) {
if (type == SSH2_MSG_REQUEST_SUCCESS) {
rfwd->allocated_port = packet_get_int();
logit("Allocated port %u for remote forward to %s:%d",
@@ -1276,12 +1542,21 @@
}
if (type == SSH2_MSG_REQUEST_FAILURE) {
- if (options.exit_on_forward_failure)
- fatal("Error: remote port forwarding failed for "
- "listen port %d", rfwd->listen_port);
- else
- logit("Warning: remote port forwarding failed for "
- "listen port %d", rfwd->listen_port);
+ if (options.exit_on_forward_failure) {
+ if (rfwd->listen_path != NULL)
+ fatal("Error: remote port forwarding failed "
+ "for listen path %s", rfwd->listen_path);
+ else
+ fatal("Error: remote port forwarding failed "
+ "for listen port %d", rfwd->listen_port);
+ } else {
+ if (rfwd->listen_path != NULL)
+ logit("Warning: remote port forwarding failed "
+ "for listen path %s", rfwd->listen_path);
+ else
+ logit("Warning: remote port forwarding failed "
+ "for listen port %d", rfwd->listen_port);
+ }
}
if (++remote_forward_confirms_received == options.num_remote_forwards) {
debug("All remote forwarding requests processed");
@@ -1298,25 +1573,34 @@
}
static void
+ssh_stdio_confirm(int id, int success, void *arg)
+{
+ if (!success)
+ fatal("stdio forwarding failed");
+}
+
+static void
ssh_init_stdio_forwarding(void)
{
Channel *c;
int in, out;
- if (stdio_forward_host == NULL)
+ if (options.stdio_forward_host == NULL)
return;
if (!compat20)
fatal("stdio forwarding require Protocol 2");
- debug3("%s: %s:%d", __func__, stdio_forward_host, stdio_forward_port);
+ debug3("%s: %s:%d", __func__, options.stdio_forward_host,
+ options.stdio_forward_port);
if ((in = dup(STDIN_FILENO)) < 0 ||
(out = dup(STDOUT_FILENO)) < 0)
fatal("channel_connect_stdio_fwd: dup() in/out failed");
- if ((c = channel_connect_stdio_fwd(stdio_forward_host,
- stdio_forward_port, in, out)) == NULL)
+ if ((c = channel_connect_stdio_fwd(options.stdio_forward_host,
+ options.stdio_forward_port, in, out)) == NULL)
fatal("%s: channel_connect_stdio_fwd failed", __func__);
channel_register_cleanup(c->self, client_cleanup_stdio_fwd, 0);
+ channel_register_open_confirm(c->self, ssh_stdio_confirm, NULL);
}
static void
@@ -1329,18 +1613,18 @@
for (i = 0; i < options.num_local_forwards; i++) {
debug("Local connections to %.200s:%d forwarded to remote "
"address %.200s:%d",
+ (options.local_forwards[i].listen_path != NULL) ?
+ options.local_forwards[i].listen_path :
(options.local_forwards[i].listen_host == NULL) ?
- (options.gateway_ports ? "*" : "LOCALHOST") :
+ (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
options.local_forwards[i].listen_host,
options.local_forwards[i].listen_port,
+ (options.local_forwards[i].connect_path != NULL) ?
+ options.local_forwards[i].connect_path :
options.local_forwards[i].connect_host,
options.local_forwards[i].connect_port);
success += channel_setup_local_fwd_listener(
- options.local_forwards[i].listen_host,
- options.local_forwards[i].listen_port,
- options.local_forwards[i].connect_host,
- options.local_forwards[i].connect_port,
- options.gateway_ports);
+ &options.local_forwards[i], &options.fwd_opts);
}
if (i > 0 && success != i && options.exit_on_forward_failure)
fatal("Could not request local forwarding.");
@@ -1351,17 +1635,18 @@
for (i = 0; i < options.num_remote_forwards; i++) {
debug("Remote connections from %.200s:%d forwarded to "
"local address %.200s:%d",
+ (options.remote_forwards[i].listen_path != NULL) ?
+ options.remote_forwards[i].listen_path :
(options.remote_forwards[i].listen_host == NULL) ?
"LOCALHOST" : options.remote_forwards[i].listen_host,
options.remote_forwards[i].listen_port,
+ (options.remote_forwards[i].connect_path != NULL) ?
+ options.remote_forwards[i].connect_path :
options.remote_forwards[i].connect_host,
options.remote_forwards[i].connect_port);
options.remote_forwards[i].handle =
channel_request_remote_forwarding(
- options.remote_forwards[i].listen_host,
- options.remote_forwards[i].listen_port,
- options.remote_forwards[i].connect_host,
- options.remote_forwards[i].connect_port);
+ &options.remote_forwards[i]);
if (options.remote_forwards[i].handle < 0) {
if (options.exit_on_forward_failure)
fatal("Could not request remote forwarding.");
@@ -1389,10 +1674,16 @@
static void
check_agent_present(void)
{
+ int r;
+
if (options.forward_agent) {
/* Clear agent forwarding if we don't have an agent. */
- if (!ssh_agent_present())
+ if ((r = ssh_get_authentication_socket(NULL)) != 0) {
options.forward_agent = 0;
+ if (r != SSH_ERR_AGENT_NOT_PRESENT)
+ debug("ssh_get_authentication_socket: %s",
+ ssh_err(r));
+ }
}
}
@@ -1405,6 +1696,7 @@
struct winsize ws;
char *cp;
const char *display;
+ char *proto = NULL, *data = NULL;
/* Enable compression if requested. */
if (options.compression) {
@@ -1473,13 +1765,11 @@
}
/* Request X11 forwarding if enabled and DISPLAY is set. */
display = getenv("DISPLAY");
- if (options.forward_x11 && display != NULL) {
- char *proto, *data;
- /* Get reasonable local authentication information. */
- client_x11_get_proto(display, options.xauth_location,
- options.forward_x11_trusted,
- options.forward_x11_timeout,
- &proto, &data);
+ if (display == NULL && options.forward_x11)
+ debug("X11 forwarding requested but DISPLAY not set");
+ if (options.forward_x11 && client_x11_get_proto(display,
+ options.xauth_location, options.forward_x11_trusted,
+ options.forward_x11_timeout, &proto, &data) == 0) {
/* Request forwarding with authentication spoofing. */
debug("Requesting X11 forwarding with authentication "
"spoofing.");
@@ -1569,17 +1859,17 @@
extern char **environ;
const char *display;
int interactive = tty_flag;
+ char *proto = NULL, *data = NULL;
if (!success)
return; /* No need for error message, channels code sens one */
display = getenv("DISPLAY");
- if (options.forward_x11 && display != NULL) {
- char *proto, *data;
- /* Get reasonable local authentication information. */
- client_x11_get_proto(display, options.xauth_location,
- options.forward_x11_trusted,
- options.forward_x11_timeout, &proto, &data);
+ if (display == NULL && options.forward_x11)
+ debug("X11 forwarding requested but DISPLAY not set");
+ if (options.forward_x11 && client_x11_get_proto(display,
+ options.xauth_location, options.forward_x11_trusted,
+ options.forward_x11_timeout, &proto, &data) == 0) {
/* Request forwarding with authentication spoofing. */
debug("Requesting X11 forwarding with authentication "
"spoofing.");
@@ -1733,25 +2023,30 @@
options.escape_char : SSH_ESCAPECHAR_NONE, id);
}
+/* Loads all IdentityFile and CertificateFile keys */
static void
load_public_identity_files(void)
{
char *filename, *cp, thishost[NI_MAXHOST];
char *pwdir = NULL, *pwname = NULL;
- int i = 0;
Key *public;
struct passwd *pw;
- u_int n_ids;
+ int i;
+ u_int n_ids, n_certs;
char *identity_files[SSH_MAX_IDENTITY_FILES];
Key *identity_keys[SSH_MAX_IDENTITY_FILES];
+ char *certificate_files[SSH_MAX_CERTIFICATE_FILES];
+ struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES];
#ifdef ENABLE_PKCS11
Key **keys;
int nkeys;
#endif /* PKCS11 */
- n_ids = 0;
+ n_ids = n_certs = 0;
memset(identity_files, 0, sizeof(identity_files));
memset(identity_keys, 0, sizeof(identity_keys));
+ memset(certificate_files, 0, sizeof(certificate_files));
+ memset(certificates, 0, sizeof(certificates));
#ifdef ENABLE_PKCS11
if (options.pkcs11_provider != NULL &&
@@ -1783,6 +2078,7 @@
if (n_ids >= SSH_MAX_IDENTITY_FILES ||
strcasecmp(options.identity_files[i], "none") == 0) {
free(options.identity_files[i]);
+ options.identity_files[i] = NULL;
continue;
}
cp = tilde_expand_filename(options.identity_files[i],
@@ -1801,7 +2097,12 @@
if (++n_ids >= SSH_MAX_IDENTITY_FILES)
continue;
- /* Try to add the certificate variant too */
+ /*
+ * If no certificates have been explicitly listed then try
+ * to add the default certificate variant too.
+ */
+ if (options.num_certificate_files != 0)
+ continue;
xasprintf(&cp, "%s-cert", filename);
public = key_load_public(cp, NULL);
debug("identity file %s type %d", cp,
@@ -1818,14 +2119,50 @@
continue;
}
identity_keys[n_ids] = public;
- /* point to the original path, most likely the private key */
- identity_files[n_ids] = xstrdup(filename);
+ identity_files[n_ids] = cp;
n_ids++;
}
+
+ if (options.num_certificate_files > SSH_MAX_CERTIFICATE_FILES)
+ fatal("%s: too many certificates", __func__);
+ for (i = 0; i < options.num_certificate_files; i++) {
+ cp = tilde_expand_filename(options.certificate_files[i],
+ original_real_uid);
+ filename = percent_expand(cp, "d", pwdir,
+ "u", pwname, "l", thishost, "h", host,
+ "r", options.user, (char *)NULL);
+ free(cp);
+
+ public = key_load_public(filename, NULL);
+ debug("certificate file %s type %d", filename,
+ public ? public->type : -1);
+ free(options.certificate_files[i]);
+ options.certificate_files[i] = NULL;
+ if (public == NULL) {
+ free(filename);
+ continue;
+ }
+ if (!key_is_cert(public)) {
+ debug("%s: key %s type %s is not a certificate",
+ __func__, filename, key_type(public));
+ key_free(public);
+ free(filename);
+ continue;
+ }
+ certificate_files[n_certs] = filename;
+ certificates[n_certs] = public;
+ ++n_certs;
+ }
+
options.num_identity_files = n_ids;
memcpy(options.identity_files, identity_files, sizeof(identity_files));
memcpy(options.identity_keys, identity_keys, sizeof(identity_keys));
+ options.num_certificate_files = n_certs;
+ memcpy(options.certificate_files,
+ certificate_files, sizeof(certificate_files));
+ memcpy(options.certificates, certificates, sizeof(certificates));
+
explicit_bzero(pwname, strlen(pwname));
free(pwname);
explicit_bzero(pwdir, strlen(pwdir));
Modified: trunk/crypto/openssh/ssh.h
===================================================================
--- trunk/crypto/openssh/ssh.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.h,v 1.79 2010/06/25 07:14:46 djm Exp $ */
+/* $OpenBSD: ssh.h,v 1.83 2015/12/11 03:19:09 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -19,6 +19,12 @@
#define SSH_DEFAULT_PORT 22
/*
+ * Maximum number of certificate files that can be specified
+ * in configuration files or on the command line.
+ */
+#define SSH_MAX_CERTIFICATE_FILES 100
+
+/*
* Maximum number of RSA authentication identity files that can be specified
* in configuration files or on the command line.
*/
@@ -29,7 +35,7 @@
* Current value permits 16kbit RSA and RSA1 keys and 8kbit DSA keys, with
* some room for options and comments.
*/
-#define SSH_MAX_PUBKEY_BYTES 8192
+#define SSH_MAX_PUBKEY_BYTES 16384
/*
* Major protocol version. Different version indicates major incompatibility
Modified: trunk/crypto/openssh/ssh1.h
===================================================================
--- trunk/crypto/openssh/ssh1.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh1.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh1.h,v 1.6 2006/03/25 22:22:43 djm Exp $ */
+/* $OpenBSD: ssh1.h,v 1.7 2016/05/04 14:22:33 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -22,7 +22,6 @@
#define SSH_MSG_MIN 1
#define SSH_MSG_MAX 254
/* Message name */ /* msg code */ /* arguments */
-#define SSH_MSG_NONE 0 /* no message */
#define SSH_MSG_DISCONNECT 1 /* cause (string) */
#define SSH_SMSG_PUBLIC_KEY 2 /* ck,msk,srvk,hostk */
#define SSH_CMSG_SESSION_KEY 3 /* key (BIGNUM) */
Modified: trunk/crypto/openssh/ssh2.h
===================================================================
--- trunk/crypto/openssh/ssh2.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh2.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh2.h,v 1.15 2014/01/29 06:18:35 djm Exp $ */
+/* $OpenBSD: ssh2.h,v 1.18 2016/05/04 14:22:33 markus Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -55,6 +55,10 @@
* 192-255 Local extensions
*/
+/* special marker for no message */
+
+#define SSH_MSG_NONE 0
+
/* ranges */
#define SSH2_MSG_TRANSPORT_MIN 1
@@ -80,6 +84,7 @@
#define SSH2_MSG_DEBUG 4
#define SSH2_MSG_SERVICE_REQUEST 5
#define SSH2_MSG_SERVICE_ACCEPT 6
+#define SSH2_MSG_EXT_INFO 7
/* transport layer: alg negotiation */
@@ -164,13 +169,6 @@
#define SSH2_EXTENDED_DATA_STDERR 1
-/* kex messages for resume at appgate.com */
-#define SSH2_MSG_KEX_ROAMING_RESUME 30
-#define SSH2_MSG_KEX_ROAMING_AUTH_REQUIRED 31
-#define SSH2_MSG_KEX_ROAMING_AUTH 32
-#define SSH2_MSG_KEX_ROAMING_AUTH_OK 33
-#define SSH2_MSG_KEX_ROAMING_AUTH_FAIL 34
-
/* Certificate types for OpenSSH certificate keys extension */
#define SSH2_CERT_TYPE_USER 1
#define SSH2_CERT_TYPE_HOST 2
Copied: trunk/crypto/openssh/ssh_api.c (from rev 9222, vendor-crypto/openssh/dist/ssh_api.c)
===================================================================
--- trunk/crypto/openssh/ssh_api.c (rev 0)
+++ trunk/crypto/openssh/ssh_api.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,541 @@
+/* $OpenBSD: ssh_api.c,v 1.7 2016/05/04 14:22:33 markus Exp $ */
+/*
+ * Copyright (c) 2012 Markus Friedl. All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#include "ssh_api.h"
+#include "compat.h"
+#include "log.h"
+#include "authfile.h"
+#include "sshkey.h"
+#include "misc.h"
+#include "ssh2.h"
+#include "version.h"
+#include "myproposal.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+
+#include <string.h>
+
+int _ssh_exchange_banner(struct ssh *);
+int _ssh_send_banner(struct ssh *, char **);
+int _ssh_read_banner(struct ssh *, char **);
+int _ssh_order_hostkeyalgs(struct ssh *);
+int _ssh_verify_host_key(struct sshkey *, struct ssh *);
+struct sshkey *_ssh_host_public_key(int, int, struct ssh *);
+struct sshkey *_ssh_host_private_key(int, int, struct ssh *);
+int _ssh_host_key_sign(struct sshkey *, struct sshkey *,
+ u_char **, size_t *, const u_char *, size_t, const char *, u_int);
+
+/*
+ * stubs for the server side implementation of kex.
+ * disable privsep so our stubs will never be called.
+ */
+int use_privsep = 0;
+int mm_sshkey_sign(struct sshkey *, u_char **, u_int *,
+ u_char *, u_int, char *, u_int);
+DH *mm_choose_dh(int, int, int);
+
+/* Define these two variables here so that they are part of the library */
+u_char *session_id2 = NULL;
+u_int session_id2_len = 0;
+
+int
+mm_sshkey_sign(struct sshkey *key, u_char **sigp, u_int *lenp,
+ u_char *data, u_int datalen, char *alg, u_int compat)
+{
+ return (-1);
+}
+
+DH *
+mm_choose_dh(int min, int nbits, int max)
+{
+ return (NULL);
+}
+
+/* API */
+
+int
+ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
+{
+ char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
+ struct ssh *ssh;
+ char **proposal;
+ static int called;
+ int r;
+
+ if (!called) {
+#ifdef WITH_OPENSSL
+ OpenSSL_add_all_algorithms();
+#endif /* WITH_OPENSSL */
+ called = 1;
+ }
+
+ if ((ssh = ssh_packet_set_connection(NULL, -1, -1)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (is_server)
+ ssh_packet_set_server(ssh);
+
+ /* Initialize key exchange */
+ proposal = kex_params ? kex_params->proposal : myproposal;
+ if ((r = kex_new(ssh, proposal, &ssh->kex)) != 0) {
+ ssh_free(ssh);
+ return r;
+ }
+ ssh->kex->server = is_server;
+ if (is_server) {
+#ifdef WITH_OPENSSL
+ ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
+ ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
+ ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
+ ssh->kex->kex[KEX_DH_GRP16_SHA512] = kexdh_server;
+ ssh->kex->kex[KEX_DH_GRP18_SHA512] = kexdh_server;
+ ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+ ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
+# ifdef OPENSSL_HAS_ECC
+ ssh->kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+# endif
+#endif /* WITH_OPENSSL */
+ ssh->kex->kex[KEX_C25519_SHA256] = kexc25519_server;
+ ssh->kex->load_host_public_key=&_ssh_host_public_key;
+ ssh->kex->load_host_private_key=&_ssh_host_private_key;
+ ssh->kex->sign=&_ssh_host_key_sign;
+ } else {
+#ifdef WITH_OPENSSL
+ ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
+ ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
+ ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_client;
+ ssh->kex->kex[KEX_DH_GRP16_SHA512] = kexdh_client;
+ ssh->kex->kex[KEX_DH_GRP18_SHA512] = kexdh_client;
+ ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
+ ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
+# ifdef OPENSSL_HAS_ECC
+ ssh->kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
+# endif
+#endif /* WITH_OPENSSL */
+ ssh->kex->kex[KEX_C25519_SHA256] = kexc25519_client;
+ ssh->kex->verify_host_key =&_ssh_verify_host_key;
+ }
+ *sshp = ssh;
+ return 0;
+}
+
+void
+ssh_free(struct ssh *ssh)
+{
+ struct key_entry *k;
+
+ ssh_packet_close(ssh);
+ /*
+ * we've only created the public keys variants in case we
+ * are a acting as a server.
+ */
+ while ((k = TAILQ_FIRST(&ssh->public_keys)) != NULL) {
+ TAILQ_REMOVE(&ssh->public_keys, k, next);
+ if (ssh->kex && ssh->kex->server)
+ sshkey_free(k->key);
+ free(k);
+ }
+ while ((k = TAILQ_FIRST(&ssh->private_keys)) != NULL) {
+ TAILQ_REMOVE(&ssh->private_keys, k, next);
+ free(k);
+ }
+ if (ssh->kex)
+ kex_free(ssh->kex);
+ free(ssh);
+}
+
+void
+ssh_set_app_data(struct ssh *ssh, void *app_data)
+{
+ ssh->app_data = app_data;
+}
+
+void *
+ssh_get_app_data(struct ssh *ssh)
+{
+ return ssh->app_data;
+}
+
+/* Returns < 0 on error, 0 otherwise */
+int
+ssh_add_hostkey(struct ssh *ssh, struct sshkey *key)
+{
+ struct sshkey *pubkey = NULL;
+ struct key_entry *k = NULL, *k_prv = NULL;
+ int r;
+
+ if (ssh->kex->server) {
+ if ((r = sshkey_from_private(key, &pubkey)) != 0)
+ return r;
+ if ((k = malloc(sizeof(*k))) == NULL ||
+ (k_prv = malloc(sizeof(*k_prv))) == NULL) {
+ free(k);
+ sshkey_free(pubkey);
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ k_prv->key = key;
+ TAILQ_INSERT_TAIL(&ssh->private_keys, k_prv, next);
+
+ /* add the public key, too */
+ k->key = pubkey;
+ TAILQ_INSERT_TAIL(&ssh->public_keys, k, next);
+ r = 0;
+ } else {
+ if ((k = malloc(sizeof(*k))) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ k->key = key;
+ TAILQ_INSERT_TAIL(&ssh->public_keys, k, next);
+ r = 0;
+ }
+
+ return r;
+}
+
+int
+ssh_set_verify_host_key_callback(struct ssh *ssh,
+ int (*cb)(struct sshkey *, struct ssh *))
+{
+ if (cb == NULL || ssh->kex == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+
+ ssh->kex->verify_host_key = cb;
+
+ return 0;
+}
+
+int
+ssh_input_append(struct ssh *ssh, const u_char *data, size_t len)
+{
+ return sshbuf_put(ssh_packet_get_input(ssh), data, len);
+}
+
+int
+ssh_packet_next(struct ssh *ssh, u_char *typep)
+{
+ int r;
+ u_int32_t seqnr;
+ u_char type;
+
+ /*
+ * Try to read a packet. Return SSH_MSG_NONE if no packet or not
+ * enough data.
+ */
+ *typep = SSH_MSG_NONE;
+ if (ssh->kex->client_version_string == NULL ||
+ ssh->kex->server_version_string == NULL)
+ return _ssh_exchange_banner(ssh);
+ /*
+ * If we enough data and a dispatch function then
+ * call the function and get the next packet.
+ * Otherwise return the packet type to the caller so it
+ * can decide how to go on.
+ *
+ * We will only call the dispatch function for:
+ * 20-29 Algorithm negotiation
+ * 30-49 Key exchange method specific (numbers can be reused for
+ * different authentication methods)
+ */
+ for (;;) {
+ if ((r = ssh_packet_read_poll2(ssh, &type, &seqnr)) != 0)
+ return r;
+ if (type > 0 && type < DISPATCH_MAX &&
+ type >= SSH2_MSG_KEXINIT && type <= SSH2_MSG_TRANSPORT_MAX &&
+ ssh->dispatch[type] != NULL) {
+ if ((r = (*ssh->dispatch[type])(type, seqnr, ssh)) != 0)
+ return r;
+ } else {
+ *typep = type;
+ return 0;
+ }
+ }
+}
+
+const u_char *
+ssh_packet_payload(struct ssh *ssh, size_t *lenp)
+{
+ return sshpkt_ptr(ssh, lenp);
+}
+
+int
+ssh_packet_put(struct ssh *ssh, int type, const u_char *data, size_t len)
+{
+ int r;
+
+ if ((r = sshpkt_start(ssh, type)) != 0 ||
+ (r = sshpkt_put(ssh, data, len)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ return r;
+ return 0;
+}
+
+const u_char *
+ssh_output_ptr(struct ssh *ssh, size_t *len)
+{
+ struct sshbuf *output = ssh_packet_get_output(ssh);
+
+ *len = sshbuf_len(output);
+ return sshbuf_ptr(output);
+}
+
+int
+ssh_output_consume(struct ssh *ssh, size_t len)
+{
+ return sshbuf_consume(ssh_packet_get_output(ssh), len);
+}
+
+int
+ssh_output_space(struct ssh *ssh, size_t len)
+{
+ return (0 == sshbuf_check_reserve(ssh_packet_get_output(ssh), len));
+}
+
+int
+ssh_input_space(struct ssh *ssh, size_t len)
+{
+ return (0 == sshbuf_check_reserve(ssh_packet_get_input(ssh), len));
+}
+
+/* Read other side's version identification. */
+int
+_ssh_read_banner(struct ssh *ssh, char **bannerp)
+{
+ struct sshbuf *input;
+ const char *s;
+ char buf[256], remote_version[256]; /* must be same size! */
+ const char *mismatch = "Protocol mismatch.\r\n";
+ int r, remote_major, remote_minor;
+ size_t i, n, j, len;
+
+ *bannerp = NULL;
+ input = ssh_packet_get_input(ssh);
+ len = sshbuf_len(input);
+ s = (const char *)sshbuf_ptr(input);
+ for (j = n = 0;;) {
+ for (i = 0; i < sizeof(buf) - 1; i++) {
+ if (j >= len)
+ return (0);
+ buf[i] = s[j++];
+ if (buf[i] == '\r') {
+ buf[i] = '\n';
+ buf[i + 1] = 0;
+ continue; /**XXX wait for \n */
+ }
+ if (buf[i] == '\n') {
+ buf[i + 1] = 0;
+ break;
+ }
+ }
+ buf[sizeof(buf) - 1] = 0;
+ if (strncmp(buf, "SSH-", 4) == 0)
+ break;
+ debug("ssh_exchange_identification: %s", buf);
+ if (ssh->kex->server || ++n > 65536) {
+ if ((r = sshbuf_put(ssh_packet_get_output(ssh),
+ mismatch, strlen(mismatch))) != 0)
+ return r;
+ return SSH_ERR_NO_PROTOCOL_VERSION;
+ }
+ }
+ if ((r = sshbuf_consume(input, j)) != 0)
+ return r;
+
+ /*
+ * Check that the versions match. In future this might accept
+ * several versions and set appropriate flags to handle them.
+ */
+ if (sscanf(buf, "SSH-%d.%d-%[^\n]\n",
+ &remote_major, &remote_minor, remote_version) != 3)
+ return SSH_ERR_INVALID_FORMAT;
+ debug("Remote protocol version %d.%d, remote software version %.100s",
+ remote_major, remote_minor, remote_version);
+
+ ssh->compat = compat_datafellows(remote_version);
+ if (remote_major == 1 && remote_minor == 99) {
+ remote_major = 2;
+ remote_minor = 0;
+ }
+ if (remote_major != 2)
+ return SSH_ERR_PROTOCOL_MISMATCH;
+ enable_compat20();
+ chop(buf);
+ debug("Remote version string %.100s", buf);
+ if ((*bannerp = strdup(buf)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ return 0;
+}
+
+/* Send our own protocol version identification. */
+int
+_ssh_send_banner(struct ssh *ssh, char **bannerp)
+{
+ char buf[256];
+ int r;
+
+ snprintf(buf, sizeof buf, "SSH-2.0-%.100s\r\n", SSH_VERSION);
+ if ((r = sshbuf_put(ssh_packet_get_output(ssh), buf, strlen(buf))) != 0)
+ return r;
+ chop(buf);
+ debug("Local version string %.100s", buf);
+ if ((*bannerp = strdup(buf)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ return 0;
+}
+
+int
+_ssh_exchange_banner(struct ssh *ssh)
+{
+ struct kex *kex = ssh->kex;
+ int r;
+
+ /*
+ * if _ssh_read_banner() cannot parse a full version string
+ * it will return NULL and we end up calling it again.
+ */
+
+ r = 0;
+ if (kex->server) {
+ if (kex->server_version_string == NULL)
+ r = _ssh_send_banner(ssh, &kex->server_version_string);
+ if (r == 0 &&
+ kex->server_version_string != NULL &&
+ kex->client_version_string == NULL)
+ r = _ssh_read_banner(ssh, &kex->client_version_string);
+ } else {
+ if (kex->server_version_string == NULL)
+ r = _ssh_read_banner(ssh, &kex->server_version_string);
+ if (r == 0 &&
+ kex->server_version_string != NULL &&
+ kex->client_version_string == NULL)
+ r = _ssh_send_banner(ssh, &kex->client_version_string);
+ }
+ if (r != 0)
+ return r;
+ /* start initial kex as soon as we have exchanged the banners */
+ if (kex->server_version_string != NULL &&
+ kex->client_version_string != NULL) {
+ if ((r = _ssh_order_hostkeyalgs(ssh)) != 0 ||
+ (r = kex_send_kexinit(ssh)) != 0)
+ return r;
+ }
+ return 0;
+}
+
+struct sshkey *
+_ssh_host_public_key(int type, int nid, struct ssh *ssh)
+{
+ struct key_entry *k;
+
+ debug3("%s: need %d", __func__, type);
+ TAILQ_FOREACH(k, &ssh->public_keys, next) {
+ debug3("%s: check %s", __func__, sshkey_type(k->key));
+ if (k->key->type == type &&
+ (type != KEY_ECDSA || k->key->ecdsa_nid == nid))
+ return (k->key);
+ }
+ return (NULL);
+}
+
+struct sshkey *
+_ssh_host_private_key(int type, int nid, struct ssh *ssh)
+{
+ struct key_entry *k;
+
+ debug3("%s: need %d", __func__, type);
+ TAILQ_FOREACH(k, &ssh->private_keys, next) {
+ debug3("%s: check %s", __func__, sshkey_type(k->key));
+ if (k->key->type == type &&
+ (type != KEY_ECDSA || k->key->ecdsa_nid == nid))
+ return (k->key);
+ }
+ return (NULL);
+}
+
+int
+_ssh_verify_host_key(struct sshkey *hostkey, struct ssh *ssh)
+{
+ struct key_entry *k;
+
+ debug3("%s: need %s", __func__, sshkey_type(hostkey));
+ TAILQ_FOREACH(k, &ssh->public_keys, next) {
+ debug3("%s: check %s", __func__, sshkey_type(k->key));
+ if (sshkey_equal_public(hostkey, k->key))
+ return (0); /* ok */
+ }
+ return (-1); /* failed */
+}
+
+/* offer hostkey algorithms in kexinit depending on registered keys */
+int
+_ssh_order_hostkeyalgs(struct ssh *ssh)
+{
+ struct key_entry *k;
+ char *orig, *avail, *oavail = NULL, *alg, *replace = NULL;
+ char **proposal;
+ size_t maxlen;
+ int ktype, r;
+
+ /* XXX we de-serialize ssh->kex->my, modify it, and change it */
+ if ((r = kex_buf2prop(ssh->kex->my, NULL, &proposal)) != 0)
+ return r;
+ orig = proposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
+ if ((oavail = avail = strdup(orig)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ maxlen = strlen(avail) + 1;
+ if ((replace = calloc(1, maxlen)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ *replace = '\0';
+ while ((alg = strsep(&avail, ",")) && *alg != '\0') {
+ if ((ktype = sshkey_type_from_name(alg)) == KEY_UNSPEC)
+ continue;
+ TAILQ_FOREACH(k, &ssh->public_keys, next) {
+ if (k->key->type == ktype ||
+ (sshkey_is_cert(k->key) && k->key->type ==
+ sshkey_type_plain(ktype))) {
+ if (*replace != '\0')
+ strlcat(replace, ",", maxlen);
+ strlcat(replace, alg, maxlen);
+ break;
+ }
+ }
+ }
+ if (*replace != '\0') {
+ debug2("%s: orig/%d %s", __func__, ssh->kex->server, orig);
+ debug2("%s: replace/%d %s", __func__, ssh->kex->server, replace);
+ free(orig);
+ proposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = replace;
+ replace = NULL; /* owned by proposal */
+ r = kex_prop2buf(ssh->kex->my, proposal);
+ }
+ out:
+ free(oavail);
+ free(replace);
+ kex_prop_free(proposal);
+ return r;
+}
+
+int
+_ssh_host_key_sign(struct sshkey *privkey, struct sshkey *pubkey,
+ u_char **signature, size_t *slen, const u_char *data, size_t dlen,
+ const char *alg, u_int compat)
+{
+ return sshkey_sign(privkey, signature, slen, data, dlen, alg, compat);
+}
Copied: trunk/crypto/openssh/ssh_api.h (from rev 9222, vendor-crypto/openssh/dist/ssh_api.h)
===================================================================
--- trunk/crypto/openssh/ssh_api.h (rev 0)
+++ trunk/crypto/openssh/ssh_api.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,137 @@
+/* $OpenBSD: ssh_api.h,v 1.1 2015/01/19 20:30:23 markus Exp $ */
+/*
+ * Copyright (c) 2012 Markus Friedl. All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef API_H
+#define API_H
+
+#include <sys/types.h>
+#include <signal.h>
+
+#include "openbsd-compat/sys-queue.h"
+
+#include "cipher.h"
+#include "sshkey.h"
+#include "kex.h"
+#include "ssh.h"
+#include "ssh2.h"
+#include "packet.h"
+
+struct kex_params {
+ char *proposal[PROPOSAL_MAX];
+};
+
+/* public SSH API functions */
+
+/*
+ * ssh_init() create a ssh connection object with given (optional)
+ * key exchange parameters.
+ */
+int ssh_init(struct ssh **, int is_server, struct kex_params *kex_params);
+
+/*
+ * release ssh connection state.
+ */
+void ssh_free(struct ssh *);
+
+/*
+ * attach application specific data to the connection state
+ */
+void ssh_set_app_data(struct ssh *, void *);
+void *ssh_get_app_data(struct ssh *);
+
+/*
+ * ssh_add_hostkey() registers a private/public hostkey for an ssh
+ * connection.
+ * ssh_add_hostkey() needs to be called before a key exchange is
+ * initiated with ssh_packet_next().
+ * private hostkeys are required if we need to act as a server.
+ * public hostkeys are used to verify the servers hostkey.
+ */
+int ssh_add_hostkey(struct ssh *ssh, struct sshkey *key);
+
+/*
+ * ssh_set_verify_host_key_callback() registers a callback function
+ * which should be called instead of the default verification. The
+ * function given must return 0 if the hostkey is ok, -1 if the
+ * verification has failed.
+ */
+int ssh_set_verify_host_key_callback(struct ssh *ssh,
+ int (*cb)(struct sshkey *, struct ssh *));
+
+/*
+ * ssh_packet_next() advances to the next input packet and returns
+ * the packet type in typep.
+ * ssh_packet_next() works by processing an input byte-stream,
+ * decrypting the received data and hiding the key-exchange from
+ * the caller.
+ * ssh_packet_next() sets typep if there is no new packet available.
+ * in this case the caller must fill the input byte-stream by passing
+ * the data received over network to ssh_input_append().
+ * additinally, the caller needs to send the resulting output
+ * byte-stream back over the network. otherwise the key exchange
+ * would not proceed. the output byte-stream is accessed through
+ * ssh_output_ptr().
+ */
+int ssh_packet_next(struct ssh *ssh, u_char *typep);
+
+/*
+ * ssh_packet_payload() returns a pointer to the raw payload data of
+ * the current input packet and the length of this payload.
+ * the payload is accessible until ssh_packet_next() is called again.
+ */
+const u_char *ssh_packet_payload(struct ssh *ssh, size_t *lenp);
+
+/*
+ * ssh_packet_put() creates an encrypted packet with the given type
+ * and payload.
+ * the encrypted packet is appended to the output byte-stream.
+ */
+int ssh_packet_put(struct ssh *ssh, int type, const u_char *data,
+ size_t len);
+
+/*
+ * ssh_input_space() checks if 'len' bytes can be appended to the
+ * input byte-stream.
+ */
+int ssh_input_space(struct ssh *ssh, size_t len);
+
+/*
+ * ssh_input_append() appends data to the input byte-stream.
+ */
+int ssh_input_append(struct ssh *ssh, const u_char *data, size_t len);
+
+/*
+ * ssh_output_space() checks if 'len' bytes can be appended to the
+ * output byte-stream. XXX
+ */
+int ssh_output_space(struct ssh *ssh, size_t len);
+
+/*
+ * ssh_output_ptr() retrieves both a pointer and the length of the
+ * current output byte-stream. the bytes need to be sent over the
+ * network. the number of bytes that have been successfully sent can
+ * be removed from the output byte-stream with ssh_output_consume().
+ */
+const u_char *ssh_output_ptr(struct ssh *ssh, size_t *len);
+
+/*
+ * ssh_output_consume() removes the given number of bytes from
+ * the output byte-stream.
+ */
+int ssh_output_consume(struct ssh *ssh, size_t len);
+
+#endif
Modified: trunk/crypto/openssh/ssh_config
===================================================================
--- trunk/crypto/openssh/ssh_config 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh_config 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $OpenBSD: ssh_config,v 1.28 2013/09/16 11:35:43 sthen Exp $
+# $OpenBSD: ssh_config,v 1.30 2016/02/20 23:06:23 sobrado Exp $
# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
@@ -35,8 +35,10 @@
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
+# IdentityFile ~/.ssh/id_ecdsa
+# IdentityFile ~/.ssh/id_ed25519
# Port 22
-# Protocol 2,1
+# Protocol 2
# Cipher 3des
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,umac-64 at openssh.com,hmac-ripemd160
Modified: trunk/crypto/openssh/ssh_config.0
===================================================================
--- trunk/crypto/openssh/ssh_config.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh_config.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-SSH_CONFIG(5) OpenBSD Programmer's Manual SSH_CONFIG(5)
+SSH_CONFIG(5) File Formats Manual SSH_CONFIG(5)
NAME
- ssh_config - OpenSSH SSH client configuration files
+ ssh_config M-bM-^@M-^S OpenSSH SSH client configuration files
SYNOPSIS
~/.ssh/config
@@ -16,10 +16,11 @@
3. system-wide configuration file (/etc/ssh/ssh_config)
For each parameter, the first obtained value will be used. The
- configuration files contain sections separated by ``Host''
- specifications, and that section is only applied for hosts that match one
- of the patterns given in the specification. The matched host name is the
- one given on the command line.
+ configuration files contain sections separated by M-bM-^@M-^\HostM-bM-^@M-^] specifications,
+ and that section is only applied for hosts that match one of the patterns
+ given in the specification. The matched host name is usually the one
+ given on the command line (see the CanonicalizeHostname option for
+ exceptions.)
Since the first obtained value for each parameter is used, more host-
specific declarations should be given near the beginning of the file, and
@@ -27,9 +28,9 @@
The configuration file has the following format:
- Empty lines and lines starting with `#' are comments. Otherwise a line
- is of the format ``keyword arguments''. Configuration options may be
- separated by whitespace or optional whitespace and exactly one `='; the
+ Empty lines and lines starting with M-bM-^@M-^X#M-bM-^@M-^Y are comments. Otherwise a line
+ is of the format M-bM-^@M-^\keyword argumentsM-bM-^@M-^]. Configuration options may be
+ separated by whitespace or optional whitespace and exactly one M-bM-^@M-^X=M-bM-^@M-^Y; the
latter format is useful to avoid the need to quote whitespace when
specifying configuration options using the ssh, scp, and sftp -o option.
Arguments may optionally be enclosed in double quotes (") in order to
@@ -41,14 +42,14 @@
Host Restricts the following declarations (up to the next Host or
Match keyword) to be only for those hosts that match one of the
patterns given after the keyword. If more than one pattern is
- provided, they should be separated by whitespace. A single `*'
+ provided, they should be separated by whitespace. A single M-bM-^@M-^X*M-bM-^@M-^Y
as a pattern can be used to provide global defaults for all
- hosts. The host is the hostname argument given on the command
- line (i.e. the name is not converted to a canonicalized host name
- before matching).
+ hosts. The host is usually the hostname argument given on the
+ command line (see the CanonicalizeHostname option for
+ exceptions.)
A pattern entry may be negated by prefixing it with an
- exclamation mark (`!'). If a negated entry is matched, then the
+ exclamation mark (M-bM-^@M-^X!M-bM-^@M-^Y). If a negated entry is matched, then the
Host entry is ignored, regardless of whether any other patterns
on the line match. Negated matches are therefore useful to
provide exceptions for wildcard matches.
@@ -58,50 +59,70 @@
Match Restricts the following declarations (up to the next Host or
Match keyword) to be used only when the conditions following the
Match keyword are satisfied. Match conditions are specified
- using one or more keyword/criteria pairs or the single token all
- which matches all criteria. The available keywords are: exec,
- host, originalhost, user, and localuser.
+ using one or more criteria or the single token all which always
+ matches. The available criteria keywords are: canonical, exec,
+ host, originalhost, user, and localuser. The all criteria must
+ appear alone or immediately after canonical. Other criteria may
+ be combined arbitrarily. All criteria but all and canonical
+ require an argument. Criteria may be negated by prepending an
+ exclamation mark (M-bM-^@M-^X!M-bM-^@M-^Y).
- The exec keyword executes the specified command under the user's
- shell. If the command returns a zero exit status then the
- condition is considered true. Commands containing whitespace
- characters must be quoted. The following character sequences in
- the command will be expanded prior to execution: `%L' will be
- substituted by the first component of the local host name, `%l'
- will be substituted by the local host name (including any domain
- name), `%h' will be substituted by the target host name, `%n'
- will be substituted by the original target host name specified on
- the command-line, `%p' the destination port, `%r' by the remote
- login username, and `%u' by the username of the user running
- ssh(1).
+ The canonical keyword matches only when the configuration file is
+ being re-parsed after hostname canonicalization (see the
+ CanonicalizeHostname option.) This may be useful to specify
+ conditions that work with canonical host names only. The exec
+ keyword executes the specified command under the user's shell.
+ If the command returns a zero exit status then the condition is
+ considered true. Commands containing whitespace characters must
+ be quoted. The following character sequences in the command will
+ be expanded prior to execution: M-bM-^@M-^X%LM-bM-^@M-^Y will be substituted by the
+ first component of the local host name, M-bM-^@M-^X%lM-bM-^@M-^Y will be substituted
+ by the local host name (including any domain name), M-bM-^@M-^X%hM-bM-^@M-^Y will be
+ substituted by the target host name, M-bM-^@M-^X%nM-bM-^@M-^Y will be substituted by
+ the original target host name specified on the command-line, M-bM-^@M-^X%pM-bM-^@M-^Y
+ the destination port, M-bM-^@M-^X%rM-bM-^@M-^Y by the remote login username, and M-bM-^@M-^X%uM-bM-^@M-^Y
+ by the username of the user running ssh(1).
The other keywords' criteria must be single entries or comma-
separated lists and may use the wildcard and negation operators
described in the PATTERNS section. The criteria for the host
keyword are matched against the target hostname, after any
- substitution by the Hostname option. The originalhost keyword
- matches against the hostname as it was specified on the command-
- line. The user keyword matches against the target username on
- the remote host. The localuser keyword matches against the name
- of the local user running ssh(1) (this keyword may be useful in
- system-wide ssh_config files).
+ substitution by the Hostname or CanonicalizeHostname options.
+ The originalhost keyword matches against the hostname as it was
+ specified on the command-line. The user keyword matches against
+ the target username on the remote host. The localuser keyword
+ matches against the name of the local user running ssh(1) (this
+ keyword may be useful in system-wide ssh_config files).
+ AddKeysToAgent
+ Specifies whether keys should be automatically added to a running
+ ssh-agent(1). If this option is set to M-bM-^@M-^\yesM-bM-^@M-^] and a key is loaded
+ from a file, the key and its passphrase are added to the agent
+ with the default lifetime, as if by ssh-add(1). If this option
+ is set to M-bM-^@M-^\askM-bM-^@M-^], ssh will require confirmation using the
+ SSH_ASKPASS program before adding a key (see ssh-add(1) for
+ details). If this option is set to M-bM-^@M-^\confirmM-bM-^@M-^], each use of the
+ key must be confirmed, as if the -c option was specified to
+ ssh-add(1). If this option is set to M-bM-^@M-^\noM-bM-^@M-^], no keys are added to
+ the agent. The argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\confirmM-bM-^@M-^], M-bM-^@M-^\askM-bM-^@M-^], or
+ M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
+
AddressFamily
Specifies which address family to use when connecting. Valid
- arguments are ``any'', ``inet'' (use IPv4 only), or ``inet6''
- (use IPv6 only).
+ arguments are M-bM-^@M-^\anyM-bM-^@M-^], M-bM-^@M-^\inetM-bM-^@M-^] (use IPv4 only), or M-bM-^@M-^\inet6M-bM-^@M-^] (use IPv6
+ only). The default is M-bM-^@M-^\anyM-bM-^@M-^].
BatchMode
- If set to ``yes'', passphrase/password querying will be disabled.
+ If set to M-bM-^@M-^\yesM-bM-^@M-^], passphrase/password querying will be disabled.
This option is useful in scripts and other batch jobs where no
user is present to supply the password. The argument must be
- ``yes'' or ``no''. The default is ``no''.
+ M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
BindAddress
Use the specified address on the local machine as the source
address of the connection. Only useful on systems with more than
one address. Note that this option does not work if
- UsePrivilegedPort is set to ``yes''.
+ UsePrivilegedPort is set to M-bM-^@M-^\yesM-bM-^@M-^].
CanonicalDomains
When CanonicalizeHostname is enabled, this option specifies the
@@ -110,33 +131,31 @@
CanonicalizeFallbackLocal
Specifies whether to fail with an error when hostname
- canonicalization fails. The default, ``yes'', will attempt to
- look up the unqualified hostname using the system resolver's
- search rules. A value of ``no'' will cause ssh(1) to fail
- instantly if CanonicalizeHostname is enabled and the target
- hostname cannot be found in any of the domains specified by
- CanonicalDomains.
+ canonicalization fails. The default, M-bM-^@M-^\yesM-bM-^@M-^], will attempt to look
+ up the unqualified hostname using the system resolver's search
+ rules. A value of M-bM-^@M-^\noM-bM-^@M-^] will cause ssh(1) to fail instantly if
+ CanonicalizeHostname is enabled and the target hostname cannot be
+ found in any of the domains specified by CanonicalDomains.
CanonicalizeHostname
Controls whether explicit hostname canonicalization is performed.
- The default, ``no'', is not to perform any name rewriting and let
- the system resolver handle all hostname lookups. If set to
- ``yes'' then, for connections that do not use a ProxyCommand,
- ssh(1) will attempt to canonicalize the hostname specified on the
- command line using the CanonicalDomains suffixes and
+ The default, M-bM-^@M-^\noM-bM-^@M-^], is not to perform any name rewriting and let
+ the system resolver handle all hostname lookups. If set to M-bM-^@M-^\yesM-bM-^@M-^]
+ then, for connections that do not use a ProxyCommand, ssh(1) will
+ attempt to canonicalize the hostname specified on the command
+ line using the CanonicalDomains suffixes and
CanonicalizePermittedCNAMEs rules. If CanonicalizeHostname is
- set to ``always'', then canonicalization is applied to proxied
+ set to M-bM-^@M-^\alwaysM-bM-^@M-^], then canonicalization is applied to proxied
connections too.
- If this option is enabled and canonicalisation results in the
- target hostname changing, then the configuration files are
+ If this option is enabled, then the configuration files are
processed again using the new target name to pick up any new
- configuration in matching Host stanzas.
+ configuration in matching Host and Match stanzas.
CanonicalizeMaxDots
Specifies the maximum number of dot characters in a hostname
- before canonicalization is disabled. The default, ``1'', allows
- a single dot (i.e. hostname.subdomain).
+ before canonicalization is disabled. The default, M-bM-^@M-^\1M-bM-^@M-^], allows a
+ single dot (i.e. hostname.subdomain).
CanonicalizePermittedCNAMEs
Specifies rules to determine whether CNAMEs should be followed
@@ -146,52 +165,82 @@
CNAMEs in canonicalization, and target_domain_list is a pattern-
list of domains that they may resolve to.
- For example, ``*.a.example.com:*.b.example.com,*.c.example.com''
- will allow hostnames matching ``*.a.example.com'' to be
- canonicalized to names in the ``*.b.example.com'' or
- ``*.c.example.com'' domains.
+ For example, M-bM-^@M-^\*.a.example.com:*.b.example.com,*.c.example.comM-bM-^@M-^]
+ will allow hostnames matching M-bM-^@M-^\*.a.example.comM-bM-^@M-^] to be
+ canonicalized to names in the M-bM-^@M-^\*.b.example.comM-bM-^@M-^] or
+ M-bM-^@M-^\*.c.example.comM-bM-^@M-^] domains.
+ CertificateFile
+ Specifies a file from which the user's certificate is read. A
+ corresponding private key must be provided separately in order to
+ use this certificate either from an IdentityFile directive or -i
+ flag to ssh(1), via ssh-agent(1), or via a PKCS11Provider.
+
+ The file name may use the tilde syntax to refer to a user's home
+ directory or one of the following escape characters: M-bM-^@M-^X%dM-bM-^@M-^Y (local
+ user's home directory), M-bM-^@M-^X%uM-bM-^@M-^Y (local user name), M-bM-^@M-^X%lM-bM-^@M-^Y (local host
+ name), M-bM-^@M-^X%hM-bM-^@M-^Y (remote host name) or M-bM-^@M-^X%rM-bM-^@M-^Y (remote user name).
+
+ It is possible to have multiple certificate files specified in
+ configuration files; these certificates will be tried in
+ sequence. Multiple CertificateFile directives will add to the
+ list of certificates used for authentication.
+
ChallengeResponseAuthentication
Specifies whether to use challenge-response authentication. The
- argument to this keyword must be ``yes'' or ``no''. The default
- is ``yes''.
+ argument to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is
+ M-bM-^@M-^\yesM-bM-^@M-^].
CheckHostIP
- If this flag is set to ``yes'', ssh(1) will additionally check
- the host IP address in the known_hosts file. This allows ssh to
- detect if a host key changed due to DNS spoofing. If the option
- is set to ``no'', the check will not be executed. The default is
- ``yes''.
+ If this flag is set to M-bM-^@M-^\yesM-bM-^@M-^], ssh(1) will additionally check the
+ host IP address in the known_hosts file. This allows ssh to
+ detect if a host key changed due to DNS spoofing and will add
+ addresses of destination hosts to ~/.ssh/known_hosts in the
+ process, regardless of the setting of StrictHostKeyChecking. If
+ the option is set to M-bM-^@M-^\noM-bM-^@M-^], the check will not be executed. The
+ default is M-bM-^@M-^\yesM-bM-^@M-^].
Cipher Specifies the cipher to use for encrypting the session in
- protocol version 1. Currently, ``blowfish'', ``3des'', and
- ``des'' are supported. des is only supported in the ssh(1)
- client for interoperability with legacy protocol 1
- implementations that do not support the 3des cipher. Its use is
- strongly discouraged due to cryptographic weaknesses. The
- default is ``3des''.
+ protocol version 1. Currently, M-bM-^@M-^\blowfishM-bM-^@M-^], M-bM-^@M-^\3desM-bM-^@M-^], and M-bM-^@M-^\desM-bM-^@M-^] are
+ supported. des is only supported in the ssh(1) client for
+ interoperability with legacy protocol 1 implementations that do
+ not support the 3des cipher. Its use is strongly discouraged due
+ to cryptographic weaknesses. The default is M-bM-^@M-^\3desM-bM-^@M-^].
Ciphers
Specifies the ciphers allowed for protocol version 2 in order of
- preference. Multiple ciphers must be comma-separated. The
- supported ciphers are:
+ preference. Multiple ciphers must be comma-separated. If the
+ specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified
+ ciphers will be appended to the default set instead of replacing
+ them.
- ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
- ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'',
- ``aes128-gcm at openssh.com'', ``aes256-gcm at openssh.com'',
- ``arcfour128'', ``arcfour256'', ``arcfour'', ``blowfish-cbc'',
- ``cast128-cbc'', and ``chacha20-poly1305 at openssh.com''.
+ The supported ciphers are:
+ 3des-cbc
+ aes128-cbc
+ aes192-cbc
+ aes256-cbc
+ aes128-ctr
+ aes192-ctr
+ aes256-ctr
+ aes128-gcm at openssh.com
+ aes256-gcm at openssh.com
+ arcfour
+ arcfour128
+ arcfour256
+ blowfish-cbc
+ cast128-cbc
+ chacha20-poly1305 at openssh.com
+
The default is:
- aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
- aes128-gcm at openssh.com,aes256-gcm at openssh.com,
- chacha20-poly1305 at openssh.com,
- aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
- aes256-cbc,arcfour
+ chacha20-poly1305 at openssh.com,
+ aes128-ctr,aes192-ctr,aes256-ctr,
+ aes128-gcm at openssh.com,aes256-gcm at openssh.com,
+ aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
The list of available ciphers may also be obtained using the -Q
- option of ssh(1).
+ option of ssh(1) with an argument of M-bM-^@M-^\cipherM-bM-^@M-^].
ClearAllForwardings
Specifies that all local, remote, and dynamic port forwardings
@@ -199,12 +248,12 @@
cleared. This option is primarily useful when used from the
ssh(1) command line to clear port forwardings set in
configuration files, and is automatically set by scp(1) and
- sftp(1). The argument must be ``yes'' or ``no''. The default is
- ``no''.
+ sftp(1). The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is
+ M-bM-^@M-^\noM-bM-^@M-^].
Compression
- Specifies whether to use compression. The argument must be
- ``yes'' or ``no''. The default is ``no''.
+ Specifies whether to use compression. The argument must be M-bM-^@M-^\yesM-bM-^@M-^]
+ or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
CompressionLevel
Specifies the compression level to use if compression is enabled.
@@ -226,19 +275,18 @@
ControlMaster
Enables the sharing of multiple sessions over a single network
- connection. When set to ``yes'', ssh(1) will listen for
+ connection. When set to M-bM-^@M-^\yesM-bM-^@M-^], ssh(1) will listen for
connections on a control socket specified using the ControlPath
argument. Additional sessions can connect to this socket using
- the same ControlPath with ControlMaster set to ``no'' (the
+ the same ControlPath with ControlMaster set to M-bM-^@M-^\noM-bM-^@M-^] (the
default). These sessions will try to reuse the master instance's
network connection rather than initiating new ones, but will fall
back to connecting normally if the control socket does not exist,
or is not listening.
- Setting this to ``ask'' will cause ssh to listen for control
- connections, but require confirmation using the SSH_ASKPASS
- program before they are accepted (see ssh-add(1) for details).
- If the ControlPath cannot be opened, ssh will continue without
+ Setting this to M-bM-^@M-^\askM-bM-^@M-^] will cause ssh to listen for control
+ connections, but require confirmation using ssh-askpass(1). If
+ the ControlPath cannot be opened, ssh will continue without
connecting to a master instance.
X11 and ssh-agent(1) forwarding is supported over these
@@ -248,38 +296,41 @@
Two additional options allow for opportunistic multiplexing: try
to use a master connection but fall back to creating a new one if
- one does not already exist. These options are: ``auto'' and
- ``autoask''. The latter requires confirmation like the ``ask''
+ one does not already exist. These options are: M-bM-^@M-^\autoM-bM-^@M-^] and
+ M-bM-^@M-^\autoaskM-bM-^@M-^]. The latter requires confirmation like the M-bM-^@M-^\askM-bM-^@M-^]
option.
ControlPath
Specify the path to the control socket used for connection
sharing as described in the ControlMaster section above or the
- string ``none'' to disable connection sharing. In the path, `%L'
+ string M-bM-^@M-^\noneM-bM-^@M-^] to disable connection sharing. In the path, M-bM-^@M-^X%LM-bM-^@M-^Y
will be substituted by the first component of the local host
- name, `%l' will be substituted by the local host name (including
- any domain name), `%h' will be substituted by the target host
- name, `%n' will be substituted by the original target host name
- specified on the command line, `%p' the destination port, `%r' by
- the remote login username, and `%u' by the username of the user
- running ssh(1). It is recommended that any ControlPath used for
- opportunistic connection sharing include at least %h, %p, and %r.
- This ensures that shared connections are uniquely identified.
+ name, M-bM-^@M-^X%lM-bM-^@M-^Y will be substituted by the local host name (including
+ any domain name), M-bM-^@M-^X%hM-bM-^@M-^Y will be substituted by the target host
+ name, M-bM-^@M-^X%nM-bM-^@M-^Y will be substituted by the original target host name
+ specified on the command line, M-bM-^@M-^X%pM-bM-^@M-^Y the destination port, M-bM-^@M-^X%rM-bM-^@M-^Y by
+ the remote login username, M-bM-^@M-^X%uM-bM-^@M-^Y by the username and M-bM-^@M-^X%iM-bM-^@M-^Y by the
+ numeric user ID (uid) of the user running ssh(1), and M-bM-^@M-^X%CM-bM-^@M-^Y by a
+ hash of the concatenation: %l%h%p%r. It is recommended that any
+ ControlPath used for opportunistic connection sharing include at
+ least %h, %p, and %r (or alternatively %C) and be placed in a
+ directory that is not writable by other users. This ensures that
+ shared connections are uniquely identified.
ControlPersist
When used in conjunction with ControlMaster, specifies that the
master connection should remain open in the background (waiting
for future client connections) after the initial client
- connection has been closed. If set to ``no'', then the master
+ connection has been closed. If set to M-bM-^@M-^\noM-bM-^@M-^], then the master
connection will not be placed into the background, and will close
as soon as the initial client connection is closed. If set to
- ``yes'', then the master connection will remain in the background
- indefinitely (until killed or closed via a mechanism such as the
- ssh(1) ``-O exit'' option). If set to a time in seconds, or a
- time in any of the formats documented in sshd_config(5), then the
- backgrounded master connection will automatically terminate after
- it has remained idle (with no client connections) for the
- specified time.
+ M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\0M-bM-^@M-^], then the master connection will remain in the
+ background indefinitely (until killed or closed via a mechanism
+ such as the ssh(1) M-bM-^@M-^\-O exitM-bM-^@M-^] option). If set to a time in
+ seconds, or a time in any of the formats documented in
+ sshd_config(5), then the backgrounded master connection will
+ automatically terminate after it has remained idle (with no
+ client connections) for the specified time.
DynamicForward
Specifies that a TCP port on the local machine be forwarded over
@@ -291,9 +342,9 @@
the local port is bound in accordance with the GatewayPorts
setting. However, an explicit bind_address may be used to bind
the connection to a specific address. The bind_address of
- ``localhost'' indicates that the listening port be bound for
- local use only, while an empty address or `*' indicates that the
- port should be available from all interfaces.
+ M-bM-^@M-^\localhostM-bM-^@M-^] indicates that the listening port be bound for local
+ use only, while an empty address or M-bM-^@M-^X*M-bM-^@M-^Y indicates that the port
+ should be available from all interfaces.
Currently the SOCKS4 and SOCKS5 protocols are supported, and
ssh(1) will act as a SOCKS server. Multiple forwardings may be
@@ -301,30 +352,39 @@
line. Only the superuser can forward privileged ports.
EnableSSHKeysign
- Setting this option to ``yes'' in the global client configuration
+ Setting this option to M-bM-^@M-^\yesM-bM-^@M-^] in the global client configuration
file /etc/ssh/ssh_config enables the use of the helper program
ssh-keysign(8) during HostbasedAuthentication. The argument must
- be ``yes'' or ``no''. The default is ``no''. This option should
- be placed in the non-hostspecific section. See ssh-keysign(8)
- for more information.
+ be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^]. This option should be
+ placed in the non-hostspecific section. See ssh-keysign(8) for
+ more information.
EscapeChar
- Sets the escape character (default: `~'). The escape character
+ Sets the escape character (default: M-bM-^@M-^X~M-bM-^@M-^Y). The escape character
can also be set on the command line. The argument should be a
- single character, `^' followed by a letter, or ``none'' to
- disable the escape character entirely (making the connection
- transparent for binary data).
+ single character, M-bM-^@M-^X^M-bM-^@M-^Y followed by a letter, or M-bM-^@M-^\noneM-bM-^@M-^] to disable
+ the escape character entirely (making the connection transparent
+ for binary data).
ExitOnForwardFailure
Specifies whether ssh(1) should terminate the connection if it
cannot set up all requested dynamic, tunnel, local, and remote
- port forwardings. The argument must be ``yes'' or ``no''. The
- default is ``no''.
+ port forwardings, (e.g. if either end is unable to bind and
+ listen on a specified port). Note that ExitOnForwardFailure does
+ not apply to connections made over port forwardings and will not,
+ for example, cause ssh(1) to exit if TCP connections to the
+ ultimate forwarding destination fail. The argument must be M-bM-^@M-^\yesM-bM-^@M-^]
+ or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
+ FingerprintHash
+ Specifies the hash algorithm used when displaying key
+ fingerprints. Valid options are: M-bM-^@M-^\md5M-bM-^@M-^] and M-bM-^@M-^\sha256M-bM-^@M-^]. The
+ default is M-bM-^@M-^\sha256M-bM-^@M-^].
+
ForwardAgent
Specifies whether the connection to the authentication agent (if
any) will be forwarded to the remote machine. The argument must
- be ``yes'' or ``no''. The default is ``no''.
+ be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
Agent forwarding should be enabled with caution. Users with the
ability to bypass file permissions on the remote host (for the
@@ -337,7 +397,7 @@
ForwardX11
Specifies whether X11 connections will be automatically
redirected over the secure channel and DISPLAY set. The argument
- must be ``yes'' or ``no''. The default is ``no''.
+ must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
X11 forwarding should be enabled with caution. Users with the
ability to bypass file permissions on the remote host (for the
@@ -354,10 +414,10 @@
minutes has elapsed.
ForwardX11Trusted
- If this option is set to ``yes'', remote X11 clients will have
- full access to the original X11 display.
+ If this option is set to M-bM-^@M-^\yesM-bM-^@M-^], remote X11 clients will have full
+ access to the original X11 display.
- If this option is set to ``no'', remote X11 clients will be
+ If this option is set to M-bM-^@M-^\noM-bM-^@M-^], remote X11 clients will be
considered untrusted and prevented from stealing or tampering
with data belonging to trusted X11 clients. Furthermore, the
xauth(1) token used for the session will be set to expire after
@@ -364,7 +424,7 @@
20 minutes. Remote clients will be refused access after this
time.
- The default is ``no''.
+ The default is M-bM-^@M-^\noM-bM-^@M-^].
See the X11 SECURITY extension specification for full details on
the restrictions imposed on untrusted clients.
@@ -376,8 +436,8 @@
connecting to forwarded ports. GatewayPorts can be used to
specify that ssh should bind local port forwardings to the
wildcard address, thus allowing remote hosts to connect to
- forwarded ports. The argument must be ``yes'' or ``no''. The
- default is ``no''.
+ forwarded ports. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The
+ default is M-bM-^@M-^\noM-bM-^@M-^].
GlobalKnownHostsFile
Specifies one or more files to use for the global host key
@@ -386,13 +446,11 @@
GSSAPIAuthentication
Specifies whether user authentication based on GSSAPI is allowed.
- The default is ``no''. Note that this option applies to protocol
- version 2 only.
+ The default is M-bM-^@M-^\noM-bM-^@M-^].
GSSAPIDelegateCredentials
Forward (delegate) credentials to the server. The default is
- ``no''. Note that this option applies to protocol version 2
- only.
+ M-bM-^@M-^\noM-bM-^@M-^].
HashKnownHosts
Indicates that ssh(1) should hash host names and addresses when
@@ -399,33 +457,53 @@
they are added to ~/.ssh/known_hosts. These hashed names may be
used normally by ssh(1) and sshd(8), but they do not reveal
identifying information should the file's contents be disclosed.
- The default is ``no''. Note that existing names and addresses in
+ The default is M-bM-^@M-^\noM-bM-^@M-^]. Note that existing names and addresses in
known hosts files will not be converted automatically, but may be
manually hashed using ssh-keygen(1).
HostbasedAuthentication
Specifies whether to try rhosts based authentication with public
- key authentication. The argument must be ``yes'' or ``no''. The
- default is ``no''. This option applies to protocol version 2
- only and is similar to RhostsRSAAuthentication.
+ key authentication. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The
+ default is M-bM-^@M-^\noM-bM-^@M-^].
+ HostbasedKeyTypes
+ Specifies the key types that will be used for hostbased
+ authentication as a comma-separated pattern list. Alternately if
+ the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the
+ specified key types will be appended to the default set instead
+ of replacing them. The default for this option is:
+
+ ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ ssh-ed25519-cert-v01 at openssh.com,
+ ssh-rsa-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ ssh-ed25519,ssh-rsa
+
+ The -Q option of ssh(1) may be used to list supported key types.
+
HostKeyAlgorithms
- Specifies the protocol version 2 host key algorithms that the
- client wants to use in order of preference. The default for this
- option is:
+ Specifies the host key algorithms that the client wants to use in
+ order of preference. Alternately if the specified value begins
+ with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified key types will be
+ appended to the default set instead of replacing them. The
+ default for this option is:
ecdsa-sha2-nistp256-cert-v01 at openssh.com,
ecdsa-sha2-nistp384-cert-v01 at openssh.com,
ecdsa-sha2-nistp521-cert-v01 at openssh.com,
ssh-ed25519-cert-v01 at openssh.com,
- ssh-rsa-cert-v01 at openssh.com,ssh-dss-cert-v01 at openssh.com,
- ssh-rsa-cert-v00 at openssh.com,ssh-dss-cert-v00 at openssh.com,
+ ssh-rsa-cert-v01 at openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
- ssh-ed25519,ssh-rsa,ssh-dss
+ ssh-ed25519,ssh-rsa
If hostkeys are known for the destination host then this default
is modified to prefer their algorithms.
+ The list of available key types may also be obtained using the -Q
+ option of ssh(1) with an argument of M-bM-^@M-^\keyM-bM-^@M-^].
+
HostKeyAlias
Specifies an alias that should be used instead of the real host
name when looking up or saving the host key in the host key
@@ -435,36 +513,57 @@
HostName
Specifies the real host name to log into. This can be used to
specify nicknames or abbreviations for hosts. If the hostname
- contains the character sequence `%h', then this will be replaced
+ contains the character sequence M-bM-^@M-^X%hM-bM-^@M-^Y, then this will be replaced
with the host name specified on the command line (this is useful
- for manipulating unqualified names). The default is the name
- given on the command line. Numeric IP addresses are also
- permitted (both on the command line and in HostName
- specifications).
+ for manipulating unqualified names). The character sequence M-bM-^@M-^X%%M-bM-^@M-^Y
+ will be replaced by a single M-bM-^@M-^X%M-bM-^@M-^Y character, which may be used
+ when specifying IPv6 link-local addresses.
+ The default is the name given on the command line. Numeric IP
+ addresses are also permitted (both on the command line and in
+ HostName specifications).
+
IdentitiesOnly
Specifies that ssh(1) should only use the authentication identity
- files configured in the ssh_config files, even if ssh-agent(1) or
- a PKCS11Provider offers more identities. The argument to this
- keyword must be ``yes'' or ``no''. This option is intended for
+ and certificate files explicitly configured in the ssh_config
+ files or passed on the ssh(1) command-line, even if ssh-agent(1)
+ or a PKCS11Provider offers more identities. The argument to this
+ keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. This option is intended for
situations where ssh-agent offers many different identities. The
- default is ``no''.
+ default is M-bM-^@M-^\noM-bM-^@M-^].
+ IdentityAgent
+ Specifies the UNIX-domain socket used to communicate with the
+ authentication agent.
+
+ This option overrides the M-bM-^@M-^\SSH_AUTH_SOCKM-bM-^@M-^] environment variable
+ and can be used to select a specific agent. Setting the socket
+ name to M-bM-^@M-^\noneM-bM-^@M-^] disables the use of an authentication agent. If
+ the string M-bM-^@M-^\SSH_AUTH_SOCKM-bM-^@M-^] is specified, the location of the
+ socket will be read from the SSH_AUTH_SOCK environment variable.
+
+ The socket name may use the tilde syntax to refer to a user's
+ home directory or one of the following escape characters: M-bM-^@M-^X%dM-bM-^@M-^Y
+ (local user's home directory), M-bM-^@M-^X%uM-bM-^@M-^Y (local user name), M-bM-^@M-^X%lM-bM-^@M-^Y
+ (local host name), M-bM-^@M-^X%hM-bM-^@M-^Y (remote host name) or M-bM-^@M-^X%rM-bM-^@M-^Y (remote user
+ name).
+
IdentityFile
- Specifies a file from which the user's DSA, ECDSA, ED25519 or RSA
+ Specifies a file from which the user's DSA, ECDSA, Ed25519 or RSA
authentication identity is read. The default is ~/.ssh/identity
for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa,
~/.ssh/id_ed25519 and ~/.ssh/id_rsa for protocol version 2.
Additionally, any identities represented by the authentication
agent will be used for authentication unless IdentitiesOnly is
- set. ssh(1) will try to load certificate information from the
- filename obtained by appending -cert.pub to the path of a
- specified IdentityFile.
+ set. If no certificates have been explicitly specified by
+ CertificateFile, ssh(1) will try to load certificate information
+ from the filename obtained by appending -cert.pub to the path of
+ a specified IdentityFile.
The file name may use the tilde syntax to refer to a user's home
- directory or one of the following escape characters: `%d' (local
- user's home directory), `%u' (local user name), `%l' (local host
- name), `%h' (remote host name) or `%r' (remote user name).
+ directory or one of the following escape characters: M-bM-^@M-^X%dM-bM-^@M-^Y (local
+ user's home directory), M-bM-^@M-^X%uM-bM-^@M-^Y (local user name), M-bM-^@M-^X%lM-bM-^@M-^Y (local host
+ name), M-bM-^@M-^X%hM-bM-^@M-^Y (remote host name) or M-bM-^@M-^X%rM-bM-^@M-^Y (remote user name).
It is possible to have multiple identity files specified in
configuration files; all these identities will be tried in
@@ -474,7 +573,9 @@
IdentityFile may be used in conjunction with IdentitiesOnly to
select which identities in an agent are offered during
- authentication.
+ authentication. IdentityFile may also be used in conjunction
+ with CertificateFile in order to provide any certificate also
+ needed for authentication with the identity.
IgnoreUnknown
Specifies a pattern-list of unknown options to be ignored if they
@@ -484,23 +585,33 @@
listed early in the configuration file as it will not be applied
to unknown options that appear before it.
+ Include
+ Include the specified configuration file(s). Multiple pathnames
+ may be specified and each pathname may contain glob(3) wildcards
+ and, for user configurations, shell-like M-bM-^@M-^\~M-bM-^@M-^] references to user
+ home directories. Files without absolute paths are assumed to be
+ in ~/.ssh if included in a user configuration file or /etc/ssh if
+ included from the system configuration file. Include directive
+ may appear inside a Match or Host block to perform conditional
+ inclusion.
+
IPQoS Specifies the IPv4 type-of-service or DSCP class for connections.
- Accepted values are ``af11'', ``af12'', ``af13'', ``af21'',
- ``af22'', ``af23'', ``af31'', ``af32'', ``af33'', ``af41'',
- ``af42'', ``af43'', ``cs0'', ``cs1'', ``cs2'', ``cs3'', ``cs4'',
- ``cs5'', ``cs6'', ``cs7'', ``ef'', ``lowdelay'', ``throughput'',
- ``reliability'', or a numeric value. This option may take one or
- two arguments, separated by whitespace. If one argument is
- specified, it is used as the packet class unconditionally. If
- two values are specified, the first is automatically selected for
- interactive sessions and the second for non-interactive sessions.
- The default is ``lowdelay'' for interactive sessions and
- ``throughput'' for non-interactive sessions.
+ Accepted values are M-bM-^@M-^\af11M-bM-^@M-^], M-bM-^@M-^\af12M-bM-^@M-^], M-bM-^@M-^\af13M-bM-^@M-^], M-bM-^@M-^\af21M-bM-^@M-^], M-bM-^@M-^\af22M-bM-^@M-^],
+ M-bM-^@M-^\af23M-bM-^@M-^], M-bM-^@M-^\af31M-bM-^@M-^], M-bM-^@M-^\af32M-bM-^@M-^], M-bM-^@M-^\af33M-bM-^@M-^], M-bM-^@M-^\af41M-bM-^@M-^], M-bM-^@M-^\af42M-bM-^@M-^], M-bM-^@M-^\af43M-bM-^@M-^], M-bM-^@M-^\cs0M-bM-^@M-^],
+ M-bM-^@M-^\cs1M-bM-^@M-^], M-bM-^@M-^\cs2M-bM-^@M-^], M-bM-^@M-^\cs3M-bM-^@M-^], M-bM-^@M-^\cs4M-bM-^@M-^], M-bM-^@M-^\cs5M-bM-^@M-^], M-bM-^@M-^\cs6M-bM-^@M-^], M-bM-^@M-^\cs7M-bM-^@M-^], M-bM-^@M-^\efM-bM-^@M-^],
+ M-bM-^@M-^\lowdelayM-bM-^@M-^], M-bM-^@M-^\throughputM-bM-^@M-^], M-bM-^@M-^\reliabilityM-bM-^@M-^], or a numeric value.
+ This option may take one or two arguments, separated by
+ whitespace. If one argument is specified, it is used as the
+ packet class unconditionally. If two values are specified, the
+ first is automatically selected for interactive sessions and the
+ second for non-interactive sessions. The default is M-bM-^@M-^\lowdelayM-bM-^@M-^]
+ for interactive sessions and M-bM-^@M-^\throughputM-bM-^@M-^] for non-interactive
+ sessions.
KbdInteractiveAuthentication
Specifies whether to use keyboard-interactive authentication.
- The argument to this keyword must be ``yes'' or ``no''. The
- default is ``yes''.
+ The argument to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default
+ is M-bM-^@M-^\yesM-bM-^@M-^].
KbdInteractiveDevices
Specifies the list of methods to use in keyboard-interactive
@@ -507,29 +618,35 @@
authentication. Multiple method names must be comma-separated.
The default is to use the server specified list. The methods
available vary depending on what the server supports. For an
- OpenSSH server, it may be zero or more of: ``bsdauth'', ``pam'',
- and ``skey''.
+ OpenSSH server, it may be zero or more of: M-bM-^@M-^\bsdauthM-bM-^@M-^], M-bM-^@M-^\pamM-bM-^@M-^], and
+ M-bM-^@M-^\skeyM-bM-^@M-^].
KexAlgorithms
Specifies the available KEX (Key Exchange) algorithms. Multiple
- algorithms must be comma-separated. The default is:
+ algorithms must be comma-separated. Alternately if the specified
+ value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified methods
+ will be appended to the default set instead of replacing them.
+ The default is:
curve25519-sha256 at libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
diffie-hellman-group-exchange-sha1,
- diffie-hellman-group14-sha1,
- diffie-hellman-group1-sha1
+ diffie-hellman-group14-sha1
+ The list of available key exchange algorithms may also be
+ obtained using the -Q option of ssh(1) with an argument of M-bM-^@M-^\kexM-bM-^@M-^].
+
LocalCommand
Specifies a command to execute on the local machine after
successfully connecting to the server. The command string
extends to the end of the line, and is executed with the user's
shell. The following escape character substitutions will be
- performed: `%d' (local user's home directory), `%h' (remote host
- name), `%l' (local host name), `%n' (host name as provided on the
- command line), `%p' (remote port), `%r' (remote user name) or
- `%u' (local user name).
+ performed: M-bM-^@M-^X%dM-bM-^@M-^Y (local user's home directory), M-bM-^@M-^X%hM-bM-^@M-^Y (remote host
+ name), M-bM-^@M-^X%lM-bM-^@M-^Y (local host name), M-bM-^@M-^X%nM-bM-^@M-^Y (host name as provided on the
+ command line), M-bM-^@M-^X%pM-bM-^@M-^Y (remote port), M-bM-^@M-^X%rM-bM-^@M-^Y (remote user name) or
+ M-bM-^@M-^X%uM-bM-^@M-^Y (local user name) or M-bM-^@M-^X%CM-bM-^@M-^Y by a hash of the concatenation:
+ %l%h%p%r.
The command is run synchronously and does not have access to the
session of the ssh(1) that spawned it. It should not be used for
@@ -549,9 +666,9 @@
privileged ports. By default, the local port is bound in
accordance with the GatewayPorts setting. However, an explicit
bind_address may be used to bind the connection to a specific
- address. The bind_address of ``localhost'' indicates that the
+ address. The bind_address of M-bM-^@M-^\localhostM-bM-^@M-^] indicates that the
listening port be bound for local use only, while an empty
- address or `*' indicates that the port should be available from
+ address or M-bM-^@M-^X*M-bM-^@M-^Y indicates that the port should be available from
all interfaces.
LogLevel
@@ -562,21 +679,27 @@
higher levels of verbose output.
MACs Specifies the MAC (message authentication code) algorithms in
- order of preference. The MAC algorithm is used in protocol
- version 2 for data integrity protection. Multiple algorithms
- must be comma-separated. The algorithms that contain ``-etm''
- calculate the MAC after encryption (encrypt-then-mac). These are
- considered safer and their use recommended. The default is:
+ order of preference. The MAC algorithm is used for data
+ integrity protection. Multiple algorithms must be comma-
+ separated. If the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character,
+ then the specified algorithms will be appended to the default set
+ instead of replacing them.
- hmac-md5-etm at openssh.com,hmac-sha1-etm at openssh.com,
+ The algorithms that contain M-bM-^@M-^\-etmM-bM-^@M-^] calculate the MAC after
+ encryption (encrypt-then-mac). These are considered safer and
+ their use recommended.
+
+ The default is:
+
umac-64-etm at openssh.com,umac-128-etm at openssh.com,
hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at openssh.com,
- hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at openssh.com,
- hmac-md5-96-etm at openssh.com,
- hmac-md5,hmac-sha1,umac-64 at openssh.com,umac-128 at openssh.com,
- hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
- hmac-sha1-96,hmac-md5-96
+ hmac-sha1-etm at openssh.com,
+ umac-64 at openssh.com,umac-128 at openssh.com,
+ hmac-sha2-256,hmac-sha2-512,hmac-sha1
+ The list of available MAC algorithms may also be obtained using
+ the -Q option of ssh(1) with an argument of M-bM-^@M-^\macM-bM-^@M-^].
+
NoHostAuthenticationForLocalhost
This option can be used if the home directory is shared across
machines. In this case localhost will refer to a different
@@ -583,8 +706,8 @@
machine on each of the machines and the user will get many
warnings about changed host keys. However, this option disables
host authentication for localhost. The argument to this keyword
- must be ``yes'' or ``no''. The default is to check the host key
- for localhost.
+ must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is to check the host key for
+ localhost.
NumberOfPasswordPrompts
Specifies the number of password prompts before giving up. The
@@ -592,13 +715,12 @@
PasswordAuthentication
Specifies whether to use password authentication. The argument
- to this keyword must be ``yes'' or ``no''. The default is
- ``yes''.
+ to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\yesM-bM-^@M-^].
PermitLocalCommand
Allow local command execution via the LocalCommand option or
using the !command escape sequence in ssh(1). The argument must
- be ``yes'' or ``no''. The default is ``no''.
+ be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
PKCS11Provider
Specifies which PKCS#11 provider to use. The argument to this
@@ -610,10 +732,10 @@
default is 22.
PreferredAuthentications
- Specifies the order in which the client should try protocol 2
- authentication methods. This allows a client to prefer one
- method (e.g. keyboard-interactive) over another method (e.g.
- password). The default is:
+ Specifies the order in which the client should try authentication
+ methods. This allows a client to prefer one method (e.g.
+ keyboard-interactive) over another method (e.g. password). The
+ default is:
gssapi-with-mic,hostbased,publickey,
keyboard-interactive,password
@@ -620,26 +742,30 @@
Protocol
Specifies the protocol versions ssh(1) should support in order of
- preference. The possible values are `1' and `2'. Multiple
+ preference. The possible values are M-bM-^@M-^X1M-bM-^@M-^Y and M-bM-^@M-^X2M-bM-^@M-^Y. Multiple
versions must be comma-separated. When this option is set to
- ``2,1'' ssh will try version 2 and fall back to version 1 if
- version 2 is not available. The default is `2'.
+ M-bM-^@M-^\2,1M-bM-^@M-^] ssh will try version 2 and fall back to version 1 if
+ version 2 is not available. The default is M-bM-^@M-^X2M-bM-^@M-^Y. Protocol 1
+ suffers from a number of cryptographic weaknesses and should not
+ be used. It is only offered to support legacy devices.
ProxyCommand
Specifies the command to use to connect to the server. The
command string extends to the end of the line, and is executed
- with the user's shell. In the command string, any occurrence of
- `%h' will be substituted by the host name to connect, `%p' by the
- port, and `%r' by the remote user name. The command can be
- basically anything, and should read from its standard input and
- write to its standard output. It should eventually connect an
- sshd(8) server running on some machine, or execute sshd -i
- somewhere. Host key management will be done using the HostName
- of the host being connected (defaulting to the name typed by the
- user). Setting the command to ``none'' disables this option
- entirely. Note that CheckHostIP is not available for connects
- with a proxy command.
+ using the user's shell M-bM-^@M-^XexecM-bM-^@M-^Y directive to avoid a lingering
+ shell process.
+ In the command string, any occurrence of M-bM-^@M-^X%hM-bM-^@M-^Y will be substituted
+ by the host name to connect, M-bM-^@M-^X%pM-bM-^@M-^Y by the port, and M-bM-^@M-^X%rM-bM-^@M-^Y by the
+ remote user name. The command can be basically anything, and
+ should read from its standard input and write to its standard
+ output. It should eventually connect an sshd(8) server running
+ on some machine, or execute sshd -i somewhere. Host key
+ management will be done using the HostName of the host being
+ connected (defaulting to the name typed by the user). Setting
+ the command to M-bM-^@M-^\noneM-bM-^@M-^] disables this option entirely. Note that
+ CheckHostIP is not available for connects with a proxy command.
+
This directive is useful in conjunction with nc(1) and its proxy
support. For example, the following directive would connect via
an HTTP proxy at 192.0.2.0:
@@ -646,15 +772,43 @@
ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p
+ ProxyJump
+ Specifies one or more jump proxies as [user@]host[:port].
+ Multiple proxies may be separated by comma characters and will be
+ visited sequentially. Setting this option will cause ssh(1) to
+ connect to the target host by first making a ssh(1) connection to
+ the specified ProxyJump host and then establishing a TCP
+ forwarding to the ultimate target from there.
+
+ Note that this option will compete with the ProxyCommand option -
+ whichever is specified first will prevent later instances of the
+ other from taking effect.
+
ProxyUseFdpass
Specifies that ProxyCommand will pass a connected file descriptor
back to ssh(1) instead of continuing to execute and pass data.
- The default is ``no''.
+ The default is M-bM-^@M-^\noM-bM-^@M-^].
+ PubkeyAcceptedKeyTypes
+ Specifies the key types that will be used for public key
+ authentication as a comma-separated pattern list. Alternately if
+ the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the key
+ types after it will be appended to the default instead of
+ replacing it. The default for this option is:
+
+ ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ ssh-ed25519-cert-v01 at openssh.com,
+ ssh-rsa-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ ssh-ed25519,ssh-rsa
+
+ The -Q option of ssh(1) may be used to list supported key types.
+
PubkeyAuthentication
Specifies whether to try public key authentication. The argument
- to this keyword must be ``yes'' or ``no''. The default is
- ``yes''. This option applies to protocol version 2 only.
+ to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\yesM-bM-^@M-^].
RekeyLimit
Specifies the maximum amount of data that may be transmitted
@@ -661,15 +815,14 @@
before the session key is renegotiated, optionally followed a
maximum amount of time that may pass before the session key is
renegotiated. The first argument is specified in bytes and may
- have a suffix of `K', `M', or `G' to indicate Kilobytes,
+ have a suffix of M-bM-^@M-^XKM-bM-^@M-^Y, M-bM-^@M-^XMM-bM-^@M-^Y, or M-bM-^@M-^XGM-bM-^@M-^Y to indicate Kilobytes,
Megabytes, or Gigabytes, respectively. The default is between
- `1G' and `4G', depending on the cipher. The optional second
+ M-bM-^@M-^X1GM-bM-^@M-^Y and M-bM-^@M-^X4GM-bM-^@M-^Y, depending on the cipher. The optional second
value is specified in seconds and may use any of the units
documented in the TIME FORMATS section of sshd_config(5). The
- default value for RekeyLimit is ``default none'', which means
- that rekeying is performed after the cipher's default amount of
- data has been sent or received and no time based rekeying is
- done. This option applies to protocol version 2 only.
+ default value for RekeyLimit is M-bM-^@M-^\default noneM-bM-^@M-^], which means that
+ rekeying is performed after the cipher's default amount of data
+ has been sent or received and no time based rekeying is done.
RemoteForward
Specifies that a TCP port on the remote machine be forwarded over
@@ -681,11 +834,11 @@
given on the command line. Privileged ports can be forwarded
only when logging in as root on the remote machine.
- If the port argument is `0', the listen port will be dynamically
+ If the port argument is M-bM-^@M-^X0M-bM-^@M-^Y, the listen port will be dynamically
allocated on the server and reported to the client at run time.
If the bind_address is not specified, the default is to only bind
- to loopback addresses. If the bind_address is `*' or an empty
+ to loopback addresses. If the bind_address is M-bM-^@M-^X*M-bM-^@M-^Y or an empty
string, then the forwarding is requested to listen on all
interfaces. Specifying a remote bind_address will only succeed
if the server's GatewayPorts option is enabled (see
@@ -693,35 +846,45 @@
RequestTTY
Specifies whether to request a pseudo-tty for the session. The
- argument may be one of: ``no'' (never request a TTY), ``yes''
- (always request a TTY when standard input is a TTY), ``force''
- (always request a TTY) or ``auto'' (request a TTY when opening a
- login session). This option mirrors the -t and -T flags for
- ssh(1).
+ argument may be one of: M-bM-^@M-^\noM-bM-^@M-^] (never request a TTY), M-bM-^@M-^\yesM-bM-^@M-^] (always
+ request a TTY when standard input is a TTY), M-bM-^@M-^\forceM-bM-^@M-^] (always
+ request a TTY) or M-bM-^@M-^\autoM-bM-^@M-^] (request a TTY when opening a login
+ session). This option mirrors the -t and -T flags for ssh(1).
+ RevokedHostKeys
+ Specifies revoked host public keys. Keys listed in this file
+ will be refused for host authentication. Note that if this file
+ does not exist or is not readable, then host authentication will
+ be refused for all hosts. Keys may be specified as a text file,
+ listing one public key per line, or as an OpenSSH Key Revocation
+ List (KRL) as generated by ssh-keygen(1). For more information
+ on KRLs, see the KEY REVOCATION LISTS section in ssh-keygen(1).
+
RhostsRSAAuthentication
Specifies whether to try rhosts based authentication with RSA
- host authentication. The argument must be ``yes'' or ``no''.
- The default is ``no''. This option applies to protocol version 1
- only and requires ssh(1) to be setuid root.
+ host authentication. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The
+ default is M-bM-^@M-^\noM-bM-^@M-^]. This option applies to protocol version 1 only
+ and requires ssh(1) to be setuid root.
RSAAuthentication
Specifies whether to try RSA authentication. The argument to
- this keyword must be ``yes'' or ``no''. RSA authentication will
- only be attempted if the identity file exists, or an
- authentication agent is running. The default is ``yes''. Note
- that this option applies to protocol version 1 only.
+ this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. RSA authentication will only
+ be attempted if the identity file exists, or an authentication
+ agent is running. The default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that this option
+ applies to protocol version 1 only.
SendEnv
Specifies what variables from the local environ(7) should be sent
- to the server. Note that environment passing is only supported
- for protocol 2. The server must also support it, and the server
- must be configured to accept these environment variables. Refer
- to AcceptEnv in sshd_config(5) for how to configure the server.
- Variables are specified by name, which may contain wildcard
- characters. Multiple environment variables may be separated by
- whitespace or spread across multiple SendEnv directives. The
- default is not to send any environment variables.
+ to the server. The server must also support it, and the server
+ must be configured to accept these environment variables. Note
+ that the TERM environment variable is always sent whenever a
+ pseudo-terminal is requested as it is required by the protocol.
+ Refer to AcceptEnv in sshd_config(5) for how to configure the
+ server. Variables are specified by name, which may contain
+ wildcard characters. Multiple environment variables may be
+ separated by whitespace or spread across multiple SendEnv
+ directives. The default is not to send any environment
+ variables.
See PATTERNS for more information on patterns.
@@ -741,8 +904,7 @@
The default value is 3. If, for example, ServerAliveInterval
(see below) is set to 15 and ServerAliveCountMax is left at the
default, if the server becomes unresponsive, ssh will disconnect
- after approximately 45 seconds. This option applies to protocol
- version 2 only.
+ after approximately 45 seconds.
ServerAliveInterval
Sets a timeout interval in seconds after which if no data has
@@ -749,24 +911,45 @@
been received from the server, ssh(1) will send a message through
the encrypted channel to request a response from the server. The
default is 0, indicating that these messages will not be sent to
- the server. This option applies to protocol version 2 only.
+ the server.
+ StreamLocalBindMask
+ Sets the octal file creation mode mask (umask) used when creating
+ a Unix-domain socket file for local or remote port forwarding.
+ This option is only used for port forwarding to a Unix-domain
+ socket file.
+
+ The default value is 0177, which creates a Unix-domain socket
+ file that is readable and writable only by the owner. Note that
+ not all operating systems honor the file mode on Unix-domain
+ socket files.
+
+ StreamLocalBindUnlink
+ Specifies whether to remove an existing Unix-domain socket file
+ for local or remote port forwarding before creating a new one.
+ If the socket file already exists and StreamLocalBindUnlink is
+ not enabled, ssh will be unable to forward the port to the Unix-
+ domain socket file. This option is only used for port forwarding
+ to a Unix-domain socket file.
+
+ The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
+
StrictHostKeyChecking
- If this flag is set to ``yes'', ssh(1) will never automatically
- add host keys to the ~/.ssh/known_hosts file, and refuses to
- connect to hosts whose host key has changed. This provides
- maximum protection against trojan horse attacks, though it can be
+ If this flag is set to M-bM-^@M-^\yesM-bM-^@M-^], ssh(1) will never automatically add
+ host keys to the ~/.ssh/known_hosts file, and refuses to connect
+ to hosts whose host key has changed. This provides maximum
+ protection against trojan horse attacks, though it can be
annoying when the /etc/ssh/ssh_known_hosts file is poorly
maintained or when connections to new hosts are frequently made.
This option forces the user to manually add all new hosts. If
- this flag is set to ``no'', ssh will automatically add new host
+ this flag is set to M-bM-^@M-^\noM-bM-^@M-^], ssh will automatically add new host
keys to the user known hosts files. If this flag is set to
- ``ask'', new host keys will be added to the user known host files
+ M-bM-^@M-^\askM-bM-^@M-^], new host keys will be added to the user known host files
only after the user has confirmed that is what they really want
to do, and ssh will refuse to connect to hosts whose host key has
changed. The host keys of known hosts will be verified
- automatically in all cases. The argument must be ``yes'',
- ``no'', or ``ask''. The default is ``ask''.
+ automatically in all cases. The argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\noM-bM-^@M-^], or
+ M-bM-^@M-^\askM-bM-^@M-^]. The default is M-bM-^@M-^\askM-bM-^@M-^].
TCPKeepAlive
Specifies whether the system should send TCP keepalive messages
@@ -775,18 +958,18 @@
this means that connections will die if the route is down
temporarily, and some people find it annoying.
- The default is ``yes'' (to send TCP keepalive messages), and the
+ The default is M-bM-^@M-^\yesM-bM-^@M-^] (to send TCP keepalive messages), and the
client will notice if the network goes down or the remote host
dies. This is important in scripts, and many users want it too.
To disable TCP keepalive messages, the value should be set to
- ``no''.
+ M-bM-^@M-^\noM-bM-^@M-^].
Tunnel Request tun(4) device forwarding between the client and the
- server. The argument must be ``yes'', ``point-to-point'' (layer
- 3), ``ethernet'' (layer 2), or ``no''. Specifying ``yes''
- requests the default tunnel mode, which is ``point-to-point''.
- The default is ``no''.
+ server. The argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\point-to-pointM-bM-^@M-^] (layer 3),
+ M-bM-^@M-^\ethernetM-bM-^@M-^] (layer 2), or M-bM-^@M-^\noM-bM-^@M-^]. Specifying M-bM-^@M-^\yesM-bM-^@M-^] requests the
+ default tunnel mode, which is M-bM-^@M-^\point-to-pointM-bM-^@M-^]. The default is
+ M-bM-^@M-^\noM-bM-^@M-^].
TunnelDevice
Specifies the tun(4) devices to open on the client (local_tun)
@@ -793,16 +976,35 @@
and the server (remote_tun).
The argument must be local_tun[:remote_tun]. The devices may be
- specified by numerical ID or the keyword ``any'', which uses the
+ specified by numerical ID or the keyword M-bM-^@M-^\anyM-bM-^@M-^], which uses the
next available tunnel device. If remote_tun is not specified, it
- defaults to ``any''. The default is ``any:any''.
+ defaults to M-bM-^@M-^\anyM-bM-^@M-^]. The default is M-bM-^@M-^\any:anyM-bM-^@M-^].
+ UpdateHostKeys
+ Specifies whether ssh(1) should accept notifications of
+ additional hostkeys from the server sent after authentication has
+ completed and add them to UserKnownHostsFile. The argument must
+ be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\noM-bM-^@M-^] (the default) or M-bM-^@M-^\askM-bM-^@M-^]. Enabling this option
+ allows learning alternate hostkeys for a server and supports
+ graceful key rotation by allowing a server to send replacement
+ public keys before old ones are removed. Additional hostkeys are
+ only accepted if the key used to authenticate the host was
+ already trusted or explicitly accepted by the user. If
+ UpdateHostKeys is set to M-bM-^@M-^\askM-bM-^@M-^], then the user is asked to confirm
+ the modifications to the known_hosts file. Confirmation is
+ currently incompatible with ControlPersist, and will be disabled
+ if it is enabled.
+
+ Presently, only sshd(8) from OpenSSH 6.8 and greater support the
+ M-bM-^@M-^\hostkeys at openssh.comM-bM-^@M-^] protocol extension used to inform the
+ client of all the server's hostkeys.
+
UsePrivilegedPort
Specifies whether to use a privileged port for outgoing
- connections. The argument must be ``yes'' or ``no''. The
- default is ``no''. If set to ``yes'', ssh(1) must be setuid
- root. Note that this option must be set to ``yes'' for
- RhostsRSAAuthentication with older servers.
+ connections. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is
+ M-bM-^@M-^\noM-bM-^@M-^]. If set to M-bM-^@M-^\yesM-bM-^@M-^], ssh(1) must be setuid root. Note that
+ this option must be set to M-bM-^@M-^\yesM-bM-^@M-^] for RhostsRSAAuthentication with
+ older servers.
User Specifies the user to log in as. This can be useful when a
different user name is used on different machines. This saves
@@ -816,25 +1018,24 @@
VerifyHostKeyDNS
Specifies whether to verify the remote key using DNS and SSHFP
- resource records. If this option is set to ``yes'', the client
+ resource records. If this option is set to M-bM-^@M-^\yesM-bM-^@M-^], the client
will implicitly trust keys that match a secure fingerprint from
DNS. Insecure fingerprints will be handled as if this option was
- set to ``ask''. If this option is set to ``ask'', information on
+ set to M-bM-^@M-^\askM-bM-^@M-^]. If this option is set to M-bM-^@M-^\askM-bM-^@M-^], information on
fingerprint match will be displayed, but the user will still need
to confirm new host keys according to the StrictHostKeyChecking
- option. The argument must be ``yes'', ``no'', or ``ask''. The
- default is ``no''. Note that this option applies to protocol
- version 2 only.
+ option. The argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\noM-bM-^@M-^], or M-bM-^@M-^\askM-bM-^@M-^]. The default
+ is M-bM-^@M-^\noM-bM-^@M-^].
See also VERIFYING HOST KEYS in ssh(1).
VisualHostKey
- If this flag is set to ``yes'', an ASCII art representation of
- the remote host key fingerprint is printed in addition to the hex
+ If this flag is set to M-bM-^@M-^\yesM-bM-^@M-^], an ASCII art representation of the
+ remote host key fingerprint is printed in addition to the
fingerprint string at login and for unknown host keys. If this
- flag is set to ``no'', no fingerprint strings are printed at
- login and only the hex fingerprint string will be printed for
- unknown host keys. The default is ``no''.
+ flag is set to M-bM-^@M-^\noM-bM-^@M-^], no fingerprint strings are printed at login
+ and only the fingerprint string will be printed for unknown host
+ keys. The default is M-bM-^@M-^\noM-bM-^@M-^].
XAuthLocation
Specifies the full pathname of the xauth(1) program. The default
@@ -841,10 +1042,10 @@
is /usr/X11R6/bin/xauth.
PATTERNS
- A pattern consists of zero or more non-whitespace characters, `*' (a
- wildcard that matches zero or more characters), or `?' (a wildcard that
+ A pattern consists of zero or more non-whitespace characters, M-bM-^@M-^X*M-bM-^@M-^Y (a
+ wildcard that matches zero or more characters), or M-bM-^@M-^X?M-bM-^@M-^Y (a wildcard that
matches exactly one character). For example, to specify a set of
- declarations for any host in the ``.co.uk'' set of domains, the following
+ declarations for any host in the M-bM-^@M-^\.co.ukM-bM-^@M-^] set of domains, the following
pattern could be used:
Host *.co.uk
@@ -856,8 +1057,8 @@
A pattern-list is a comma-separated list of patterns. Patterns within
pattern-lists may be negated by preceding them with an exclamation mark
- (`!'). For example, to allow a key to be used from anywhere within an
- organization except from the ``dialup'' pool, the following entry (in
+ (M-bM-^@M-^X!M-bM-^@M-^Y). For example, to allow a key to be used from anywhere within an
+ organization except from the M-bM-^@M-^\dialupM-bM-^@M-^] pool, the following entry (in
authorized_keys) could be used:
from="!*.dialup.example.com,*.example.com"
@@ -886,4 +1087,4 @@
created OpenSSH. Markus Friedl contributed the support for SSH protocol
versions 1.5 and 2.0.
-OpenBSD 5.5 February 23, 2014 OpenBSD 5.5
+OpenBSD 6.0 July 22, 2016 OpenBSD 6.0
Modified: trunk/crypto/openssh/ssh_config.5
===================================================================
--- trunk/crypto/openssh/ssh_config.5 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ssh_config.5 2016-11-05 20:36:34 UTC (rev 9223)
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.185 2014/02/23 20:11:36 djm Exp $
-.Dd $Mdocdate: February 23 2014 $
+.\" $OpenBSD: ssh_config.5,v 1.236 2016/07/22 07:00:46 djm Exp $
+.Dd $Mdocdate: July 22 2016 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -65,7 +65,10 @@
.Dq Host
specifications, and that section is only applied for hosts that
match one of the patterns given in the specification.
-The matched host name is the one given on the command line.
+The matched host name is usually the one given on the command line
+(see the
+.Cm CanonicalizeHostname
+option for exceptions.)
.Pp
Since the first obtained value for each parameter is used, more
host-specific declarations should be given near the beginning of the
@@ -109,10 +112,12 @@
.Ql *
as a pattern can be used to provide global
defaults for all hosts.
-The host is the
+The host is usually the
.Ar hostname
-argument given on the command line (i.e. the name is not converted to
-a canonicalized host name before matching).
+argument given on the command line
+(see the
+.Cm CanonicalizeHostname
+option for exceptions.)
.Pp
A pattern entry may be negated by prefixing it with an exclamation mark
.Pq Sq !\& .
@@ -134,11 +139,12 @@
keyword) to be used only when the conditions following the
.Cm Match
keyword are satisfied.
-Match conditions are specified using one or more keyword/criteria pairs
+Match conditions are specified using one or more criteria
or the single token
.Cm all
-which matches all criteria.
-The available keywords are:
+which always matches.
+The available criteria keywords are:
+.Cm canonical ,
.Cm exec ,
.Cm host ,
.Cm originalhost ,
@@ -145,8 +151,28 @@
.Cm user ,
and
.Cm localuser .
+The
+.Cm all
+criteria must appear alone or immediately after
+.Cm canonical .
+Other criteria may be combined arbitrarily.
+All criteria but
+.Cm all
+and
+.Cm canonical
+require an argument.
+Criteria may be negated by prepending an exclamation mark
+.Pq Sq !\& .
.Pp
The
+.Cm canonical
+keyword matches only when the configuration file is being re-parsed
+after hostname canonicalization (see the
+.Cm CanonicalizeHostname
+option.)
+This may be useful to specify conditions that work with canonical host
+names only.
+The
.Cm exec
keyword executes the specified command under the user's shell.
If the command returns a zero exit status then the condition is considered true.
@@ -179,7 +205,9 @@
keyword are matched against the target hostname, after any substitution
by the
.Cm Hostname
-option.
+or
+.Cm CanonicalizeHostname
+options.
The
.Cm originalhost
keyword matches against the hostname as it was specified on the command-line.
@@ -193,6 +221,39 @@
(this keyword may be useful in system-wide
.Nm
files).
+.It Cm AddKeysToAgent
+Specifies whether keys should be automatically added to a running
+.Xr ssh-agent 1 .
+If this option is set to
+.Dq yes
+and a key is loaded from a file, the key and its passphrase are added to
+the agent with the default lifetime, as if by
+.Xr ssh-add 1 .
+If this option is set to
+.Dq ask ,
+.Nm ssh
+will require confirmation using the
+.Ev SSH_ASKPASS
+program before adding a key (see
+.Xr ssh-add 1
+for details).
+If this option is set to
+.Dq confirm ,
+each use of the key must be confirmed, as if the
+.Fl c
+option was specified to
+.Xr ssh-add 1 .
+If this option is set to
+.Dq no ,
+no keys are added to the agent.
+The argument must be
+.Dq yes ,
+.Dq confirm ,
+.Dq ask ,
+or
+.Dq no .
+The default is
+.Dq no .
.It Cm AddressFamily
Specifies which address family to use when connecting.
Valid arguments are
@@ -201,6 +262,8 @@
(use IPv4 only), or
.Dq inet6
(use IPv6 only).
+The default is
+.Dq any .
.It Cm BatchMode
If set to
.Dq yes ,
@@ -264,10 +327,11 @@
.Dq always ,
then canonicalization is applied to proxied connections too.
.Pp
-If this option is enabled and canonicalisation results in the target hostname
-changing, then the configuration files are processed again using the new
-target name to pick up any new configuration in matching
+If this option is enabled, then the configuration files are processed
+again using the new target name to pick up any new configuration in matching
.Cm Host
+and
+.Cm Match
stanzas.
.It Cm CanonicalizeMaxDots
Specifies the maximum number of dot characters in a hostname before
@@ -296,6 +360,41 @@
or
.Dq *.c.example.com
domains.
+.It Cm CertificateFile
+Specifies a file from which the user's certificate is read.
+A corresponding private key must be provided separately in order
+to use this certificate either
+from an
+.Cm IdentityFile
+directive or
+.Fl i
+flag to
+.Xr ssh 1 ,
+via
+.Xr ssh-agent 1 ,
+or via a
+.Cm PKCS11Provider .
+.Pp
+The file name may use the tilde
+syntax to refer to a user's home directory or one of the following
+escape characters:
+.Ql %d
+(local user's home directory),
+.Ql %u
+(local user name),
+.Ql %l
+(local host name),
+.Ql %h
+(remote host name) or
+.Ql %r
+(remote user name).
+.Pp
+It is possible to have multiple certificate files specified in
+configuration files; these certificates will be tried in sequence.
+Multiple
+.Cm CertificateFile
+directives will add to the list of certificates used for
+authentication.
.It Cm ChallengeResponseAuthentication
Specifies whether to use challenge-response authentication.
The argument to this keyword must be
@@ -311,7 +410,11 @@
will additionally check the host IP address in the
.Pa known_hosts
file.
-This allows ssh to detect if a host key changed due to DNS spoofing.
+This allows ssh to detect if a host key changed due to DNS spoofing
+and will add addresses of destination hosts to
+.Pa ~/.ssh/known_hosts
+in the process, regardless of the setting of
+.Cm StrictHostKeyChecking .
If the option is set to
.Dq no ,
the check will not be executed.
@@ -340,38 +443,60 @@
Specifies the ciphers allowed for protocol version 2
in order of preference.
Multiple ciphers must be comma-separated.
+If the specified value begins with a
+.Sq +
+character, then the specified ciphers will be appended to the default set
+instead of replacing them.
+.Pp
The supported ciphers are:
.Pp
-.Dq 3des-cbc ,
-.Dq aes128-cbc ,
-.Dq aes192-cbc ,
-.Dq aes256-cbc ,
-.Dq aes128-ctr ,
-.Dq aes192-ctr ,
-.Dq aes256-ctr ,
-.Dq aes128-gcm at openssh.com ,
-.Dq aes256-gcm at openssh.com ,
-.Dq arcfour128 ,
-.Dq arcfour256 ,
-.Dq arcfour ,
-.Dq blowfish-cbc ,
-.Dq cast128-cbc ,
-and
-.Dq chacha20-poly1305 at openssh.com .
+.Bl -item -compact -offset indent
+.It
+3des-cbc
+.It
+aes128-cbc
+.It
+aes192-cbc
+.It
+aes256-cbc
+.It
+aes128-ctr
+.It
+aes192-ctr
+.It
+aes256-ctr
+.It
+aes128-gcm at openssh.com
+.It
+aes256-gcm at openssh.com
+.It
+arcfour
+.It
+arcfour128
+.It
+arcfour256
+.It
+blowfish-cbc
+.It
+cast128-cbc
+.It
+chacha20-poly1305 at openssh.com
+.El
.Pp
The default is:
-.Bd -literal -offset 3n
-aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
+.Bd -literal -offset indent
+chacha20-poly1305 at openssh.com,
+aes128-ctr,aes192-ctr,aes256-ctr,
aes128-gcm at openssh.com,aes256-gcm at openssh.com,
-chacha20-poly1305 at openssh.com,
-aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
-aes256-cbc,arcfour
+aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
.Ed
.Pp
The list of available ciphers may also be obtained using the
.Fl Q
option of
-.Xr ssh 1 .
+.Xr ssh 1
+with an argument of
+.Dq cipher .
.It Cm ClearAllForwardings
Specifies that all local, remote, and dynamic port forwardings
specified in the configuration files or on the command line be
@@ -436,11 +561,8 @@
Setting this to
.Dq ask
will cause ssh
-to listen for control connections, but require confirmation using the
-.Ev SSH_ASKPASS
-program before they are accepted (see
-.Xr ssh-add 1
-for details).
+to listen for control connections, but require confirmation using
+.Xr ssh-askpass 1 .
If the
.Cm ControlPath
cannot be opened,
@@ -482,14 +604,20 @@
.Ql %p
the destination port,
.Ql %r
-by the remote login username, and
+by the remote login username,
.Ql %u
-by the username of the user running
-.Xr ssh 1 .
+by the username and
+.Ql %i
+by the numeric user ID (uid) of the user running
+.Xr ssh 1 ,
+and
+.Ql \&%C
+by a hash of the concatenation: %l%h%p%r.
It is recommended that any
.Cm ControlPath
used for opportunistic connection sharing include
-at least %h, %p, and %r.
+at least %h, %p, and %r (or alternatively %C) and be placed in a directory
+that is not writable by other users.
This ensures that shared connections are uniquely identified.
.It Cm ControlPersist
When used in conjunction with
@@ -502,7 +630,9 @@
then the master connection will not be placed into the background,
and will close as soon as the initial client connection is closed.
If set to
-.Dq yes ,
+.Dq yes
+or
+.Dq 0 ,
then the master connection will remain in the background indefinitely
(until killed or closed via a mechanism such as the
.Xr ssh 1
@@ -580,7 +710,14 @@
Specifies whether
.Xr ssh 1
should terminate the connection if it cannot set up all requested
-dynamic, tunnel, local, and remote port forwardings.
+dynamic, tunnel, local, and remote port forwardings, (e.g.\&
+if either end is unable to bind and listen on a specified port).
+Note that
+.Cm ExitOnForwardFailure
+does not apply to connections made over port forwardings and will not,
+for example, cause
+.Xr ssh 1
+to exit if TCP connections to the ultimate forwarding destination fail.
The argument must be
.Dq yes
or
@@ -587,6 +724,14 @@
.Dq no .
The default is
.Dq no .
+.It Cm FingerprintHash
+Specifies the hash algorithm used when displaying key fingerprints.
+Valid options are:
+.Dq md5
+and
+.Dq sha256 .
+The default is
+.Dq sha256 .
.It Cm ForwardAgent
Specifies whether the connection to the authentication agent (if any)
will be forwarded to the remote machine.
@@ -681,12 +826,10 @@
Specifies whether user authentication based on GSSAPI is allowed.
The default is
.Dq no .
-Note that this option applies to protocol version 2 only.
.It Cm GSSAPIDelegateCredentials
Forward (delegate) credentials to the server.
The default is
.Dq no .
-Note that this option applies to protocol version 2 only.
.It Cm HashKnownHosts
Indicates that
.Xr ssh 1
@@ -713,12 +856,36 @@
.Dq no .
The default is
.Dq no .
-This option applies to protocol version 2 only and
-is similar to
-.Cm RhostsRSAAuthentication .
+.It Cm HostbasedKeyTypes
+Specifies the key types that will be used for hostbased authentication
+as a comma-separated pattern list.
+Alternately if the specified value begins with a
+.Sq +
+character, then the specified key types will be appended to the default set
+instead of replacing them.
+The default for this option is:
+.Bd -literal -offset 3n
+ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ssh-ed25519-cert-v01 at openssh.com,
+ssh-rsa-cert-v01 at openssh.com,
+ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ssh-ed25519,ssh-rsa
+.Ed
+.Pp
+The
+.Fl Q
+option of
+.Xr ssh 1
+may be used to list supported key types.
.It Cm HostKeyAlgorithms
-Specifies the protocol version 2 host key algorithms
+Specifies the host key algorithms
that the client wants to use in order of preference.
+Alternately if the specified value begins with a
+.Sq +
+character, then the specified key types will be appended to the default set
+instead of replacing them.
The default for this option is:
.Bd -literal -offset 3n
ecdsa-sha2-nistp256-cert-v01 at openssh.com,
@@ -725,14 +892,20 @@
ecdsa-sha2-nistp384-cert-v01 at openssh.com,
ecdsa-sha2-nistp521-cert-v01 at openssh.com,
ssh-ed25519-cert-v01 at openssh.com,
-ssh-rsa-cert-v01 at openssh.com,ssh-dss-cert-v01 at openssh.com,
-ssh-rsa-cert-v00 at openssh.com,ssh-dss-cert-v00 at openssh.com,
+ssh-rsa-cert-v01 at openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-ssh-ed25519,ssh-rsa,ssh-dss
+ssh-ed25519,ssh-rsa
.Ed
.Pp
If hostkeys are known for the destination host then this default is modified
to prefer their algorithms.
+.Pp
+The list of available key types may also be obtained using the
+.Fl Q
+option of
+.Xr ssh 1
+with an argument of
+.Dq key .
.It Cm HostKeyAlias
Specifies an alias that should be used instead of the
real host name when looking up or saving the host key
@@ -746,6 +919,12 @@
.Ql %h ,
then this will be replaced with the host name specified on the command line
(this is useful for manipulating unqualified names).
+The character sequence
+.Ql %%
+will be replaced by a single
+.Ql %
+character, which may be used when specifying IPv6 link-local addresses.
+.Pp
The default is the name given on the command line.
Numeric IP addresses are also permitted (both on the command line and in
.Cm HostName
@@ -753,9 +932,13 @@
.It Cm IdentitiesOnly
Specifies that
.Xr ssh 1
-should only use the authentication identity files configured in the
+should only use the authentication identity and certificate files explicitly
+configured in the
.Nm
-files,
+files
+or passed on the
+.Xr ssh 1
+command-line,
even if
.Xr ssh-agent 1
or a
@@ -769,8 +952,38 @@
offers many different identities.
The default is
.Dq no .
+.It Cm IdentityAgent
+Specifies the
+.Ux Ns -domain
+socket used to communicate with the authentication agent.
+.Pp
+This option overrides the
+.Dq SSH_AUTH_SOCK
+environment variable and can be used to select a specific agent.
+Setting the socket name to
+.Dq none
+disables the use of an authentication agent.
+If the string
+.Dq SSH_AUTH_SOCK
+is specified, the location of the socket will be read from the
+.Ev SSH_AUTH_SOCK
+environment variable.
+.Pp
+The socket name may use the tilde
+syntax to refer to a user's home directory or one of the following
+escape characters:
+.Ql %d
+(local user's home directory),
+.Ql %u
+(local user name),
+.Ql %l
+(local host name),
+.Ql %h
+(remote host name) or
+.Ql %r
+(remote user name).
.It Cm IdentityFile
-Specifies a file from which the user's DSA, ECDSA, ED25519 or RSA authentication
+Specifies a file from which the user's DSA, ECDSA, Ed25519 or RSA authentication
identity is read.
The default is
.Pa ~/.ssh/identity
@@ -785,6 +998,8 @@
will be used for authentication unless
.Cm IdentitiesOnly
is set.
+If no certificates have been explicitly specified by
+.Cm CertificateFile ,
.Xr ssh 1
will try to load certificate information from the filename obtained by
appending
@@ -818,6 +1033,11 @@
may be used in conjunction with
.Cm IdentitiesOnly
to select which identities in an agent are offered during authentication.
+.Cm IdentityFile
+may also be used in conjunction with
+.Cm CertificateFile
+in order to provide any certificate also needed for authentication with
+the identity.
.It Cm IgnoreUnknown
Specifies a pattern-list of unknown options to be ignored if they are
encountered in configuration parsing.
@@ -829,6 +1049,25 @@
.Cm IgnoreUnknown
be listed early in the configuration file as it will not be applied
to unknown options that appear before it.
+.It Cm Include
+Include the specified configuration file(s).
+Multiple pathnames may be specified and each pathname may contain
+.Xr glob 3
+wildcards and, for user configurations, shell-like
+.Dq ~
+references to user home directories.
+Files without absolute paths are assumed to be in
+.Pa ~/.ssh
+if included in a user configuration file or
+.Pa /etc/ssh
+if included from the system configuration file.
+.Cm Include
+directive may appear inside a
+.Cm Match
+or
+.Cm Host
+block
+to perform conditional inclusion.
.It Cm IPQoS
Specifies the IPv4 type-of-service or DSCP class for connections.
Accepted values are
@@ -888,6 +1127,10 @@
.It Cm KexAlgorithms
Specifies the available KEX (Key Exchange) algorithms.
Multiple algorithms must be comma-separated.
+Alternately if the specified value begins with a
+.Sq +
+character, then the specified methods will be appended to the default set
+instead of replacing them.
The default is:
.Bd -literal -offset indent
curve25519-sha256 at libssh.org,
@@ -894,9 +1137,15 @@
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
diffie-hellman-group-exchange-sha1,
-diffie-hellman-group14-sha1,
-diffie-hellman-group1-sha1
+diffie-hellman-group14-sha1
.Ed
+.Pp
+The list of available key exchange algorithms may also be obtained using the
+.Fl Q
+option of
+.Xr ssh 1
+with an argument of
+.Dq kex .
.It Cm LocalCommand
Specifies a command to execute on the local machine after successfully
connecting to the server.
@@ -916,7 +1165,9 @@
.Ql %r
(remote user name) or
.Ql %u
-(local user name).
+(local user name) or
+.Ql \&%C
+by a hash of the concatenation: %l%h%p%r.
.Pp
The command is run synchronously and does not have access to the
session of the
@@ -965,24 +1216,33 @@
.It Cm MACs
Specifies the MAC (message authentication code) algorithms
in order of preference.
-The MAC algorithm is used in protocol version 2
-for data integrity protection.
+The MAC algorithm is used for data integrity protection.
Multiple algorithms must be comma-separated.
+If the specified value begins with a
+.Sq +
+character, then the specified algorithms will be appended to the default set
+instead of replacing them.
+.Pp
The algorithms that contain
.Dq -etm
calculate the MAC after encryption (encrypt-then-mac).
These are considered safer and their use recommended.
+.Pp
The default is:
.Bd -literal -offset indent
-hmac-md5-etm at openssh.com,hmac-sha1-etm at openssh.com,
umac-64-etm at openssh.com,umac-128-etm at openssh.com,
hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at openssh.com,
-hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at openssh.com,
-hmac-md5-96-etm at openssh.com,
-hmac-md5,hmac-sha1,umac-64 at openssh.com,umac-128 at openssh.com,
-hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
-hmac-sha1-96,hmac-md5-96
+hmac-sha1-etm at openssh.com,
+umac-64 at openssh.com,umac-128 at openssh.com,
+hmac-sha2-256,hmac-sha2-512,hmac-sha1
.Ed
+.Pp
+The list of available MAC algorithms may also be obtained using the
+.Fl Q
+option of
+.Xr ssh 1
+with an argument of
+.Dq mac .
.It Cm NoHostAuthenticationForLocalhost
This option can be used if the home directory is shared across machines.
In this case localhost will refer to a different machine on each of
@@ -1028,8 +1288,7 @@
Specifies the port number to connect on the remote host.
The default is 22.
.It Cm PreferredAuthentications
-Specifies the order in which the client should try protocol 2
-authentication methods.
+Specifies the order in which the client should try authentication methods.
This allows a client to prefer one method (e.g.\&
.Cm keyboard-interactive )
over another method (e.g.\&
@@ -1055,11 +1314,17 @@
if version 2 is not available.
The default is
.Sq 2 .
+Protocol 1 suffers from a number of cryptographic weaknesses and should
+not be used.
+It is only offered to support legacy devices.
.It Cm ProxyCommand
Specifies the command to use to connect to the server.
The command
-string extends to the end of the line, and is executed with
-the user's shell.
+string extends to the end of the line, and is executed
+using the user's shell
+.Ql exec
+directive to avoid a lingering shell process.
+.Pp
In the command string, any occurrence of
.Ql %h
will be substituted by the host name to
@@ -1093,6 +1358,30 @@
.Bd -literal -offset 3n
ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p
.Ed
+.It Cm ProxyJump
+Specifies one or more jump proxies as
+.Xo
+.Sm off
+.Op Ar user No @
+.Ar host
+.Op : Ns Ar port
+.Sm on
+.Xc .
+Multiple proxies may be separated by comma characters and will be visited
+sequentially.
+Setting this option will cause
+.Xr ssh 1
+to connect to the target host by first making a
+.Xr ssh 1
+connection to the specified
+.Cm ProxyJump
+host and then establishing a
+TCP forwarding to the ultimate target from there.
+.Pp
+Note that this option will compete with the
+.Cm ProxyCommand
+option - whichever is specified first will prevent later instances of the
+other from taking effect.
.It Cm ProxyUseFdpass
Specifies that
.Cm ProxyCommand
@@ -1101,6 +1390,29 @@
instead of continuing to execute and pass data.
The default is
.Dq no .
+.It Cm PubkeyAcceptedKeyTypes
+Specifies the key types that will be used for public key authentication
+as a comma-separated pattern list.
+Alternately if the specified value begins with a
+.Sq +
+character, then the key types after it will be appended to the default
+instead of replacing it.
+The default for this option is:
+.Bd -literal -offset 3n
+ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ssh-ed25519-cert-v01 at openssh.com,
+ssh-rsa-cert-v01 at openssh.com,
+ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ssh-ed25519,ssh-rsa
+.Ed
+.Pp
+The
+.Fl Q
+option of
+.Xr ssh 1
+may be used to list supported key types.
.It Cm PubkeyAuthentication
Specifies whether to try public key authentication.
The argument to this keyword must be
@@ -1109,7 +1421,6 @@
.Dq no .
The default is
.Dq yes .
-This option applies to protocol version 2 only.
.It Cm RekeyLimit
Specifies the maximum amount of data that may be transmitted before the
session key is renegotiated, optionally followed a maximum amount of
@@ -1135,7 +1446,6 @@
.Dq default none ,
which means that rekeying is performed after the cipher's default amount
of data has been sent or received and no time based rekeying is done.
-This option applies to protocol version 2 only.
.It Cm RemoteForward
Specifies that a TCP port on the remote machine be forwarded over
the secure channel to the specified host and port from the local machine.
@@ -1190,6 +1500,16 @@
.Fl T
flags for
.Xr ssh 1 .
+.It Cm RevokedHostKeys
+Specifies revoked host public keys.
+Keys listed in this file will be refused for host authentication.
+Note that if this file does not exist or is not readable,
+then host authentication will be refused for all hosts.
+Keys may be specified as a text file, listing one public key per line, or as
+an OpenSSH Key Revocation List (KRL) as generated by
+.Xr ssh-keygen 1 .
+For more information on KRLs, see the KEY REVOCATION LISTS section in
+.Xr ssh-keygen 1 .
.It Cm RhostsRSAAuthentication
Specifies whether to try rhosts based authentication with RSA host
authentication.
@@ -1218,9 +1538,12 @@
Specifies what variables from the local
.Xr environ 7
should be sent to the server.
-Note that environment passing is only supported for protocol 2.
The server must also support it, and the server must be configured to
accept these environment variables.
+Note that the
+.Ev TERM
+environment variable is always sent whenever a
+pseudo-terminal is requested as it is required by the protocol.
Refer to
.Cm AcceptEnv
in
@@ -1262,7 +1585,6 @@
.Cm ServerAliveCountMax
is left at the default, if the server becomes unresponsive,
ssh will disconnect after approximately 45 seconds.
-This option applies to protocol version 2 only.
.It Cm ServerAliveInterval
Sets a timeout interval in seconds after which if no data has been received
from the server,
@@ -1271,7 +1593,33 @@
channel to request a response from the server.
The default
is 0, indicating that these messages will not be sent to the server.
-This option applies to protocol version 2 only.
+.It Cm StreamLocalBindMask
+Sets the octal file creation mode mask
+.Pq umask
+used when creating a Unix-domain socket file for local or remote
+port forwarding.
+This option is only used for port forwarding to a Unix-domain socket file.
+.Pp
+The default value is 0177, which creates a Unix-domain socket file that is
+readable and writable only by the owner.
+Note that not all operating systems honor the file mode on Unix-domain
+socket files.
+.It Cm StreamLocalBindUnlink
+Specifies whether to remove an existing Unix-domain socket file for local
+or remote port forwarding before creating a new one.
+If the socket file already exists and
+.Cm StreamLocalBindUnlink
+is not enabled,
+.Nm ssh
+will be unable to forward the port to the Unix-domain socket file.
+This option is only used for port forwarding to a Unix-domain socket file.
+.Pp
+The argument must be
+.Dq yes
+or
+.Dq no .
+The default is
+.Dq no .
.It Cm StrictHostKeyChecking
If this flag is set to
.Dq yes ,
@@ -1361,6 +1709,36 @@
.Dq any .
The default is
.Dq any:any .
+.It Cm UpdateHostKeys
+Specifies whether
+.Xr ssh 1
+should accept notifications of additional hostkeys from the server sent
+after authentication has completed and add them to
+.Cm UserKnownHostsFile .
+The argument must be
+.Dq yes ,
+.Dq no
+(the default) or
+.Dq ask .
+Enabling this option allows learning alternate hostkeys for a server
+and supports graceful key rotation by allowing a server to send replacement
+public keys before old ones are removed.
+Additional hostkeys are only accepted if the key used to authenticate the
+host was already trusted or explicitly accepted by the user.
+If
+.Cm UpdateHostKeys
+is set to
+.Dq ask ,
+then the user is asked to confirm the modifications to the known_hosts file.
+Confirmation is currently incompatible with
+.Cm ControlPersist ,
+and will be disabled if it is enabled.
+.Pp
+Presently, only
+.Xr sshd 8
+from OpenSSH 6.8 and greater support the
+.Dq hostkeys at openssh.com
+protocol extension used to inform the client of all the server's hostkeys.
.It Cm UsePrivilegedPort
Specifies whether to use a privileged port for outgoing connections.
The argument must be
@@ -1411,7 +1789,6 @@
.Dq ask .
The default is
.Dq no .
-Note that this option applies to protocol version 2 only.
.Pp
See also VERIFYING HOST KEYS in
.Xr ssh 1 .
@@ -1419,12 +1796,12 @@
If this flag is set to
.Dq yes ,
an ASCII art representation of the remote host key fingerprint is
-printed in addition to the hex fingerprint string at login and
+printed in addition to the fingerprint string at login and
for unknown host keys.
If this flag is set to
.Dq no ,
no fingerprint strings are printed at login and
-only the hex fingerprint string will be printed for unknown host keys.
+only the fingerprint string will be printed for unknown host keys.
The default is
.Dq no .
.It Cm XAuthLocation
Copied: trunk/crypto/openssh/sshbuf-getput-basic.c (from rev 9222, vendor-crypto/openssh/dist/sshbuf-getput-basic.c)
===================================================================
--- trunk/crypto/openssh/sshbuf-getput-basic.c (rev 0)
+++ trunk/crypto/openssh/sshbuf-getput-basic.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,464 @@
+/* $OpenBSD: sshbuf-getput-basic.c,v 1.6 2016/06/16 11:00:17 dtucker Exp $ */
+/*
+ * Copyright (c) 2011 Damien Miller
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define SSHBUF_INTERNAL
+#include "includes.h"
+
+#include <sys/types.h>
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "ssherr.h"
+#include "sshbuf.h"
+
+int
+sshbuf_get(struct sshbuf *buf, void *v, size_t len)
+{
+ const u_char *p = sshbuf_ptr(buf);
+ int r;
+
+ if ((r = sshbuf_consume(buf, len)) < 0)
+ return r;
+ if (v != NULL && len != 0)
+ memcpy(v, p, len);
+ return 0;
+}
+
+int
+sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp)
+{
+ const u_char *p = sshbuf_ptr(buf);
+ int r;
+
+ if ((r = sshbuf_consume(buf, 8)) < 0)
+ return r;
+ if (valp != NULL)
+ *valp = PEEK_U64(p);
+ return 0;
+}
+
+int
+sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp)
+{
+ const u_char *p = sshbuf_ptr(buf);
+ int r;
+
+ if ((r = sshbuf_consume(buf, 4)) < 0)
+ return r;
+ if (valp != NULL)
+ *valp = PEEK_U32(p);
+ return 0;
+}
+
+int
+sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp)
+{
+ const u_char *p = sshbuf_ptr(buf);
+ int r;
+
+ if ((r = sshbuf_consume(buf, 2)) < 0)
+ return r;
+ if (valp != NULL)
+ *valp = PEEK_U16(p);
+ return 0;
+}
+
+int
+sshbuf_get_u8(struct sshbuf *buf, u_char *valp)
+{
+ const u_char *p = sshbuf_ptr(buf);
+ int r;
+
+ if ((r = sshbuf_consume(buf, 1)) < 0)
+ return r;
+ if (valp != NULL)
+ *valp = (u_int8_t)*p;
+ return 0;
+}
+
+int
+sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp)
+{
+ const u_char *val;
+ size_t len;
+ int r;
+
+ if (valp != NULL)
+ *valp = NULL;
+ if (lenp != NULL)
+ *lenp = 0;
+ if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
+ return r;
+ if (valp != NULL) {
+ if ((*valp = malloc(len + 1)) == NULL) {
+ SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ if (len != 0)
+ memcpy(*valp, val, len);
+ (*valp)[len] = '\0';
+ }
+ if (lenp != NULL)
+ *lenp = len;
+ return 0;
+}
+
+int
+sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp)
+{
+ size_t len;
+ const u_char *p;
+ int r;
+
+ if (valp != NULL)
+ *valp = NULL;
+ if (lenp != NULL)
+ *lenp = 0;
+ if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
+ return r;
+ if (valp != NULL)
+ *valp = p;
+ if (lenp != NULL)
+ *lenp = len;
+ if (sshbuf_consume(buf, len + 4) != 0) {
+ /* Shouldn't happen */
+ SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
+ SSHBUF_ABORT();
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ return 0;
+}
+
+int
+sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
+ size_t *lenp)
+{
+ u_int32_t len;
+ const u_char *p = sshbuf_ptr(buf);
+
+ if (valp != NULL)
+ *valp = NULL;
+ if (lenp != NULL)
+ *lenp = 0;
+ if (sshbuf_len(buf) < 4) {
+ SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
+ return SSH_ERR_MESSAGE_INCOMPLETE;
+ }
+ len = PEEK_U32(p);
+ if (len > SSHBUF_SIZE_MAX - 4) {
+ SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
+ return SSH_ERR_STRING_TOO_LARGE;
+ }
+ if (sshbuf_len(buf) - 4 < len) {
+ SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
+ return SSH_ERR_MESSAGE_INCOMPLETE;
+ }
+ if (valp != NULL)
+ *valp = p + 4;
+ if (lenp != NULL)
+ *lenp = len;
+ return 0;
+}
+
+int
+sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp)
+{
+ size_t len;
+ const u_char *p, *z;
+ int r;
+
+ if (valp != NULL)
+ *valp = NULL;
+ if (lenp != NULL)
+ *lenp = 0;
+ if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
+ return r;
+ /* Allow a \0 only at the end of the string */
+ if (len > 0 &&
+ (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
+ SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
+ return SSH_ERR_INVALID_FORMAT;
+ }
+ if ((r = sshbuf_skip_string(buf)) != 0)
+ return -1;
+ if (valp != NULL) {
+ if ((*valp = malloc(len + 1)) == NULL) {
+ SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ if (len != 0)
+ memcpy(*valp, p, len);
+ (*valp)[len] = '\0';
+ }
+ if (lenp != NULL)
+ *lenp = (size_t)len;
+ return 0;
+}
+
+int
+sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v)
+{
+ u_int32_t len;
+ u_char *p;
+ int r;
+
+ /*
+ * Use sshbuf_peek_string_direct() to figure out if there is
+ * a complete string in 'buf' and copy the string directly
+ * into 'v'.
+ */
+ if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 ||
+ (r = sshbuf_get_u32(buf, &len)) != 0 ||
+ (r = sshbuf_reserve(v, len, &p)) != 0 ||
+ (r = sshbuf_get(buf, p, len)) != 0)
+ return r;
+ return 0;
+}
+
+int
+sshbuf_put(struct sshbuf *buf, const void *v, size_t len)
+{
+ u_char *p;
+ int r;
+
+ if ((r = sshbuf_reserve(buf, len, &p)) < 0)
+ return r;
+ if (len != 0)
+ memcpy(p, v, len);
+ return 0;
+}
+
+int
+sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v)
+{
+ return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
+}
+
+int
+sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
+{
+ va_list ap;
+ int r;
+
+ va_start(ap, fmt);
+ r = sshbuf_putfv(buf, fmt, ap);
+ va_end(ap);
+ return r;
+}
+
+int
+sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap)
+{
+ va_list ap2;
+ int r, len;
+ u_char *p;
+
+ VA_COPY(ap2, ap);
+ if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if (len == 0) {
+ r = 0;
+ goto out; /* Nothing to do */
+ }
+ va_end(ap2);
+ VA_COPY(ap2, ap);
+ if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
+ goto out;
+ if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out; /* Shouldn't happen */
+ }
+ /* Consume terminating \0 */
+ if ((r = sshbuf_consume_end(buf, 1)) != 0)
+ goto out;
+ r = 0;
+ out:
+ va_end(ap2);
+ return r;
+}
+
+int
+sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
+{
+ u_char *p;
+ int r;
+
+ if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
+ return r;
+ POKE_U64(p, val);
+ return 0;
+}
+
+int
+sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
+{
+ u_char *p;
+ int r;
+
+ if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
+ return r;
+ POKE_U32(p, val);
+ return 0;
+}
+
+int
+sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
+{
+ u_char *p;
+ int r;
+
+ if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
+ return r;
+ POKE_U16(p, val);
+ return 0;
+}
+
+int
+sshbuf_put_u8(struct sshbuf *buf, u_char val)
+{
+ u_char *p;
+ int r;
+
+ if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
+ return r;
+ p[0] = val;
+ return 0;
+}
+
+int
+sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len)
+{
+ u_char *d;
+ int r;
+
+ if (len > SSHBUF_SIZE_MAX - 4) {
+ SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
+ return SSH_ERR_NO_BUFFER_SPACE;
+ }
+ if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
+ return r;
+ POKE_U32(d, len);
+ if (len != 0)
+ memcpy(d + 4, v, len);
+ return 0;
+}
+
+int
+sshbuf_put_cstring(struct sshbuf *buf, const char *v)
+{
+ return sshbuf_put_string(buf, (u_char *)v, v == NULL ? 0 : strlen(v));
+}
+
+int
+sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v)
+{
+ return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
+}
+
+int
+sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp)
+{
+ const u_char *p;
+ size_t len;
+ struct sshbuf *ret;
+ int r;
+
+ if (buf == NULL || bufp == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+ *bufp = NULL;
+ if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
+ return r;
+ if ((ret = sshbuf_from(p, len)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_consume(buf, len + 4)) != 0 || /* Shouldn't happen */
+ (r = sshbuf_set_parent(ret, buf)) != 0) {
+ sshbuf_free(ret);
+ return r;
+ }
+ *bufp = ret;
+ return 0;
+}
+
+int
+sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len)
+{
+ u_char *d;
+ const u_char *s = (const u_char *)v;
+ int r, prepend;
+
+ if (len > SSHBUF_SIZE_MAX - 5) {
+ SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
+ return SSH_ERR_NO_BUFFER_SPACE;
+ }
+ /* Skip leading zero bytes */
+ for (; len > 0 && *s == 0; len--, s++)
+ ;
+ /*
+ * If most significant bit is set then prepend a zero byte to
+ * avoid interpretation as a negative number.
+ */
+ prepend = len > 0 && (s[0] & 0x80) != 0;
+ if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
+ return r;
+ POKE_U32(d, len + prepend);
+ if (prepend)
+ d[4] = 0;
+ if (len != 0)
+ memcpy(d + 4 + prepend, s, len);
+ return 0;
+}
+
+int
+sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
+ const u_char **valp, size_t *lenp)
+{
+ const u_char *d;
+ size_t len, olen;
+ int r;
+
+ if ((r = sshbuf_peek_string_direct(buf, &d, &olen)) < 0)
+ return r;
+ len = olen;
+ /* Refuse negative (MSB set) bignums */
+ if ((len != 0 && (*d & 0x80) != 0))
+ return SSH_ERR_BIGNUM_IS_NEGATIVE;
+ /* Refuse overlong bignums, allow prepended \0 to avoid MSB set */
+ if (len > SSHBUF_MAX_BIGNUM + 1 ||
+ (len == SSHBUF_MAX_BIGNUM + 1 && *d != 0))
+ return SSH_ERR_BIGNUM_TOO_LARGE;
+ /* Trim leading zeros */
+ while (len > 0 && *d == 0x00) {
+ d++;
+ len--;
+ }
+ if (valp != NULL)
+ *valp = d;
+ if (lenp != NULL)
+ *lenp = len;
+ if (sshbuf_consume(buf, olen + 4) != 0) {
+ /* Shouldn't happen */
+ SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
+ SSHBUF_ABORT();
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ return 0;
+}
Copied: trunk/crypto/openssh/sshbuf-getput-crypto.c (from rev 9222, vendor-crypto/openssh/dist/sshbuf-getput-crypto.c)
===================================================================
--- trunk/crypto/openssh/sshbuf-getput-crypto.c (rev 0)
+++ trunk/crypto/openssh/sshbuf-getput-crypto.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,224 @@
+/* $OpenBSD: sshbuf-getput-crypto.c,v 1.5 2016/01/12 23:42:54 djm Exp $ */
+/*
+ * Copyright (c) 2011 Damien Miller
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define SSHBUF_INTERNAL
+#include "includes.h"
+
+#include <sys/types.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+#ifdef OPENSSL_HAS_ECC
+# include <openssl/ec.h>
+#endif /* OPENSSL_HAS_ECC */
+
+#include "ssherr.h"
+#include "sshbuf.h"
+
+int
+sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM *v)
+{
+ const u_char *d;
+ size_t len;
+ int r;
+
+ if ((r = sshbuf_get_bignum2_bytes_direct(buf, &d, &len)) != 0)
+ return r;
+ if (v != NULL && BN_bin2bn(d, len, v) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ return 0;
+}
+
+int
+sshbuf_get_bignum1(struct sshbuf *buf, BIGNUM *v)
+{
+ const u_char *d = sshbuf_ptr(buf);
+ u_int16_t len_bits;
+ size_t len_bytes;
+
+ /* Length in bits */
+ if (sshbuf_len(buf) < 2)
+ return SSH_ERR_MESSAGE_INCOMPLETE;
+ len_bits = PEEK_U16(d);
+ len_bytes = (len_bits + 7) >> 3;
+ if (len_bytes > SSHBUF_MAX_BIGNUM)
+ return SSH_ERR_BIGNUM_TOO_LARGE;
+ if (sshbuf_len(buf) < 2 + len_bytes)
+ return SSH_ERR_MESSAGE_INCOMPLETE;
+ if (v != NULL && BN_bin2bn(d + 2, len_bytes, v) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (sshbuf_consume(buf, 2 + len_bytes) != 0) {
+ SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
+ SSHBUF_ABORT();
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ return 0;
+}
+
+#ifdef OPENSSL_HAS_ECC
+static int
+get_ec(const u_char *d, size_t len, EC_POINT *v, const EC_GROUP *g)
+{
+ /* Refuse overlong bignums */
+ if (len == 0 || len > SSHBUF_MAX_ECPOINT)
+ return SSH_ERR_ECPOINT_TOO_LARGE;
+ /* Only handle uncompressed points */
+ if (*d != POINT_CONVERSION_UNCOMPRESSED)
+ return SSH_ERR_INVALID_FORMAT;
+ if (v != NULL && EC_POINT_oct2point(g, v, d, len, NULL) != 1)
+ return SSH_ERR_INVALID_FORMAT; /* XXX assumption */
+ return 0;
+}
+
+int
+sshbuf_get_ec(struct sshbuf *buf, EC_POINT *v, const EC_GROUP *g)
+{
+ const u_char *d;
+ size_t len;
+ int r;
+
+ if ((r = sshbuf_peek_string_direct(buf, &d, &len)) < 0)
+ return r;
+ if ((r = get_ec(d, len, v, g)) != 0)
+ return r;
+ /* Skip string */
+ if (sshbuf_get_string_direct(buf, NULL, NULL) != 0) {
+ /* Shouldn't happen */
+ SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
+ SSHBUF_ABORT();
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ return 0;
+}
+
+int
+sshbuf_get_eckey(struct sshbuf *buf, EC_KEY *v)
+{
+ EC_POINT *pt = EC_POINT_new(EC_KEY_get0_group(v));
+ int r;
+ const u_char *d;
+ size_t len;
+
+ if (pt == NULL) {
+ SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ if ((r = sshbuf_peek_string_direct(buf, &d, &len)) < 0) {
+ EC_POINT_free(pt);
+ return r;
+ }
+ if ((r = get_ec(d, len, pt, EC_KEY_get0_group(v))) != 0) {
+ EC_POINT_free(pt);
+ return r;
+ }
+ if (EC_KEY_set_public_key(v, pt) != 1) {
+ EC_POINT_free(pt);
+ return SSH_ERR_ALLOC_FAIL; /* XXX assumption */
+ }
+ EC_POINT_free(pt);
+ /* Skip string */
+ if (sshbuf_get_string_direct(buf, NULL, NULL) != 0) {
+ /* Shouldn't happen */
+ SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
+ SSHBUF_ABORT();
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ return 0;
+}
+#endif /* OPENSSL_HAS_ECC */
+
+int
+sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v)
+{
+ u_char d[SSHBUF_MAX_BIGNUM + 1];
+ int len = BN_num_bytes(v), prepend = 0, r;
+
+ if (len < 0 || len > SSHBUF_MAX_BIGNUM)
+ return SSH_ERR_INVALID_ARGUMENT;
+ *d = '\0';
+ if (BN_bn2bin(v, d + 1) != len)
+ return SSH_ERR_INTERNAL_ERROR; /* Shouldn't happen */
+ /* If MSB is set, prepend a \0 */
+ if (len > 0 && (d[1] & 0x80) != 0)
+ prepend = 1;
+ if ((r = sshbuf_put_string(buf, d + 1 - prepend, len + prepend)) < 0) {
+ explicit_bzero(d, sizeof(d));
+ return r;
+ }
+ explicit_bzero(d, sizeof(d));
+ return 0;
+}
+
+int
+sshbuf_put_bignum1(struct sshbuf *buf, const BIGNUM *v)
+{
+ int r, len_bits = BN_num_bits(v);
+ size_t len_bytes = (len_bits + 7) / 8;
+ u_char d[SSHBUF_MAX_BIGNUM], *dp;
+
+ if (len_bits < 0 || len_bytes > SSHBUF_MAX_BIGNUM)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (BN_bn2bin(v, d) != (int)len_bytes)
+ return SSH_ERR_INTERNAL_ERROR; /* Shouldn't happen */
+ if ((r = sshbuf_reserve(buf, len_bytes + 2, &dp)) < 0) {
+ explicit_bzero(d, sizeof(d));
+ return r;
+ }
+ POKE_U16(dp, len_bits);
+ if (len_bytes != 0)
+ memcpy(dp + 2, d, len_bytes);
+ explicit_bzero(d, sizeof(d));
+ return 0;
+}
+
+#ifdef OPENSSL_HAS_ECC
+int
+sshbuf_put_ec(struct sshbuf *buf, const EC_POINT *v, const EC_GROUP *g)
+{
+ u_char d[SSHBUF_MAX_ECPOINT];
+ BN_CTX *bn_ctx;
+ size_t len;
+ int ret;
+
+ if ((bn_ctx = BN_CTX_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((len = EC_POINT_point2oct(g, v, POINT_CONVERSION_UNCOMPRESSED,
+ NULL, 0, bn_ctx)) > SSHBUF_MAX_ECPOINT) {
+ BN_CTX_free(bn_ctx);
+ return SSH_ERR_INVALID_ARGUMENT;
+ }
+ if (EC_POINT_point2oct(g, v, POINT_CONVERSION_UNCOMPRESSED,
+ d, len, bn_ctx) != len) {
+ BN_CTX_free(bn_ctx);
+ return SSH_ERR_INTERNAL_ERROR; /* Shouldn't happen */
+ }
+ BN_CTX_free(bn_ctx);
+ ret = sshbuf_put_string(buf, d, len);
+ explicit_bzero(d, len);
+ return ret;
+}
+
+int
+sshbuf_put_eckey(struct sshbuf *buf, const EC_KEY *v)
+{
+ return sshbuf_put_ec(buf, EC_KEY_get0_public_key(v),
+ EC_KEY_get0_group(v));
+}
+#endif /* OPENSSL_HAS_ECC */
+
Copied: trunk/crypto/openssh/sshbuf-misc.c (from rev 9222, vendor-crypto/openssh/dist/sshbuf-misc.c)
===================================================================
--- trunk/crypto/openssh/sshbuf-misc.c (rev 0)
+++ trunk/crypto/openssh/sshbuf-misc.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,161 @@
+/* $OpenBSD: sshbuf-misc.c,v 1.6 2016/05/02 08:49:03 djm Exp $ */
+/*
+ * Copyright (c) 2011 Damien Miller
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <errno.h>
+#include <stdlib.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdio.h>
+#include <limits.h>
+#include <string.h>
+#include <resolv.h>
+#include <ctype.h>
+
+#include "ssherr.h"
+#define SSHBUF_INTERNAL
+#include "sshbuf.h"
+
+void
+sshbuf_dump_data(const void *s, size_t len, FILE *f)
+{
+ size_t i, j;
+ const u_char *p = (const u_char *)s;
+
+ for (i = 0; i < len; i += 16) {
+ fprintf(f, "%.4zu: ", i);
+ for (j = i; j < i + 16; j++) {
+ if (j < len)
+ fprintf(f, "%02x ", p[j]);
+ else
+ fprintf(f, " ");
+ }
+ fprintf(f, " ");
+ for (j = i; j < i + 16; j++) {
+ if (j < len) {
+ if (isascii(p[j]) && isprint(p[j]))
+ fprintf(f, "%c", p[j]);
+ else
+ fprintf(f, ".");
+ }
+ }
+ fprintf(f, "\n");
+ }
+}
+
+void
+sshbuf_dump(struct sshbuf *buf, FILE *f)
+{
+ fprintf(f, "buffer %p len = %zu\n", buf, sshbuf_len(buf));
+ sshbuf_dump_data(sshbuf_ptr(buf), sshbuf_len(buf), f);
+}
+
+char *
+sshbuf_dtob16(struct sshbuf *buf)
+{
+ size_t i, j, len = sshbuf_len(buf);
+ const u_char *p = sshbuf_ptr(buf);
+ char *ret;
+ const char hex[] = "0123456789abcdef";
+
+ if (len == 0)
+ return strdup("");
+ if (SIZE_MAX / 2 <= len || (ret = malloc(len * 2 + 1)) == NULL)
+ return NULL;
+ for (i = j = 0; i < len; i++) {
+ ret[j++] = hex[(p[i] >> 4) & 0xf];
+ ret[j++] = hex[p[i] & 0xf];
+ }
+ ret[j] = '\0';
+ return ret;
+}
+
+char *
+sshbuf_dtob64(struct sshbuf *buf)
+{
+ size_t len = sshbuf_len(buf), plen;
+ const u_char *p = sshbuf_ptr(buf);
+ char *ret;
+ int r;
+
+ if (len == 0)
+ return strdup("");
+ plen = ((len + 2) / 3) * 4 + 1;
+ if (SIZE_MAX / 2 <= len || (ret = malloc(plen)) == NULL)
+ return NULL;
+ if ((r = b64_ntop(p, len, ret, plen)) == -1) {
+ explicit_bzero(ret, plen);
+ free(ret);
+ return NULL;
+ }
+ return ret;
+}
+
+int
+sshbuf_b64tod(struct sshbuf *buf, const char *b64)
+{
+ size_t plen = strlen(b64);
+ int nlen, r;
+ u_char *p;
+
+ if (plen == 0)
+ return 0;
+ if ((p = malloc(plen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((nlen = b64_pton(b64, p, plen)) < 0) {
+ explicit_bzero(p, plen);
+ free(p);
+ return SSH_ERR_INVALID_FORMAT;
+ }
+ if ((r = sshbuf_put(buf, p, nlen)) < 0) {
+ explicit_bzero(p, plen);
+ free(p);
+ return r;
+ }
+ explicit_bzero(p, plen);
+ free(p);
+ return 0;
+}
+
+char *
+sshbuf_dup_string(struct sshbuf *buf)
+{
+ const u_char *p = NULL, *s = sshbuf_ptr(buf);
+ size_t l = sshbuf_len(buf);
+ char *r;
+
+ if (s == NULL || l > SIZE_MAX)
+ return NULL;
+ /* accept a nul only as the last character in the buffer */
+ if (l > 0 && (p = memchr(s, '\0', l)) != NULL) {
+ if (p != s + l - 1)
+ return NULL;
+ l--; /* the nul is put back below */
+ }
+ if ((r = malloc(l + 1)) == NULL)
+ return NULL;
+ if (l > 0)
+ memcpy(r, s, l);
+ r[l] = '\0';
+ return r;
+}
+
Copied: trunk/crypto/openssh/sshbuf.c (from rev 9222, vendor-crypto/openssh/dist/sshbuf.c)
===================================================================
--- trunk/crypto/openssh/sshbuf.c (rev 0)
+++ trunk/crypto/openssh/sshbuf.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,404 @@
+/* $OpenBSD: sshbuf.c,v 1.6 2016/01/12 23:42:54 djm Exp $ */
+/*
+ * Copyright (c) 2011 Damien Miller
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define SSHBUF_INTERNAL
+#include "includes.h"
+
+#include <sys/param.h> /* roundup */
+#include <sys/types.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "ssherr.h"
+#include "sshbuf.h"
+
+static inline int
+sshbuf_check_sanity(const struct sshbuf *buf)
+{
+ SSHBUF_TELL("sanity");
+ if (__predict_false(buf == NULL ||
+ (!buf->readonly && buf->d != buf->cd) ||
+ buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX ||
+ buf->cd == NULL ||
+ (buf->dont_free && (buf->readonly || buf->parent != NULL)) ||
+ buf->max_size > SSHBUF_SIZE_MAX ||
+ buf->alloc > buf->max_size ||
+ buf->size > buf->alloc ||
+ buf->off > buf->size)) {
+ /* Do not try to recover from corrupted buffer internals */
+ SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
+ signal(SIGSEGV, SIG_DFL);
+ raise(SIGSEGV);
+ return SSH_ERR_INTERNAL_ERROR;
+ }
+ return 0;
+}
+
+static void
+sshbuf_maybe_pack(struct sshbuf *buf, int force)
+{
+ SSHBUF_DBG(("force %d", force));
+ SSHBUF_TELL("pre-pack");
+ if (buf->off == 0 || buf->readonly || buf->refcount > 1)
+ return;
+ if (force ||
+ (buf->off >= SSHBUF_PACK_MIN && buf->off >= buf->size / 2)) {
+ memmove(buf->d, buf->d + buf->off, buf->size - buf->off);
+ buf->size -= buf->off;
+ buf->off = 0;
+ SSHBUF_TELL("packed");
+ }
+}
+
+struct sshbuf *
+sshbuf_new(void)
+{
+ struct sshbuf *ret;
+
+ if ((ret = calloc(sizeof(*ret), 1)) == NULL)
+ return NULL;
+ ret->alloc = SSHBUF_SIZE_INIT;
+ ret->max_size = SSHBUF_SIZE_MAX;
+ ret->readonly = 0;
+ ret->refcount = 1;
+ ret->parent = NULL;
+ if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL) {
+ free(ret);
+ return NULL;
+ }
+ return ret;
+}
+
+struct sshbuf *
+sshbuf_from(const void *blob, size_t len)
+{
+ struct sshbuf *ret;
+
+ if (blob == NULL || len > SSHBUF_SIZE_MAX ||
+ (ret = calloc(sizeof(*ret), 1)) == NULL)
+ return NULL;
+ ret->alloc = ret->size = ret->max_size = len;
+ ret->readonly = 1;
+ ret->refcount = 1;
+ ret->parent = NULL;
+ ret->cd = blob;
+ ret->d = NULL;
+ return ret;
+}
+
+int
+sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent)
+{
+ int r;
+
+ if ((r = sshbuf_check_sanity(child)) != 0 ||
+ (r = sshbuf_check_sanity(parent)) != 0)
+ return r;
+ child->parent = parent;
+ child->parent->refcount++;
+ return 0;
+}
+
+struct sshbuf *
+sshbuf_fromb(struct sshbuf *buf)
+{
+ struct sshbuf *ret;
+
+ if (sshbuf_check_sanity(buf) != 0)
+ return NULL;
+ if ((ret = sshbuf_from(sshbuf_ptr(buf), sshbuf_len(buf))) == NULL)
+ return NULL;
+ if (sshbuf_set_parent(ret, buf) != 0) {
+ sshbuf_free(ret);
+ return NULL;
+ }
+ return ret;
+}
+
+void
+sshbuf_init(struct sshbuf *ret)
+{
+ explicit_bzero(ret, sizeof(*ret));
+ ret->alloc = SSHBUF_SIZE_INIT;
+ ret->max_size = SSHBUF_SIZE_MAX;
+ ret->readonly = 0;
+ ret->dont_free = 1;
+ ret->refcount = 1;
+ if ((ret->cd = ret->d = calloc(1, ret->alloc)) == NULL)
+ ret->alloc = 0;
+}
+
+void
+sshbuf_free(struct sshbuf *buf)
+{
+ int dont_free = 0;
+
+ if (buf == NULL)
+ return;
+ /*
+ * The following will leak on insane buffers, but this is the safest
+ * course of action - an invalid pointer or already-freed pointer may
+ * have been passed to us and continuing to scribble over memory would
+ * be bad.
+ */
+ if (sshbuf_check_sanity(buf) != 0)
+ return;
+ /*
+ * If we are a child, the free our parent to decrement its reference
+ * count and possibly free it.
+ */
+ sshbuf_free(buf->parent);
+ buf->parent = NULL;
+ /*
+ * If we are a parent with still-extant children, then don't free just
+ * yet. The last child's call to sshbuf_free should decrement our
+ * refcount to 0 and trigger the actual free.
+ */
+ buf->refcount--;
+ if (buf->refcount > 0)
+ return;
+ dont_free = buf->dont_free;
+ if (!buf->readonly) {
+ explicit_bzero(buf->d, buf->alloc);
+ free(buf->d);
+ }
+ explicit_bzero(buf, sizeof(*buf));
+ if (!dont_free)
+ free(buf);
+}
+
+void
+sshbuf_reset(struct sshbuf *buf)
+{
+ u_char *d;
+
+ if (buf->readonly || buf->refcount > 1) {
+ /* Nonsensical. Just make buffer appear empty */
+ buf->off = buf->size;
+ return;
+ }
+ if (sshbuf_check_sanity(buf) == 0)
+ explicit_bzero(buf->d, buf->alloc);
+ buf->off = buf->size = 0;
+ if (buf->alloc != SSHBUF_SIZE_INIT) {
+ if ((d = realloc(buf->d, SSHBUF_SIZE_INIT)) != NULL) {
+ buf->cd = buf->d = d;
+ buf->alloc = SSHBUF_SIZE_INIT;
+ }
+ }
+}
+
+size_t
+sshbuf_max_size(const struct sshbuf *buf)
+{
+ return buf->max_size;
+}
+
+size_t
+sshbuf_alloc(const struct sshbuf *buf)
+{
+ return buf->alloc;
+}
+
+const struct sshbuf *
+sshbuf_parent(const struct sshbuf *buf)
+{
+ return buf->parent;
+}
+
+u_int
+sshbuf_refcount(const struct sshbuf *buf)
+{
+ return buf->refcount;
+}
+
+int
+sshbuf_set_max_size(struct sshbuf *buf, size_t max_size)
+{
+ size_t rlen;
+ u_char *dp;
+ int r;
+
+ SSHBUF_DBG(("set max buf = %p len = %zu", buf, max_size));
+ if ((r = sshbuf_check_sanity(buf)) != 0)
+ return r;
+ if (max_size == buf->max_size)
+ return 0;
+ if (buf->readonly || buf->refcount > 1)
+ return SSH_ERR_BUFFER_READ_ONLY;
+ if (max_size > SSHBUF_SIZE_MAX)
+ return SSH_ERR_NO_BUFFER_SPACE;
+ /* pack and realloc if necessary */
+ sshbuf_maybe_pack(buf, max_size < buf->size);
+ if (max_size < buf->alloc && max_size > buf->size) {
+ if (buf->size < SSHBUF_SIZE_INIT)
+ rlen = SSHBUF_SIZE_INIT;
+ else
+ rlen = roundup(buf->size, SSHBUF_SIZE_INC);
+ if (rlen > max_size)
+ rlen = max_size;
+ explicit_bzero(buf->d + buf->size, buf->alloc - buf->size);
+ SSHBUF_DBG(("new alloc = %zu", rlen));
+ if ((dp = realloc(buf->d, rlen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ buf->cd = buf->d = dp;
+ buf->alloc = rlen;
+ }
+ SSHBUF_TELL("new-max");
+ if (max_size < buf->alloc)
+ return SSH_ERR_NO_BUFFER_SPACE;
+ buf->max_size = max_size;
+ return 0;
+}
+
+size_t
+sshbuf_len(const struct sshbuf *buf)
+{
+ if (sshbuf_check_sanity(buf) != 0)
+ return 0;
+ return buf->size - buf->off;
+}
+
+size_t
+sshbuf_avail(const struct sshbuf *buf)
+{
+ if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
+ return 0;
+ return buf->max_size - (buf->size - buf->off);
+}
+
+const u_char *
+sshbuf_ptr(const struct sshbuf *buf)
+{
+ if (sshbuf_check_sanity(buf) != 0)
+ return NULL;
+ return buf->cd + buf->off;
+}
+
+u_char *
+sshbuf_mutable_ptr(const struct sshbuf *buf)
+{
+ if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
+ return NULL;
+ return buf->d + buf->off;
+}
+
+int
+sshbuf_check_reserve(const struct sshbuf *buf, size_t len)
+{
+ int r;
+
+ if ((r = sshbuf_check_sanity(buf)) != 0)
+ return r;
+ if (buf->readonly || buf->refcount > 1)
+ return SSH_ERR_BUFFER_READ_ONLY;
+ SSHBUF_TELL("check");
+ /* Check that len is reasonable and that max_size + available < len */
+ if (len > buf->max_size || buf->max_size - len < buf->size - buf->off)
+ return SSH_ERR_NO_BUFFER_SPACE;
+ return 0;
+}
+
+int
+sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp)
+{
+ size_t rlen, need;
+ u_char *dp;
+ int r;
+
+ if (dpp != NULL)
+ *dpp = NULL;
+
+ SSHBUF_DBG(("reserve buf = %p len = %zu", buf, len));
+ if ((r = sshbuf_check_reserve(buf, len)) != 0)
+ return r;
+ /*
+ * If the requested allocation appended would push us past max_size
+ * then pack the buffer, zeroing buf->off.
+ */
+ sshbuf_maybe_pack(buf, buf->size + len > buf->max_size);
+ SSHBUF_TELL("reserve");
+ if (len + buf->size > buf->alloc) {
+ /*
+ * Prefer to alloc in SSHBUF_SIZE_INC units, but
+ * allocate less if doing so would overflow max_size.
+ */
+ need = len + buf->size - buf->alloc;
+ rlen = roundup(buf->alloc + need, SSHBUF_SIZE_INC);
+ SSHBUF_DBG(("need %zu initial rlen %zu", need, rlen));
+ if (rlen > buf->max_size)
+ rlen = buf->alloc + need;
+ SSHBUF_DBG(("adjusted rlen %zu", rlen));
+ if ((dp = realloc(buf->d, rlen)) == NULL) {
+ SSHBUF_DBG(("realloc fail"));
+ if (dpp != NULL)
+ *dpp = NULL;
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ buf->alloc = rlen;
+ buf->cd = buf->d = dp;
+ if ((r = sshbuf_check_reserve(buf, len)) < 0) {
+ /* shouldn't fail */
+ if (dpp != NULL)
+ *dpp = NULL;
+ return r;
+ }
+ }
+ dp = buf->d + buf->size;
+ buf->size += len;
+ SSHBUF_TELL("done");
+ if (dpp != NULL)
+ *dpp = dp;
+ return 0;
+}
+
+int
+sshbuf_consume(struct sshbuf *buf, size_t len)
+{
+ int r;
+
+ SSHBUF_DBG(("len = %zu", len));
+ if ((r = sshbuf_check_sanity(buf)) != 0)
+ return r;
+ if (len == 0)
+ return 0;
+ if (len > sshbuf_len(buf))
+ return SSH_ERR_MESSAGE_INCOMPLETE;
+ buf->off += len;
+ SSHBUF_TELL("done");
+ return 0;
+}
+
+int
+sshbuf_consume_end(struct sshbuf *buf, size_t len)
+{
+ int r;
+
+ SSHBUF_DBG(("len = %zu", len));
+ if ((r = sshbuf_check_sanity(buf)) != 0)
+ return r;
+ if (len == 0)
+ return 0;
+ if (len > sshbuf_len(buf))
+ return SSH_ERR_MESSAGE_INCOMPLETE;
+ buf->size -= len;
+ SSHBUF_TELL("done");
+ return 0;
+}
+
Copied: trunk/crypto/openssh/sshbuf.h (from rev 9222, vendor-crypto/openssh/dist/sshbuf.h)
===================================================================
--- trunk/crypto/openssh/sshbuf.h (rev 0)
+++ trunk/crypto/openssh/sshbuf.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,348 @@
+/* $OpenBSD: sshbuf.h,v 1.7 2016/05/02 08:49:03 djm Exp $ */
+/*
+ * Copyright (c) 2011 Damien Miller
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _SSHBUF_H
+#define _SSHBUF_H
+
+#include <sys/types.h>
+#include <stdarg.h>
+#include <stdio.h>
+#ifdef WITH_OPENSSL
+# include <openssl/bn.h>
+# ifdef OPENSSL_HAS_ECC
+# include <openssl/ec.h>
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+
+#define SSHBUF_SIZE_MAX 0x8000000 /* Hard maximum size */
+#define SSHBUF_REFS_MAX 0x100000 /* Max child buffers */
+#define SSHBUF_MAX_BIGNUM (16384 / 8) /* Max bignum *bytes* */
+#define SSHBUF_MAX_ECPOINT ((528 * 2 / 8) + 1) /* Max EC point *bytes* */
+
+/*
+ * NB. do not depend on the internals of this. It will be made opaque
+ * one day.
+ */
+struct sshbuf {
+ u_char *d; /* Data */
+ const u_char *cd; /* Const data */
+ size_t off; /* First available byte is buf->d + buf->off */
+ size_t size; /* Last byte is buf->d + buf->size - 1 */
+ size_t max_size; /* Maximum size of buffer */
+ size_t alloc; /* Total bytes allocated to buf->d */
+ int readonly; /* Refers to external, const data */
+ int dont_free; /* Kludge to support sshbuf_init */
+ u_int refcount; /* Tracks self and number of child buffers */
+ struct sshbuf *parent; /* If child, pointer to parent */
+};
+
+#ifndef SSHBUF_NO_DEPREACTED
+/*
+ * NB. Please do not use sshbuf_init() in new code. Please use sshbuf_new()
+ * instead. sshbuf_init() is deprectated and will go away soon (it is
+ * only included to allow compat with buffer_* in OpenSSH)
+ */
+void sshbuf_init(struct sshbuf *buf);
+#endif
+
+/*
+ * Create a new sshbuf buffer.
+ * Returns pointer to buffer on success, or NULL on allocation failure.
+ */
+struct sshbuf *sshbuf_new(void);
+
+/*
+ * Create a new, read-only sshbuf buffer from existing data.
+ * Returns pointer to buffer on success, or NULL on allocation failure.
+ */
+struct sshbuf *sshbuf_from(const void *blob, size_t len);
+
+/*
+ * Create a new, read-only sshbuf buffer from the contents of an existing
+ * buffer. The contents of "buf" must not change in the lifetime of the
+ * resultant buffer.
+ * Returns pointer to buffer on success, or NULL on allocation failure.
+ */
+struct sshbuf *sshbuf_fromb(struct sshbuf *buf);
+
+/*
+ * Create a new, read-only sshbuf buffer from the contents of a string in
+ * an existing buffer (the string is consumed in the process).
+ * The contents of "buf" must not change in the lifetime of the resultant
+ * buffer.
+ * Returns pointer to buffer on success, or NULL on allocation failure.
+ */
+int sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp);
+
+/*
+ * Clear and free buf
+ */
+void sshbuf_free(struct sshbuf *buf);
+
+/*
+ * Reset buf, clearing its contents. NB. max_size is preserved.
+ */
+void sshbuf_reset(struct sshbuf *buf);
+
+/*
+ * Return the maximum size of buf
+ */
+size_t sshbuf_max_size(const struct sshbuf *buf);
+
+/*
+ * Set the maximum size of buf
+ * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
+ */
+int sshbuf_set_max_size(struct sshbuf *buf, size_t max_size);
+
+/*
+ * Returns the length of data in buf
+ */
+size_t sshbuf_len(const struct sshbuf *buf);
+
+/*
+ * Returns number of bytes left in buffer before hitting max_size.
+ */
+size_t sshbuf_avail(const struct sshbuf *buf);
+
+/*
+ * Returns a read-only pointer to the start of the data in buf
+ */
+const u_char *sshbuf_ptr(const struct sshbuf *buf);
+
+/*
+ * Returns a mutable pointer to the start of the data in buf, or
+ * NULL if the buffer is read-only.
+ */
+u_char *sshbuf_mutable_ptr(const struct sshbuf *buf);
+
+/*
+ * Check whether a reservation of size len will succeed in buf
+ * Safer to use than direct comparisons again sshbuf_avail as it copes
+ * with unsigned overflows correctly.
+ * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
+ */
+int sshbuf_check_reserve(const struct sshbuf *buf, size_t len);
+
+/*
+ * Reserve len bytes in buf.
+ * Returns 0 on success and a pointer to the first reserved byte via the
+ * optional dpp parameter or a negative * SSH_ERR_* error code on failure.
+ */
+int sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp);
+
+/*
+ * Consume len bytes from the start of buf
+ * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
+ */
+int sshbuf_consume(struct sshbuf *buf, size_t len);
+
+/*
+ * Consume len bytes from the end of buf
+ * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
+ */
+int sshbuf_consume_end(struct sshbuf *buf, size_t len);
+
+/* Extract or deposit some bytes */
+int sshbuf_get(struct sshbuf *buf, void *v, size_t len);
+int sshbuf_put(struct sshbuf *buf, const void *v, size_t len);
+int sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v);
+
+/* Append using a printf(3) format */
+int sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
+ __attribute__((format(printf, 2, 3)));
+int sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap);
+
+/* Functions to extract or store big-endian words of various sizes */
+int sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp);
+int sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp);
+int sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp);
+int sshbuf_get_u8(struct sshbuf *buf, u_char *valp);
+int sshbuf_put_u64(struct sshbuf *buf, u_int64_t val);
+int sshbuf_put_u32(struct sshbuf *buf, u_int32_t val);
+int sshbuf_put_u16(struct sshbuf *buf, u_int16_t val);
+int sshbuf_put_u8(struct sshbuf *buf, u_char val);
+
+/*
+ * Functions to extract or store SSH wire encoded strings (u32 len || data)
+ * The "cstring" variants admit no \0 characters in the string contents.
+ * Caller must free *valp.
+ */
+int sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp);
+int sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp);
+int sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v);
+int sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len);
+int sshbuf_put_cstring(struct sshbuf *buf, const char *v);
+int sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v);
+
+/*
+ * "Direct" variant of sshbuf_get_string, returns pointer into the sshbuf to
+ * avoid an malloc+memcpy. The pointer is guaranteed to be valid until the
+ * next sshbuf-modifying function call. Caller does not free.
+ */
+int sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp,
+ size_t *lenp);
+
+/* Skip past a string */
+#define sshbuf_skip_string(buf) sshbuf_get_string_direct(buf, NULL, NULL)
+
+/* Another variant: "peeks" into the buffer without modifying it */
+int sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
+ size_t *lenp);
+
+/*
+ * Functions to extract or store SSH wire encoded bignums and elliptic
+ * curve points.
+ */
+int sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len);
+int sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
+ const u_char **valp, size_t *lenp);
+#ifdef WITH_OPENSSL
+int sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM *v);
+int sshbuf_get_bignum1(struct sshbuf *buf, BIGNUM *v);
+int sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v);
+int sshbuf_put_bignum1(struct sshbuf *buf, const BIGNUM *v);
+# ifdef OPENSSL_HAS_ECC
+int sshbuf_get_ec(struct sshbuf *buf, EC_POINT *v, const EC_GROUP *g);
+int sshbuf_get_eckey(struct sshbuf *buf, EC_KEY *v);
+int sshbuf_put_ec(struct sshbuf *buf, const EC_POINT *v, const EC_GROUP *g);
+int sshbuf_put_eckey(struct sshbuf *buf, const EC_KEY *v);
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+
+/* Dump the contents of the buffer in a human-readable format */
+void sshbuf_dump(struct sshbuf *buf, FILE *f);
+
+/* Dump specified memory in a human-readable format */
+void sshbuf_dump_data(const void *s, size_t len, FILE *f);
+
+/* Return the hexadecimal representation of the contents of the buffer */
+char *sshbuf_dtob16(struct sshbuf *buf);
+
+/* Encode the contents of the buffer as base64 */
+char *sshbuf_dtob64(struct sshbuf *buf);
+
+/* Decode base64 data and append it to the buffer */
+int sshbuf_b64tod(struct sshbuf *buf, const char *b64);
+
+/*
+ * Duplicate the contents of a buffer to a string (caller to free).
+ * Returns NULL on buffer error, or if the buffer contains a premature
+ * nul character.
+ */
+char *sshbuf_dup_string(struct sshbuf *buf);
+
+/* Macros for decoding/encoding integers */
+#define PEEK_U64(p) \
+ (((u_int64_t)(((const u_char *)(p))[0]) << 56) | \
+ ((u_int64_t)(((const u_char *)(p))[1]) << 48) | \
+ ((u_int64_t)(((const u_char *)(p))[2]) << 40) | \
+ ((u_int64_t)(((const u_char *)(p))[3]) << 32) | \
+ ((u_int64_t)(((const u_char *)(p))[4]) << 24) | \
+ ((u_int64_t)(((const u_char *)(p))[5]) << 16) | \
+ ((u_int64_t)(((const u_char *)(p))[6]) << 8) | \
+ (u_int64_t)(((const u_char *)(p))[7]))
+#define PEEK_U32(p) \
+ (((u_int32_t)(((const u_char *)(p))[0]) << 24) | \
+ ((u_int32_t)(((const u_char *)(p))[1]) << 16) | \
+ ((u_int32_t)(((const u_char *)(p))[2]) << 8) | \
+ (u_int32_t)(((const u_char *)(p))[3]))
+#define PEEK_U16(p) \
+ (((u_int16_t)(((const u_char *)(p))[0]) << 8) | \
+ (u_int16_t)(((const u_char *)(p))[1]))
+
+#define POKE_U64(p, v) \
+ do { \
+ const u_int64_t __v = (v); \
+ ((u_char *)(p))[0] = (__v >> 56) & 0xff; \
+ ((u_char *)(p))[1] = (__v >> 48) & 0xff; \
+ ((u_char *)(p))[2] = (__v >> 40) & 0xff; \
+ ((u_char *)(p))[3] = (__v >> 32) & 0xff; \
+ ((u_char *)(p))[4] = (__v >> 24) & 0xff; \
+ ((u_char *)(p))[5] = (__v >> 16) & 0xff; \
+ ((u_char *)(p))[6] = (__v >> 8) & 0xff; \
+ ((u_char *)(p))[7] = __v & 0xff; \
+ } while (0)
+#define POKE_U32(p, v) \
+ do { \
+ const u_int32_t __v = (v); \
+ ((u_char *)(p))[0] = (__v >> 24) & 0xff; \
+ ((u_char *)(p))[1] = (__v >> 16) & 0xff; \
+ ((u_char *)(p))[2] = (__v >> 8) & 0xff; \
+ ((u_char *)(p))[3] = __v & 0xff; \
+ } while (0)
+#define POKE_U16(p, v) \
+ do { \
+ const u_int16_t __v = (v); \
+ ((u_char *)(p))[0] = (__v >> 8) & 0xff; \
+ ((u_char *)(p))[1] = __v & 0xff; \
+ } while (0)
+
+/* Internal definitions follow. Exposed for regress tests */
+#ifdef SSHBUF_INTERNAL
+
+/*
+ * Return the allocation size of buf
+ */
+size_t sshbuf_alloc(const struct sshbuf *buf);
+
+/*
+ * Increment the reference count of buf.
+ */
+int sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent);
+
+/*
+ * Return the parent buffer of buf, or NULL if it has no parent.
+ */
+const struct sshbuf *sshbuf_parent(const struct sshbuf *buf);
+
+/*
+ * Return the reference count of buf
+ */
+u_int sshbuf_refcount(const struct sshbuf *buf);
+
+# define SSHBUF_SIZE_INIT 256 /* Initial allocation */
+# define SSHBUF_SIZE_INC 256 /* Preferred increment length */
+# define SSHBUF_PACK_MIN 8192 /* Minimim packable offset */
+
+/* # define SSHBUF_ABORT abort */
+/* # define SSHBUF_DEBUG */
+
+# ifndef SSHBUF_ABORT
+# define SSHBUF_ABORT()
+# endif
+
+# ifdef SSHBUF_DEBUG
+# define SSHBUF_TELL(what) do { \
+ printf("%s:%d %s: %s size %zu alloc %zu off %zu max %zu\n", \
+ __FILE__, __LINE__, __func__, what, \
+ buf->size, buf->alloc, buf->off, buf->max_size); \
+ fflush(stdout); \
+ } while (0)
+# define SSHBUF_DBG(x) do { \
+ printf("%s:%d %s: ", __FILE__, __LINE__, __func__); \
+ printf x; \
+ printf("\n"); \
+ fflush(stdout); \
+ } while (0)
+# else
+# define SSHBUF_TELL(what)
+# define SSHBUF_DBG(x)
+# endif
+#endif /* SSHBUF_INTERNAL */
+
+#endif /* _SSHBUF_H */
Modified: trunk/crypto/openssh/sshconnect.c
===================================================================
--- trunk/crypto/openssh/sshconnect.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshconnect.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.246 2014/02/06 22:21:01 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.271 2016/01/14 22:56:56 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -15,6 +15,7 @@
#include "includes.h"
+#include <sys/param.h> /* roundup */
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/stat.h>
@@ -54,17 +55,20 @@
#include "sshconnect.h"
#include "hostfile.h"
#include "log.h"
+#include "misc.h"
#include "readconf.h"
#include "atomicio.h"
-#include "misc.h"
#include "dns.h"
-#include "roaming.h"
#include "monitor_fdpass.h"
#include "ssh2.h"
#include "version.h"
+#include "authfile.h"
+#include "ssherr.h"
+#include "authfd.h"
char *client_version_string = NULL;
char *server_version_string = NULL;
+Key *previous_host_key = NULL;
static int matching_host_key_dns = 0;
@@ -163,6 +167,7 @@
if ((sock = mm_receive_fd(sp[1])) == -1)
fatal("proxy dialer did not pass back a connection");
+ close(sp[1]);
while (waitpid(pid, NULL, 0) == -1)
if (errno != EINTR)
@@ -352,7 +357,7 @@
goto done;
}
- fdset = (fd_set *)xcalloc(howmany(sockfd + 1, NFDBITS),
+ fdset = xcalloc(howmany(sockfd + 1, NFDBITS),
sizeof(fd_mask));
FD_SET(sockfd, fdset);
ms_to_timeval(&tv, *timeoutp);
@@ -428,7 +433,9 @@
char ntop[NI_MAXHOST], strport[NI_MAXSERV];
struct addrinfo *ai;
- debug2("ssh_connect: needpriv %d", needpriv);
+ debug2("%s: needpriv %d", __func__, needpriv);
+ memset(ntop, 0, sizeof(ntop));
+ memset(strport, 0, sizeof(strport));
for (attempt = 0; attempt < connection_attempts; attempt++) {
if (attempt > 0) {
@@ -447,7 +454,7 @@
if (getnameinfo(ai->ai_addr, ai->ai_addrlen,
ntop, sizeof(ntop), strport, sizeof(strport),
NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
- error("ssh_connect: getnameinfo failed");
+ error("%s: getnameinfo failed", __func__);
continue;
}
debug("Connecting to %.200s [%.100s] port %s.",
@@ -525,7 +532,7 @@
xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n",
PROTOCOL_MAJOR_1, minor1, SSH_VERSION);
}
- if (roaming_atomicio(vwrite, connection_out, client_version_string,
+ if (atomicio(vwrite, connection_out, client_version_string,
strlen(client_version_string)) != strlen(client_version_string))
fatal("write: %.100s", strerror(errno));
chop(client_version_string);
@@ -585,7 +592,7 @@
}
}
- len = roaming_atomicio(read, connection_in, &buf[i], 1);
+ len = atomicio(read, connection_in, &buf[i], 1);
if (len != 1 && errno == EPIPE)
fatal("ssh_exchange_identification: "
@@ -624,7 +631,7 @@
debug("Remote protocol version %d.%d, remote software version %.100s",
remote_major, remote_minor, remote_version);
- compat_datafellows(remote_version);
+ active_state->compat = compat_datafellows(remote_version);
mismatch = 0;
switch (remote_major) {
@@ -709,7 +716,7 @@
error("%s", reason);
return 0;
}
- if (buffer_len(&host_key->cert->critical) != 0) {
+ if (buffer_len(host_key->cert->critical) != 0) {
error("Certificate for %s contains unsupported "
"critical options(s)", host);
return 0;
@@ -766,7 +773,7 @@
if (options.proxy_command == NULL) {
if (getnameinfo(hostaddr, addrlen,
ntop, sizeof(ntop), NULL, 0, NI_NUMERICHOST) != 0)
- fatal("check_host_key: getnameinfo failed");
+ fatal("%s: getnameinfo failed", __func__);
*hostfile_ipaddr = put_host_port(ntop, port);
} else {
*hostfile_ipaddr = xstrdup("<no hostip for proxy "
@@ -814,6 +821,7 @@
int len, cancelled_forwarding = 0;
int local = sockaddr_is_local(hostaddr);
int r, want_cert = key_is_cert(host_key), host_ip_differ = 0;
+ int hostkey_trusted = 0; /* Known or explicitly accepted by user */
struct hostkeys *host_hostkeys, *ip_hostkeys;
u_int i;
@@ -907,7 +915,7 @@
host_key, options.hash_known_hosts))
logit("Failed to add the %s host key for IP "
"address '%.128s' to the list of known "
- "hosts (%.30s).", type, ip,
+ "hosts (%.500s).", type, ip,
user_hostfiles[0]);
else
logit("Warning: Permanently added the %s host "
@@ -914,13 +922,17 @@
"key for IP address '%.128s' to the list "
"of known hosts.", type, ip);
} else if (options.visual_host_key) {
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
- ra = key_fingerprint(host_key, SSH_FP_MD5,
- SSH_FP_RANDOMART);
- logit("Host key fingerprint is %s\n%s\n", fp, ra);
+ fp = sshkey_fingerprint(host_key,
+ options.fingerprint_hash, SSH_FP_DEFAULT);
+ ra = sshkey_fingerprint(host_key,
+ options.fingerprint_hash, SSH_FP_RANDOMART);
+ if (fp == NULL || ra == NULL)
+ fatal("%s: sshkey_fingerprint fail", __func__);
+ logit("Host key fingerprint is %s\n%s", fp, ra);
free(ra);
free(fp);
}
+ hostkey_trusted = 1;
break;
case HOST_NEW:
if (options.host_key_alias == NULL && port != 0 &&
@@ -955,9 +967,12 @@
else
snprintf(msg1, sizeof(msg1), ".");
/* The default */
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
- ra = key_fingerprint(host_key, SSH_FP_MD5,
- SSH_FP_RANDOMART);
+ fp = sshkey_fingerprint(host_key,
+ options.fingerprint_hash, SSH_FP_DEFAULT);
+ ra = sshkey_fingerprint(host_key,
+ options.fingerprint_hash, SSH_FP_RANDOMART);
+ if (fp == NULL || ra == NULL)
+ fatal("%s: sshkey_fingerprint fail", __func__);
msg2[0] = '\0';
if (options.verify_host_key_dns) {
if (matching_host_key_dns)
@@ -983,6 +998,7 @@
free(fp);
if (!confirm(msg))
goto fail;
+ hostkey_trusted = 1; /* user explicitly confirmed */
}
/*
* If not in strict mode, add the key automatically to the
@@ -1181,6 +1197,12 @@
}
}
+ if (!hostkey_trusted && options.update_hostkeys) {
+ debug("%s: hostkey not known or explicitly trusted: "
+ "disabling UpdateHostkeys", __func__);
+ options.update_hostkeys = 0;
+ }
+
free(ip);
free(host);
if (host_hostkeys != NULL)
@@ -1217,29 +1239,89 @@
int
verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
{
- int flags = 0;
- char *fp;
+ u_int i;
+ int r = -1, flags = 0;
+ char valid[64], *fp = NULL, *cafp = NULL;
+ struct sshkey *plain = NULL;
Key *plain = NULL;
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
- debug("Server host key: %s %s", key_type(host_key), fp);
- free(fp);
+ if ((fp = sshkey_fingerprint(host_key,
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
+ error("%s: fingerprint host key: %s", __func__, ssh_err(r));
+ r = -1;
+ goto out;
+ }
+ if (sshkey_is_cert(host_key)) {
+ if ((cafp = sshkey_fingerprint(host_key->cert->signature_key,
+ options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
+ error("%s: fingerprint CA key: %s",
+ __func__, ssh_err(r));
+ r = -1;
+ goto out;
+ }
+ sshkey_format_cert_validity(host_key->cert,
+ valid, sizeof(valid));
+ debug("Server host certificate: %s %s, serial %llu "
+ "ID \"%s\" CA %s %s valid %s",
+ sshkey_ssh_name(host_key), fp,
+ (unsigned long long)host_key->cert->serial,
+ host_key->cert->key_id,
+ sshkey_ssh_name(host_key->cert->signature_key), cafp,
+ valid);
+ for (i = 0; i < host_key->cert->nprincipals; i++) {
+ debug2("Server host certificate hostname: %s",
+ host_key->cert->principals[i]);
+ }
+ } else {
+ debug("Server host key: %s %s", compat20 ?
+ sshkey_ssh_name(host_key) : sshkey_type(host_key), fp);
+ }
+
+ if (sshkey_equal(previous_host_key, host_key)) {
+ debug2("%s: server host key %s %s matches cached key",
+ __func__, sshkey_type(host_key), fp);
+ r = 0;
+ goto out;
+ }
+
+ /* Check in RevokedHostKeys file if specified */
+ if (options.revoked_host_keys != NULL) {
+ r = sshkey_check_revoked(host_key, options.revoked_host_keys);
+ switch (r) {
+ case 0:
+ break; /* not revoked */
+ case SSH_ERR_KEY_REVOKED:
+ error("Host key %s %s revoked by file %s",
+ sshkey_type(host_key), fp,
+ options.revoked_host_keys);
+ r = -1;
+ goto out;
+ default:
+ error("Error checking host key %s %s in "
+ "revoked keys file %s: %s", sshkey_type(host_key),
+ fp, options.revoked_host_keys, ssh_err(r));
+ r = -1;
+ goto out;
+ }
+ }
+
if (options.verify_host_key_dns) {
/*
* XXX certs are not yet supported for DNS, so downgrade
* them and try the plain key.
*/
- plain = key_from_private(host_key);
- if (key_is_cert(plain))
- key_drop_cert(plain);
+ if ((r = sshkey_from_private(host_key, &plain)) != 0)
+ goto out;
+ if (sshkey_is_cert(plain))
+ sshkey_drop_cert(plain);
if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) {
if (flags & DNS_VERIFY_FOUND) {
if (options.verify_host_key_dns == 1 &&
flags & DNS_VERIFY_MATCH &&
flags & DNS_VERIFY_SECURE) {
- key_free(plain);
- return 0;
+ r = 0;
+ goto out;
}
if (flags & DNS_VERIFY_MATCH) {
matching_host_key_dns = 1;
@@ -1253,10 +1335,20 @@
}
key_free(plain);
}
-
- return check_host_key(host, hostaddr, options.port, host_key, RDRW,
+ r = check_host_key(host, hostaddr, options.port, host_key, RDRW,
options.user_hostfiles, options.num_user_hostfiles,
options.system_hostfiles, options.num_system_hostfiles);
+
+out:
+ sshkey_free(plain);
+ free(fp);
+ free(cafp);
+ if (r == 0 && host_key != NULL) {
+ key_free(previous_host_key);
+ previous_host_key = key_from_private(host_key);
+ }
+
+ return r;
}
/*
@@ -1288,12 +1380,17 @@
/* key exchange */
/* authenticate user */
+ debug("Authenticating to %s:%d as '%s'", host, port, server_user);
if (compat20) {
ssh_kex2(host, hostaddr, port);
ssh_userauth2(local_user, server_user, host, sensitive);
} else {
+#ifdef WITH_SSH1
ssh_kex(host, hostaddr);
ssh_userauth1(local_user, server_user, host, sensitive);
+#else
+ fatal("ssh1 is not supported");
+#endif
}
free(local_user);
}
@@ -1337,8 +1434,12 @@
continue;
if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
continue;
- fp = key_fingerprint(found->key, SSH_FP_MD5, SSH_FP_HEX);
- ra = key_fingerprint(found->key, SSH_FP_MD5, SSH_FP_RANDOMART);
+ fp = sshkey_fingerprint(found->key,
+ options.fingerprint_hash, SSH_FP_DEFAULT);
+ ra = sshkey_fingerprint(found->key,
+ options.fingerprint_hash, SSH_FP_RANDOMART);
+ if (fp == NULL || ra == NULL)
+ fatal("%s: sshkey_fingerprint fail", __func__);
logit("WARNING: %s key found for host %s\n"
"in %s:%lu\n"
"%s key fingerprint %s.",
@@ -1359,7 +1460,10 @@
{
char *fp;
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
+ fp = sshkey_fingerprint(host_key, options.fingerprint_hash,
+ SSH_FP_DEFAULT);
+ if (fp == NULL)
+ fatal("%s: sshkey_fingerprint fail", __func__);
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
@@ -1413,3 +1517,30 @@
return (WEXITSTATUS(status));
}
+
+void
+maybe_add_key_to_agent(char *authfile, Key *private, char *comment,
+ char *passphrase)
+{
+ int auth_sock = -1, r;
+
+ if (options.add_keys_to_agent == 0)
+ return;
+
+ if ((r = ssh_get_authentication_socket(&auth_sock)) != 0) {
+ debug3("no authentication agent, not adding key");
+ return;
+ }
+
+ if (options.add_keys_to_agent == 2 &&
+ !ask_permission("Add key %s (%s) to agent?", authfile, comment)) {
+ debug3("user denied adding this key");
+ return;
+ }
+
+ if ((r = ssh_add_identity_constrained(auth_sock, private, comment, 0,
+ (options.add_keys_to_agent == 3))) == 0)
+ debug("identity added to agent: %s", authfile);
+ else
+ debug("could not add identity to agent: %s (%d)", authfile, r);
+}
Modified: trunk/crypto/openssh/sshconnect.h
===================================================================
--- trunk/crypto/openssh/sshconnect.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshconnect.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.h,v 1.28 2013/10/16 02:31:47 djm Exp $ */
+/* $OpenBSD: sshconnect.h,v 1.29 2015/11/15 22:26:49 jcs Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -55,6 +55,8 @@
void ssh_put_password(char *);
int ssh_local_cmd(const char *);
+void maybe_add_key_to_agent(char *, Key *, char *, char *);
+
/*
* Macros to raise/lower permissions.
*/
Modified: trunk/crypto/openssh/sshconnect1.c
===================================================================
--- trunk/crypto/openssh/sshconnect1.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshconnect1.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect1.c,v 1.74 2014/02/02 03:44:32 djm Exp $ */
+/* $OpenBSD: sshconnect1.c,v 1.78 2015/11/15 22:26:49 jcs Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -15,11 +15,14 @@
#include "includes.h"
+#ifdef WITH_SSH1
+
#include <sys/types.h>
#include <sys/socket.h>
#include <openssl/bn.h>
+#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
@@ -38,15 +41,16 @@
#include "kex.h"
#include "uidswap.h"
#include "log.h"
+#include "misc.h"
#include "readconf.h"
#include "authfd.h"
#include "sshconnect.h"
#include "authfile.h"
-#include "misc.h"
#include "canohost.h"
#include "hostfile.h"
#include "auth.h"
#include "digest.h"
+#include "ssherr.h"
/* Session id for the current session. */
u_char session_id[16];
@@ -62,33 +66,38 @@
static int
try_agent_authentication(void)
{
- int type;
- char *comment;
- AuthenticationConnection *auth;
+ int r, type, agent_fd, ret = 0;
u_char response[16];
- u_int i;
- Key *key;
+ size_t i;
BIGNUM *challenge;
+ struct ssh_identitylist *idlist = NULL;
/* Get connection to the agent. */
- auth = ssh_get_authentication_connection();
- if (!auth)
+ if ((r = ssh_get_authentication_socket(&agent_fd)) != 0) {
+ if (r != SSH_ERR_AGENT_NOT_PRESENT)
+ debug("%s: ssh_get_authentication_socket: %s",
+ __func__, ssh_err(r));
return 0;
+ }
if ((challenge = BN_new()) == NULL)
fatal("try_agent_authentication: BN_new failed");
+
/* Loop through identities served by the agent. */
- for (key = ssh_get_first_identity(auth, &comment, 1);
- key != NULL;
- key = ssh_get_next_identity(auth, &comment, 1)) {
-
+ if ((r = ssh_fetch_identitylist(agent_fd, 1, &idlist)) != 0) {
+ if (r != SSH_ERR_AGENT_NO_IDENTITIES)
+ debug("%s: ssh_fetch_identitylist: %s",
+ __func__, ssh_err(r));
+ goto out;
+ }
+ for (i = 0; i < idlist->nkeys; i++) {
/* Try this identity. */
- debug("Trying RSA authentication via agent with '%.100s'", comment);
- free(comment);
+ debug("Trying RSA authentication via agent with '%.100s'",
+ idlist->comments[i]);
/* Tell the server that we are willing to authenticate using this key. */
packet_start(SSH_CMSG_AUTH_RSA);
- packet_put_bignum(key->rsa->n);
+ packet_put_bignum(idlist->keys[i]->rsa->n);
packet_send();
packet_write_wait();
@@ -99,7 +108,6 @@
does not support RSA authentication. */
if (type == SSH_SMSG_FAILURE) {
debug("Server refused our key.");
- key_free(key);
continue;
}
/* Otherwise it should have sent a challenge. */
@@ -113,16 +121,17 @@
debug("Received RSA challenge from server.");
/* Ask the agent to decrypt the challenge. */
- if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
+ if ((r = ssh_decrypt_challenge(agent_fd, idlist->keys[i],
+ challenge, session_id, response)) != 0) {
/*
* The agent failed to authenticate this identifier
* although it advertised it supports this. Just
* return a wrong value.
*/
- logit("Authentication agent failed to decrypt challenge.");
+ logit("Authentication agent failed to decrypt "
+ "challenge: %s", ssh_err(r));
explicit_bzero(response, sizeof(response));
}
- key_free(key);
debug("Sending response to RSA challenge.");
/* Send the decrypted challenge back to the server. */
@@ -135,22 +144,25 @@
/* Wait for response from the server. */
type = packet_read();
- /* The server returns success if it accepted the authentication. */
+ /*
+ * The server returns success if it accepted the
+ * authentication.
+ */
if (type == SSH_SMSG_SUCCESS) {
- ssh_close_authentication_connection(auth);
- BN_clear_free(challenge);
debug("RSA authentication accepted by server.");
- return 1;
- }
- /* Otherwise it should return failure. */
- if (type != SSH_SMSG_FAILURE)
- packet_disconnect("Protocol error waiting RSA auth response: %d",
- type);
+ ret = 1;
+ break;
+ } else if (type != SSH_SMSG_FAILURE)
+ packet_disconnect("Protocol error waiting RSA auth "
+ "response: %d", type);
}
- ssh_close_authentication_connection(auth);
+ if (ret != 1)
+ debug("RSA authentication using agent refused.");
+ out:
+ ssh_free_identitylist(idlist);
+ ssh_close_authentication_socket(agent_fd);
BN_clear_free(challenge);
- debug("RSA authentication using agent refused.");
- return 0;
+ return ret;
}
/*
@@ -166,7 +178,7 @@
/* Decrypt the challenge using the private key. */
/* XXX think about Bleichenbacher, too */
- if (rsa_private_decrypt(challenge, challenge, prv) <= 0)
+ if (rsa_private_decrypt(challenge, challenge, prv) != 0)
packet_disconnect(
"respond_to_rsa_challenge: rsa_private_decrypt failed");
@@ -209,7 +221,7 @@
{
BIGNUM *challenge;
Key *public, *private;
- char buf[300], *passphrase, *comment, *authfile;
+ char buf[300], *passphrase = NULL, *comment, *authfile;
int i, perm_ok = 1, type, quit;
public = options.identity_keys[idx];
@@ -253,7 +265,7 @@
* load the private key. Try first with empty passphrase; if it
* fails, ask for a passphrase.
*/
- if (public->flags & KEY_FLAG_EXT)
+ if (public->flags & SSHKEY_FLAG_EXT)
private = public;
else
private = key_load_private_type(KEY_RSA1, authfile, "", NULL,
@@ -271,13 +283,20 @@
debug2("no passphrase given, try next key");
quit = 1;
}
- explicit_bzero(passphrase, strlen(passphrase));
- free(passphrase);
if (private != NULL || quit)
break;
debug2("bad passphrase given, try again...");
}
}
+
+ if (private != NULL)
+ maybe_add_key_to_agent(authfile, private, comment, passphrase);
+
+ if (passphrase != NULL) {
+ explicit_bzero(passphrase, strlen(passphrase));
+ free(passphrase);
+ }
+
/* We no longer need the comment. */
free(comment);
@@ -302,7 +321,7 @@
respond_to_rsa_challenge(challenge, private->rsa);
/* Destroy the private key unless it in external hardware. */
- if (!(private->flags & KEY_FLAG_EXT))
+ if (!(private->flags & SSHKEY_FLAG_EXT))
key_free(private);
/* We no longer need the challenge. */
@@ -592,8 +611,9 @@
BN_num_bits(server_key->rsa->n),
SSH_KEY_BITS_RESERVED);
}
- rsa_public_encrypt(key, key, server_key->rsa);
- rsa_public_encrypt(key, key, host_key->rsa);
+ if (rsa_public_encrypt(key, key, server_key->rsa) != 0 ||
+ rsa_public_encrypt(key, key, host_key->rsa) != 0)
+ fatal("%s: rsa_public_encrypt failed", __func__);
} else {
/* Host key has smaller modulus (or they are equal). */
if (BN_num_bits(server_key->rsa->n) <
@@ -604,8 +624,9 @@
BN_num_bits(host_key->rsa->n),
SSH_KEY_BITS_RESERVED);
}
- rsa_public_encrypt(key, key, host_key->rsa);
- rsa_public_encrypt(key, key, server_key->rsa);
+ if (rsa_public_encrypt(key, key, host_key->rsa) != 0 ||
+ rsa_public_encrypt(key, key, server_key->rsa) != 0)
+ fatal("%s: rsa_public_encrypt failed", __func__);
}
/* Destroy the public keys since we no longer need them. */
@@ -753,3 +774,5 @@
success:
return; /* need statement after label */
}
+
+#endif /* WITH_SSH1 */
Modified: trunk/crypto/openssh/sshconnect2.c
===================================================================
--- trunk/crypto/openssh/sshconnect2.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshconnect2.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.204 2014/02/02 03:44:32 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.247 2016/07/22 05:46:11 dtucker Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved.
@@ -61,8 +61,8 @@
#include "dh.h"
#include "authfd.h"
#include "log.h"
+#include "misc.h"
#include "readconf.h"
-#include "misc.h"
#include "match.h"
#include "dispatch.h"
#include "canohost.h"
@@ -70,6 +70,8 @@
#include "pathnames.h"
#include "uidswap.h"
#include "hostfile.h"
+#include "ssherr.h"
+#include "utf8.h"
#ifdef GSSAPI
#include "ssh-gss.h"
@@ -90,10 +92,8 @@
char *xxx_host;
struct sockaddr *xxx_hostaddr;
-Kex *xxx_kex = NULL;
-
static int
-verify_host_key_callback(Key *hostkey)
+verify_host_key_callback(Key *hostkey, struct ssh *ssh)
{
if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
fatal("Host key verification failed.");
@@ -131,16 +131,17 @@
} while (0)
while ((alg = strsep(&avail, ",")) && *alg != '\0') {
- if ((ktype = key_type_from_name(alg)) == KEY_UNSPEC)
+ if ((ktype = sshkey_type_from_name(alg)) == KEY_UNSPEC)
fatal("%s: unknown alg %s", __func__, alg);
if (lookup_key_in_hostkeys_by_type(hostkeys,
- key_type_plain(ktype), NULL))
+ sshkey_type_plain(ktype), NULL))
ALG_APPEND(first, alg);
else
ALG_APPEND(last, alg);
}
#undef ALG_APPEND
- xasprintf(&ret, "%s%s%s", first, *first == '\0' ? "" : ",", last);
+ xasprintf(&ret, "%s%s%s", first,
+ (*first == '\0' || *last == '\0') ? "" : ",", last);
if (*first != '\0')
debug3("%s: prefer hostkeyalgs: %s", __func__, first);
@@ -156,45 +157,40 @@
void
ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
{
- Kex *kex;
+ char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
+ char *s;
+ struct kex *kex;
+ int r;
xxx_host = host;
xxx_hostaddr = hostaddr;
- if (options.ciphers == (char *)-1) {
- logit("No valid ciphers for protocol version 2 given, using defaults.");
- options.ciphers = NULL;
- }
- if (options.ciphers != NULL) {
- myproposal[PROPOSAL_ENC_ALGS_CTOS] =
- myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
- }
+ if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
+ fatal("%s: kex_names_cat", __func__);
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(s);
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
- compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
+ compat_cipher_proposal(options.ciphers);
myproposal[PROPOSAL_ENC_ALGS_STOC] =
- compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
- if (options.compression) {
- myproposal[PROPOSAL_COMP_ALGS_CTOS] =
- myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib at openssh.com,zlib,none";
- } else {
- myproposal[PROPOSAL_COMP_ALGS_CTOS] =
- myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib at openssh.com,zlib";
- }
- if (options.macs != NULL) {
- myproposal[PROPOSAL_MAC_ALGS_CTOS] =
- myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
- }
- if (options.hostkeyalgorithms != NULL)
+ compat_cipher_proposal(options.ciphers);
+ myproposal[PROPOSAL_COMP_ALGS_CTOS] =
+ myproposal[PROPOSAL_COMP_ALGS_STOC] = options.compression ?
+ "zlib at openssh.com,zlib,none" : "none,zlib at openssh.com,zlib";
+ myproposal[PROPOSAL_MAC_ALGS_CTOS] =
+ myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
+ if (options.hostkeyalgorithms != NULL) {
+ if (kex_assemble_names(KEX_DEFAULT_PK_ALG,
+ &options.hostkeyalgorithms) != 0)
+ fatal("%s: kex_assemble_namelist", __func__);
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
compat_pkalg_proposal(options.hostkeyalgorithms);
- else {
+ } else {
+ /* Enforce default */
+ options.hostkeyalgorithms = xstrdup(KEX_DEFAULT_PK_ALG);
/* Prefer algorithms that we already have keys for */
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
compat_pkalg_proposal(
order_hostkeyalgs(host, hostaddr, port));
}
- if (options.kex_algorithms != NULL)
- myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
if (options.rekey_limit || options.rekey_interval)
packet_set_rekey_limits((u_int32_t)options.rekey_limit,
@@ -201,26 +197,34 @@
(time_t)options.rekey_interval);
/* start key exchange */
- kex = kex_setup(myproposal);
+ if ((r = kex_setup(active_state, myproposal)) != 0)
+ fatal("kex_setup: %s", ssh_err(r));
+ kex = active_state->kex;
+#ifdef WITH_OPENSSL
kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
+ kex->kex[KEX_DH_GRP14_SHA256] = kexdh_client;
+ kex->kex[KEX_DH_GRP16_SHA512] = kexdh_client;
+ kex->kex[KEX_DH_GRP18_SHA512] = kexdh_client;
kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
+# ifdef OPENSSL_HAS_ECC
kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
+# endif
+#endif
kex->kex[KEX_C25519_SHA256] = kexc25519_client;
kex->client_version_string=client_version_string;
kex->server_version_string=server_version_string;
kex->verify_host_key=&verify_host_key_callback;
- xxx_kex = kex;
+ dispatch_run(DISPATCH_BLOCK, &kex->done, active_state);
- dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
+ /* remove ext-info from the KEX proposals for rekeying */
+ myproposal[PROPOSAL_KEX_ALGS] =
+ compat_kex_proposal(options.kex_algorithms);
+ if ((r = kex_prop2buf(kex->my, myproposal)) != 0)
+ fatal("kex_prop2buf: %s", ssh_err(r));
- if (options.use_roaming && !kex->roaming) {
- debug("Roaming not allowed by server");
- options.use_roaming = 0;
- }
-
session_id2 = kex->session_id;
session_id2_len = kex->session_id_len;
@@ -237,15 +241,15 @@
* Authenticate user
*/
-typedef struct Authctxt Authctxt;
-typedef struct Authmethod Authmethod;
+typedef struct cauthctxt Authctxt;
+typedef struct cauthmethod Authmethod;
typedef struct identity Identity;
typedef struct idlist Idlist;
struct identity {
TAILQ_ENTRY(identity) next;
- AuthenticationConnection *ac; /* set if agent supports key */
- Key *key; /* public/private key */
+ int agent_fd; /* >=0 if agent supports key */
+ struct sshkey *key; /* public/private key */
char *filename; /* comment for agent-only keys */
int tried;
int isprivate; /* key points to the private key */
@@ -253,25 +257,29 @@
};
TAILQ_HEAD(idlist, identity);
-struct Authctxt {
+struct cauthctxt {
const char *server_user;
const char *local_user;
const char *host;
const char *service;
- Authmethod *method;
+ struct cauthmethod *method;
sig_atomic_t success;
char *authlist;
+ int attempt;
/* pubkey */
- Idlist keys;
- AuthenticationConnection *agent;
+ struct idlist keys;
+ int agent_fd;
/* hostbased */
Sensitive *sensitive;
+ char *oktypes, *ktypes;
+ const char *active_ktype;
/* kbd-interactive */
int info_req_seen;
/* generic */
void *methoddata;
};
-struct Authmethod {
+
+struct cauthmethod {
char *name; /* string to compare against server's list */
int (*userauth)(Authctxt *authctxt);
void (*cleanup)(Authctxt *authctxt);
@@ -279,14 +287,16 @@
int *batch_flag; /* flag in option struct that disables method */
};
-void input_userauth_success(int, u_int32_t, void *);
-void input_userauth_success_unexpected(int, u_int32_t, void *);
-void input_userauth_failure(int, u_int32_t, void *);
-void input_userauth_banner(int, u_int32_t, void *);
-void input_userauth_error(int, u_int32_t, void *);
-void input_userauth_info_req(int, u_int32_t, void *);
-void input_userauth_pk_ok(int, u_int32_t, void *);
-void input_userauth_passwd_changereq(int, u_int32_t, void *);
+int input_userauth_service_accept(int, u_int32_t, void *);
+int input_userauth_ext_info(int, u_int32_t, void *);
+int input_userauth_success(int, u_int32_t, void *);
+int input_userauth_success_unexpected(int, u_int32_t, void *);
+int input_userauth_failure(int, u_int32_t, void *);
+int input_userauth_banner(int, u_int32_t, void *);
+int input_userauth_error(int, u_int32_t, void *);
+int input_userauth_info_req(int, u_int32_t, void *);
+int input_userauth_pk_ok(int, u_int32_t, void *);
+int input_userauth_passwd_changereq(int, u_int32_t, void *);
int userauth_none(Authctxt *);
int userauth_pubkey(Authctxt *);
@@ -296,11 +306,11 @@
#ifdef GSSAPI
int userauth_gssapi(Authctxt *authctxt);
-void input_gssapi_response(int type, u_int32_t, void *);
-void input_gssapi_token(int type, u_int32_t, void *);
-void input_gssapi_hash(int type, u_int32_t, void *);
-void input_gssapi_error(int, u_int32_t, void *);
-void input_gssapi_errtok(int, u_int32_t, void *);
+int input_gssapi_response(int type, u_int32_t, void *);
+int input_gssapi_token(int type, u_int32_t, void *);
+int input_gssapi_hash(int type, u_int32_t, void *);
+int input_gssapi_error(int, u_int32_t, void *);
+int input_gssapi_errtok(int, u_int32_t, void *);
#endif
void userauth(Authctxt *, char *);
@@ -308,7 +318,7 @@
static int sign_and_send_pubkey(Authctxt *, Identity *);
static void pubkey_prepare(Authctxt *);
static void pubkey_cleanup(Authctxt *);
-static Key *load_identity_file(char *, int);
+static Key *load_identity_file(Identity *);
static Authmethod *authmethod_get(char *authlist);
static Authmethod *authmethod_lookup(const char *name);
@@ -354,30 +364,12 @@
ssh_userauth2(const char *local_user, const char *server_user, char *host,
Sensitive *sensitive)
{
+ struct ssh *ssh = active_state;
Authctxt authctxt;
- int type;
+ int r;
if (options.challenge_response_authentication)
options.kbd_interactive_authentication = 1;
-
- packet_start(SSH2_MSG_SERVICE_REQUEST);
- packet_put_cstring("ssh-userauth");
- packet_send();
- debug("SSH2_MSG_SERVICE_REQUEST sent");
- packet_write_wait();
- type = packet_read();
- if (type != SSH2_MSG_SERVICE_ACCEPT)
- fatal("Server denied authentication request: %d", type);
- if (packet_remaining() > 0) {
- char *reply = packet_get_string(NULL);
- debug2("service_accept: %s", reply);
- free(reply);
- } else {
- debug2("buggy server: service_accept w/o service");
- }
- packet_check_eom();
- debug("SSH2_MSG_SERVICE_ACCEPT received");
-
if (options.preferred_authentications == NULL)
options.preferred_authentications = authmethods_get();
@@ -393,25 +385,69 @@
authctxt.authlist = NULL;
authctxt.methoddata = NULL;
authctxt.sensitive = sensitive;
+ authctxt.active_ktype = authctxt.oktypes = authctxt.ktypes = NULL;
authctxt.info_req_seen = 0;
+ authctxt.agent_fd = -1;
if (authctxt.method == NULL)
fatal("ssh_userauth2: internal error: cannot send userauth none request");
- /* initial userauth request */
- userauth_none(&authctxt);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_SERVICE_REQUEST)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, "ssh-userauth")) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+ fatal("%s: %s", __func__, ssh_err(r));
- dispatch_init(&input_userauth_error);
- dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
- dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
- dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
- dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
+ ssh_dispatch_init(ssh, &input_userauth_error);
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &input_userauth_ext_info);
+ ssh_dispatch_set(ssh, SSH2_MSG_SERVICE_ACCEPT, &input_userauth_service_accept);
+ ssh_dispatch_run(ssh, DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
pubkey_cleanup(&authctxt);
- dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
+ ssh_dispatch_range(ssh, SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
debug("Authentication succeeded (%s).", authctxt.method->name);
}
+/* ARGSUSED */
+int
+input_userauth_service_accept(int type, u_int32_t seqnr, void *ctxt)
+{
+ Authctxt *authctxt = ctxt;
+ struct ssh *ssh = active_state;
+ int r;
+
+ if (ssh_packet_remaining(ssh) > 0) {
+ char *reply;
+
+ if ((r = sshpkt_get_cstring(ssh, &reply, NULL)) != 0)
+ goto out;
+ debug2("service_accept: %s", reply);
+ free(reply);
+ } else {
+ debug2("buggy server: service_accept w/o service");
+ }
+ if ((r = sshpkt_get_end(ssh)) != 0)
+ goto out;
+ debug("SSH2_MSG_SERVICE_ACCEPT received");
+
+ /* initial userauth request */
+ userauth_none(authctxt);
+
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &input_userauth_error);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
+ r = 0;
+ out:
+ return r;
+}
+
+/* ARGSUSED */
+int
+input_userauth_ext_info(int type, u_int32_t seqnr, void *ctxt)
+{
+ return kex_input_ext_info(type, seqnr, active_state);
+}
+
void
userauth(Authctxt *authctxt, char *authlist)
{
@@ -448,37 +484,33 @@
}
/* ARGSUSED */
-void
+int
input_userauth_error(int type, u_int32_t seq, void *ctxt)
{
fatal("input_userauth_error: bad message during authentication: "
"type %d", type);
+ return 0;
}
/* ARGSUSED */
-void
+int
input_userauth_banner(int type, u_int32_t seq, void *ctxt)
{
- char *msg, *raw, *lang;
+ char *msg, *lang;
u_int len;
- debug3("input_userauth_banner");
- raw = packet_get_string(&len);
+ debug3("%s", __func__);
+ msg = packet_get_string(&len);
lang = packet_get_string(NULL);
- if (len > 0 && options.log_level >= SYSLOG_LEVEL_INFO) {
- if (len > 65536)
- len = 65536;
- msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
- strnvis(msg, raw, len * 4 + 1, VIS_SAFE|VIS_OCTAL|VIS_NOSLASH);
- fprintf(stderr, "%s", msg);
- free(msg);
- }
- free(raw);
+ if (len > 0 && options.log_level >= SYSLOG_LEVEL_INFO)
+ fmprintf(stderr, "%s", msg);
+ free(msg);
free(lang);
+ return 0;
}
/* ARGSUSED */
-void
+int
input_userauth_success(int type, u_int32_t seq, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -492,9 +524,10 @@
free(authctxt->methoddata);
authctxt->methoddata = NULL;
authctxt->success = 1; /* break out */
+ return 0;
}
-void
+int
input_userauth_success_unexpected(int type, u_int32_t seq, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -504,10 +537,11 @@
fatal("Unexpected authentication success during %s.",
authctxt->method->name);
+ return 0;
}
/* ARGSUSED */
-void
+int
input_userauth_failure(int type, u_int32_t seq, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -522,7 +556,7 @@
packet_check_eom();
if (partial != 0) {
- logit("Authenticated with partial success.");
+ verbose("Authenticated with partial success.");
/* reset state */
pubkey_cleanup(authctxt);
pubkey_prepare(authctxt);
@@ -530,10 +564,11 @@
debug("Authentications that can continue: %s", authlist);
userauth(authctxt, authlist);
+ return 0;
}
/* ARGSUSED */
-void
+int
input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -577,7 +612,9 @@
key->type, pktype);
goto done;
}
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL)
+ goto done;
debug2("input_userauth_pk_ok: fp %s", fp);
free(fp);
@@ -601,6 +638,7 @@
/* try another method if we did not send a packet */
if (sent == 0)
userauth(authctxt, NULL);
+ return 0;
}
#ifdef GSSAPI
@@ -716,7 +754,7 @@
}
/* ARGSUSED */
-void
+int
input_gssapi_response(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -737,7 +775,7 @@
free(oidv);
debug("Badly encoded mechanism OID received");
userauth(authctxt, NULL);
- return;
+ return 0;
}
if (!ssh_gssapi_check_oid(gssctxt, oidv + 2, oidlen - 2))
@@ -751,12 +789,13 @@
/* Start again with next method on list */
debug("Trying to start again");
userauth(authctxt, NULL);
- return;
+ return 0;
}
+ return 0;
}
/* ARGSUSED */
-void
+int
input_gssapi_token(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -779,12 +818,13 @@
if (GSS_ERROR(status)) {
/* Start again with the next method in the list */
userauth(authctxt, NULL);
- return;
+ return 0;
}
+ return 0;
}
/* ARGSUSED */
-void
+int
input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -811,10 +851,11 @@
gss_release_buffer(&ms, &send_tok);
/* Server will be returning a failed packet after this one */
+ return 0;
}
/* ARGSUSED */
-void
+int
input_gssapi_error(int type, u_int32_t plen, void *ctxt)
{
char *msg;
@@ -830,6 +871,7 @@
debug("Server GSSAPI Error:\n%s", msg);
free(msg);
free(lang);
+ return 0;
}
#endif /* GSSAPI */
@@ -884,7 +926,7 @@
* parse PASSWD_CHANGEREQ, prompt user and send SSH2_MSG_USERAUTH_REQUEST
*/
/* ARGSUSED */
-void
+int
input_userauth_passwd_changereq(int type, u_int32_t seqnr, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -925,7 +967,7 @@
password = read_passphrase(prompt, RP_ALLOW_EOF);
if (password == NULL) {
/* bail out */
- return;
+ return 0;
}
snprintf(prompt, sizeof(prompt),
"Retype %.30s@%.128s's new password: ",
@@ -948,30 +990,52 @@
dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
&input_userauth_passwd_changereq);
+ return 0;
}
+static const char *
+identity_sign_encode(struct identity *id)
+{
+ struct ssh *ssh = active_state;
+
+ if (id->key->type == KEY_RSA) {
+ switch (ssh->kex->rsa_sha2) {
+ case 256:
+ return "rsa-sha2-256";
+ case 512:
+ return "rsa-sha2-512";
+ }
+ }
+ return key_ssh_name(id->key);
+}
+
static int
-identity_sign(Identity *id, u_char **sigp, u_int *lenp,
- u_char *data, u_int datalen)
+identity_sign(struct identity *id, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, u_int compat)
{
Key *prv;
int ret;
+ const char *alg;
+ alg = identity_sign_encode(id);
+
/* the agent supports this key */
- if (id->ac)
- return (ssh_agent_sign(id->ac, id->key, sigp, lenp,
- data, datalen));
+ if (id->agent_fd != -1)
+ return ssh_agent_sign(id->agent_fd, id->key, sigp, lenp,
+ data, datalen, alg, compat);
+
/*
* we have already loaded the private key or
* the private key is stored in external hardware
*/
- if (id->isprivate || (id->key->flags & KEY_FLAG_EXT))
- return (key_sign(id->key, sigp, lenp, data, datalen));
+ if (id->isprivate || (id->key->flags & SSHKEY_FLAG_EXT))
+ return (sshkey_sign(id->key, sigp, lenp, data, datalen, alg,
+ compat));
/* load the private key from the file */
- if ((prv = load_identity_file(id->filename, id->userprovided)) == NULL)
- return (-1);
- ret = key_sign(prv, sigp, lenp, data, datalen);
- key_free(prv);
+ if ((prv = load_identity_file(id)) == NULL)
+ return SSH_ERR_KEY_NOT_FOUND;
+ ret = sshkey_sign(prv, sigp, lenp, data, datalen, alg, compat);
+ sshkey_free(prv);
return (ret);
}
@@ -979,15 +1043,17 @@
sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
{
Buffer b;
+ Identity *private_id;
u_char *blob, *signature;
- u_int bloblen, slen;
- u_int skip = 0;
- int ret = -1;
- int have_sig = 1;
+ size_t slen;
+ u_int bloblen, skip = 0;
+ int matched, ret = -1, have_sig = 1;
char *fp;
- fp = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
- debug3("sign_and_send_pubkey: %s %s", key_type(id->key), fp);
+ if ((fp = sshkey_fingerprint(id->key, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL)
+ return 0;
+ debug3("%s: %s %s", __func__, key_type(id->key), fp);
free(fp);
if (key_to_blob(id->key, &blob, &bloblen) == 0) {
@@ -1015,14 +1081,42 @@
} else {
buffer_put_cstring(&b, authctxt->method->name);
buffer_put_char(&b, have_sig);
- buffer_put_cstring(&b, key_ssh_name(id->key));
+ buffer_put_cstring(&b, identity_sign_encode(id));
}
buffer_put_string(&b, blob, bloblen);
+ /*
+ * If the key is an certificate, try to find a matching private key
+ * and use it to complete the signature.
+ * If no such private key exists, fall back to trying the certificate
+ * key itself in case it has a private half already loaded.
+ */
+ if (key_is_cert(id->key)) {
+ matched = 0;
+ TAILQ_FOREACH(private_id, &authctxt->keys, next) {
+ if (sshkey_equal_public(id->key, private_id->key) &&
+ id->key->type != private_id->key->type) {
+ id = private_id;
+ matched = 1;
+ break;
+ }
+ }
+ if (matched) {
+ debug2("%s: using private key \"%s\"%s for "
+ "certificate", __func__, id->filename,
+ id->agent_fd != -1 ? " from agent" : "");
+ } else {
+ debug("%s: no separate private key for certificate "
+ "\"%s\"", __func__, id->filename);
+ }
+ }
+
/* generate signature */
ret = identity_sign(id, &signature, &slen,
- buffer_ptr(&b), buffer_len(&b));
- if (ret == -1) {
+ buffer_ptr(&b), buffer_len(&b), datafellows);
+ if (ret != 0) {
+ if (ret != SSH_ERR_KEY_NOT_FOUND)
+ error("%s: signing failed: %s", __func__, ssh_err(ret));
free(blob);
buffer_free(&b);
return 0;
@@ -1085,7 +1179,7 @@
packet_put_cstring(authctxt->method->name);
packet_put_char(have_sig);
if (!(datafellows & SSH_BUG_PKAUTH))
- packet_put_cstring(key_ssh_name(id->key));
+ packet_put_cstring(identity_sign_encode(id));
packet_put_string(blob, bloblen);
free(blob);
packet_send();
@@ -1093,45 +1187,67 @@
}
static Key *
-load_identity_file(char *filename, int userprovided)
+load_identity_file(Identity *id)
{
- Key *private;
- char prompt[300], *passphrase;
- int perm_ok = 0, quit, i;
+ Key *private = NULL;
+ char prompt[300], *passphrase, *comment;
+ int r, perm_ok = 0, quit = 0, i;
struct stat st;
- if (stat(filename, &st) < 0) {
- (userprovided ? logit : debug3)("no such identity: %s: %s",
- filename, strerror(errno));
+ if (stat(id->filename, &st) < 0) {
+ (id->userprovided ? logit : debug3)("no such identity: %s: %s",
+ id->filename, strerror(errno));
return NULL;
}
- private = key_load_private_type(KEY_UNSPEC, filename, "", NULL, &perm_ok);
- if (!perm_ok) {
- if (private != NULL)
- key_free(private);
- return NULL;
- }
- if (private == NULL) {
- if (options.batch_mode)
- return NULL;
- snprintf(prompt, sizeof prompt,
- "Enter passphrase for key '%.100s': ", filename);
- for (i = 0; i < options.number_of_password_prompts; i++) {
+ snprintf(prompt, sizeof prompt,
+ "Enter passphrase for key '%.100s': ", id->filename);
+ for (i = 0; i <= options.number_of_password_prompts; i++) {
+ if (i == 0)
+ passphrase = "";
+ else {
passphrase = read_passphrase(prompt, 0);
- if (strcmp(passphrase, "") != 0) {
- private = key_load_private_type(KEY_UNSPEC,
- filename, passphrase, NULL, NULL);
- quit = 0;
- } else {
+ if (*passphrase == '\0') {
debug2("no passphrase given, try next key");
+ free(passphrase);
+ break;
+ }
+ }
+ switch ((r = sshkey_load_private_type(KEY_UNSPEC, id->filename,
+ passphrase, &private, &comment, &perm_ok))) {
+ case 0:
+ break;
+ case SSH_ERR_KEY_WRONG_PASSPHRASE:
+ if (options.batch_mode) {
quit = 1;
+ break;
}
+ if (i != 0)
+ debug2("bad passphrase given, try again...");
+ break;
+ case SSH_ERR_SYSTEM_ERROR:
+ if (errno == ENOENT) {
+ debug2("Load key \"%s\": %s",
+ id->filename, ssh_err(r));
+ quit = 1;
+ break;
+ }
+ /* FALLTHROUGH */
+ default:
+ error("Load key \"%s\": %s", id->filename, ssh_err(r));
+ quit = 1;
+ break;
+ }
+ if (!quit && private != NULL && id->agent_fd == -1 &&
+ !(id->key && id->isprivate))
+ maybe_add_key_to_agent(id->filename, private, comment,
+ passphrase);
+ if (i > 0) {
explicit_bzero(passphrase, strlen(passphrase));
free(passphrase);
- if (private != NULL || quit)
- break;
- debug2("bad passphrase given, try again...");
}
+ free(comment);
+ if (private != NULL || quit)
+ break;
}
return private;
}
@@ -1138,19 +1254,21 @@
/*
* try keys in the following order:
- * 1. agent keys that are found in the config file
- * 2. other agent keys
- * 3. keys that are only listed in the config file
+ * 1. certificates listed in the config file
+ * 2. other input certificates
+ * 3. agent keys that are found in the config file
+ * 4. other agent keys
+ * 5. keys that are only listed in the config file
*/
static void
pubkey_prepare(Authctxt *authctxt)
{
- Identity *id, *id2, *tmp;
- Idlist agent, files, *preferred;
- Key *key;
- AuthenticationConnection *ac;
- char *comment;
- int i, found;
+ struct identity *id, *id2, *tmp;
+ struct idlist agent, files, *preferred;
+ struct sshkey *key;
+ int agent_fd = -1, i, r, found;
+ size_t j;
+ struct ssh_identitylist *idlist;
TAILQ_INIT(&agent); /* keys from the agent */
TAILQ_INIT(&files); /* keys from the config file */
@@ -1166,48 +1284,47 @@
continue;
options.identity_keys[i] = NULL;
id = xcalloc(1, sizeof(*id));
+ id->agent_fd = -1;
id->key = key;
id->filename = xstrdup(options.identity_files[i]);
id->userprovided = options.identity_file_userprovided[i];
TAILQ_INSERT_TAIL(&files, id, next);
}
- /* Prefer PKCS11 keys that are explicitly listed */
- TAILQ_FOREACH_SAFE(id, &files, next, tmp) {
- if (id->key == NULL || (id->key->flags & KEY_FLAG_EXT) == 0)
+ /* list of certificates specified by user */
+ for (i = 0; i < options.num_certificate_files; i++) {
+ key = options.certificates[i];
+ if (!key_is_cert(key) || key->cert == NULL ||
+ key->cert->type != SSH2_CERT_TYPE_USER)
continue;
- found = 0;
- TAILQ_FOREACH(id2, &files, next) {
- if (id2->key == NULL ||
- (id2->key->flags & KEY_FLAG_EXT) != 0)
- continue;
- if (key_equal(id->key, id2->key)) {
- TAILQ_REMOVE(&files, id, next);
- TAILQ_INSERT_TAIL(preferred, id, next);
- found = 1;
- break;
- }
- }
- /* If IdentitiesOnly set and key not found then don't use it */
- if (!found && options.identities_only) {
- TAILQ_REMOVE(&files, id, next);
- explicit_bzero(id, sizeof(*id));
- free(id);
- }
+ id = xcalloc(1, sizeof(*id));
+ id->agent_fd = -1;
+ id->key = key;
+ id->filename = xstrdup(options.certificate_files[i]);
+ id->userprovided = options.certificate_file_userprovided[i];
+ TAILQ_INSERT_TAIL(preferred, id, next);
}
/* list of keys supported by the agent */
- if ((ac = ssh_get_authentication_connection())) {
- for (key = ssh_get_first_identity(ac, &comment, 2);
- key != NULL;
- key = ssh_get_next_identity(ac, &comment, 2)) {
+ if ((r = ssh_get_authentication_socket(&agent_fd)) != 0) {
+ if (r != SSH_ERR_AGENT_NOT_PRESENT)
+ debug("%s: ssh_get_authentication_socket: %s",
+ __func__, ssh_err(r));
+ } else if ((r = ssh_fetch_identitylist(agent_fd, 2, &idlist)) != 0) {
+ if (r != SSH_ERR_AGENT_NO_IDENTITIES)
+ debug("%s: ssh_fetch_identitylist: %s",
+ __func__, ssh_err(r));
+ close(agent_fd);
+ } else {
+ for (j = 0; j < idlist->nkeys; j++) {
found = 0;
TAILQ_FOREACH(id, &files, next) {
- /* agent keys from the config file are preferred */
- if (key_equal(key, id->key)) {
- key_free(key);
- free(comment);
+ /*
+ * agent keys from the config file are
+ * preferred
+ */
+ if (sshkey_equal(idlist->keys[j], id->key)) {
TAILQ_REMOVE(&files, id, next);
TAILQ_INSERT_TAIL(preferred, id, next);
- id->ac = ac;
+ id->agent_fd = agent_fd;
found = 1;
break;
}
@@ -1214,27 +1331,68 @@
}
if (!found && !options.identities_only) {
id = xcalloc(1, sizeof(*id));
- id->key = key;
- id->filename = comment;
- id->ac = ac;
+ /* XXX "steals" key/comment from idlist */
+ id->key = idlist->keys[j];
+ id->filename = idlist->comments[j];
+ idlist->keys[j] = NULL;
+ idlist->comments[j] = NULL;
+ id->agent_fd = agent_fd;
TAILQ_INSERT_TAIL(&agent, id, next);
}
}
+ ssh_free_identitylist(idlist);
/* append remaining agent keys */
for (id = TAILQ_FIRST(&agent); id; id = TAILQ_FIRST(&agent)) {
TAILQ_REMOVE(&agent, id, next);
TAILQ_INSERT_TAIL(preferred, id, next);
}
- authctxt->agent = ac;
+ authctxt->agent_fd = agent_fd;
}
+ /* Prefer PKCS11 keys that are explicitly listed */
+ TAILQ_FOREACH_SAFE(id, &files, next, tmp) {
+ if (id->key == NULL || (id->key->flags & SSHKEY_FLAG_EXT) == 0)
+ continue;
+ found = 0;
+ TAILQ_FOREACH(id2, &files, next) {
+ if (id2->key == NULL ||
+ (id2->key->flags & SSHKEY_FLAG_EXT) == 0)
+ continue;
+ if (sshkey_equal(id->key, id2->key)) {
+ TAILQ_REMOVE(&files, id, next);
+ TAILQ_INSERT_TAIL(preferred, id, next);
+ found = 1;
+ break;
+ }
+ }
+ /* If IdentitiesOnly set and key not found then don't use it */
+ if (!found && options.identities_only) {
+ TAILQ_REMOVE(&files, id, next);
+ explicit_bzero(id, sizeof(*id));
+ free(id);
+ }
+ }
/* append remaining keys from the config file */
for (id = TAILQ_FIRST(&files); id; id = TAILQ_FIRST(&files)) {
TAILQ_REMOVE(&files, id, next);
TAILQ_INSERT_TAIL(preferred, id, next);
}
- TAILQ_FOREACH(id, preferred, next) {
- debug2("key: %s (%p),%s", id->filename, id->key,
- id->userprovided ? " explicit" : "");
+ /* finally, filter by PubkeyAcceptedKeyTypes */
+ TAILQ_FOREACH_SAFE(id, preferred, next, id2) {
+ if (id->key != NULL &&
+ match_pattern_list(sshkey_ssh_name(id->key),
+ options.pubkey_key_types, 0) != 1) {
+ debug("Skipping %s key %s - "
+ "not in PubkeyAcceptedKeyTypes",
+ sshkey_ssh_name(id->key), id->filename);
+ TAILQ_REMOVE(preferred, id, next);
+ sshkey_free(id->key);
+ free(id->filename);
+ memset(id, 0, sizeof(*id));
+ continue;
+ }
+ debug2("key: %s (%p)%s%s", id->filename, id->key,
+ id->userprovided ? ", explicit" : "",
+ id->agent_fd != -1 ? ", agent" : "");
}
}
@@ -1243,18 +1401,31 @@
{
Identity *id;
- if (authctxt->agent != NULL)
- ssh_close_authentication_connection(authctxt->agent);
+ if (authctxt->agent_fd != -1)
+ ssh_close_authentication_socket(authctxt->agent_fd);
for (id = TAILQ_FIRST(&authctxt->keys); id;
id = TAILQ_FIRST(&authctxt->keys)) {
TAILQ_REMOVE(&authctxt->keys, id, next);
- if (id->key)
- key_free(id->key);
+ sshkey_free(id->key);
free(id->filename);
free(id);
}
}
+static int
+try_identity(Identity *id)
+{
+ if (!id->key)
+ return (0);
+ if (key_type_plain(id->key->type) == KEY_RSA &&
+ (datafellows & SSH_BUG_RSASIGMD5) != 0) {
+ debug("Skipped %s key %s for RSA/MD5 server",
+ key_type(id->key), id->filename);
+ return (0);
+ }
+ return (id->key->type != KEY_RSA1);
+}
+
int
userauth_pubkey(Authctxt *authctxt)
{
@@ -1273,11 +1444,7 @@
* private key instead
*/
if (id->key != NULL) {
- if (key_type_plain(id->key->type) == KEY_RSA &&
- (datafellows & SSH_BUG_RSASIGMD5) != 0) {
- debug("Skipped %s key %s for RSA/MD5 server",
- key_type(id->key), id->filename);
- } else if (id->key->type != KEY_RSA1) {
+ if (try_identity(id)) {
debug("Offering %s public key: %s",
key_type(id->key), id->filename);
sent = send_pubkey_test(authctxt, id);
@@ -1284,16 +1451,10 @@
}
} else {
debug("Trying private key: %s", id->filename);
- id->key = load_identity_file(id->filename,
- id->userprovided);
+ id->key = load_identity_file(id);
if (id->key != NULL) {
- id->isprivate = 1;
- if (key_type_plain(id->key->type) == KEY_RSA &&
- (datafellows & SSH_BUG_RSASIGMD5) != 0) {
- debug("Skipped %s key %s for RSA/MD5 "
- "server", key_type(id->key),
- id->filename);
- } else {
+ if (try_identity(id)) {
+ id->isprivate = 1;
sent = sign_and_send_pubkey(
authctxt, id);
}
@@ -1341,7 +1502,7 @@
/*
* parse INFO_REQUEST, prompt user and send INFO_RESPONSE
*/
-void
+int
input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -1393,81 +1554,120 @@
packet_add_padding(64);
packet_send();
+ return 0;
}
static int
-ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
- u_char *data, u_int datalen)
+ssh_keysign(struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen)
{
- Buffer b;
+ struct sshbuf *b;
struct stat st;
pid_t pid;
- int to[2], from[2], status, version = 2;
+ int i, r, to[2], from[2], status, sock = packet_get_connection_in();
+ u_char rversion = 0, version = 2;
+ void (*osigchld)(int);
- debug2("ssh_keysign called");
+ *sigp = NULL;
+ *lenp = 0;
if (stat(_PATH_SSH_KEY_SIGN, &st) < 0) {
- error("ssh_keysign: not installed: %s", strerror(errno));
+ error("%s: not installed: %s", __func__, strerror(errno));
return -1;
}
- if (fflush(stdout) != 0)
- error("ssh_keysign: fflush: %s", strerror(errno));
+ if (fflush(stdout) != 0) {
+ error("%s: fflush: %s", __func__, strerror(errno));
+ return -1;
+ }
if (pipe(to) < 0) {
- error("ssh_keysign: pipe: %s", strerror(errno));
+ error("%s: pipe: %s", __func__, strerror(errno));
return -1;
}
if (pipe(from) < 0) {
- error("ssh_keysign: pipe: %s", strerror(errno));
+ error("%s: pipe: %s", __func__, strerror(errno));
return -1;
}
if ((pid = fork()) < 0) {
- error("ssh_keysign: fork: %s", strerror(errno));
+ error("%s: fork: %s", __func__, strerror(errno));
return -1;
}
+ osigchld = signal(SIGCHLD, SIG_DFL);
if (pid == 0) {
/* keep the socket on exec */
- fcntl(packet_get_connection_in(), F_SETFD, 0);
+ fcntl(sock, F_SETFD, 0);
permanently_drop_suid(getuid());
close(from[0]);
if (dup2(from[1], STDOUT_FILENO) < 0)
- fatal("ssh_keysign: dup2: %s", strerror(errno));
+ fatal("%s: dup2: %s", __func__, strerror(errno));
close(to[1]);
if (dup2(to[0], STDIN_FILENO) < 0)
- fatal("ssh_keysign: dup2: %s", strerror(errno));
+ fatal("%s: dup2: %s", __func__, strerror(errno));
close(from[1]);
close(to[0]);
- execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *) 0);
- fatal("ssh_keysign: exec(%s): %s", _PATH_SSH_KEY_SIGN,
+ /* Close everything but stdio and the socket */
+ for (i = STDERR_FILENO + 1; i < sock; i++)
+ close(i);
+ closefrom(sock + 1);
+ debug3("%s: [child] pid=%ld, exec %s",
+ __func__, (long)getpid(), _PATH_SSH_KEY_SIGN);
+ execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *)NULL);
+ fatal("%s: exec(%s): %s", __func__, _PATH_SSH_KEY_SIGN,
strerror(errno));
}
close(from[1]);
close(to[0]);
- buffer_init(&b);
- buffer_put_int(&b, packet_get_connection_in()); /* send # of socket */
- buffer_put_string(&b, data, datalen);
- if (ssh_msg_send(to[1], version, &b) == -1)
- fatal("ssh_keysign: couldn't send request");
-
- if (ssh_msg_recv(from[0], &b) < 0) {
- error("ssh_keysign: no reply");
- buffer_free(&b);
- return -1;
- }
+ if ((b = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ /* send # of sock, data to be signed */
+ if ((r = sshbuf_put_u32(b, sock) != 0) ||
+ (r = sshbuf_put_string(b, data, datalen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (ssh_msg_send(to[1], version, b) == -1)
+ fatal("%s: couldn't send request", __func__);
+ sshbuf_reset(b);
+ r = ssh_msg_recv(from[0], b);
close(from[0]);
close(to[1]);
+ if (r < 0) {
+ error("%s: no reply", __func__);
+ goto fail;
+ }
- while (waitpid(pid, &status, 0) < 0)
- if (errno != EINTR)
- break;
-
- if (buffer_get_char(&b) != version) {
- error("ssh_keysign: bad version");
- buffer_free(&b);
+ errno = 0;
+ while (waitpid(pid, &status, 0) < 0) {
+ if (errno != EINTR) {
+ error("%s: waitpid %ld: %s",
+ __func__, (long)pid, strerror(errno));
+ goto fail;
+ }
+ }
+ if (!WIFEXITED(status)) {
+ error("%s: exited abnormally", __func__);
+ goto fail;
+ }
+ if (WEXITSTATUS(status) != 0) {
+ error("%s: exited with status %d",
+ __func__, WEXITSTATUS(status));
+ goto fail;
+ }
+ if ((r = sshbuf_get_u8(b, &rversion)) != 0) {
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ goto fail;
+ }
+ if (rversion != version) {
+ error("%s: bad version", __func__);
+ goto fail;
+ }
+ if ((r = sshbuf_get_string(b, sigp, lenp)) != 0) {
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ fail:
+ signal(SIGCHLD, osigchld);
+ sshbuf_free(b);
return -1;
}
- *sigp = buffer_get_string(&b, lenp);
- buffer_free(&b);
+ signal(SIGCHLD, osigchld);
+ sshbuf_free(b);
return 0;
}
@@ -1475,94 +1675,148 @@
int
userauth_hostbased(Authctxt *authctxt)
{
- Key *private = NULL;
- Sensitive *sensitive = authctxt->sensitive;
- Buffer b;
- u_char *signature, *blob;
- char *chost, *pkalg, *p;
+ struct ssh *ssh = active_state;
+ struct sshkey *private = NULL;
+ struct sshbuf *b = NULL;
const char *service;
- u_int blen, slen;
- int ok, i, found = 0;
+ u_char *sig = NULL, *keyblob = NULL;
+ char *fp = NULL, *chost = NULL, *lname = NULL;
+ size_t siglen = 0, keylen = 0;
+ int i, r, success = 0;
- /* check for a useful key */
- for (i = 0; i < sensitive->nkeys; i++) {
- private = sensitive->keys[i];
- if (private && private->type != KEY_RSA1) {
- found = 1;
+ if (authctxt->ktypes == NULL) {
+ authctxt->oktypes = xstrdup(options.hostbased_key_types);
+ authctxt->ktypes = authctxt->oktypes;
+ }
+
+ /*
+ * Work through each listed type pattern in HostbasedKeyTypes,
+ * trying each hostkey that matches the type in turn.
+ */
+ for (;;) {
+ if (authctxt->active_ktype == NULL)
+ authctxt->active_ktype = strsep(&authctxt->ktypes, ",");
+ if (authctxt->active_ktype == NULL ||
+ *authctxt->active_ktype == '\0')
+ break;
+ debug3("%s: trying key type %s", __func__,
+ authctxt->active_ktype);
+
+ /* check for a useful key */
+ private = NULL;
+ for (i = 0; i < authctxt->sensitive->nkeys; i++) {
+ if (authctxt->sensitive->keys[i] == NULL ||
+ authctxt->sensitive->keys[i]->type == KEY_RSA1 ||
+ authctxt->sensitive->keys[i]->type == KEY_UNSPEC)
+ continue;
+ if (match_pattern_list(
+ sshkey_ssh_name(authctxt->sensitive->keys[i]),
+ authctxt->active_ktype, 0) != 1)
+ continue;
/* we take and free the key */
- sensitive->keys[i] = NULL;
+ private = authctxt->sensitive->keys[i];
+ authctxt->sensitive->keys[i] = NULL;
break;
}
+ /* Found one */
+ if (private != NULL)
+ break;
+ /* No more keys of this type; advance */
+ authctxt->active_ktype = NULL;
}
- if (!found) {
+ if (private == NULL) {
+ free(authctxt->oktypes);
+ authctxt->oktypes = authctxt->ktypes = NULL;
+ authctxt->active_ktype = NULL;
debug("No more client hostkeys for hostbased authentication.");
- return 0;
+ goto out;
}
- if (key_to_blob(private, &blob, &blen) == 0) {
- key_free(private);
- return 0;
+
+ if ((fp = sshkey_fingerprint(private, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL) {
+ error("%s: sshkey_fingerprint failed", __func__);
+ goto out;
}
+ debug("%s: trying hostkey %s %s",
+ __func__, sshkey_ssh_name(private), fp);
+
/* figure out a name for the client host */
- p = get_local_name(packet_get_connection_in());
- if (p == NULL) {
- error("userauth_hostbased: cannot get local ipaddr/name");
- key_free(private);
- free(blob);
- return 0;
+ if ((lname = get_local_name(packet_get_connection_in())) == NULL) {
+ error("%s: cannot get local ipaddr/name", __func__);
+ goto out;
}
- xasprintf(&chost, "%s.", p);
- debug2("userauth_hostbased: chost %s", chost);
- free(p);
+ /* XXX sshbuf_put_stringf? */
+ xasprintf(&chost, "%s.", lname);
+ debug2("%s: chost %s", __func__, chost);
+
service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
authctxt->service;
- pkalg = xstrdup(key_ssh_name(private));
- buffer_init(&b);
+
/* construct data */
- buffer_put_string(&b, session_id2, session_id2_len);
- buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
- buffer_put_cstring(&b, authctxt->server_user);
- buffer_put_cstring(&b, service);
- buffer_put_cstring(&b, authctxt->method->name);
- buffer_put_cstring(&b, pkalg);
- buffer_put_string(&b, blob, blen);
- buffer_put_cstring(&b, chost);
- buffer_put_cstring(&b, authctxt->local_user);
+ if ((b = sshbuf_new()) == NULL) {
+ error("%s: sshbuf_new failed", __func__);
+ goto out;
+ }
+ if ((r = sshkey_to_blob(private, &keyblob, &keylen)) != 0) {
+ error("%s: sshkey_to_blob: %s", __func__, ssh_err(r));
+ goto out;
+ }
+ if ((r = sshbuf_put_string(b, session_id2, session_id2_len)) != 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
+ (r = sshbuf_put_cstring(b, authctxt->server_user)) != 0 ||
+ (r = sshbuf_put_cstring(b, service)) != 0 ||
+ (r = sshbuf_put_cstring(b, authctxt->method->name)) != 0 ||
+ (r = sshbuf_put_cstring(b, key_ssh_name(private))) != 0 ||
+ (r = sshbuf_put_string(b, keyblob, keylen)) != 0 ||
+ (r = sshbuf_put_cstring(b, chost)) != 0 ||
+ (r = sshbuf_put_cstring(b, authctxt->local_user)) != 0) {
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ goto out;
+ }
+
#ifdef DEBUG_PK
- buffer_dump(&b);
+ sshbuf_dump(b, stderr);
#endif
- if (sensitive->external_keysign)
- ok = ssh_keysign(private, &signature, &slen,
- buffer_ptr(&b), buffer_len(&b));
- else
- ok = key_sign(private, &signature, &slen,
- buffer_ptr(&b), buffer_len(&b));
- key_free(private);
- buffer_free(&b);
- if (ok != 0) {
- error("key_sign failed");
- free(chost);
- free(pkalg);
- free(blob);
- return 0;
+ if (authctxt->sensitive->external_keysign)
+ r = ssh_keysign(private, &sig, &siglen,
+ sshbuf_ptr(b), sshbuf_len(b));
+ else if ((r = sshkey_sign(private, &sig, &siglen,
+ sshbuf_ptr(b), sshbuf_len(b), NULL, datafellows)) != 0)
+ debug("%s: sshkey_sign: %s", __func__, ssh_err(r));
+ if (r != 0) {
+ error("sign using hostkey %s %s failed",
+ sshkey_ssh_name(private), fp);
+ goto out;
}
- packet_start(SSH2_MSG_USERAUTH_REQUEST);
- packet_put_cstring(authctxt->server_user);
- packet_put_cstring(authctxt->service);
- packet_put_cstring(authctxt->method->name);
- packet_put_cstring(pkalg);
- packet_put_string(blob, blen);
- packet_put_cstring(chost);
- packet_put_cstring(authctxt->local_user);
- packet_put_string(signature, slen);
- explicit_bzero(signature, slen);
- free(signature);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, authctxt->server_user)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, authctxt->service)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, authctxt->method->name)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, key_ssh_name(private))) != 0 ||
+ (r = sshpkt_put_string(ssh, keyblob, keylen)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, chost)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, authctxt->local_user)) != 0 ||
+ (r = sshpkt_put_string(ssh, sig, siglen)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0) {
+ error("%s: packet error: %s", __func__, ssh_err(r));
+ goto out;
+ }
+ success = 1;
+
+ out:
+ if (sig != NULL) {
+ explicit_bzero(sig, siglen);
+ free(sig);
+ }
+ free(keyblob);
+ free(lname);
+ free(fp);
free(chost);
- free(pkalg);
- free(blob);
+ sshkey_free(private);
+ sshbuf_free(b);
- packet_send();
- return 1;
+ return success;
}
/* find auth method */
@@ -1662,8 +1916,8 @@
buffer_append(&b, method->name, strlen(method->name));
}
}
- buffer_append(&b, "\0", 1);
- list = xstrdup(buffer_ptr(&b));
+ if ((list = sshbuf_dup_string(&b)) == NULL)
+ fatal("%s: sshbuf_dup_string failed", __func__);
buffer_free(&b);
return list;
}
Modified: trunk/crypto/openssh/sshd.0
===================================================================
--- trunk/crypto/openssh/sshd.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshd.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-SSHD(8) OpenBSD System Manager's Manual SSHD(8)
+SSHD(8) System Manager's Manual SSHD(8)
NAME
- sshd - OpenSSH SSH daemon
+ sshd M-bM-^@M-^S OpenSSH SSH daemon
SYNOPSIS
sshd [-46DdeiqTt] [-b bits] [-C connection_spec]
@@ -11,7 +11,7 @@
DESCRIPTION
sshd (OpenSSH Daemon) is the daemon program for ssh(1). Together these
- programs replace rlogin(1) and rsh(1), and provide secure encrypted
+ programs replace rlogin and rsh, and provide secure encrypted
communications between two untrusted hosts over an insecure network.
sshd listens for connections from clients. It is normally started at
@@ -41,10 +41,9 @@
file that would apply to the specified user, host, and address
will be set before the configuration is written to standard
output. The connection parameters are supplied as keyword=value
- pairs. The keywords are ``user'', ``host'', ``laddr'',
- ``lport'', and ``addr''. All are required and may be supplied in
- any order, either with multiple -C options or as a comma-
- separated list.
+ pairs. The keywords are M-bM-^@M-^\userM-bM-^@M-^], M-bM-^@M-^\hostM-bM-^@M-^], M-bM-^@M-^\laddrM-bM-^@M-^], M-bM-^@M-^\lportM-bM-^@M-^], and
+ M-bM-^@M-^\addrM-bM-^@M-^]. All are required and may be supplied in any order,
+ either with multiple -C options or as a comma-separated list.
-c host_certificate_file
Specifies a path to a certificate file to identify sshd during
@@ -88,12 +87,11 @@
files for the different protocol versions and host key
algorithms.
- -i Specifies that sshd is being run from inetd(8). sshd is normally
- not run from inetd because it needs to generate the server key
- before it can respond to the client, and this may take tens of
- seconds. Clients would have to wait too long if the key was
- regenerated every time. However, with small key sizes (e.g. 512)
- using sshd from inetd may be feasible.
+ -i Specifies that sshd is being run from inetd(8). If SSH protocol
+ 1 is enabled, sshd should not normally be run from inetd because
+ it needs to generate the server key before it can respond to the
+ client, and this may take some time. Clients may have to wait
+ too long if the key was regenerated every time.
-k key_gen_time
Specifies how often the ephemeral protocol version 1 server key
@@ -148,12 +146,12 @@
AUTHENTICATION
The OpenSSH SSH daemon supports SSH protocols 1 and 2. The default is to
use protocol 2 only, though this can be changed via the Protocol option
- in sshd_config(5). Protocol 2 supports DSA, ECDSA, ED25519 and RSA keys;
- protocol 1 only supports RSA keys. For both protocols, each host has a
- host-specific key, normally 2048 bits, used to identify the host.
+ in sshd_config(5). Protocol 1 should not be used and is only offered to
+ support legacy devices.
- Forward security for protocol 1 is provided through an additional server
- key, normally 768 bits, generated when the server starts. This key is
+ Each host has a host-specific key, used to identify the host. Partial
+ forward security for protocol 1 is provided through an additional server
+ key, normally 1024 bits, generated when the server starts. This key is
normally regenerated every hour if it has been used, and is never stored
on disk. Whenever a client connects, the daemon responds with its public
host and server keys. The client compares the RSA host key against its
@@ -185,11 +183,11 @@
listed in DenyUsers or its group is listed in DenyGroups . The
definition of a locked account is system dependant. Some platforms have
their own account database (eg AIX) and some modify the passwd field (
- `*LK*' on Solaris and UnixWare, `*' on HP-UX, containing `Nologin' on
- Tru64, a leading `*LOCKED*' on FreeBSD and a leading `!' on most
+ M-bM-^@M-^X*LK*M-bM-^@M-^Y on Solaris and UnixWare, M-bM-^@M-^X*M-bM-^@M-^Y on HP-UX, containing M-bM-^@M-^XNologinM-bM-^@M-^Y on
+ Tru64, a leading M-bM-^@M-^X*LOCKED*M-bM-^@M-^Y on FreeBSD and a leading M-bM-^@M-^X!M-bM-^@M-^Y on most
Linuxes). If there is a requirement to disable password authentication
for the account while allowing still public-key, then the passwd field
- should be set to something other than these values (eg `NP' or `*NP*' ).
+ should be set to something other than these values (eg M-bM-^@M-^XNPM-bM-^@M-^Y or M-bM-^@M-^X*NP*M-bM-^@M-^Y ).
If the client successfully authenticates itself, a dialog for preparing
the session is entered. At this time the client may request things like
@@ -228,12 +226,15 @@
7. Changes to user's home directory.
- 8. If ~/.ssh/rc exists, runs it; else if /etc/ssh/sshrc exists,
- runs it; otherwise runs xauth. The ``rc'' files are given the
- X11 authentication protocol and cookie in standard input. See
+ 8. If ~/.ssh/rc exists and the sshd_config(5) PermitUserRC option
+ is set, runs it; else if /etc/ssh/sshrc exists, runs it;
+ otherwise runs xauth. The M-bM-^@M-^\rcM-bM-^@M-^] files are given the X11
+ authentication protocol and cookie in standard input. See
SSHRC, below.
- 9. Runs user's shell or command.
+ 9. Runs user's shell or command. All commands are run under the
+ user's login shell as specified in the system password
+ database.
SSHRC
If the file ~/.ssh/rc exists, sh(1) runs it after reading the environment
@@ -267,9 +268,9 @@
AUTHORIZED_KEYS FILE FORMAT
AuthorizedKeysFile specifies the files containing public keys for public
- key authentication; if none is specified, the default is
+ key authentication; if this option is not specified, the default is
~/.ssh/authorized_keys and ~/.ssh/authorized_keys2. Each line of the
- file contains one key (empty lines and lines starting with a `#' are
+ file contains one key (empty lines and lines starting with a M-bM-^@M-^X#M-bM-^@M-^Y are
ignored as comments). Protocol 1 public keys consist of the following
space-separated fields: options, bits, exponent, modulus, comment.
Protocol 2 public key consist of: options, keytype, base64-encoded key,
@@ -278,9 +279,9 @@
starts with a number). The bits, exponent, modulus, and comment fields
give the RSA key for protocol version 1; the comment field is not used
for anything (but may be convenient for the user to identify the key).
- For protocol version 2 the keytype is ``ecdsa-sha2-nistp256'',
- ``ecdsa-sha2-nistp384'', ``ecdsa-sha2-nistp521'', ``ssh-ed25519'',
- ``ssh-dss'' or ``ssh-rsa''.
+ For protocol version 2 the keytype is M-bM-^@M-^\ecdsa-sha2-nistp256M-bM-^@M-^],
+ M-bM-^@M-^\ecdsa-sha2-nistp384M-bM-^@M-^], M-bM-^@M-^\ecdsa-sha2-nistp521M-bM-^@M-^], M-bM-^@M-^\ssh-ed25519M-bM-^@M-^], M-bM-^@M-^\ssh-dssM-bM-^@M-^] or
+ M-bM-^@M-^\ssh-rsaM-bM-^@M-^].
Note that lines in this file are usually several hundred bytes long
(because of the size of the public key encoding) up to a limit of 8
@@ -297,6 +298,10 @@
The following option specifications are supported (note that option
keywords are case-insensitive):
+ agent-forwarding
+ Enable authentication agent forwarding previously disabled by the
+ restrict option.
+
cert-authority
Specifies that the listed key is a certification authority (CA)
that is trusted to validate signed certificates for user
@@ -369,7 +374,7 @@
Any X11 forward requests by the client will return an error.
permitopen="host:port"
- Limit local ``ssh -L'' port forwarding such that it may only
+ Limit local port forwarding with ssh(1) -L such that it may only
connect to the specified host and port. IPv6 addresses can be
specified by enclosing the address in square brackets. Multiple
permitopen options may be applied separated by commas. No
@@ -377,6 +382,9 @@
must be literal domains or addresses. A port specification of *
matches any port.
+ port-forwarding
+ Enable port forwarding previously disabled by the restrict
+
principals="principals"
On a cert-authority line, specifies allowed principals for
certificate authentication as a comma-separated list. At least
@@ -385,11 +393,28 @@
ignored for keys that are not marked as trusted certificate
signers using the cert-authority option.
+ pty Permits tty allocation previously disabled by the restrict
+ option.
+
+ restrict
+ Enable all restrictions, i.e. disable port, agent and X11
+ forwarding, as well as disabling PTY allocation and execution of
+ ~/.ssh/rc. If any future restriction capabilities are added to
+ authorized_keys files they will be included in this set.
+
tunnel="n"
Force a tun(4) device on the server. Without this option, the
next available device will be used if the client requests a
tunnel.
+ user-rc
+ Enables execution of ~/.ssh/rc previously disabled by the
+ restrict option.
+
+ X11-forwarding
+ Permits X11 forwarding previously disabled by the restrict
+ option.
+
An example authorized_keys file:
# Comments allowed at start of line
@@ -402,6 +427,10 @@
AAAAB5...21S==
tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...==
jane at example.net
+ restrict,command="uptime" ssh-rsa AAAA1C8...32Tv==
+ user at example.net
+ restrict,pty,command="nethack" ssh-rsa AAAA1f8...IrrC5==
+ user at example.net
SSH_KNOWN_HOSTS FILE FORMAT
The /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts files contain host
@@ -415,23 +444,23 @@
separated by spaces.
The marker is optional, but if it is present then it must be one of
- ``@cert-authority'', to indicate that the line contains a certification
- authority (CA) key, or ``@revoked'', to indicate that the key contained
- on the line is revoked and must not ever be accepted. Only one marker
+ M-bM-^@M-^\@cert-authorityM-bM-^@M-^], to indicate that the line contains a certification
+ authority (CA) key, or M-bM-^@M-^\@revokedM-bM-^@M-^], to indicate that the key contained on
+ the line is revoked and must not ever be accepted. Only one marker
should be used on a key line.
- Hostnames is a comma-separated list of patterns (`*' and `?' act as
+ Hostnames is a comma-separated list of patterns (M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y act as
wildcards); each pattern in turn is matched against the canonical host
name (when authenticating a client) or against the user-supplied name
- (when authenticating a server). A pattern may also be preceded by `!' to
+ (when authenticating a server). A pattern may also be preceded by M-bM-^@M-^X!M-bM-^@M-^Y to
indicate negation: if the host name matches a negated pattern, it is not
accepted (by that line) even if it matched another pattern on the line.
- A hostname or address may optionally be enclosed within `[' and `]'
- brackets then followed by `:' and a non-standard port number.
+ A hostname or address may optionally be enclosed within M-bM-^@M-^X[M-bM-^@M-^Y and M-bM-^@M-^X]M-bM-^@M-^Y
+ brackets then followed by M-bM-^@M-^X:M-bM-^@M-^Y and a non-standard port number.
Alternately, hostnames may be stored in a hashed form which hides host
names and addresses should the file's contents be disclosed. Hashed
- hostnames start with a `|' character. Only one hashed hostname may
+ hostnames start with a M-bM-^@M-^X|M-bM-^@M-^Y character. Only one hashed hostname may
appear on a single line and none of the above negation or wildcard
operators may be applied.
@@ -439,21 +468,21 @@
they can be obtained, for example, from /etc/ssh/ssh_host_key.pub. The
optional comment field continues to the end of the line, and is not used.
- Lines starting with `#' and empty lines are ignored as comments.
+ Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines are ignored as comments.
When performing host authentication, authentication is accepted if any
matching line has the proper key; either one that matches exactly or, if
the server has presented a certificate for authentication, the key of the
certification authority that signed the certificate. For a key to be
- trusted as a certification authority, it must use the ``@cert-authority''
+ trusted as a certification authority, it must use the M-bM-^@M-^\@cert-authorityM-bM-^@M-^]
marker described above.
The known hosts file also provides a facility to mark keys as revoked,
for example when it is known that the associated private key has been
- stolen. Revoked keys are specified by including the ``@revoked'' marker
- at the beginning of the key line, and are never accepted for
- authentication or as certification authorities, but instead will produce
- a warning from ssh(1) when they are encountered.
+ stolen. Revoked keys are specified by including the M-bM-^@M-^\@revokedM-bM-^@M-^] marker at
+ the beginning of the key line, and are never accepted for authentication
+ or as certification authorities, but instead will produce a warning from
+ ssh(1) when they are encountered.
It is permissible (but not recommended) to have several lines or
different host keys for the same names. This will inevitably happen when
@@ -513,7 +542,7 @@
for the user, and not accessible by others.
~/.ssh/authorized_keys
- Lists the public keys (DSA, ECDSA, ED25519, RSA) that can be used
+ Lists the public keys (DSA, ECDSA, Ed25519, RSA) that can be used
for logging in as this user. The format of this file is
described above. The content of the file is not highly
sensitive, but the recommended permissions are read/write for the
@@ -523,12 +552,12 @@
are writable by other users, then the file could be modified or
replaced by unauthorized users. In this case, sshd will not
allow it to be used unless the StrictModes option has been set to
- ``no''.
+ M-bM-^@M-^\noM-bM-^@M-^].
~/.ssh/environment
This file is read into the environment at login (if it exists).
It can only contain empty lines, comment lines (that start with
- `#'), and assignment lines of the form name=value. The file
+ M-bM-^@M-^X#M-bM-^@M-^Y), and assignment lines of the form name=value. The file
should be writable only by the user; it need not be readable by
anyone else. Environment processing is disabled by default and
is controlled via the PermitUserEnvironment option.
@@ -545,11 +574,6 @@
directory becomes accessible. This file should be writable only
by the user, and need not be readable by anyone else.
- /etc/hosts.allow
- /etc/hosts.deny
- Access controls that should be enforced by tcp-wrappers are
- defined here. Further details are described in hosts_access(5).
-
/etc/hosts.equiv
This file is for host-based authentication (see ssh(1)). It
should only be writable by root.
@@ -556,7 +580,9 @@
/etc/moduli
Contains Diffie-Hellman groups used for the "Diffie-Hellman Group
- Exchange". The file format is described in moduli(5).
+ Exchange" key exchange method. The file format is described in
+ moduli(5). If no usable groups are found in this file then fixed
+ internal groups will be used.
/etc/motd
See motd(5).
@@ -625,8 +651,8 @@
SEE ALSO
scp(1), sftp(1), ssh(1), ssh-add(1), ssh-agent(1), ssh-keygen(1),
- ssh-keyscan(1), chroot(2), hosts_access(5), login.conf(5), moduli(5),
- sshd_config(5), inetd(8), sftp-server(8)
+ ssh-keyscan(1), chroot(2), login.conf(5), moduli(5), sshd_config(5),
+ inetd(8), sftp-server(8)
AUTHORS
OpenSSH is a derivative of the original and free ssh 1.2.12 release by
@@ -636,8 +662,4 @@
versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support
for privilege separation.
-CAVEATS
- System security is not improved unless rshd, rlogind, and rexecd are
- disabled (thus completely disabling rlogin and rsh into the machine).
-
-OpenBSD 5.5 December 7, 2013 OpenBSD 5.5
+OpenBSD 6.0 February 17, 2016 OpenBSD 6.0
Modified: trunk/crypto/openssh/sshd.8
===================================================================
--- trunk/crypto/openssh/sshd.8 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshd.8 2016-11-05 20:36:34 UTC (rev 9223)
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd.8,v 1.273 2013/12/07 11:58:46 naddy Exp $
-.Dd $Mdocdate: December 7 2013 $
+.\" $OpenBSD: sshd.8,v 1.284 2016/02/17 07:38:19 jmc Exp $
+.Dd $Mdocdate: February 17 2016 $
.Dt SSHD 8
.Os
.Sh NAME
@@ -60,10 +60,7 @@
.Nm
(OpenSSH Daemon) is the daemon program for
.Xr ssh 1 .
-Together these programs replace
-.Xr rlogin 1
-and
-.Xr rsh 1 ,
+Together these programs replace rlogin and rsh,
and provide secure encrypted communications between two untrusted hosts
over an insecure network.
.Pp
@@ -187,15 +184,12 @@
.Nm
is being run from
.Xr inetd 8 .
+If SSH protocol 1 is enabled,
.Nm
-is normally not run
+should not normally be run
from inetd because it needs to generate the server key before it can
-respond to the client, and this may take tens of seconds.
-Clients would have to wait too long if the key was regenerated every time.
-However, with small key sizes (e.g. 512) using
-.Nm
-from inetd may
-be feasible.
+respond to the client, and this may take some time.
+Clients may have to wait too long if the key was regenerated every time.
.It Fl k Ar key_gen_time
Specifies how often the ephemeral protocol version 1 server key is
regenerated (default 3600 seconds, or one hour).
@@ -281,16 +275,14 @@
.Cm Protocol
option in
.Xr sshd_config 5 .
-Protocol 2 supports DSA, ECDSA, ED25519 and RSA keys;
-protocol 1 only supports RSA keys.
-For both protocols,
-each host has a host-specific key,
-normally 2048 bits,
+Protocol 1 should not be used
+and is only offered to support legacy devices.
+.Pp
+Each host has a host-specific key,
used to identify the host.
-.Pp
-Forward security for protocol 1 is provided through
+Partial forward security for protocol 1 is provided through
an additional server key,
-normally 768 bits,
+normally 1024 bits,
generated when the server starts.
This key is normally regenerated every hour if it has been used, and
is never stored on disk.
@@ -411,7 +403,10 @@
.It
If
.Pa ~/.ssh/rc
-exists, runs it; else if
+exists and the
+.Xr sshd_config 5
+.Cm PermitUserRC
+option is set, runs it; else if
.Pa /etc/ssh/sshrc
exists, runs
it; otherwise runs xauth.
@@ -424,6 +419,8 @@
below.
.It
Runs user's shell or command.
+All commands are run under the user's login shell as specified in the
+system password database.
.El
.Sh SSHRC
If the file
@@ -471,7 +468,7 @@
.Cm AuthorizedKeysFile
specifies the files containing public keys for
public key authentication;
-if none is specified, the default is
+if this option is not specified, the default is
.Pa ~/.ssh/authorized_keys
and
.Pa ~/.ssh/authorized_keys2 .
@@ -523,6 +520,10 @@
The following option specifications are supported (note
that option keywords are case-insensitive):
.Bl -tag -width Ds
+.It Cm agent-forwarding
+Enable authentication agent forwarding previously disabled by the
+.Cm restrict
+option.
.It Cm cert-authority
Specifies that the listed key is a certification authority (CA) that is
trusted to validate signed certificates for user authentication.
@@ -604,10 +605,10 @@
Forbids X11 forwarding when this key is used for authentication.
Any X11 forward requests by the client will return an error.
.It Cm permitopen="host:port"
-Limit local
-.Li ``ssh -L''
-port forwarding such that it may only connect to the specified host and
-port.
+Limit local port forwarding with
+.Xr ssh 1
+.Fl L
+such that it may only connect to the specified host and port.
IPv6 addresses can be specified by enclosing the address in square brackets.
Multiple
.Cm permitopen
@@ -617,6 +618,9 @@
A port specification of
.Cm *
matches any port.
+.It Cm port-forwarding
+Enable port forwarding previously disabled by the
+.Cm restrict
.It Cm principals="principals"
On a
.Cm cert-authority
@@ -628,6 +632,17 @@
signers using the
.Cm cert-authority
option.
+.It Cm pty
+Permits tty allocation previously disabled by the
+.Cm restrict
+option.
+.It Cm restrict
+Enable all restrictions, i.e. disable port, agent and X11 forwarding,
+as well as disabling PTY allocation
+and execution of
+.Pa ~/.ssh/rc .
+If any future restriction capabilities are added to authorized_keys files
+they will be included in this set.
.It Cm tunnel="n"
Force a
.Xr tun 4
@@ -634,6 +649,16 @@
device on the server.
Without this option, the next available device will be used if
the client requests a tunnel.
+.It Cm user-rc
+Enables execution of
+.Pa ~/.ssh/rc
+previously disabled by the
+.Cm restrict
+option.
+.It Cm X11-forwarding
+Permits X11 forwarding previously disabled by the
+.Cm restrict
+option.
.El
.Pp
An example authorized_keys file:
@@ -648,6 +673,10 @@
AAAAB5...21S==
tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...==
jane at example.net
+restrict,command="uptime" ssh-rsa AAAA1C8...32Tv==
+user at example.net
+restrict,pty,command="nethack" ssh-rsa AAAA1f8...IrrC5==
+user at example.net
.Ed
.Sh SSH_KNOWN_HOSTS FILE FORMAT
The
@@ -808,7 +837,7 @@
and not accessible by others.
.Pp
.It Pa ~/.ssh/authorized_keys
-Lists the public keys (DSA, ECDSA, ED25519, RSA)
+Lists the public keys (DSA, ECDSA, Ed25519, RSA)
that can be used for logging in as this user.
The format of this file is described above.
The content of the file is not highly sensitive, but the recommended
@@ -851,12 +880,6 @@
This file should be writable only by the user, and need not be
readable by anyone else.
.Pp
-.It Pa /etc/hosts.allow
-.It Pa /etc/hosts.deny
-Access controls that should be enforced by tcp-wrappers are defined here.
-Further details are described in
-.Xr hosts_access 5 .
-.Pp
.It Pa /etc/hosts.equiv
This file is for host-based authentication (see
.Xr ssh 1 ) .
@@ -863,9 +886,12 @@
It should only be writable by root.
.Pp
.It Pa /etc/moduli
-Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange".
+Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange"
+key exchange method.
The file format is described in
.Xr moduli 5 .
+If no usable groups are found in this file then fixed internal groups will
+be used.
.Pp
.It Pa /etc/motd
See
@@ -960,7 +986,6 @@
.Xr ssh-keygen 1 ,
.Xr ssh-keyscan 1 ,
.Xr chroot 2 ,
-.Xr hosts_access 5 ,
.Xr login.conf 5 ,
.Xr moduli 5 ,
.Xr sshd_config 5 ,
@@ -977,14 +1002,3 @@
protocol versions 1.5 and 2.0.
Niels Provos and Markus Friedl contributed support
for privilege separation.
-.Sh CAVEATS
-System security is not improved unless
-.Nm rshd ,
-.Nm rlogind ,
-and
-.Nm rexecd
-are disabled (thus completely disabling
-.Xr rlogin
-and
-.Xr rsh
-into the machine).
Modified: trunk/crypto/openssh/sshd.c
===================================================================
--- trunk/crypto/openssh/sshd.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshd.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.420 2014/02/26 21:53:37 markus Exp $ */
+/* $OpenBSD: sshd.c,v 1.470 2016/05/24 04:43:45 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -71,11 +71,14 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
+#ifdef WITH_OPENSSL
#include <openssl/dh.h>
#include <openssl/bn.h>
#include <openssl/rand.h>
#include "openbsd-compat/openssl-compat.h"
+#endif
#ifdef HAVE_SECUREWARE
#include <sys/security.h>
@@ -91,6 +94,8 @@
#include "packet.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
+#include "match.h"
#include "servconf.h"
#include "uidswap.h"
#include "compat.h"
@@ -98,7 +103,6 @@
#include "digest.h"
#include "key.h"
#include "kex.h"
-#include "dh.h"
#include "myproposal.h"
#include "authfile.h"
#include "pathnames.h"
@@ -107,7 +111,6 @@
#include "hostfile.h"
#include "auth.h"
#include "authfd.h"
-#include "misc.h"
#include "msg.h"
#include "dispatch.h"
#include "channels.h"
@@ -118,17 +121,10 @@
#include "ssh-gss.h"
#endif
#include "monitor_wrap.h"
-#include "roaming.h"
#include "ssh-sandbox.h"
#include "version.h"
+#include "ssherr.h"
-#ifdef LIBWRAP
-#include <tcpd.h>
-#include <syslog.h>
-int allow_severity;
-int deny_severity;
-#endif /* LIBWRAP */
-
#ifndef O_NOCTTY
#define O_NOCTTY 0
#endif
@@ -192,11 +188,8 @@
char *client_version_string = NULL;
char *server_version_string = NULL;
-/* for rekeying XXX fixme */
-Kex *xxx_kex;
-
/* Daemon's agent connection */
-AuthenticationConnection *auth_conn = NULL;
+int auth_sock = -1;
int have_agent = 0;
/*
@@ -236,7 +229,7 @@
u_int session_id2_len = 0;
/* record remote hostname or ip */
-u_int utmp_len = MAXHOSTNAMELEN;
+u_int utmp_len = HOST_NAME_MAX+1;
/* options.max_startup sized array of fd ints */
int *startup_pipes = NULL;
@@ -263,7 +256,9 @@
void destroy_sensitive_data(void);
void demote_sensitive_data(void);
+#ifdef WITH_SSH1
static void do_ssh1_kex(void);
+#endif
static void do_ssh2_kex(void);
/*
@@ -376,7 +371,8 @@
}
/* Log error and exit. */
- sigdie("Timeout before authentication for %s", get_remote_ipaddr());
+ sigdie("Timeout before authentication for %s port %d",
+ ssh_remote_ipaddr(active_state), ssh_remote_port(active_state));
}
/*
@@ -412,7 +408,7 @@
}
static void
-sshd_exchange_identification(int sock_in, int sock_out)
+sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
{
u_int i;
int mismatch;
@@ -441,10 +437,11 @@
options.version_addendum, newline);
/* Send our protocol version identification. */
- if (roaming_atomicio(vwrite, sock_out, server_version_string,
+ if (atomicio(vwrite, sock_out, server_version_string,
strlen(server_version_string))
!= strlen(server_version_string)) {
- logit("Could not write ident string to %s", get_remote_ipaddr());
+ logit("Could not write ident string to %s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
cleanup_exit(255);
}
@@ -451,9 +448,10 @@
/* Read other sides version identification. */
memset(buf, 0, sizeof(buf));
for (i = 0; i < sizeof(buf) - 1; i++) {
- if (roaming_atomicio(read, sock_in, &buf[i], 1) != 1) {
- logit("Did not receive identification string from %s",
- get_remote_ipaddr());
+ if (atomicio(read, sock_in, &buf[i], 1) != 1) {
+ logit("Did not receive identification string "
+ "from %s port %d",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
cleanup_exit(255);
}
if (buf[i] == '\r') {
@@ -482,7 +480,7 @@
(void) atomicio(vwrite, sock_out, s, strlen(s));
logit("Bad protocol version identification '%.100s' "
"from %s port %d", client_version_string,
- get_remote_ipaddr(), get_remote_port());
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
close(sock_in);
close(sock_out);
cleanup_exit(255);
@@ -490,23 +488,25 @@
debug("Client protocol version %d.%d; client software version %.100s",
remote_major, remote_minor, remote_version);
- compat_datafellows(remote_version);
+ ssh->compat = compat_datafellows(remote_version);
- if ((datafellows & SSH_BUG_PROBE) != 0) {
- logit("probed from %s with %s. Don't panic.",
- get_remote_ipaddr(), client_version_string);
+ if ((ssh->compat & SSH_BUG_PROBE) != 0) {
+ logit("probed from %s port %d with %s. Don't panic.",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
+ client_version_string);
cleanup_exit(255);
}
- if ((datafellows & SSH_BUG_SCANNER) != 0) {
- logit("scanned from %s with %s. Don't panic.",
- get_remote_ipaddr(), client_version_string);
+ if ((ssh->compat & SSH_BUG_SCANNER) != 0) {
+ logit("scanned from %s port %d with %s. Don't panic.",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
+ client_version_string);
cleanup_exit(255);
}
- if ((datafellows & SSH_BUG_RSASIGMD5) != 0) {
+ if ((ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
logit("Client version \"%.100s\" uses unsafe RSA signature "
"scheme; disabling use of RSA keys", remote_version);
}
- if ((datafellows & SSH_BUG_DERIVEKEY) != 0) {
+ if ((ssh->compat & SSH_BUG_DERIVEKEY) != 0) {
fatal("Client version \"%.100s\" uses unsafe key agreement; "
"refusing connection", remote_version);
}
@@ -551,8 +551,9 @@
(void) atomicio(vwrite, sock_out, s, strlen(s));
close(sock_in);
close(sock_out);
- logit("Protocol major versions differ for %s: %.200s vs. %.200s",
- get_remote_ipaddr(),
+ logit("Protocol major versions differ for %s port %d: "
+ "%.200s vs. %.200s",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
server_version_string, client_version_string);
cleanup_exit(255);
}
@@ -626,37 +627,39 @@
arc4random_stir();
arc4random_buf(rnd, sizeof(rnd));
+#ifdef WITH_OPENSSL
RAND_seed(rnd, sizeof(rnd));
+ if ((RAND_bytes((u_char *)rnd, 1)) != 1)
+ fatal("%s: RAND_bytes failed", __func__);
+#endif
explicit_bzero(rnd, sizeof(rnd));
/* Demote the private keys to public keys. */
demote_sensitive_data();
- /* Change our root directory */
- if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
- fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
- strerror(errno));
- if (chdir("/") == -1)
- fatal("chdir(\"/\"): %s", strerror(errno));
+ /* Demote the child */
+ if (getuid() == 0 || geteuid() == 0) {
+ /* Change our root directory */
+ if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
+ fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
+ strerror(errno));
+ if (chdir("/") == -1)
+ fatal("chdir(\"/\"): %s", strerror(errno));
- /* Drop our privileges */
- debug3("privsep user:group %u:%u", (u_int)privsep_pw->pw_uid,
- (u_int)privsep_pw->pw_gid);
-#if 0
- /* XXX not ready, too heavy after chroot */
- do_setusercontext(privsep_pw);
-#else
- gidset[0] = privsep_pw->pw_gid;
- if (setgroups(1, gidset) < 0)
- fatal("setgroups: %.100s", strerror(errno));
- permanently_set_uid(privsep_pw);
-#endif
+ /* Drop our privileges */
+ debug3("privsep user:group %u:%u", (u_int)privsep_pw->pw_uid,
+ (u_int)privsep_pw->pw_gid);
+ gidset[0] = privsep_pw->pw_gid;
+ if (setgroups(1, gidset) < 0)
+ fatal("setgroups: %.100s", strerror(errno));
+ permanently_set_uid(privsep_pw);
+ }
}
static int
privsep_preauth(Authctxt *authctxt)
{
- int status;
+ int status, r;
pid_t pid;
struct ssh_sandbox *box = NULL;
@@ -663,7 +666,7 @@
/* Set up unprivileged child process to deal with network data */
pmonitor = monitor_init();
/* Store a pointer to the kex for later rekeying */
- pmonitor->m_pkex = &xxx_kex;
+ pmonitor->m_pkex = &active_state->kex;
if (use_privsep == PRIVSEP_ON)
box = ssh_sandbox_init(pmonitor);
@@ -674,8 +677,14 @@
debug2("Network child is on pid %ld", (long)pid);
pmonitor->m_pid = pid;
- if (have_agent)
- auth_conn = ssh_get_authentication_connection();
+ if (have_agent) {
+ r = ssh_get_authentication_socket(&auth_sock);
+ if (r != 0) {
+ error("Could not get agent socket: %s",
+ ssh_err(r));
+ have_agent = 0;
+ }
+ }
if (box != NULL)
ssh_sandbox_parent_preauth(box, pid);
monitor_child_preauth(authctxt, pmonitor);
@@ -710,9 +719,7 @@
/* Arrange for logging to be sent to the monitor */
set_log_handler(mm_log_handler, pmonitor);
- /* Demote the child */
- if (getuid() == 0 || geteuid() == 0)
- privsep_preauth_child();
+ privsep_preauth_child();
setproctitle("%s", "[net]");
if (box != NULL)
ssh_sandbox_child(box);
@@ -761,7 +768,11 @@
arc4random_stir();
arc4random_buf(rnd, sizeof(rnd));
+#ifdef WITH_OPENSSL
RAND_seed(rnd, sizeof(rnd));
+ if ((RAND_bytes((u_char *)rnd, 1)) != 1)
+ fatal("%s: RAND_bytes failed", __func__);
+#endif
explicit_bzero(rnd, sizeof(rnd));
/* Drop privileges */
@@ -792,8 +803,15 @@
key = sensitive_data.host_keys[i];
if (key == NULL)
key = sensitive_data.host_pubkeys[i];
- if (key == NULL)
+ if (key == NULL || key->type == KEY_RSA1)
continue;
+ /* Check that the key is accepted in HostkeyAlgorithms */
+ if (match_pattern_list(sshkey_ssh_name(key),
+ options.hostkeyalgorithms, 0) != 1) {
+ debug3("%s: %s key not permitted by HostkeyAlgorithms",
+ __func__, sshkey_ssh_name(key));
+ continue;
+ }
switch (key->type) {
case KEY_RSA:
case KEY_DSA:
@@ -803,6 +821,12 @@
buffer_append(&b, ",", 1);
p = key_ssh_name(key);
buffer_append(&b, p, strlen(p));
+
+ /* for RSA we also support SHA2 signatures */
+ if (key->type == KEY_RSA) {
+ p = ",rsa-sha2-512,rsa-sha2-256";
+ buffer_append(&b, p, strlen(p));
+ }
break;
}
/* If the private key has a cert peer, then list that too */
@@ -810,8 +834,6 @@
if (key == NULL)
continue;
switch (key->type) {
- case KEY_RSA_CERT_V00:
- case KEY_DSA_CERT_V00:
case KEY_RSA_CERT:
case KEY_DSA_CERT:
case KEY_ECDSA_CERT:
@@ -823,8 +845,8 @@
break;
}
}
- buffer_append(&b, "\0", 1);
- ret = xstrdup(buffer_ptr(&b));
+ if ((ret = sshbuf_dup_string(&b)) == NULL)
+ fatal("%s: sshbuf_dup_string failed", __func__);
buffer_free(&b);
debug("list_hostkey_types: %s", ret);
return ret;
@@ -831,7 +853,7 @@
}
static Key *
-get_hostkey_by_type(int type, int need_private)
+get_hostkey_by_type(int type, int nid, int need_private, struct ssh *ssh)
{
int i;
Key *key;
@@ -838,8 +860,6 @@
for (i = 0; i < options.num_host_key_files; i++) {
switch (type) {
- case KEY_RSA_CERT_V00:
- case KEY_DSA_CERT_V00:
case KEY_RSA_CERT:
case KEY_DSA_CERT:
case KEY_ECDSA_CERT:
@@ -852,7 +872,8 @@
key = sensitive_data.host_pubkeys[i];
break;
}
- if (key != NULL && key->type == type)
+ if (key != NULL && key->type == type &&
+ (key->type != KEY_ECDSA || key->ecdsa_nid == nid))
return need_private ?
sensitive_data.host_keys[i] : key;
}
@@ -860,15 +881,15 @@
}
Key *
-get_hostkey_public_by_type(int type)
+get_hostkey_public_by_type(int type, int nid, struct ssh *ssh)
{
- return get_hostkey_by_type(type, 0);
+ return get_hostkey_by_type(type, nid, 0, ssh);
}
Key *
-get_hostkey_private_by_type(int type)
+get_hostkey_private_by_type(int type, int nid, struct ssh *ssh)
{
- return get_hostkey_by_type(type, 1);
+ return get_hostkey_by_type(type, nid, 1, ssh);
}
Key *
@@ -880,7 +901,7 @@
}
Key *
-get_hostkey_public_by_index(int ind)
+get_hostkey_public_by_index(int ind, struct ssh *ssh)
{
if (ind < 0 || ind >= options.num_host_key_files)
return (NULL);
@@ -888,18 +909,25 @@
}
int
-get_hostkey_index(Key *key)
+get_hostkey_index(Key *key, int compare, struct ssh *ssh)
{
int i;
for (i = 0; i < options.num_host_key_files; i++) {
if (key_is_cert(key)) {
- if (key == sensitive_data.host_certificates[i])
+ if (key == sensitive_data.host_certificates[i] ||
+ (compare && sensitive_data.host_certificates[i] &&
+ sshkey_equal(key,
+ sensitive_data.host_certificates[i])))
return (i);
} else {
- if (key == sensitive_data.host_keys[i])
+ if (key == sensitive_data.host_keys[i] ||
+ (compare && sensitive_data.host_keys[i] &&
+ sshkey_equal(key, sensitive_data.host_keys[i])))
return (i);
- if (key == sensitive_data.host_pubkeys[i])
+ if (key == sensitive_data.host_pubkeys[i] ||
+ (compare && sensitive_data.host_pubkeys[i] &&
+ sshkey_equal(key, sensitive_data.host_pubkeys[i])))
return (i);
}
}
@@ -906,6 +934,50 @@
return (-1);
}
+/* Inform the client of all hostkeys */
+static void
+notify_hostkeys(struct ssh *ssh)
+{
+ struct sshbuf *buf;
+ struct sshkey *key;
+ int i, nkeys, r;
+ char *fp;
+
+ /* Some clients cannot cope with the hostkeys message, skip those. */
+ if (datafellows & SSH_BUG_HOSTKEYS)
+ return;
+
+ if ((buf = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new", __func__);
+ for (i = nkeys = 0; i < options.num_host_key_files; i++) {
+ key = get_hostkey_public_by_index(i, ssh);
+ if (key == NULL || key->type == KEY_UNSPEC ||
+ key->type == KEY_RSA1 || sshkey_is_cert(key))
+ continue;
+ fp = sshkey_fingerprint(key, options.fingerprint_hash,
+ SSH_FP_DEFAULT);
+ debug3("%s: key %d: %s %s", __func__, i,
+ sshkey_ssh_name(key), fp);
+ free(fp);
+ if (nkeys == 0) {
+ packet_start(SSH2_MSG_GLOBAL_REQUEST);
+ packet_put_cstring("hostkeys-00 at openssh.com");
+ packet_put_char(0); /* want-reply */
+ }
+ sshbuf_reset(buf);
+ if ((r = sshkey_putb(key, buf)) != 0)
+ fatal("%s: couldn't put hostkey %d: %s",
+ __func__, i, ssh_err(r));
+ packet_put_string(sshbuf_ptr(buf), sshbuf_len(buf));
+ nkeys++;
+ }
+ debug3("%s: sent %d hostkeys", __func__, nkeys);
+ if (nkeys == 0)
+ fatal("%s: no hostkeys", __func__);
+ packet_send();
+ sshbuf_free(buf);
+}
+
/*
* returns 1 if connection should be dropped, 0 otherwise.
* dropping starts at connection #max_startups_begin with a probability
@@ -938,7 +1010,13 @@
usage(void)
{
fprintf(stderr, "%s, %s\n",
- SSH_RELEASE, SSLeay_version(SSLEAY_VERSION));
+ SSH_RELEASE,
+#ifdef WITH_OPENSSL
+ SSLeay_version(SSLEAY_VERSION)
+#else
+ "without OpenSSL"
+#endif
+ );
fprintf(stderr,
"usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-c host_cert_file]\n"
" [-E log_file] [-f config_file] [-g login_grace_time]\n"
@@ -949,12 +1027,13 @@
}
static void
-send_rexec_state(int fd, Buffer *conf)
+send_rexec_state(int fd, struct sshbuf *conf)
{
- Buffer m;
+ struct sshbuf *m;
+ int r;
- debug3("%s: entering fd = %d config len %d", __func__, fd,
- buffer_len(conf));
+ debug3("%s: entering fd = %d config len %zu", __func__, fd,
+ sshbuf_len(conf));
/*
* Protocol from reexec master to child:
@@ -968,29 +1047,41 @@
* bignum q "
* string rngseed (only if OpenSSL is not self-seeded)
*/
- buffer_init(&m);
- buffer_put_cstring(&m, buffer_ptr(conf));
+ if ((m = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ if ((r = sshbuf_put_stringb(m, conf)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+#ifdef WITH_SSH1
if (sensitive_data.server_key != NULL &&
sensitive_data.server_key->type == KEY_RSA1) {
- buffer_put_int(&m, 1);
- buffer_put_bignum(&m, sensitive_data.server_key->rsa->e);
- buffer_put_bignum(&m, sensitive_data.server_key->rsa->n);
- buffer_put_bignum(&m, sensitive_data.server_key->rsa->d);
- buffer_put_bignum(&m, sensitive_data.server_key->rsa->iqmp);
- buffer_put_bignum(&m, sensitive_data.server_key->rsa->p);
- buffer_put_bignum(&m, sensitive_data.server_key->rsa->q);
+ if ((r = sshbuf_put_u32(m, 1)) != 0 ||
+ (r = sshbuf_put_bignum1(m,
+ sensitive_data.server_key->rsa->e)) != 0 ||
+ (r = sshbuf_put_bignum1(m,
+ sensitive_data.server_key->rsa->n)) != 0 ||
+ (r = sshbuf_put_bignum1(m,
+ sensitive_data.server_key->rsa->d)) != 0 ||
+ (r = sshbuf_put_bignum1(m,
+ sensitive_data.server_key->rsa->iqmp)) != 0 ||
+ (r = sshbuf_put_bignum1(m,
+ sensitive_data.server_key->rsa->p)) != 0 ||
+ (r = sshbuf_put_bignum1(m,
+ sensitive_data.server_key->rsa->q)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
} else
- buffer_put_int(&m, 0);
+#endif
+ if ((r = sshbuf_put_u32(m, 1)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
-#ifndef OPENSSL_PRNG_ONLY
- rexec_send_rng_seed(&m);
+#if defined(WITH_OPENSSL) && !defined(OPENSSL_PRNG_ONLY)
+ rexec_send_rng_seed(m);
#endif
- if (ssh_msg_send(fd, 0, &m) == -1)
+ if (ssh_msg_send(fd, 0, m) == -1)
fatal("%s: ssh_msg_send failed", __func__);
- buffer_free(&m);
+ sshbuf_free(m);
debug3("%s: done", __func__);
}
@@ -1013,10 +1104,11 @@
cp = buffer_get_string(&m, &len);
if (conf != NULL)
- buffer_append(conf, cp, len + 1);
+ buffer_append(conf, cp, len);
free(cp);
if (buffer_get_int(&m)) {
+#ifdef WITH_SSH1
if (sensitive_data.server_key != NULL)
key_free(sensitive_data.server_key);
sensitive_data.server_key = key_new_private(KEY_RSA1);
@@ -1026,11 +1118,14 @@
buffer_get_bignum(&m, sensitive_data.server_key->rsa->iqmp);
buffer_get_bignum(&m, sensitive_data.server_key->rsa->p);
buffer_get_bignum(&m, sensitive_data.server_key->rsa->q);
- rsa_generate_additional_parameters(
- sensitive_data.server_key->rsa);
+ if (rsa_generate_additional_parameters(
+ sensitive_data.server_key->rsa) != 0)
+ fatal("%s: rsa_generate_additional_parameters "
+ "error", __func__);
+#endif
}
-#ifndef OPENSSL_PRNG_ONLY
+#if defined(WITH_OPENSSL) && !defined(OPENSSL_PRNG_ONLY)
rexec_recv_rng_seed(&m);
#endif
@@ -1178,9 +1273,8 @@
for (;;) {
if (received_sighup)
sighup_restart();
- if (fdset != NULL)
- free(fdset);
- fdset = (fd_set *)xcalloc(howmany(maxfd + 1, NFDBITS),
+ free(fdset);
+ fdset = xcalloc(howmany(maxfd + 1, NFDBITS),
sizeof(fd_mask));
for (i = 0; i < num_listen_socks; i++)
@@ -1197,7 +1291,8 @@
logit("Received signal %d; terminating.",
(int) received_sigterm);
close_listen_socks();
- unlink(options.pid_file);
+ if (options.pid_file != NULL)
+ unlink(options.pid_file);
exit(received_sigterm == SIGTERM ? 0 : 255);
}
if (key_used && key_do_regen) {
@@ -1360,7 +1455,11 @@
*/
arc4random_stir();
arc4random_buf(rnd, sizeof(rnd));
+#ifdef WITH_OPENSSL
RAND_seed(rnd, sizeof(rnd));
+ if ((RAND_bytes((u_char *)rnd, 1)) != 1)
+ fatal("%s: RAND_bytes failed", __func__);
+#endif
explicit_bzero(rnd, sizeof(rnd));
}
@@ -1370,7 +1469,48 @@
}
}
+/*
+ * If IP options are supported, make sure there are none (log and
+ * return an error if any are found). Basically we are worried about
+ * source routing; it can be used to pretend you are somebody
+ * (ip-address) you are not. That itself may be "almost acceptable"
+ * under certain circumstances, but rhosts autentication is useless
+ * if source routing is accepted. Notice also that if we just dropped
+ * source routing here, the other side could use IP spoofing to do
+ * rest of the interaction and could still bypass security. So we
+ * exit here if we detect any IP options.
+ */
+static void
+check_ip_options(struct ssh *ssh)
+{
+#ifdef IP_OPTIONS
+ int sock_in = ssh_packet_get_connection_in(ssh);
+ struct sockaddr_storage from;
+ socklen_t option_size, i, fromlen = sizeof(from);
+ u_char opts[200];
+ char text[sizeof(opts) * 3 + 1];
+ memset(&from, 0, sizeof(from));
+ if (getpeername(sock_in, (struct sockaddr *)&from,
+ &fromlen) < 0)
+ return;
+ if (from.ss_family != AF_INET)
+ return;
+ /* XXX IPv6 options? */
+
+ if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts,
+ &option_size) >= 0 && option_size != 0) {
+ text[0] = '\0';
+ for (i = 0; i < option_size; i++)
+ snprintf(text + i*3, sizeof(text) - i*3,
+ " %2.2x", opts[i]);
+ fatal("Connection from %.100s port %d with IP opts: %.800s",
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), text);
+ }
+ return;
+#endif /* IP_OPTIONS */
+}
+
/*
* Main program for the daemon.
*/
@@ -1377,13 +1517,14 @@
int
main(int ac, char **av)
{
+ struct ssh *ssh = NULL;
extern char *optarg;
extern int optind;
- int opt, i, j, on = 1;
+ int r, opt, i, j, on = 1;
int sock_in = -1, sock_out = -1, newsock = -1;
const char *remote_ip;
int remote_port;
- char *line, *logfile = NULL;
+ char *fp, *line, *laddr, *logfile = NULL;
int config_s[2] = { -1 , -1 };
u_int n;
u_int64_t ibytes, obytes;
@@ -1394,6 +1535,8 @@
Authctxt *authctxt;
struct connection_info *connection_info = get_connection_info(0, 0);
+ ssh_malloc_init(); /* must be called before any mallocs */
+
#ifdef HAVE_SECUREWARE
(void)set_auth_parameters(ac, av);
#endif
@@ -1423,7 +1566,8 @@
initialize_server_options(&options);
/* Parse command-line arguments. */
- while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:C:dDeE:iqrtQRT46")) != -1) {
+ while ((opt = getopt(ac, av,
+ "C:E:b:c:f:g:h:k:o:p:u:46DQRTdeiqrt")) != -1) {
switch (opt) {
case '4':
options.address_family = AF_INET;
@@ -1453,7 +1597,7 @@
no_daemon_flag = 1;
break;
case 'E':
- logfile = xstrdup(optarg);
+ logfile = optarg;
/* FALLTHROUGH */
case 'e':
log_stderr = 1;
@@ -1522,8 +1666,8 @@
exit(1);
break;
case 'u':
- utmp_len = (u_int)strtonum(optarg, 0, MAXHOSTNAMELEN+1, NULL);
- if (utmp_len > MAXHOSTNAMELEN) {
+ utmp_len = (u_int)strtonum(optarg, 0, HOST_NAME_MAX+1+1, NULL);
+ if (utmp_len > HOST_NAME_MAX+1) {
fprintf(stderr, "Invalid utmp length.\n");
exit(1);
}
@@ -1550,13 +1694,13 @@
else
closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
+#ifdef WITH_OPENSSL
OpenSSL_add_all_algorithms();
+#endif
/* If requested, redirect the logs to the specified logfile. */
- if (logfile != NULL) {
+ if (logfile != NULL)
log_redirect_stderr_to(logfile);
- free(logfile);
- }
/*
* Force logging to stderr until we have loaded the private host
* key (unless started from inetd)
@@ -1603,7 +1747,7 @@
buffer_init(&cfg);
if (rexeced_flag)
recv_rexec_state(REEXEC_CONFIG_PASS_FD, &cfg);
- else
+ else if (strcasecmp(config_file_name, "none") != 0)
load_server_config(config_file_name, &cfg);
parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
@@ -1624,6 +1768,11 @@
strcasecmp(options.authorized_keys_command, "none") != 0))
fatal("AuthorizedKeysCommand set without "
"AuthorizedKeysCommandUser");
+ if (options.authorized_principals_command_user == NULL &&
+ (options.authorized_principals_command != NULL &&
+ strcasecmp(options.authorized_principals_command, "none") != 0))
+ fatal("AuthorizedPrincipalsCommand set without "
+ "AuthorizedPrincipalsCommandUser");
/*
* Check whether there is any path through configured auth methods.
@@ -1655,7 +1804,12 @@
}
debug("sshd version %s, %s", SSH_VERSION,
- SSLeay_version(SSLEAY_VERSION));
+#ifdef WITH_OPENSSL
+ SSLeay_version(SSLEAY_VERSION)
+#else
+ "without OpenSSL"
+#endif
+ );
/* Store privilege separation user for later use if required. */
if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
@@ -1676,21 +1830,25 @@
sizeof(Key *));
sensitive_data.host_pubkeys = xcalloc(options.num_host_key_files,
sizeof(Key *));
- for (i = 0; i < options.num_host_key_files; i++) {
- sensitive_data.host_keys[i] = NULL;
- sensitive_data.host_pubkeys[i] = NULL;
- }
if (options.host_key_agent) {
if (strcmp(options.host_key_agent, SSH_AUTHSOCKET_ENV_NAME))
setenv(SSH_AUTHSOCKET_ENV_NAME,
options.host_key_agent, 1);
- have_agent = ssh_agent_present();
+ if ((r = ssh_get_authentication_socket(NULL)) == 0)
+ have_agent = 1;
+ else
+ error("Could not connect to agent \"%s\": %s",
+ options.host_key_agent, ssh_err(r));
}
for (i = 0; i < options.num_host_key_files; i++) {
+ if (options.host_key_files[i] == NULL)
+ continue;
key = key_load_private(options.host_key_files[i], "", NULL);
pubkey = key_load_public(options.host_key_files[i], NULL);
+ if (pubkey == NULL && key != NULL)
+ pubkey = key_demote(key);
sensitive_data.host_keys[i] = key;
sensitive_data.host_pubkeys[i] = pubkey;
@@ -1718,11 +1876,17 @@
case KEY_DSA:
case KEY_ECDSA:
case KEY_ED25519:
- sensitive_data.have_ssh2_key = 1;
+ if (have_agent || key != NULL)
+ sensitive_data.have_ssh2_key = 1;
break;
}
- debug("private host key: #%d type %d %s", i, keytype,
- key_type(key ? key : pubkey));
+ if ((fp = sshkey_fingerprint(pubkey, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL)
+ fatal("sshkey_fingerprint failed");
+ debug("%s host key #%d: %s %s",
+ key ? "private" : "agent", i, keytype == KEY_RSA1 ?
+ sshkey_type(pubkey) : sshkey_ssh_name(pubkey), fp);
+ free(fp);
}
if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
logit("Disabling protocol version 1. Could not load host key");
@@ -1747,6 +1911,8 @@
sensitive_data.host_certificates[i] = NULL;
for (i = 0; i < options.num_host_cert_files; i++) {
+ if (options.host_cert_files[i] == NULL)
+ continue;
key = key_load_public(options.host_cert_files[i], NULL);
if (key == NULL) {
error("Could not load host certificate: %s",
@@ -1777,10 +1943,12 @@
debug("host certificate: #%d type %d %s", j, key->type,
key_type(key));
}
+
+#ifdef WITH_SSH1
/* Check certain values for sanity. */
if (options.protocol & SSH_PROTO_1) {
- if (options.server_key_bits < 512 ||
- options.server_key_bits > 32768) {
+ if (options.server_key_bits < SSH_RSA_MINIMUM_MODULUS_SIZE ||
+ options.server_key_bits > OPENSSL_RSA_MAX_MODULUS_BITS) {
fprintf(stderr, "Bad server key size.\n");
exit(1);
}
@@ -1801,6 +1969,7 @@
options.server_key_bits);
}
}
+#endif
if (use_privsep) {
struct stat st;
@@ -1911,7 +2080,7 @@
* Write out the pid file after the sigterm handler
* is setup and the listen sockets are bound
*/
- if (!debug_flag) {
+ if (options.pid_file != NULL && !debug_flag) {
FILE *f = fopen(options.pid_file, "w");
if (f == NULL) {
@@ -2008,6 +2177,8 @@
*/
packet_set_connection(sock_in, sock_out);
packet_set_server();
+ ssh = active_state; /* XXX */
+ check_ip_options(ssh);
/* Set SO_KEEPALIVE if requested. */
if (options.tcp_keep_alive && packet_connection_is_on_socket() &&
@@ -2014,49 +2185,27 @@
setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) < 0)
error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
- if ((remote_port = get_remote_port()) < 0) {
- debug("get_remote_port failed");
+ if ((remote_port = ssh_remote_port(ssh)) < 0) {
+ debug("ssh_remote_port failed");
cleanup_exit(255);
}
/*
- * We use get_canonical_hostname with usedns = 0 instead of
- * get_remote_ipaddr here so IP options will be checked.
- */
- (void) get_canonical_hostname(0);
- /*
* The rest of the code depends on the fact that
- * get_remote_ipaddr() caches the remote ip, even if
+ * ssh_remote_ipaddr() caches the remote ip, even if
* the socket goes away.
*/
- remote_ip = get_remote_ipaddr();
+ remote_ip = ssh_remote_ipaddr(ssh);
#ifdef SSH_AUDIT_EVENTS
audit_connection_from(remote_ip, remote_port);
#endif
-#ifdef LIBWRAP
- allow_severity = options.log_facility|LOG_INFO;
- deny_severity = options.log_facility|LOG_WARNING;
- /* Check whether logins are denied from this host. */
- if (packet_connection_is_on_socket()) {
- struct request_info req;
- request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
- fromhost(&req);
-
- if (!hosts_access(&req)) {
- debug("Connection refused by tcp wrapper");
- refuse(&req);
- /* NOTREACHED */
- fatal("libwrap refuse returns");
- }
- }
-#endif /* LIBWRAP */
-
/* Log the connection. */
+ laddr = get_local_ipaddr(sock_in);
verbose("Connection from %s port %d on %s port %d",
- remote_ip, remote_port,
- get_local_ipaddr(sock_in), get_local_port());
+ remote_ip, remote_port, laddr, ssh_local_port(ssh));
+ free(laddr);
/*
* We don't want to listen forever unless the other side
@@ -2070,7 +2219,7 @@
if (!debug_flag)
alarm(options.login_grace_time);
- sshd_exchange_identification(sock_in, sock_out);
+ sshd_exchange_identification(ssh, sock_in, sock_out);
/* In inetd mode, generate ephemeral key only for proto 1 connections */
if (!compat20 && inetd_flag && sensitive_data.server_key == NULL)
@@ -2093,8 +2242,12 @@
if (use_privsep) {
if (privsep_preauth(authctxt) == 1)
goto authenticated;
- } else if (compat20 && have_agent)
- auth_conn = ssh_get_authentication_connection();
+ } else if (compat20 && have_agent) {
+ if ((r = ssh_get_authentication_socket(&auth_sock)) != 0) {
+ error("Unable to get agent socket: %s", ssh_err(r));
+ have_agent = 0;
+ }
+ }
/* perform the key exchange */
/* authenticate user and start session */
@@ -2102,8 +2255,12 @@
do_ssh2_kex();
do_authentication2(authctxt);
} else {
+#ifdef WITH_SSH1
do_ssh1_kex();
do_authentication(authctxt);
+#else
+ fatal("ssh1 not supported");
+#endif
}
/*
* If we use privilege separation, the unprivileged child transfers
@@ -2159,12 +2316,15 @@
packet_set_timeout(options.client_alive_interval,
options.client_alive_count_max);
+ /* Try to send all our hostkeys to the client */
+ if (compat20)
+ notify_hostkeys(active_state);
+
/* Start session. */
do_authenticated(authctxt);
/* The connection has been terminated. */
- packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
- packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
+ packet_get_bytes(&ibytes, &obytes);
verbose("Transferred: sent %llu, received %llu bytes",
(unsigned long long)obytes, (unsigned long long)ibytes);
@@ -2187,6 +2347,7 @@
exit(0);
}
+#ifdef WITH_SSH1
/*
* Decrypt session_key_int using our private server key and private host key
* (key with larger modulus first).
@@ -2194,6 +2355,7 @@
int
ssh1_session_key(BIGNUM *session_key_int)
{
+ struct ssh *ssh = active_state; /* XXX */
int rsafail = 0;
if (BN_cmp(sensitive_data.server_key->rsa->n,
@@ -2202,18 +2364,18 @@
if (BN_num_bits(sensitive_data.server_key->rsa->n) <
BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) +
SSH_KEY_BITS_RESERVED) {
- fatal("do_connection: %s: "
+ fatal("do_connection: %s port %d: "
"server_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d",
- get_remote_ipaddr(),
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
BN_num_bits(sensitive_data.server_key->rsa->n),
BN_num_bits(sensitive_data.ssh1_host_key->rsa->n),
SSH_KEY_BITS_RESERVED);
}
if (rsa_private_decrypt(session_key_int, session_key_int,
- sensitive_data.server_key->rsa) <= 0)
+ sensitive_data.server_key->rsa) != 0)
rsafail++;
if (rsa_private_decrypt(session_key_int, session_key_int,
- sensitive_data.ssh1_host_key->rsa) <= 0)
+ sensitive_data.ssh1_host_key->rsa) != 0)
rsafail++;
} else {
/* Host key has bigger modulus (or they are equal). */
@@ -2220,22 +2382,23 @@
if (BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) <
BN_num_bits(sensitive_data.server_key->rsa->n) +
SSH_KEY_BITS_RESERVED) {
- fatal("do_connection: %s: "
+ fatal("do_connection: %s port %d: "
"host_key %d < server_key %d + SSH_KEY_BITS_RESERVED %d",
- get_remote_ipaddr(),
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
BN_num_bits(sensitive_data.ssh1_host_key->rsa->n),
BN_num_bits(sensitive_data.server_key->rsa->n),
SSH_KEY_BITS_RESERVED);
}
if (rsa_private_decrypt(session_key_int, session_key_int,
- sensitive_data.ssh1_host_key->rsa) < 0)
+ sensitive_data.ssh1_host_key->rsa) != 0)
rsafail++;
if (rsa_private_decrypt(session_key_int, session_key_int,
- sensitive_data.server_key->rsa) < 0)
+ sensitive_data.server_key->rsa) != 0)
rsafail++;
}
return (rsafail);
}
+
/*
* SSH1 key exchange
*/
@@ -2242,10 +2405,13 @@
static void
do_ssh1_kex(void)
{
+ struct ssh *ssh = active_state; /* XXX */
int i, len;
int rsafail = 0;
- BIGNUM *session_key_int;
+ BIGNUM *session_key_int, *fake_key_int, *real_key_int;
u_char session_key[SSH_SESSION_KEY_LENGTH];
+ u_char fake_key_bytes[4096 / 8];
+ size_t fake_key_len;
u_char cookie[8];
u_int cipher_type, auth_mask, protocol_flags;
@@ -2323,74 +2489,62 @@
debug("Encryption type: %.200s", cipher_name(cipher_type));
/* Get the encrypted integer. */
- if ((session_key_int = BN_new()) == NULL)
+ if ((real_key_int = BN_new()) == NULL)
fatal("do_ssh1_kex: BN_new failed");
- packet_get_bignum(session_key_int);
+ packet_get_bignum(real_key_int);
protocol_flags = packet_get_int();
packet_set_protocol_flags(protocol_flags);
packet_check_eom();
- /* Decrypt session_key_int using host/server keys */
- rsafail = PRIVSEP(ssh1_session_key(session_key_int));
+ /* Setup a fake key in case RSA decryption fails */
+ if ((fake_key_int = BN_new()) == NULL)
+ fatal("do_ssh1_kex: BN_new failed");
+ fake_key_len = BN_num_bytes(real_key_int);
+ if (fake_key_len > sizeof(fake_key_bytes))
+ fake_key_len = sizeof(fake_key_bytes);
+ arc4random_buf(fake_key_bytes, fake_key_len);
+ if (BN_bin2bn(fake_key_bytes, fake_key_len, fake_key_int) == NULL)
+ fatal("do_ssh1_kex: BN_bin2bn failed");
+ /* Decrypt real_key_int using host/server keys */
+ rsafail = PRIVSEP(ssh1_session_key(real_key_int));
+ /* If decryption failed, use the fake key. Else, the real key. */
+ if (rsafail)
+ session_key_int = fake_key_int;
+ else
+ session_key_int = real_key_int;
+
/*
* Extract session key from the decrypted integer. The key is in the
* least significant 256 bits of the integer; the first byte of the
* key is in the highest bits.
*/
- if (!rsafail) {
- (void) BN_mask_bits(session_key_int, sizeof(session_key) * 8);
- len = BN_num_bytes(session_key_int);
- if (len < 0 || (u_int)len > sizeof(session_key)) {
- error("do_ssh1_kex: bad session key len from %s: "
- "session_key_int %d > sizeof(session_key) %lu",
- get_remote_ipaddr(), len, (u_long)sizeof(session_key));
- rsafail++;
- } else {
- explicit_bzero(session_key, sizeof(session_key));
- BN_bn2bin(session_key_int,
- session_key + sizeof(session_key) - len);
+ (void) BN_mask_bits(session_key_int, sizeof(session_key) * 8);
+ len = BN_num_bytes(session_key_int);
+ if (len < 0 || (u_int)len > sizeof(session_key)) {
+ error("%s: bad session key len from %s port %d: "
+ "session_key_int %d > sizeof(session_key) %lu", __func__,
+ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
+ len, (u_long)sizeof(session_key));
+ rsafail++;
+ } else {
+ explicit_bzero(session_key, sizeof(session_key));
+ BN_bn2bin(session_key_int,
+ session_key + sizeof(session_key) - len);
- derive_ssh1_session_id(
- sensitive_data.ssh1_host_key->rsa->n,
- sensitive_data.server_key->rsa->n,
- cookie, session_id);
- /*
- * Xor the first 16 bytes of the session key with the
- * session id.
- */
- for (i = 0; i < 16; i++)
- session_key[i] ^= session_id[i];
- }
+ derive_ssh1_session_id(
+ sensitive_data.ssh1_host_key->rsa->n,
+ sensitive_data.server_key->rsa->n,
+ cookie, session_id);
+ /*
+ * Xor the first 16 bytes of the session key with the
+ * session id.
+ */
+ for (i = 0; i < 16; i++)
+ session_key[i] ^= session_id[i];
}
- if (rsafail) {
- int bytes = BN_num_bytes(session_key_int);
- u_char *buf = xmalloc(bytes);
- struct ssh_digest_ctx *md;
- logit("do_connection: generating a fake encryption key");
- BN_bn2bin(session_key_int, buf);
- if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL ||
- ssh_digest_update(md, buf, bytes) < 0 ||
- ssh_digest_update(md, sensitive_data.ssh1_cookie,
- SSH_SESSION_KEY_LENGTH) < 0 ||
- ssh_digest_final(md, session_key, sizeof(session_key)) < 0)
- fatal("%s: md5 failed", __func__);
- ssh_digest_free(md);
- if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL ||
- ssh_digest_update(md, session_key, 16) < 0 ||
- ssh_digest_update(md, sensitive_data.ssh1_cookie,
- SSH_SESSION_KEY_LENGTH) < 0 ||
- ssh_digest_final(md, session_key + 16,
- sizeof(session_key) - 16) < 0)
- fatal("%s: md5 failed", __func__);
- ssh_digest_free(md);
- explicit_bzero(buf, bytes);
- free(buf);
- for (i = 0; i < 16; i++)
- session_id[i] = session_key[i] ^ session_key[i + 16];
- }
/* Destroy the private and public keys. No longer. */
destroy_sensitive_data();
@@ -2398,7 +2552,8 @@
mm_ssh1_session_id(session_id);
/* Destroy the decrypted integer. It is no longer needed. */
- BN_clear_free(session_key_int);
+ BN_clear_free(real_key_int);
+ BN_clear_free(fake_key_int);
/* Set the session key. From this on all communications will be encrypted. */
packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, cipher_type);
@@ -2413,57 +2568,64 @@
packet_send();
packet_write_wait();
}
+#endif
-void
-sshd_hostkey_sign(Key *privkey, Key *pubkey, u_char **signature, u_int *slen,
- u_char *data, u_int dlen)
+int
+sshd_hostkey_sign(Key *privkey, Key *pubkey, u_char **signature, size_t *slen,
+ const u_char *data, size_t dlen, const char *alg, u_int flag)
{
+ int r;
+ u_int xxx_slen, xxx_dlen = dlen;
+
if (privkey) {
- if (PRIVSEP(key_sign(privkey, signature, slen, data, dlen) < 0))
+ if (PRIVSEP(key_sign(privkey, signature, &xxx_slen, data, xxx_dlen,
+ alg) < 0))
fatal("%s: key_sign failed", __func__);
+ if (slen)
+ *slen = xxx_slen;
} else if (use_privsep) {
- if (mm_key_sign(pubkey, signature, slen, data, dlen) < 0)
+ if (mm_key_sign(pubkey, signature, &xxx_slen, data, xxx_dlen,
+ alg) < 0)
fatal("%s: pubkey_sign failed", __func__);
+ if (slen)
+ *slen = xxx_slen;
} else {
- if (ssh_agent_sign(auth_conn, pubkey, signature, slen, data,
- dlen))
- fatal("%s: ssh_agent_sign failed", __func__);
+ if ((r = ssh_agent_sign(auth_sock, pubkey, signature, slen,
+ data, dlen, alg, datafellows)) != 0)
+ fatal("%s: ssh_agent_sign failed: %s",
+ __func__, ssh_err(r));
}
+ return 0;
}
-/*
- * SSH2 key exchange: diffie-hellman-group1-sha1
- */
+/* SSH2 key exchange */
static void
do_ssh2_kex(void)
{
- Kex *kex;
+ char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
+ struct kex *kex;
+ int r;
- if (options.ciphers != NULL) {
- myproposal[PROPOSAL_ENC_ALGS_CTOS] =
- myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
- }
- myproposal[PROPOSAL_ENC_ALGS_CTOS] =
- compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
- myproposal[PROPOSAL_ENC_ALGS_STOC] =
- compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+ options.kex_algorithms);
+ myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal(
+ options.ciphers);
+ myproposal[PROPOSAL_ENC_ALGS_STOC] = compat_cipher_proposal(
+ options.ciphers);
+ myproposal[PROPOSAL_MAC_ALGS_CTOS] =
+ myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
- if (options.macs != NULL) {
- myproposal[PROPOSAL_MAC_ALGS_CTOS] =
- myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
- }
if (options.compression == COMP_NONE) {
myproposal[PROPOSAL_COMP_ALGS_CTOS] =
- myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
+ myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
} else if (options.compression == COMP_DELAYED) {
myproposal[PROPOSAL_COMP_ALGS_CTOS] =
- myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib at openssh.com";
+ myproposal[PROPOSAL_COMP_ALGS_STOC] =
+ "none,zlib at openssh.com";
}
- if (options.kex_algorithms != NULL)
- myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
if (options.rekey_limit || options.rekey_interval)
- packet_set_rekey_limits((u_int32_t)options.rekey_limit,
+ packet_set_rekey_limits(options.rekey_limit,
(time_t)options.rekey_interval);
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
@@ -2470,12 +2632,21 @@
list_hostkey_types());
/* start key exchange */
- kex = kex_setup(myproposal);
+ if ((r = kex_setup(active_state, myproposal)) != 0)
+ fatal("kex_setup: %s", ssh_err(r));
+ kex = active_state->kex;
+#ifdef WITH_OPENSSL
kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
+ kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
+ kex->kex[KEX_DH_GRP16_SHA512] = kexdh_server;
+ kex->kex[KEX_DH_GRP18_SHA512] = kexdh_server;
kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
+# ifdef OPENSSL_HAS_ECC
kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+# endif
+#endif
kex->kex[KEX_C25519_SHA256] = kexc25519_server;
kex->server = 1;
kex->client_version_string=client_version_string;
@@ -2485,10 +2656,8 @@
kex->host_key_index=&get_hostkey_index;
kex->sign = sshd_hostkey_sign;
- xxx_kex = kex;
+ dispatch_run(DISPATCH_BLOCK, &kex->done, active_state);
- dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-
session_id2 = kex->session_id;
session_id2_len = kex->session_id_len;
@@ -2508,7 +2677,8 @@
{
if (the_authctxt) {
do_cleanup(the_authctxt);
- if (use_privsep && privsep_is_preauth && pmonitor->m_pid > 1) {
+ if (use_privsep && privsep_is_preauth &&
+ pmonitor != NULL && pmonitor->m_pid > 1) {
debug("Killing privsep child %d", pmonitor->m_pid);
if (kill(pmonitor->m_pid, SIGKILL) != 0 &&
errno != ESRCH)
Modified: trunk/crypto/openssh/sshd_config
===================================================================
--- trunk/crypto/openssh/sshd_config 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshd_config 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-# $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $
+# $OpenBSD: sshd_config,v 1.99 2016/07/11 03:19:44 tedu Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
@@ -34,7 +34,6 @@
#RekeyLimit default none
# Logging
-# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO
@@ -41,7 +40,7 @@
# Authentication:
#LoginGraceTime 2m
-#PermitRootLogin yes
+#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
@@ -107,12 +106,12 @@
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
-UsePrivilegeSeparation sandbox # Default for new installations.
+#UsePrivilegeSeparation sandbox
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
-#UseDNS yes
+#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
Modified: trunk/crypto/openssh/sshd_config.0
===================================================================
--- trunk/crypto/openssh/sshd_config.0 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshd_config.0 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,7 +1,7 @@
-SSHD_CONFIG(5) OpenBSD Programmer's Manual SSHD_CONFIG(5)
+SSHD_CONFIG(5) File Formats Manual SSHD_CONFIG(5)
NAME
- sshd_config - OpenSSH SSH daemon configuration file
+ sshd_config M-bM-^@M-^S OpenSSH SSH daemon configuration file
SYNOPSIS
/etc/ssh/sshd_config
@@ -9,7 +9,7 @@
DESCRIPTION
sshd(8) reads configuration data from /etc/ssh/sshd_config (or the file
specified with -f on the command line). The file contains keyword-
- argument pairs, one per line. Lines starting with `#' and empty lines
+ argument pairs, one per line. Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines
are interpreted as comments. Arguments may optionally be enclosed in
double quotes (") in order to represent arguments containing spaces.
@@ -19,10 +19,11 @@
AcceptEnv
Specifies what environment variables sent by the client will be
copied into the session's environ(7). See SendEnv in
- ssh_config(5) for how to configure the client. Note that
- environment passing is only supported for protocol 2. Variables
+ ssh_config(5) for how to configure the client. The TERM
+ environment variable is always sent whenever the client requests
+ a pseudo-terminal as it is required by the protocol. Variables
are specified by name, which may contain the wildcard characters
- `*' and `?'. Multiple environment variables may be separated by
+ M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y. Multiple environment variables may be separated by
whitespace or spread across multiple AcceptEnv directives. Be
warned that some environment variables could be used to bypass
restricted user environments. For this reason, care should be
@@ -31,14 +32,14 @@
AddressFamily
Specifies which address family should be used by sshd(8). Valid
- arguments are ``any'', ``inet'' (use IPv4 only), or ``inet6''
- (use IPv6 only). The default is ``any''.
+ arguments are M-bM-^@M-^\anyM-bM-^@M-^], M-bM-^@M-^\inetM-bM-^@M-^] (use IPv4 only), or M-bM-^@M-^\inet6M-bM-^@M-^] (use IPv6
+ only). The default is M-bM-^@M-^\anyM-bM-^@M-^].
AllowAgentForwarding
Specifies whether ssh-agent(1) forwarding is permitted. The
- default is ``yes''. Note that disabling agent forwarding does
- not improve security unless users are also denied shell access,
- as they can always install their own forwarders.
+ default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that disabling agent forwarding does not
+ improve security unless users are also denied shell access, as
+ they can always install their own forwarders.
AllowGroups
This keyword can be followed by a list of group name patterns,
@@ -54,14 +55,24 @@
AllowTcpForwarding
Specifies whether TCP forwarding is permitted. The available
- options are ``yes'' or ``all'' to allow TCP forwarding, ``no'' to
- prevent all TCP forwarding, ``local'' to allow local (from the
- perspective of ssh(1)) forwarding only or ``remote'' to allow
- remote forwarding only. The default is ``yes''. Note that
+ options are M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\allM-bM-^@M-^] to allow TCP forwarding, M-bM-^@M-^\noM-bM-^@M-^] to
+ prevent all TCP forwarding, M-bM-^@M-^\localM-bM-^@M-^] to allow local (from the
+ perspective of ssh(1)) forwarding only or M-bM-^@M-^\remoteM-bM-^@M-^] to allow
+ remote forwarding only. The default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that
disabling TCP forwarding does not improve security unless users
are also denied shell access, as they can always install their
own forwarders.
+ AllowStreamLocalForwarding
+ Specifies whether StreamLocal (Unix-domain socket) forwarding is
+ permitted. The available options are M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\allM-bM-^@M-^] to allow
+ StreamLocal forwarding, M-bM-^@M-^\noM-bM-^@M-^] to prevent all StreamLocal
+ forwarding, M-bM-^@M-^\localM-bM-^@M-^] to allow local (from the perspective of
+ ssh(1)) forwarding only or M-bM-^@M-^\remoteM-bM-^@M-^] to allow remote forwarding
+ only. The default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that disabling StreamLocal
+ forwarding does not improve security unless users are also denied
+ shell access, as they can always install their own forwarders.
+
AllowUsers
This keyword can be followed by a list of user name patterns,
separated by spaces. If specified, login is allowed only for
@@ -69,9 +80,11 @@
valid; a numerical user ID is not recognized. By default, login
is allowed for all users. If the pattern takes the form
USER at HOST then USER and HOST are separately checked, restricting
- logins to particular users from particular hosts. The allow/deny
- directives are processed in the following order: DenyUsers,
- AllowUsers, DenyGroups, and finally AllowGroups.
+ logins to particular users from particular hosts. HOST criteria
+ may additionally contain addresses to match in CIDR
+ address/masklen format. The allow/deny directives are processed
+ in the following order: DenyUsers, AllowUsers, DenyGroups, and
+ finally AllowGroups.
See PATTERNS in ssh_config(5) for more information on patterns.
@@ -79,11 +92,14 @@
Specifies the authentication methods that must be successfully
completed for a user to be granted access. This option must be
followed by one or more comma-separated lists of authentication
- method names. Successful authentication requires completion of
- every method in at least one of these lists.
+ method names, or by the single string M-bM-^@M-^\anyM-bM-^@M-^] to indicate the
+ default behaviour of accepting any single authentication method.
+ if the default is overridden, then successful authentication
+ requires completion of every method in at least one of these
+ lists.
- For example, an argument of ``publickey,password
- publickey,keyboard-interactive'' would require the user to
+ For example, an argument of M-bM-^@M-^\publickey,password
+ publickey,keyboard-interactiveM-bM-^@M-^] would require the user to
complete public key authentication, followed by either password
or keyboard interactive authentication. Only methods that are
next in one or more lists are offered at each stage, so for this
@@ -92,34 +108,51 @@
For keyboard interactive authentication it is also possible to
restrict authentication to a specific device by appending a colon
- followed by the device identifier ``bsdauth'', ``pam'', or
- ``skey'', depending on the server configuration. For example,
- ``keyboard-interactive:bsdauth'' would restrict keyboard
- interactive authentication to the ``bsdauth'' device.
+ followed by the device identifier M-bM-^@M-^\bsdauthM-bM-^@M-^], M-bM-^@M-^\pamM-bM-^@M-^], or M-bM-^@M-^\skeyM-bM-^@M-^],
+ depending on the server configuration. For example,
+ M-bM-^@M-^\keyboard-interactive:bsdauthM-bM-^@M-^] would restrict keyboard
+ interactive authentication to the M-bM-^@M-^\bsdauthM-bM-^@M-^] device.
- This option is only available for SSH protocol 2 and will yield a
- fatal error if enabled if protocol 1 is also enabled. Note that
- each authentication method listed should also be explicitly
- enabled in the configuration. The default is not to require
- multiple authentication; successful completion of a single
- authentication method is sufficient.
+ If the M-bM-^@M-^\publickeyM-bM-^@M-^] method is listed more than once, sshd(8)
+ verifies that keys that have been used successfully are not
+ reused for subsequent authentications. For example, an
+ AuthenticationMethods of M-bM-^@M-^\publickey,publickeyM-bM-^@M-^] will require
+ successful authentication using two different public keys.
+ This option will yield a fatal error if enabled if protocol 1 is
+ also enabled. Note that each authentication method listed should
+ also be explicitly enabled in the configuration. The default
+ M-bM-^@M-^\anyM-bM-^@M-^] is not to require multiple authentication; successful
+ completion of a single authentication method is sufficient.
+
AuthorizedKeysCommand
Specifies a program to be used to look up the user's public keys.
- The program must be owned by root and not writable by group or
- others. It will be invoked with a single argument of the
- username being authenticated, and should produce on standard
- output zero or more lines of authorized_keys output (see
- AUTHORIZED_KEYS in sshd(8)). If a key supplied by
- AuthorizedKeysCommand does not successfully authenticate and
- authorize the user then public key authentication continues using
- the usual AuthorizedKeysFile files. By default, no
- AuthorizedKeysCommand is run.
+ The program must be owned by root, not writable by group or
+ others and specified by an absolute path.
+ Arguments to AuthorizedKeysCommand may be provided using the
+ following tokens, which will be expanded at runtime: %% is
+ replaced by a literal '%', %u is replaced by the username being
+ authenticated, %h is replaced by the home directory of the user
+ being authenticated, %t is replaced with the key type offered for
+ authentication, %f is replaced with the fingerprint of the key,
+ and %k is replaced with the key being offered for authentication.
+ If no arguments are specified then the username of the target
+ user will be supplied.
+
+ The program should produce on standard output zero or more lines
+ of authorized_keys output (see AUTHORIZED_KEYS in sshd(8)). If a
+ key supplied by AuthorizedKeysCommand does not successfully
+ authenticate and authorize the user then public key
+ authentication continues using the usual AuthorizedKeysFile
+ files. By default, no AuthorizedKeysCommand is run.
+
AuthorizedKeysCommandUser
Specifies the user under whose account the AuthorizedKeysCommand
is run. It is recommended to use a dedicated user that has no
- other role on the host than running authorized keys commands.
+ other role on the host than running authorized keys commands. If
+ AuthorizedKeysCommand is specified but AuthorizedKeysCommandUser
+ is not, then sshd(8) will refuse to start.
AuthorizedKeysFile
Specifies the file that contains the public keys that can be used
@@ -132,9 +165,37 @@
replaced by the username of that user. After expansion,
AuthorizedKeysFile is taken to be an absolute path or one
relative to the user's home directory. Multiple files may be
- listed, separated by whitespace. The default is
- ``.ssh/authorized_keys .ssh/authorized_keys2''.
+ listed, separated by whitespace. Alternately this option may be
+ set to M-bM-^@M-^\noneM-bM-^@M-^] to skip checking for user keys in files. The
+ default is M-bM-^@M-^\.ssh/authorized_keys .ssh/authorized_keys2M-bM-^@M-^].
+ AuthorizedPrincipalsCommand
+ Specifies a program to be used to generate the list of allowed
+ certificate principals as per AuthorizedPrincipalsFile. The
+ program must be owned by root, not writable by group or others
+ and specified by an absolute path.
+
+ Arguments to AuthorizedPrincipalsCommand may be provided using
+ the following tokens, which will be expanded at runtime: %% is
+ replaced by a literal '%', %u is replaced by the username being
+ authenticated and %h is replaced by the home directory of the
+ user being authenticated.
+
+ The program should produce on standard output zero or more lines
+ of AuthorizedPrincipalsFile output. If either
+ AuthorizedPrincipalsCommand or AuthorizedPrincipalsFile is
+ specified, then certificates offered by the client for
+ authentication must contain a principal that is listed. By
+ default, no AuthorizedPrincipalsCommand is run.
+
+ AuthorizedPrincipalsCommandUser
+ Specifies the user under whose account the
+ AuthorizedPrincipalsCommand is run. It is recommended to use a
+ dedicated user that has no other role on the host than running
+ authorized principals commands. If AuthorizedPrincipalsCommand
+ is specified but AuthorizedPrincipalsCommandUser is not, then
+ sshd(8) will refuse to start.
+
AuthorizedPrincipalsFile
Specifies a file that lists principal names that are accepted for
certificate authentication. When using certificates signed by a
@@ -142,7 +203,7 @@
which must appear in the certificate for it to be accepted for
authentication. Names are listed one per line preceded by key
options (as described in AUTHORIZED_KEYS FILE FORMAT in sshd(8)).
- Empty lines and comments starting with `#' are ignored.
+ Empty lines and comments starting with M-bM-^@M-^X#M-bM-^@M-^Y are ignored.
AuthorizedPrincipalsFile may contain tokens of the form %T which
are substituted during connection setup. The following tokens
@@ -152,7 +213,7 @@
AuthorizedPrincipalsFile is taken to be an absolute path or one
relative to the user's home directory.
- The default is ``none'', i.e. not to use a principals file - in
+ The default is M-bM-^@M-^\noneM-bM-^@M-^], i.e. not to use a principals file M-bM-^@M-^S in
this case, the username of the user must appear in a
certificate's principals list for it to be accepted. Note that
AuthorizedPrincipalsFile is only used when authentication
@@ -162,21 +223,21 @@
a similar facility (see sshd(8) for details).
Banner The contents of the specified file are sent to the remote user
- before authentication is allowed. If the argument is ``none''
- then no banner is displayed. This option is only available for
- protocol version 2. By default, no banner is displayed.
+ before authentication is allowed. If the argument is M-bM-^@M-^\noneM-bM-^@M-^] then
+ no banner is displayed. By default, no banner is displayed.
ChallengeResponseAuthentication
Specifies whether challenge-response authentication is allowed
- (e.g. via PAM or though authentication styles supported in
- login.conf(5)) The default is ``yes''.
+ (e.g. via PAM or through authentication styles supported in
+ login.conf(5)) The default is M-bM-^@M-^\yesM-bM-^@M-^].
ChrootDirectory
Specifies the pathname of a directory to chroot(2) to after
- authentication. All components of the pathname must be root-
- owned directories that are not writable by any other user or
- group. After the chroot, sshd(8) changes the working directory
- to the user's home directory.
+ authentication. At session startup sshd(8) checks that all
+ components of the pathname are root-owned directories which are
+ not writable by any other user or group. After the chroot,
+ sshd(8) changes the working directory to the user's home
+ directory.
The pathname may contain the following tokens that are expanded
at runtime once the connecting user has been authenticated: %% is
@@ -188,34 +249,52 @@
directories to support the user's session. For an interactive
session this requires at least a shell, typically sh(1), and
basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4),
- stderr(4), arandom(4) and tty(4) devices. For file transfer
- sessions using ``sftp'', no additional configuration of the
- environment is necessary if the in-process sftp server is used,
- though sessions which use logging do require /dev/log inside the
- chroot directory (see sftp-server(8) for details).
+ stderr(4), and tty(4) devices. For file transfer sessions using
+ M-bM-^@M-^\sftpM-bM-^@M-^], no additional configuration of the environment is
+ necessary if the in-process sftp server is used, though sessions
+ which use logging may require /dev/log inside the chroot
+ directory on some operating systems (see sftp-server(8) for
+ details).
- The default is not to chroot(2).
+ For safety, it is very important that the directory hierarchy be
+ prevented from modification by other processes on the system
+ (especially those outside the jail). Misconfiguration can lead
+ to unsafe environments which sshd(8) cannot detect.
+ The default is M-bM-^@M-^\noneM-bM-^@M-^], indicating not to chroot(2).
+
Ciphers
- Specifies the ciphers allowed for protocol version 2. Multiple
- ciphers must be comma-separated. The supported ciphers are:
+ Specifies the ciphers allowed. Multiple ciphers must be comma-
+ separated. If the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character,
+ then the specified ciphers will be appended to the default set
+ instead of replacing them.
- ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
- ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'',
- ``aes128-gcm at openssh.com'', ``aes256-gcm at openssh.com'',
- ``arcfour128'', ``arcfour256'', ``arcfour'', ``blowfish-cbc'',
- ``cast128-cbc'', and ``chacha20-poly1305 at openssh.com''.
+ The supported ciphers are:
+ 3des-cbc
+ aes128-cbc
+ aes192-cbc
+ aes256-cbc
+ aes128-ctr
+ aes192-ctr
+ aes256-ctr
+ aes128-gcm at openssh.com
+ aes256-gcm at openssh.com
+ arcfour
+ arcfour128
+ arcfour256
+ blowfish-cbc
+ cast128-cbc
+ chacha20-poly1305 at openssh.com
+
The default is:
- aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
- aes128-gcm at openssh.com,aes256-gcm at openssh.com,
- chacha20-poly1305 at openssh.com,
- aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
- aes256-cbc,arcfour
+ chacha20-poly1305 at openssh.com,
+ aes128-ctr,aes192-ctr,aes256-ctr,
+ aes128-gcm at openssh.com,aes256-gcm at openssh.com
The list of available ciphers may also be obtained using the -Q
- option of ssh(1).
+ option of ssh(1) with an argument of M-bM-^@M-^\cipherM-bM-^@M-^].
ClientAliveCountMax
Sets the number of client alive messages (see below) which may be
@@ -233,7 +312,7 @@
The default value is 3. If ClientAliveInterval (see below) is
set to 15, and ClientAliveCountMax is left at the default,
unresponsive SSH clients will be disconnected after approximately
- 45 seconds. This option applies to protocol version 2 only.
+ 45 seconds.
ClientAliveInterval
Sets a timeout interval in seconds after which if no data has
@@ -240,13 +319,12 @@
been received from the client, sshd(8) will send a message
through the encrypted channel to request a response from the
client. The default is 0, indicating that these messages will
- not be sent to the client. This option applies to protocol
- version 2 only.
+ not be sent to the client.
Compression
Specifies whether compression is allowed, or delayed until the
- user has authenticated successfully. The argument must be
- ``yes'', ``delayed'', or ``no''. The default is ``delayed''.
+ user has authenticated successfully. The argument must be M-bM-^@M-^\yesM-bM-^@M-^],
+ M-bM-^@M-^\delayedM-bM-^@M-^], or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\delayedM-bM-^@M-^].
DenyGroups
This keyword can be followed by a list of group name patterns,
@@ -266,12 +344,18 @@
numerical user ID is not recognized. By default, login is
allowed for all users. If the pattern takes the form USER at HOST
then USER and HOST are separately checked, restricting logins to
- particular users from particular hosts. The allow/deny
- directives are processed in the following order: DenyUsers,
- AllowUsers, DenyGroups, and finally AllowGroups.
+ particular users from particular hosts. HOST criteria may
+ additionally contain addresses to match in CIDR address/masklen
+ format. The allow/deny directives are processed in the following
+ order: DenyUsers, AllowUsers, DenyGroups, and finally
+ AllowGroups.
See PATTERNS in ssh_config(5) for more information on patterns.
+ FingerprintHash
+ Specifies the hash algorithm used when logging key fingerprints.
+ Valid options are: M-bM-^@M-^\md5M-bM-^@M-^] and M-bM-^@M-^\sha256M-bM-^@M-^]. The default is M-bM-^@M-^\sha256M-bM-^@M-^].
+
ForceCommand
Forces the execution of the command specified by ForceCommand,
ignoring any command supplied by the client and ~/.ssh/rc if
@@ -280,9 +364,9 @@
execution. It is most useful inside a Match block. The command
originally supplied by the client is available in the
SSH_ORIGINAL_COMMAND environment variable. Specifying a command
- of ``internal-sftp'' will force the use of an in-process sftp
+ of M-bM-^@M-^\internal-sftpM-bM-^@M-^] will force the use of an in-process sftp
server that requires no support files when used with
- ChrootDirectory.
+ ChrootDirectory. The default is M-bM-^@M-^\noneM-bM-^@M-^].
GatewayPorts
Specifies whether remote hosts are allowed to connect to ports
@@ -291,37 +375,59 @@
hosts from connecting to forwarded ports. GatewayPorts can be
used to specify that sshd should allow remote port forwardings to
bind to non-loopback addresses, thus allowing other hosts to
- connect. The argument may be ``no'' to force remote port
- forwardings to be available to the local host only, ``yes'' to
+ connect. The argument may be M-bM-^@M-^\noM-bM-^@M-^] to force remote port
+ forwardings to be available to the local host only, M-bM-^@M-^\yesM-bM-^@M-^] to
force remote port forwardings to bind to the wildcard address, or
- ``clientspecified'' to allow the client to select the address to
- which the forwarding is bound. The default is ``no''.
+ M-bM-^@M-^\clientspecifiedM-bM-^@M-^] to allow the client to select the address to
+ which the forwarding is bound. The default is M-bM-^@M-^\noM-bM-^@M-^].
GSSAPIAuthentication
Specifies whether user authentication based on GSSAPI is allowed.
- The default is ``no''. Note that this option applies to protocol
- version 2 only.
+ The default is M-bM-^@M-^\noM-bM-^@M-^].
GSSAPICleanupCredentials
Specifies whether to automatically destroy the user's credentials
- cache on logout. The default is ``yes''. Note that this option
- applies to protocol version 2 only.
+ cache on logout. The default is M-bM-^@M-^\yesM-bM-^@M-^].
+ GSSAPIStrictAcceptorCheck
+ Determines whether to be strict about the identity of the GSSAPI
+ acceptor a client authenticates against. If set to M-bM-^@M-^\yesM-bM-^@M-^] then
+ the client must authenticate against the host service on the
+ current hostname. If set to M-bM-^@M-^\noM-bM-^@M-^] then the client may
+ authenticate against any service key stored in the machine's
+ default store. This facility is provided to assist with
+ operation on multi homed machines. The default is M-bM-^@M-^\yesM-bM-^@M-^].
+
+ HostbasedAcceptedKeyTypes
+ Specifies the key types that will be accepted for hostbased
+ authentication as a comma-separated pattern list. Alternately if
+ the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the
+ specified key types will be appended to the default set instead
+ of replacing them. The default for this option is:
+
+ ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ ssh-ed25519-cert-v01 at openssh.com,
+ ssh-rsa-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ ssh-ed25519,ssh-rsa
+
+ The -Q option of ssh(1) may be used to list supported key types.
+
HostbasedAuthentication
Specifies whether rhosts or /etc/hosts.equiv authentication
together with successful public key client host authentication is
- allowed (host-based authentication). This option is similar to
- RhostsRSAAuthentication and applies to protocol version 2 only.
- The default is ``no''.
+ allowed (host-based authentication). The default is M-bM-^@M-^\noM-bM-^@M-^].
HostbasedUsesNameFromPacketOnly
Specifies whether or not the server will attempt to perform a
reverse name lookup when matching the name in the ~/.shosts,
~/.rhosts, and /etc/hosts.equiv files during
- HostbasedAuthentication. A setting of ``yes'' means that sshd(8)
+ HostbasedAuthentication. A setting of M-bM-^@M-^\yesM-bM-^@M-^] means that sshd(8)
uses the name supplied by the client rather than attempting to
resolve the name from the TCP connection itself. The default is
- ``no''.
+ M-bM-^@M-^\noM-bM-^@M-^].
HostCertificate
Specifies a file containing a public host certificate. The
@@ -334,51 +440,69 @@
default is /etc/ssh/ssh_host_key for protocol version 1, and
/etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_ecdsa_key,
/etc/ssh/ssh_host_ed25519_key and /etc/ssh/ssh_host_rsa_key for
- protocol version 2. Note that sshd(8) will refuse to use a file
- if it is group/world-accessible. It is possible to have multiple
- host key files. ``rsa1'' keys are used for version 1 and
- ``dsa'', ``ecdsa'', ``ed25519'' or ``rsa'' are used for version 2
- of the SSH protocol. It is also possible to specify public host
- key files instead. In this case operations on the private key
- will be delegated to an ssh-agent(1).
+ protocol version 2.
+ Note that sshd(8) will refuse to use a file if it is group/world-
+ accessible and that the HostKeyAlgorithms option restricts which
+ of the keys are actually used by sshd(8).
+
+ It is possible to have multiple host key files. M-bM-^@M-^\rsa1M-bM-^@M-^] keys are
+ used for version 1 and M-bM-^@M-^\dsaM-bM-^@M-^], M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ed25519M-bM-^@M-^] or M-bM-^@M-^\rsaM-bM-^@M-^] are
+ used for version 2 of the SSH protocol. It is also possible to
+ specify public host key files instead. In this case operations
+ on the private key will be delegated to an ssh-agent(1).
+
HostKeyAgent
Identifies the UNIX-domain socket used to communicate with an
- agent that has access to the private host keys. If
- ``SSH_AUTH_SOCK'' is specified, the location of the socket will
- be read from the SSH_AUTH_SOCK environment variable.
+ agent that has access to the private host keys. If the string
+ M-bM-^@M-^\SSH_AUTH_SOCKM-bM-^@M-^] is specified, the location of the socket will be
+ read from the SSH_AUTH_SOCK environment variable.
+ HostKeyAlgorithms
+ Specifies the host key algorithms that the server offers. The
+ default for this option is:
+
+ ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ ssh-ed25519-cert-v01 at openssh.com,
+ ssh-rsa-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ ssh-ed25519,ssh-rsa
+
+ The list of available key types may also be obtained using the -Q
+ option of ssh(1) with an argument of M-bM-^@M-^\keyM-bM-^@M-^].
+
IgnoreRhosts
Specifies that .rhosts and .shosts files will not be used in
RhostsRSAAuthentication or HostbasedAuthentication.
/etc/hosts.equiv and /etc/shosts.equiv are still used. The
- default is ``yes''.
+ default is M-bM-^@M-^\yesM-bM-^@M-^].
IgnoreUserKnownHosts
Specifies whether sshd(8) should ignore the user's
~/.ssh/known_hosts during RhostsRSAAuthentication or
- HostbasedAuthentication. The default is ``no''.
+ HostbasedAuthentication. The default is M-bM-^@M-^\noM-bM-^@M-^].
IPQoS Specifies the IPv4 type-of-service or DSCP class for the
- connection. Accepted values are ``af11'', ``af12'', ``af13'',
- ``af21'', ``af22'', ``af23'', ``af31'', ``af32'', ``af33'',
- ``af41'', ``af42'', ``af43'', ``cs0'', ``cs1'', ``cs2'', ``cs3'',
- ``cs4'', ``cs5'', ``cs6'', ``cs7'', ``ef'', ``lowdelay'',
- ``throughput'', ``reliability'', or a numeric value. This option
- may take one or two arguments, separated by whitespace. If one
- argument is specified, it is used as the packet class
- unconditionally. If two values are specified, the first is
- automatically selected for interactive sessions and the second
- for non-interactive sessions. The default is ``lowdelay'' for
- interactive sessions and ``throughput'' for non-interactive
+ connection. Accepted values are M-bM-^@M-^\af11M-bM-^@M-^], M-bM-^@M-^\af12M-bM-^@M-^], M-bM-^@M-^\af13M-bM-^@M-^], M-bM-^@M-^\af21M-bM-^@M-^],
+ M-bM-^@M-^\af22M-bM-^@M-^], M-bM-^@M-^\af23M-bM-^@M-^], M-bM-^@M-^\af31M-bM-^@M-^], M-bM-^@M-^\af32M-bM-^@M-^], M-bM-^@M-^\af33M-bM-^@M-^], M-bM-^@M-^\af41M-bM-^@M-^], M-bM-^@M-^\af42M-bM-^@M-^], M-bM-^@M-^\af43M-bM-^@M-^],
+ M-bM-^@M-^\cs0M-bM-^@M-^], M-bM-^@M-^\cs1M-bM-^@M-^], M-bM-^@M-^\cs2M-bM-^@M-^], M-bM-^@M-^\cs3M-bM-^@M-^], M-bM-^@M-^\cs4M-bM-^@M-^], M-bM-^@M-^\cs5M-bM-^@M-^], M-bM-^@M-^\cs6M-bM-^@M-^], M-bM-^@M-^\cs7M-bM-^@M-^], M-bM-^@M-^\efM-bM-^@M-^],
+ M-bM-^@M-^\lowdelayM-bM-^@M-^], M-bM-^@M-^\throughputM-bM-^@M-^], M-bM-^@M-^\reliabilityM-bM-^@M-^], or a numeric value.
+ This option may take one or two arguments, separated by
+ whitespace. If one argument is specified, it is used as the
+ packet class unconditionally. If two values are specified, the
+ first is automatically selected for interactive sessions and the
+ second for non-interactive sessions. The default is M-bM-^@M-^\lowdelayM-bM-^@M-^]
+ for interactive sessions and M-bM-^@M-^\throughputM-bM-^@M-^] for non-interactive
sessions.
KbdInteractiveAuthentication
Specifies whether to allow keyboard-interactive authentication.
- The argument to this keyword must be ``yes'' or ``no''. The
- default is to use whatever value ChallengeResponseAuthentication
- is set to (by default ``yes'').
+ The argument to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default
+ is to use whatever value ChallengeResponseAuthentication is set
+ to (by default M-bM-^@M-^\yesM-bM-^@M-^]).
KerberosAuthentication
Specifies whether the password provided by the user for
@@ -385,33 +509,48 @@
PasswordAuthentication will be validated through the Kerberos
KDC. To use this option, the server needs a Kerberos servtab
which allows the verification of the KDC's identity. The default
- is ``no''.
+ is M-bM-^@M-^\noM-bM-^@M-^].
KerberosGetAFSToken
If AFS is active and the user has a Kerberos 5 TGT, attempt to
acquire an AFS token before accessing the user's home directory.
- The default is ``no''.
+ The default is M-bM-^@M-^\noM-bM-^@M-^].
KerberosOrLocalPasswd
If password authentication through Kerberos fails then the
password will be validated via any additional local mechanism
- such as /etc/passwd. The default is ``yes''.
+ such as /etc/passwd. The default is M-bM-^@M-^\yesM-bM-^@M-^].
KerberosTicketCleanup
Specifies whether to automatically destroy the user's ticket
- cache file on logout. The default is ``yes''.
+ cache file on logout. The default is M-bM-^@M-^\yesM-bM-^@M-^].
KexAlgorithms
Specifies the available KEX (Key Exchange) algorithms. Multiple
- algorithms must be comma-separated. The default is
+ algorithms must be comma-separated. Alternately if the specified
+ value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified methods
+ will be appended to the default set instead of replacing them.
+ The supported algorithms are:
+ curve25519-sha256 at libssh.org
+ diffie-hellman-group1-sha1
+ diffie-hellman-group14-sha1
+ diffie-hellman-group-exchange-sha1
+ diffie-hellman-group-exchange-sha256
+ ecdh-sha2-nistp256
+ ecdh-sha2-nistp384
+ ecdh-sha2-nistp521
+
+ The default is:
+
curve25519-sha256 at libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
- diffie-hellman-group-exchange-sha1,
- diffie-hellman-group14-sha1,
- diffie-hellman-group1-sha1
+ diffie-hellman-group14-sha1
+ The list of available key exchange algorithms may also be
+ obtained using the -Q option of ssh(1) with an argument of M-bM-^@M-^\kexM-bM-^@M-^].
+
KeyRegenerationInterval
In protocol version 1, the ephemeral server key is automatically
regenerated after this many seconds (if it has been used). The
@@ -429,10 +568,8 @@
ListenAddress [host|IPv6_addr]:port
If port is not specified, sshd will listen on the address and all
- prior Port options specified. The default is to listen on all
- local addresses. Multiple ListenAddress options are permitted.
- Additionally, any Port options must precede this option for non-
- port qualified addresses.
+ Port options specified. The default is to listen on all local
+ addresses. Multiple ListenAddress options are permitted.
LoginGraceTime
The server disconnects after this time if the user has not
@@ -448,27 +585,52 @@
violates the privacy of users and is not recommended.
MACs Specifies the available MAC (message authentication code)
- algorithms. The MAC algorithm is used in protocol version 2 for
- data integrity protection. Multiple algorithms must be comma-
- separated. The algorithms that contain ``-etm'' calculate the
- MAC after encryption (encrypt-then-mac). These are considered
- safer and their use recommended. The default is:
+ algorithms. The MAC algorithm is used for data integrity
+ protection. Multiple algorithms must be comma-separated. If the
+ specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified
+ algorithms will be appended to the default set instead of
+ replacing them.
- hmac-md5-etm at openssh.com,hmac-sha1-etm at openssh.com,
+ The algorithms that contain M-bM-^@M-^\-etmM-bM-^@M-^] calculate the MAC after
+ encryption (encrypt-then-mac). These are considered safer and
+ their use recommended. The supported MACs are:
+
+ hmac-md5
+ hmac-md5-96
+ hmac-ripemd160
+ hmac-sha1
+ hmac-sha1-96
+ hmac-sha2-256
+ hmac-sha2-512
+ umac-64 at openssh.com
+ umac-128 at openssh.com
+ hmac-md5-etm at openssh.com
+ hmac-md5-96-etm at openssh.com
+ hmac-ripemd160-etm at openssh.com
+ hmac-sha1-etm at openssh.com
+ hmac-sha1-96-etm at openssh.com
+ hmac-sha2-256-etm at openssh.com
+ hmac-sha2-512-etm at openssh.com
+ umac-64-etm at openssh.com
+ umac-128-etm at openssh.com
+
+ The default is:
+
umac-64-etm at openssh.com,umac-128-etm at openssh.com,
hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at openssh.com,
- hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at openssh.com,
- hmac-md5-96-etm at openssh.com,
- hmac-md5,hmac-sha1,umac-64 at openssh.com,umac-128 at openssh.com,
- hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
- hmac-sha1-96,hmac-md5-96
+ hmac-sha1-etm at openssh.com,
+ umac-64 at openssh.com,umac-128 at openssh.com,
+ hmac-sha2-256,hmac-sha2-512,hmac-sha1
+ The list of available MAC algorithms may also be obtained using
+ the -Q option of ssh(1) with an argument of M-bM-^@M-^\macM-bM-^@M-^].
+
Match Introduces a conditional block. If all of the criteria on the
Match line are satisfied, the keywords on the following lines
override those set in the global section of the config file,
until either another Match line or the end of the file. If a
- keyword appears in multiple Match blocks that are satisified,
- only the first instance of the keyword is applied.
+ keyword appears in multiple Match blocks that are satisfied, only
+ the first instance of the keyword is applied.
The arguments to Match are one or more criteria-pattern pairs or
the single token All which matches all criteria. The available
@@ -479,25 +641,29 @@
The patterns in an Address criteria may additionally contain
addresses to match in CIDR address/masklen format, e.g.
- ``192.0.2.0/24'' or ``3ffe:ffff::/32''. Note that the mask
- length provided must be consistent with the address - it is an
- error to specify a mask length that is too long for the address
- or one with bits set in this host portion of the address. For
- example, ``192.0.2.0/33'' and ``192.0.2.0/8'' respectively.
+ M-bM-^@M-^\192.0.2.0/24M-bM-^@M-^] or M-bM-^@M-^\3ffe:ffff::/32M-bM-^@M-^]. Note that the mask length
+ provided must be consistent with the address - it is an error to
+ specify a mask length that is too long for the address or one
+ with bits set in this host portion of the address. For example,
+ M-bM-^@M-^\192.0.2.0/33M-bM-^@M-^] and M-bM-^@M-^\192.0.2.0/8M-bM-^@M-^] respectively.
Only a subset of keywords may be used on the lines following a
Match keyword. Available keywords are AcceptEnv,
- AllowAgentForwarding, AllowGroups, AllowTcpForwarding,
- AllowUsers, AuthenticationMethods, AuthorizedKeysCommand,
- AuthorizedKeysCommandUser, AuthorizedKeysFile,
- AuthorizedPrincipalsFile, Banner, ChrootDirectory, DenyGroups,
- DenyUsers, ForceCommand, GatewayPorts, GSSAPIAuthentication,
- HostbasedAuthentication, HostbasedUsesNameFromPacketOnly,
+ AllowAgentForwarding, AllowGroups, AllowStreamLocalForwarding,
+ AllowTcpForwarding, AllowUsers, AuthenticationMethods,
+ AuthorizedKeysCommand, AuthorizedKeysCommandUser,
+ AuthorizedKeysFile, AuthorizedPrincipalsCommand,
+ AuthorizedPrincipalsCommandUser, AuthorizedPrincipalsFile,
+ Banner, ChrootDirectory, DenyGroups, DenyUsers, ForceCommand,
+ GatewayPorts, GSSAPIAuthentication, HostbasedAcceptedKeyTypes,
+ HostbasedAuthentication, HostbasedUsesNameFromPacketOnly, IPQoS,
KbdInteractiveAuthentication, KerberosAuthentication,
MaxAuthTries, MaxSessions, PasswordAuthentication,
PermitEmptyPasswords, PermitOpen, PermitRootLogin, PermitTTY,
- PermitTunnel, PubkeyAuthentication, RekeyLimit,
- RhostsRSAAuthentication, RSAAuthentication, X11DisplayOffset,
+ PermitTunnel, PermitUserRC, PubkeyAcceptedKeyTypes,
+ PubkeyAuthentication, RekeyLimit, RevokedKeys,
+ RhostsRSAAuthentication, RSAAuthentication, StreamLocalBindMask,
+ StreamLocalBindUnlink, TrustedUserCAKeys, X11DisplayOffset,
X11Forwarding and X11UseLocalHost.
MaxAuthTries
@@ -506,8 +672,13 @@
value, additional failures are logged. The default is 6.
MaxSessions
- Specifies the maximum number of open sessions permitted per
- network connection. The default is 10.
+ Specifies the maximum number of open shell, login or subsystem
+ (e.g. sftp) sessions permitted per network connection. Multiple
+ sessions may be established by clients that support connection
+ multiplexing. Setting MaxSessions to 1 will effectively disable
+ session multiplexing, whereas setting it to 0 will prevent all
+ shell, login and subsystem sessions while still permitting
+ forwarding. The default is 10.
MaxStartups
Specifies the maximum number of concurrent unauthenticated
@@ -516,21 +687,21 @@
expires for a connection. The default is 10:30:100.
Alternatively, random early drop can be enabled by specifying the
- three colon separated values ``start:rate:full'' (e.g.
- "10:30:60"). sshd(8) will refuse connection attempts with a
- probability of ``rate/100'' (30%) if there are currently
- ``start'' (10) unauthenticated connections. The probability
- increases linearly and all connection attempts are refused if the
- number of unauthenticated connections reaches ``full'' (60).
+ three colon separated values M-bM-^@M-^\start:rate:fullM-bM-^@M-^] (e.g. "10:30:60").
+ sshd(8) will refuse connection attempts with a probability of
+ M-bM-^@M-^\rate/100M-bM-^@M-^] (30%) if there are currently M-bM-^@M-^\startM-bM-^@M-^] (10)
+ unauthenticated connections. The probability increases linearly
+ and all connection attempts are refused if the number of
+ unauthenticated connections reaches M-bM-^@M-^\fullM-bM-^@M-^] (60).
PasswordAuthentication
Specifies whether password authentication is allowed. The
- default is ``yes''.
+ default is M-bM-^@M-^\yesM-bM-^@M-^].
PermitEmptyPasswords
When password authentication is allowed, it specifies whether the
server allows login to accounts with empty password strings. The
- default is ``no''.
+ default is M-bM-^@M-^\noM-bM-^@M-^].
PermitOpen
Specifies the destinations to which TCP port forwarding is
@@ -542,47 +713,59 @@
PermitOpen [IPv6_addr]:port
Multiple forwards may be specified by separating them with
- whitespace. An argument of ``any'' can be used to remove all
+ whitespace. An argument of M-bM-^@M-^\anyM-bM-^@M-^] can be used to remove all
restrictions and permit any forwarding requests. An argument of
- ``none'' can be used to prohibit all forwarding requests. By
- default all port forwarding requests are permitted.
+ M-bM-^@M-^\noneM-bM-^@M-^] can be used to prohibit all forwarding requests. The
+ wildcard M-bM-^@M-^\*M-bM-^@M-^] can be used for host or port to allow all hosts or
+ ports, respectively. By default all port forwarding requests are
+ permitted.
PermitRootLogin
Specifies whether root can log in using ssh(1). The argument
- must be ``yes'', ``without-password'', ``forced-commands-only'',
- or ``no''. The default is ``yes''.
+ must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\prohibit-passwordM-bM-^@M-^], M-bM-^@M-^\without-passwordM-bM-^@M-^],
+ M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^], or M-bM-^@M-^\noM-bM-^@M-^]. The default is
+ M-bM-^@M-^\prohibit-passwordM-bM-^@M-^].
- If this option is set to ``without-password'', password
- authentication is disabled for root.
+ If this option is set to M-bM-^@M-^\prohibit-passwordM-bM-^@M-^] or
+ M-bM-^@M-^\without-passwordM-bM-^@M-^], password and keyboard-interactive
+ authentication are disabled for root.
- If this option is set to ``forced-commands-only'', root login
- with public key authentication will be allowed, but only if the
+ If this option is set to M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^], root login with
+ public key authentication will be allowed, but only if the
command option has been specified (which may be useful for taking
remote backups even if root login is normally not allowed). All
other authentication methods are disabled for root.
- If this option is set to ``no'', root is not allowed to log in.
+ If this option is set to M-bM-^@M-^\noM-bM-^@M-^], root is not allowed to log in.
PermitTunnel
Specifies whether tun(4) device forwarding is allowed. The
- argument must be ``yes'', ``point-to-point'' (layer 3),
- ``ethernet'' (layer 2), or ``no''. Specifying ``yes'' permits
- both ``point-to-point'' and ``ethernet''. The default is ``no''.
+ argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\point-to-pointM-bM-^@M-^] (layer 3), M-bM-^@M-^\ethernetM-bM-^@M-^]
+ (layer 2), or M-bM-^@M-^\noM-bM-^@M-^]. Specifying M-bM-^@M-^\yesM-bM-^@M-^] permits both
+ M-bM-^@M-^\point-to-pointM-bM-^@M-^] and M-bM-^@M-^\ethernetM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
+ Independent of this setting, the permissions of the selected
+ tun(4) device must allow access to the user.
+
PermitTTY
Specifies whether pty(4) allocation is permitted. The default is
- ``yes''.
+ M-bM-^@M-^\yesM-bM-^@M-^].
PermitUserEnvironment
Specifies whether ~/.ssh/environment and environment= options in
~/.ssh/authorized_keys are processed by sshd(8). The default is
- ``no''. Enabling environment processing may enable users to
- bypass access restrictions in some configurations using
- mechanisms such as LD_PRELOAD.
+ M-bM-^@M-^\noM-bM-^@M-^]. Enabling environment processing may enable users to bypass
+ access restrictions in some configurations using mechanisms such
+ as LD_PRELOAD.
+ PermitUserRC
+ Specifies whether any ~/.ssh/rc file is executed. The default is
+ M-bM-^@M-^\yesM-bM-^@M-^].
+
PidFile
Specifies the file that contains the process ID of the SSH
- daemon. The default is /var/run/sshd.pid.
+ daemon, or M-bM-^@M-^\noneM-bM-^@M-^] to not write one. The default is
+ /var/run/sshd.pid.
Port Specifies the port number that sshd(8) listens on. The default
is 22. Multiple options of this type are permitted. See also
@@ -591,25 +774,45 @@
PrintLastLog
Specifies whether sshd(8) should print the date and time of the
last user login when a user logs in interactively. The default
- is ``yes''.
+ is M-bM-^@M-^\yesM-bM-^@M-^].
PrintMotd
Specifies whether sshd(8) should print /etc/motd when a user logs
in interactively. (On some systems it is also printed by the
- shell, /etc/profile, or equivalent.) The default is ``yes''.
+ shell, /etc/profile, or equivalent.) The default is M-bM-^@M-^\yesM-bM-^@M-^].
Protocol
Specifies the protocol versions sshd(8) supports. The possible
- values are `1' and `2'. Multiple versions must be comma-
- separated. The default is `2'. Note that the order of the
- protocol list does not indicate preference, because the client
- selects among multiple protocol versions offered by the server.
- Specifying ``2,1'' is identical to ``1,2''.
+ values are M-bM-^@M-^X1M-bM-^@M-^Y and M-bM-^@M-^X2M-bM-^@M-^Y. Multiple versions must be comma-
+ separated. The default is M-bM-^@M-^X2M-bM-^@M-^Y. Protocol 1 suffers from a number
+ of cryptographic weaknesses and should not be used. It is only
+ offered to support legacy devices.
+ Note that the order of the protocol list does not indicate
+ preference, because the client selects among multiple protocol
+ versions offered by the server. Specifying M-bM-^@M-^\2,1M-bM-^@M-^] is identical to
+ M-bM-^@M-^\1,2M-bM-^@M-^].
+
+ PubkeyAcceptedKeyTypes
+ Specifies the key types that will be accepted for public key
+ authentication as a comma-separated pattern list. Alternately if
+ the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the
+ specified key types will be appended to the default set instead
+ of replacing them. The default for this option is:
+
+ ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ ssh-ed25519-cert-v01 at openssh.com,
+ ssh-rsa-cert-v01 at openssh.com,
+ ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ ssh-ed25519,ssh-rsa
+
+ The -Q option of ssh(1) may be used to list supported key types.
+
PubkeyAuthentication
Specifies whether public key authentication is allowed. The
- default is ``yes''. Note that this option applies to protocol
- version 2 only.
+ default is M-bM-^@M-^\yesM-bM-^@M-^].
RekeyLimit
Specifies the maximum amount of data that may be transmitted
@@ -616,46 +819,66 @@
before the session key is renegotiated, optionally followed a
maximum amount of time that may pass before the session key is
renegotiated. The first argument is specified in bytes and may
- have a suffix of `K', `M', or `G' to indicate Kilobytes,
+ have a suffix of M-bM-^@M-^XKM-bM-^@M-^Y, M-bM-^@M-^XMM-bM-^@M-^Y, or M-bM-^@M-^XGM-bM-^@M-^Y to indicate Kilobytes,
Megabytes, or Gigabytes, respectively. The default is between
- `1G' and `4G', depending on the cipher. The optional second
+ M-bM-^@M-^X1GM-bM-^@M-^Y and M-bM-^@M-^X4GM-bM-^@M-^Y, depending on the cipher. The optional second
value is specified in seconds and may use any of the units
documented in the TIME FORMATS section. The default value for
- RekeyLimit is ``default none'', which means that rekeying is
+ RekeyLimit is M-bM-^@M-^\default noneM-bM-^@M-^], which means that rekeying is
performed after the cipher's default amount of data has been sent
- or received and no time based rekeying is done. This option
- applies to protocol version 2 only.
+ or received and no time based rekeying is done.
RevokedKeys
- Specifies revoked public keys. Keys listed in this file will be
- refused for public key authentication. Note that if this file is
- not readable, then public key authentication will be refused for
- all users. Keys may be specified as a text file, listing one
- public key per line, or as an OpenSSH Key Revocation List (KRL)
- as generated by ssh-keygen(1). For more information on KRLs, see
- the KEY REVOCATION LISTS section in ssh-keygen(1).
+ Specifies revoked public keys file, or M-bM-^@M-^\noneM-bM-^@M-^] to not use one.
+ Keys listed in this file will be refused for public key
+ authentication. Note that if this file is not readable, then
+ public key authentication will be refused for all users. Keys
+ may be specified as a text file, listing one public key per line,
+ or as an OpenSSH Key Revocation List (KRL) as generated by
+ ssh-keygen(1). For more information on KRLs, see the KEY
+ REVOCATION LISTS section in ssh-keygen(1).
RhostsRSAAuthentication
Specifies whether rhosts or /etc/hosts.equiv authentication
together with successful RSA host authentication is allowed. The
- default is ``no''. This option applies to protocol version 1
- only.
+ default is M-bM-^@M-^\noM-bM-^@M-^]. This option applies to protocol version 1 only.
RSAAuthentication
Specifies whether pure RSA authentication is allowed. The
- default is ``yes''. This option applies to protocol version 1
+ default is M-bM-^@M-^\yesM-bM-^@M-^]. This option applies to protocol version 1
only.
ServerKeyBits
Defines the number of bits in the ephemeral protocol version 1
- server key. The minimum value is 512, and the default is 1024.
+ server key. The default and minimum value is 1024.
+ StreamLocalBindMask
+ Sets the octal file creation mode mask (umask) used when creating
+ a Unix-domain socket file for local or remote port forwarding.
+ This option is only used for port forwarding to a Unix-domain
+ socket file.
+
+ The default value is 0177, which creates a Unix-domain socket
+ file that is readable and writable only by the owner. Note that
+ not all operating systems honor the file mode on Unix-domain
+ socket files.
+
+ StreamLocalBindUnlink
+ Specifies whether to remove an existing Unix-domain socket file
+ for local or remote port forwarding before creating a new one.
+ If the socket file already exists and StreamLocalBindUnlink is
+ not enabled, sshd will be unable to forward the port to the Unix-
+ domain socket file. This option is only used for port forwarding
+ to a Unix-domain socket file.
+
+ The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
+
StrictModes
Specifies whether sshd(8) should check file modes and ownership
of the user's files and home directory before accepting login.
This is normally desirable because novices sometimes accidentally
leave their directory or files world-writable. The default is
- ``yes''. Note that this does not apply to ChrootDirectory, whose
+ M-bM-^@M-^\yesM-bM-^@M-^]. Note that this does not apply to ChrootDirectory, whose
permissions and ownership are checked unconditionally.
Subsystem
@@ -663,15 +886,14 @@
Arguments should be a subsystem name and a command (with optional
arguments) to execute upon subsystem request.
- The command sftp-server(8) implements the ``sftp'' file transfer
+ The command sftp-server(8) implements the M-bM-^@M-^\sftpM-bM-^@M-^] file transfer
subsystem.
- Alternately the name ``internal-sftp'' implements an in-process
- ``sftp'' server. This may simplify configurations using
+ Alternately the name M-bM-^@M-^\internal-sftpM-bM-^@M-^] implements an in-process
+ M-bM-^@M-^\sftpM-bM-^@M-^] server. This may simplify configurations using
ChrootDirectory to force a different filesystem root on clients.
- By default no subsystems are defined. Note that this option
- applies to protocol version 2 only.
+ By default no subsystems are defined.
SyslogFacility
Gives the facility code that is used when logging messages from
@@ -686,42 +908,47 @@
this means that connections will die if the route is down
temporarily, and some people find it annoying. On the other
hand, if TCP keepalives are not sent, sessions may hang
- indefinitely on the server, leaving ``ghost'' users and consuming
+ indefinitely on the server, leaving M-bM-^@M-^\ghostM-bM-^@M-^] users and consuming
server resources.
- The default is ``yes'' (to send TCP keepalive messages), and the
+ The default is M-bM-^@M-^\yesM-bM-^@M-^] (to send TCP keepalive messages), and the
server will notice if the network goes down or the client host
crashes. This avoids infinitely hanging sessions.
To disable TCP keepalive messages, the value should be set to
- ``no''.
+ M-bM-^@M-^\noM-bM-^@M-^].
TrustedUserCAKeys
Specifies a file containing public keys of certificate
authorities that are trusted to sign user certificates for
- authentication. Keys are listed one per line; empty lines and
- comments starting with `#' are allowed. If a certificate is
- presented for authentication and has its signing CA key listed in
- this file, then it may be used for authentication for any user
- listed in the certificate's principals list. Note that
- certificates that lack a list of principals will not be permitted
- for authentication using TrustedUserCAKeys. For more details on
- certificates, see the CERTIFICATES section in ssh-keygen(1).
+ authentication, or M-bM-^@M-^\noneM-bM-^@M-^] to not use one. Keys are listed one
+ per line; empty lines and comments starting with M-bM-^@M-^X#M-bM-^@M-^Y are allowed.
+ If a certificate is presented for authentication and has its
+ signing CA key listed in this file, then it may be used for
+ authentication for any user listed in the certificate's
+ principals list. Note that certificates that lack a list of
+ principals will not be permitted for authentication using
+ TrustedUserCAKeys. For more details on certificates, see the
+ CERTIFICATES section in ssh-keygen(1).
- UseDNS Specifies whether sshd(8) should look up the remote host name and
- check that the resolved host name for the remote IP address maps
- back to the very same IP address. The default is ``yes''.
+ UseDNS Specifies whether sshd(8) should look up the remote host name,
+ and to check that the resolved host name for the remote IP
+ address maps back to the very same IP address.
+ If this option is set to M-bM-^@M-^\noM-bM-^@M-^] (the default) then only addresses
+ and not host names may be used in ~/.ssh/authorized_keys from and
+ sshd_config Match Host directives.
+
UseLogin
Specifies whether login(1) is used for interactive login
- sessions. The default is ``no''. Note that login(1) is never
- used for remote command execution. Note also, that if this is
+ sessions. The default is M-bM-^@M-^\noM-bM-^@M-^]. Note that login(1) is never used
+ for remote command execution. Note also, that if this is
enabled, X11Forwarding will be disabled because login(1) does not
know how to handle xauth(1) cookies. If UsePrivilegeSeparation
is specified, it will be disabled after authentication.
UsePAM Enables the Pluggable Authentication Module interface. If set to
- ``yes'' this will enable PAM authentication using
+ M-bM-^@M-^\yesM-bM-^@M-^] this will enable PAM authentication using
ChallengeResponseAuthentication and PasswordAuthentication in
addition to PAM account and session module processing for all
authentication types.
@@ -731,7 +958,7 @@
either PasswordAuthentication or ChallengeResponseAuthentication.
If UsePAM is enabled, you will not be able to run sshd(8) as a
- non-root user. The default is ``no''.
+ non-root user. The default is M-bM-^@M-^\noM-bM-^@M-^].
UsePrivilegeSeparation
Specifies whether sshd(8) separates privileges by creating an
@@ -740,14 +967,15 @@
that has the privilege of the authenticated user. The goal of
privilege separation is to prevent privilege escalation by
containing any corruption within the unprivileged processes. The
- default is ``yes''. If UsePrivilegeSeparation is set to
- ``sandbox'' then the pre-authentication unprivileged process is
- subject to additional restrictions.
+ argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\noM-bM-^@M-^], or M-bM-^@M-^\sandboxM-bM-^@M-^]. If
+ UsePrivilegeSeparation is set to M-bM-^@M-^\sandboxM-bM-^@M-^] then the pre-
+ authentication unprivileged process is subject to additional
+ restrictions. The default is M-bM-^@M-^\sandboxM-bM-^@M-^].
VersionAddendum
Optionally specifies additional text to append to the SSH
protocol banner sent by the server upon connection. The default
- is ``none''.
+ is M-bM-^@M-^\noneM-bM-^@M-^].
X11DisplayOffset
Specifies the first display number available for sshd(8)'s X11
@@ -756,7 +984,7 @@
X11Forwarding
Specifies whether X11 forwarding is permitted. The argument must
- be ``yes'' or ``no''. The default is ``no''.
+ be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^].
When X11 forwarding is enabled, there may be additional exposure
to the server and to client displays if the sshd(8) proxy display
@@ -770,7 +998,7 @@
ssh_config(5)). A system administrator may have a stance in
which they want to protect clients that may expose themselves to
attack by unwittingly requesting X11 forwarding, which can
- warrant a ``no'' setting.
+ warrant a M-bM-^@M-^\noM-bM-^@M-^] setting.
Note that disabling X11 forwarding does not prevent users from
forwarding X11 traffic, as users can always install their own
@@ -782,16 +1010,16 @@
to the loopback address or to the wildcard address. By default,
sshd binds the forwarding server to the loopback address and sets
the hostname part of the DISPLAY environment variable to
- ``localhost''. This prevents remote hosts from connecting to the
+ M-bM-^@M-^\localhostM-bM-^@M-^]. This prevents remote hosts from connecting to the
proxy display. However, some older X11 clients may not function
- with this configuration. X11UseLocalhost may be set to ``no'' to
+ with this configuration. X11UseLocalhost may be set to M-bM-^@M-^\noM-bM-^@M-^] to
specify that the forwarding server should be bound to the
- wildcard address. The argument must be ``yes'' or ``no''. The
- default is ``yes''.
+ wildcard address. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The
+ default is M-bM-^@M-^\yesM-bM-^@M-^].
XAuthLocation
- Specifies the full pathname of the xauth(1) program. The default
- is /usr/X11R6/bin/xauth.
+ Specifies the full pathname of the xauth(1) program, or M-bM-^@M-^\noneM-bM-^@M-^] to
+ not use one. The default is /usr/X11R6/bin/xauth.
TIME FORMATS
sshd(8) command-line arguments and configuration file options that
@@ -799,7 +1027,7 @@
time[qualifier], where time is a positive integer value and qualifier is
one of the following:
- <none> seconds
+ M-bM-^_M-(noneM-bM-^_M-) seconds
s | S seconds
m | M minutes
h | H hours
@@ -832,4 +1060,4 @@
versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support
for privilege separation.
-OpenBSD 5.5 February 27, 2014 OpenBSD 5.5
+OpenBSD 6.0 July 19, 2016 OpenBSD 6.0
Modified: trunk/crypto/openssh/sshd_config.5
===================================================================
--- trunk/crypto/openssh/sshd_config.5 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshd_config.5 2016-11-05 20:36:34 UTC (rev 9223)
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd_config.5,v 1.172 2014/02/27 22:47:07 djm Exp $
-.Dd $Mdocdate: February 27 2014 $
+.\" $OpenBSD: sshd_config.5,v 1.227 2016/07/19 12:59:16 jmc Exp $
+.Dd $Mdocdate: July 19 2016 $
.Dt SSHD_CONFIG 5
.Os
.Sh NAME
@@ -70,7 +70,10 @@
in
.Xr ssh_config 5
for how to configure the client.
-Note that environment passing is only supported for protocol 2.
+The
+.Ev TERM
+environment variable is always sent whenever the client
+requests a pseudo-terminal as it is required by the protocol.
Variables are specified by name, which may contain the wildcard characters
.Ql *
and
@@ -140,6 +143,26 @@
Note that disabling TCP forwarding does not improve security unless
users are also denied shell access, as they can always install their
own forwarders.
+.It Cm AllowStreamLocalForwarding
+Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted.
+The available options are
+.Dq yes
+or
+.Dq all
+to allow StreamLocal forwarding,
+.Dq no
+to prevent all StreamLocal forwarding,
+.Dq local
+to allow local (from the perspective of
+.Xr ssh 1 )
+forwarding only or
+.Dq remote
+to allow remote forwarding only.
+The default is
+.Dq yes .
+Note that disabling StreamLocal forwarding does not improve security unless
+users are also denied shell access, as they can always install their
+own forwarders.
.It Cm AllowUsers
This keyword can be followed by a list of user name patterns, separated
by spaces.
@@ -150,6 +173,8 @@
If the pattern takes the form USER at HOST then USER and HOST
are separately checked, restricting logins to particular
users from particular hosts.
+HOST criteria may additionally contain addresses to match in CIDR
+address/masklen format.
The allow/deny directives are processed in the following order:
.Cm DenyUsers ,
.Cm AllowUsers ,
@@ -164,9 +189,12 @@
Specifies the authentication methods that must be successfully completed
for a user to be granted access.
This option must be followed by one or more comma-separated lists of
-authentication method names.
-Successful authentication requires completion of every method in at least
-one of these lists.
+authentication method names, or by the single string
+.Dq any
+to indicate the default behaviour of accepting any single authentication
+method.
+if the default is overridden, then successful authentication requires
+completion of every method in at least one of these lists.
.Pp
For example, an argument of
.Dq publickey,password publickey,keyboard-interactive
@@ -190,17 +218,43 @@
.Dq bsdauth
device.
.Pp
-This option is only available for SSH protocol 2 and will yield a fatal
+If the
+.Dq publickey
+method is listed more than once,
+.Xr sshd 8
+verifies that keys that have been used successfully are not reused for
+subsequent authentications.
+For example, an
+.Cm AuthenticationMethods
+of
+.Dq publickey,publickey
+will require successful authentication using two different public keys.
+.Pp
+This option will yield a fatal
error if enabled if protocol 1 is also enabled.
Note that each authentication method listed should also be explicitly enabled
in the configuration.
-The default is not to require multiple authentication; successful completion
+The default
+.Dq any
+is not to require multiple authentication; successful completion
of a single authentication method is sufficient.
.It Cm AuthorizedKeysCommand
Specifies a program to be used to look up the user's public keys.
-The program must be owned by root and not writable by group or others.
-It will be invoked with a single argument of the username
-being authenticated, and should produce on standard output zero or
+The program must be owned by root, not writable by group or others and
+specified by an absolute path.
+.Pp
+Arguments to
+.Cm AuthorizedKeysCommand
+may be provided using the following tokens, which will be expanded
+at runtime: %% is replaced by a literal '%', %u is replaced by the
+username being authenticated, %h is replaced by the home directory
+of the user being authenticated, %t is replaced with the key type
+offered for authentication, %f is replaced with the fingerprint of
+the key, and %k is replaced with the key being offered for authentication.
+If no arguments are specified then the username of the target user
+will be supplied.
+.Pp
+The program should produce on standard output zero or
more lines of authorized_keys output (see AUTHORIZED_KEYS in
.Xr sshd 8 ) .
If a key supplied by AuthorizedKeysCommand does not successfully authenticate
@@ -212,6 +266,13 @@
Specifies the user under whose account the AuthorizedKeysCommand is run.
It is recommended to use a dedicated user that has no other role on the host
than running authorized keys commands.
+If
+.Cm AuthorizedKeysCommand
+is specified but
+.Cm AuthorizedKeysCommandUser
+is not, then
+.Xr sshd 8
+will refuse to start.
.It Cm AuthorizedKeysFile
Specifies the file that contains the public keys that can be used
for user authentication.
@@ -230,8 +291,47 @@
is taken to be an absolute path or one relative to the user's home
directory.
Multiple files may be listed, separated by whitespace.
+Alternately this option may be set to
+.Dq none
+to skip checking for user keys in files.
The default is
.Dq .ssh/authorized_keys .ssh/authorized_keys2 .
+.It Cm AuthorizedPrincipalsCommand
+Specifies a program to be used to generate the list of allowed
+certificate principals as per
+.Cm AuthorizedPrincipalsFile .
+The program must be owned by root, not writable by group or others and
+specified by an absolute path.
+.Pp
+Arguments to
+.Cm AuthorizedPrincipalsCommand
+may be provided using the following tokens, which will be expanded
+at runtime: %% is replaced by a literal '%', %u is replaced by the
+username being authenticated and %h is replaced by the home directory
+of the user being authenticated.
+.Pp
+The program should produce on standard output zero or
+more lines of
+.Cm AuthorizedPrincipalsFile
+output.
+If either
+.Cm AuthorizedPrincipalsCommand
+or
+.Cm AuthorizedPrincipalsFile
+is specified, then certificates offered by the client for authentication
+must contain a principal that is listed.
+By default, no AuthorizedPrincipalsCommand is run.
+.It Cm AuthorizedPrincipalsCommandUser
+Specifies the user under whose account the AuthorizedPrincipalsCommand is run.
+It is recommended to use a dedicated user that has no other role on the host
+than running authorized principals commands.
+If
+.Cm AuthorizedPrincipalsCommand
+is specified but
+.Cm AuthorizedPrincipalsCommandUser
+is not, then
+.Xr sshd 8
+will refuse to start.
.It Cm AuthorizedPrincipalsFile
Specifies a file that lists principal names that are accepted for
certificate authentication.
@@ -279,11 +379,10 @@
If the argument is
.Dq none
then no banner is displayed.
-This option is only available for protocol version 2.
By default, no banner is displayed.
.It Cm ChallengeResponseAuthentication
Specifies whether challenge-response authentication is allowed (e.g. via
-PAM or though authentication styles supported in
+PAM or through authentication styles supported in
.Xr login.conf 5 )
The default is
.Dq yes .
@@ -291,8 +390,10 @@
Specifies the pathname of a directory to
.Xr chroot 2
to after authentication.
-All components of the pathname must be root-owned directories that are
-not writable by any other user or group.
+At session startup
+.Xr sshd 8
+checks that all components of the pathname are root-owned directories
+which are not writable by any other user or group.
After the chroot,
.Xr sshd 8
changes the working directory to the user's home directory.
@@ -316,7 +417,6 @@
.Xr stdin 4 ,
.Xr stdout 4 ,
.Xr stderr 4 ,
-.Xr arandom 4
and
.Xr tty 4
devices.
@@ -324,49 +424,79 @@
.Dq sftp ,
no additional configuration of the environment is necessary if the
in-process sftp server is used,
-though sessions which use logging do require
+though sessions which use logging may require
.Pa /dev/log
-inside the chroot directory (see
+inside the chroot directory on some operating systems (see
.Xr sftp-server 8
for details).
.Pp
-The default is not to
+For safety, it is very important that the directory hierarchy be
+prevented from modification by other processes on the system (especially
+those outside the jail).
+Misconfiguration can lead to unsafe environments which
+.Xr sshd 8
+cannot detect.
+.Pp
+The default is
+.Dq none ,
+indicating not to
.Xr chroot 2 .
.It Cm Ciphers
-Specifies the ciphers allowed for protocol version 2.
+Specifies the ciphers allowed.
Multiple ciphers must be comma-separated.
+If the specified value begins with a
+.Sq +
+character, then the specified ciphers will be appended to the default set
+instead of replacing them.
+.Pp
The supported ciphers are:
.Pp
-.Dq 3des-cbc ,
-.Dq aes128-cbc ,
-.Dq aes192-cbc ,
-.Dq aes256-cbc ,
-.Dq aes128-ctr ,
-.Dq aes192-ctr ,
-.Dq aes256-ctr ,
-.Dq aes128-gcm at openssh.com ,
-.Dq aes256-gcm at openssh.com ,
-.Dq arcfour128 ,
-.Dq arcfour256 ,
-.Dq arcfour ,
-.Dq blowfish-cbc ,
-.Dq cast128-cbc ,
-and
-.Dq chacha20-poly1305 at openssh.com .
+.Bl -item -compact -offset indent
+.It
+3des-cbc
+.It
+aes128-cbc
+.It
+aes192-cbc
+.It
+aes256-cbc
+.It
+aes128-ctr
+.It
+aes192-ctr
+.It
+aes256-ctr
+.It
+aes128-gcm at openssh.com
+.It
+aes256-gcm at openssh.com
+.It
+arcfour
+.It
+arcfour128
+.It
+arcfour256
+.It
+blowfish-cbc
+.It
+cast128-cbc
+.It
+chacha20-poly1305 at openssh.com
+.El
.Pp
The default is:
-.Bd -literal -offset 3n
-aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
-aes128-gcm at openssh.com,aes256-gcm at openssh.com,
+.Bd -literal -offset indent
chacha20-poly1305 at openssh.com,
-aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
-aes256-cbc,arcfour
+aes128-ctr,aes192-ctr,aes256-ctr,
+aes128-gcm at openssh.com,aes256-gcm at openssh.com
.Ed
.Pp
The list of available ciphers may also be obtained using the
.Fl Q
option of
-.Xr ssh 1 .
+.Xr ssh 1
+with an argument of
+.Dq cipher .
.It Cm ClientAliveCountMax
Sets the number of client alive messages (see below) which may be
sent without
@@ -393,7 +523,6 @@
.Cm ClientAliveCountMax
is left at the default, unresponsive SSH clients
will be disconnected after approximately 45 seconds.
-This option applies to protocol version 2 only.
.It Cm ClientAliveInterval
Sets a timeout interval in seconds after which if no data has been received
from the client,
@@ -402,7 +531,6 @@
channel to request a response from the client.
The default
is 0, indicating that these messages will not be sent to the client.
-This option applies to protocol version 2 only.
.It Cm Compression
Specifies whether compression is allowed, or delayed until
the user has authenticated successfully.
@@ -439,6 +567,8 @@
If the pattern takes the form USER at HOST then USER and HOST
are separately checked, restricting logins to particular
users from particular hosts.
+HOST criteria may additionally contain addresses to match in CIDR
+address/masklen format.
The allow/deny directives are processed in the following order:
.Cm DenyUsers ,
.Cm AllowUsers ,
@@ -449,6 +579,14 @@
See PATTERNS in
.Xr ssh_config 5
for more information on patterns.
+.It Cm FingerprintHash
+Specifies the hash algorithm used when logging key fingerprints.
+Valid options are:
+.Dq md5
+and
+.Dq sha256 .
+The default is
+.Dq sha256 .
.It Cm ForceCommand
Forces the execution of the command specified by
.Cm ForceCommand ,
@@ -468,6 +606,8 @@
will force the use of an in-process sftp server that requires no support
files when used with
.Cm ChrootDirectory .
+The default is
+.Dq none .
.It Cm GatewayPorts
Specifies whether remote hosts are allowed to connect to ports
forwarded for the client.
@@ -492,20 +632,53 @@
Specifies whether user authentication based on GSSAPI is allowed.
The default is
.Dq no .
-Note that this option applies to protocol version 2 only.
.It Cm GSSAPICleanupCredentials
Specifies whether to automatically destroy the user's credentials cache
on logout.
The default is
.Dq yes .
-Note that this option applies to protocol version 2 only.
+.It Cm GSSAPIStrictAcceptorCheck
+Determines whether to be strict about the identity of the GSSAPI acceptor
+a client authenticates against.
+If set to
+.Dq yes
+then the client must authenticate against the
+.Pa host
+service on the current hostname.
+If set to
+.Dq no
+then the client may authenticate against any service key stored in the
+machine's default store.
+This facility is provided to assist with operation on multi homed machines.
+The default is
+.Dq yes .
+.It Cm HostbasedAcceptedKeyTypes
+Specifies the key types that will be accepted for hostbased authentication
+as a comma-separated pattern list.
+Alternately if the specified value begins with a
+.Sq +
+character, then the specified key types will be appended to the default set
+instead of replacing them.
+The default for this option is:
+.Bd -literal -offset 3n
+ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ssh-ed25519-cert-v01 at openssh.com,
+ssh-rsa-cert-v01 at openssh.com,
+ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ssh-ed25519,ssh-rsa
+.Ed
+.Pp
+The
+.Fl Q
+option of
+.Xr ssh 1
+may be used to list supported key types.
.It Cm HostbasedAuthentication
Specifies whether rhosts or /etc/hosts.equiv authentication together
with successful public key client host authentication is allowed
(host-based authentication).
-This option is similar to
-.Cm RhostsRSAAuthentication
-and applies to protocol version 2 only.
The default is
.Dq no .
.It Cm HostbasedUsesNameFromPacketOnly
@@ -545,9 +718,15 @@
and
.Pa /etc/ssh/ssh_host_rsa_key
for protocol version 2.
+.Pp
Note that
.Xr sshd 8
-will refuse to use a file if it is group/world-accessible.
+will refuse to use a file if it is group/world-accessible
+and that the
+.Cm HostKeyAlgorithms
+option restricts which of the keys are actually used by
+.Xr sshd 8 .
+.Pp
It is possible to have multiple host key files.
.Dq rsa1
keys are used for version 1 and
@@ -564,11 +743,31 @@
.It Cm HostKeyAgent
Identifies the UNIX-domain socket used to communicate
with an agent that has access to the private host keys.
-If
+If the string
.Dq SSH_AUTH_SOCK
is specified, the location of the socket will be read from the
.Ev SSH_AUTH_SOCK
environment variable.
+.It Cm HostKeyAlgorithms
+Specifies the host key algorithms
+that the server offers.
+The default for this option is:
+.Bd -literal -offset 3n
+ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ssh-ed25519-cert-v01 at openssh.com,
+ssh-rsa-cert-v01 at openssh.com,
+ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ssh-ed25519,ssh-rsa
+.Ed
+.Pp
+The list of available key types may also be obtained using the
+.Fl Q
+option of
+.Xr ssh 1
+with an argument of
+.Dq key .
.It Cm IgnoreRhosts
Specifies that
.Pa .rhosts
@@ -672,15 +871,45 @@
.It Cm KexAlgorithms
Specifies the available KEX (Key Exchange) algorithms.
Multiple algorithms must be comma-separated.
-The default is
+Alternately if the specified value begins with a
+.Sq +
+character, then the specified methods will be appended to the default set
+instead of replacing them.
+The supported algorithms are:
+.Pp
+.Bl -item -compact -offset indent
+.It
+curve25519-sha256 at libssh.org
+.It
+diffie-hellman-group1-sha1
+.It
+diffie-hellman-group14-sha1
+.It
+diffie-hellman-group-exchange-sha1
+.It
+diffie-hellman-group-exchange-sha256
+.It
+ecdh-sha2-nistp256
+.It
+ecdh-sha2-nistp384
+.It
+ecdh-sha2-nistp521
+.El
+.Pp
+The default is:
.Bd -literal -offset indent
curve25519-sha256 at libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
-diffie-hellman-group-exchange-sha1,
-diffie-hellman-group14-sha1,
-diffie-hellman-group1-sha1
+diffie-hellman-group14-sha1
.Ed
+.Pp
+The list of available key exchange algorithms may also be obtained using the
+.Fl Q
+option of
+.Xr ssh 1
+with an argument of
+.Dq kex .
.It Cm KeyRegenerationInterval
In protocol version 1, the ephemeral server key is automatically regenerated
after this many seconds (if it has been used).
@@ -700,18 +929,18 @@
.It
.Cm ListenAddress
.Sm off
-.Ar host No | Ar IPv4_addr No | Ar IPv6_addr
+.Ar host | Ar IPv4_addr | Ar IPv6_addr
.Sm on
.It
.Cm ListenAddress
.Sm off
-.Ar host No | Ar IPv4_addr No : Ar port
+.Ar host | Ar IPv4_addr : Ar port
.Sm on
.It
.Cm ListenAddress
.Sm off
.Oo
-.Ar host No | Ar IPv6_addr Oc : Ar port
+.Ar host | Ar IPv6_addr Oc : Ar port
.Sm on
.El
.Pp
@@ -718,7 +947,7 @@
If
.Ar port
is not specified,
-sshd will listen on the address and all prior
+sshd will listen on the address and all
.Cm Port
options specified.
The default is to listen on all local addresses.
@@ -725,9 +954,6 @@
Multiple
.Cm ListenAddress
options are permitted.
-Additionally, any
-.Cm Port
-options must precede this option for non-port qualified addresses.
.It Cm LoginGraceTime
The server disconnects after this time if the user has not
successfully logged in.
@@ -744,24 +970,73 @@
Logging with a DEBUG level violates the privacy of users and is not recommended.
.It Cm MACs
Specifies the available MAC (message authentication code) algorithms.
-The MAC algorithm is used in protocol version 2
-for data integrity protection.
+The MAC algorithm is used for data integrity protection.
Multiple algorithms must be comma-separated.
+If the specified value begins with a
+.Sq +
+character, then the specified algorithms will be appended to the default set
+instead of replacing them.
+.Pp
The algorithms that contain
.Dq -etm
calculate the MAC after encryption (encrypt-then-mac).
These are considered safer and their use recommended.
+The supported MACs are:
+.Pp
+.Bl -item -compact -offset indent
+.It
+hmac-md5
+.It
+hmac-md5-96
+.It
+hmac-ripemd160
+.It
+hmac-sha1
+.It
+hmac-sha1-96
+.It
+hmac-sha2-256
+.It
+hmac-sha2-512
+.It
+umac-64 at openssh.com
+.It
+umac-128 at openssh.com
+.It
+hmac-md5-etm at openssh.com
+.It
+hmac-md5-96-etm at openssh.com
+.It
+hmac-ripemd160-etm at openssh.com
+.It
+hmac-sha1-etm at openssh.com
+.It
+hmac-sha1-96-etm at openssh.com
+.It
+hmac-sha2-256-etm at openssh.com
+.It
+hmac-sha2-512-etm at openssh.com
+.It
+umac-64-etm at openssh.com
+.It
+umac-128-etm at openssh.com
+.El
+.Pp
The default is:
.Bd -literal -offset indent
-hmac-md5-etm at openssh.com,hmac-sha1-etm at openssh.com,
umac-64-etm at openssh.com,umac-128-etm at openssh.com,
hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at openssh.com,
-hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at openssh.com,
-hmac-md5-96-etm at openssh.com,
-hmac-md5,hmac-sha1,umac-64 at openssh.com,umac-128 at openssh.com,
-hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
-hmac-sha1-96,hmac-md5-96
+hmac-sha1-etm at openssh.com,
+umac-64 at openssh.com,umac-128 at openssh.com,
+hmac-sha2-256,hmac-sha2-512,hmac-sha1
.Ed
+.Pp
+The list of available MAC algorithms may also be obtained using the
+.Fl Q
+option of
+.Xr ssh 1
+with an argument of
+.Dq mac .
.It Cm Match
Introduces a conditional block.
If all of the criteria on the
@@ -772,7 +1047,7 @@
line or the end of the file.
If a keyword appears in multiple
.Cm Match
-blocks that are satisified, only the first instance of the keyword is
+blocks that are satisfied, only the first instance of the keyword is
applied.
.Pp
The arguments to
@@ -816,6 +1091,7 @@
.Cm AcceptEnv ,
.Cm AllowAgentForwarding ,
.Cm AllowGroups ,
+.Cm AllowStreamLocalForwarding ,
.Cm AllowTcpForwarding ,
.Cm AllowUsers ,
.Cm AuthenticationMethods ,
@@ -822,6 +1098,8 @@
.Cm AuthorizedKeysCommand ,
.Cm AuthorizedKeysCommandUser ,
.Cm AuthorizedKeysFile ,
+.Cm AuthorizedPrincipalsCommand ,
+.Cm AuthorizedPrincipalsCommandUser ,
.Cm AuthorizedPrincipalsFile ,
.Cm Banner ,
.Cm ChrootDirectory ,
@@ -830,8 +1108,10 @@
.Cm ForceCommand ,
.Cm GatewayPorts ,
.Cm GSSAPIAuthentication ,
+.Cm HostbasedAcceptedKeyTypes ,
.Cm HostbasedAuthentication ,
.Cm HostbasedUsesNameFromPacketOnly ,
+.Cm IPQoS ,
.Cm KbdInteractiveAuthentication ,
.Cm KerberosAuthentication ,
.Cm MaxAuthTries ,
@@ -842,10 +1122,16 @@
.Cm PermitRootLogin ,
.Cm PermitTTY ,
.Cm PermitTunnel ,
+.Cm PermitUserRC ,
+.Cm PubkeyAcceptedKeyTypes ,
.Cm PubkeyAuthentication ,
.Cm RekeyLimit ,
+.Cm RevokedKeys ,
.Cm RhostsRSAAuthentication ,
.Cm RSAAuthentication ,
+.Cm StreamLocalBindMask ,
+.Cm StreamLocalBindUnlink ,
+.Cm TrustedUserCAKeys ,
.Cm X11DisplayOffset ,
.Cm X11Forwarding
and
@@ -857,7 +1143,15 @@
additional failures are logged.
The default is 6.
.It Cm MaxSessions
-Specifies the maximum number of open sessions permitted per network connection.
+Specifies the maximum number of open shell, login or subsystem (e.g. sftp)
+sessions permitted per network connection.
+Multiple sessions may be established by clients that support connection
+multiplexing.
+Setting
+.Cm MaxSessions
+to 1 will effectively disable session multiplexing, whereas setting it to 0
+will prevent all shell, login and subsystem sessions while still permitting
+forwarding.
The default is 10.
.It Cm MaxStartups
Specifies the maximum number of concurrent unauthenticated connections to the
@@ -921,6 +1215,9 @@
An argument of
.Dq none
can be used to prohibit all forwarding requests.
+The wildcard
+.Dq *
+can be used for host or port to allow all hosts or ports, respectively.
By default all port forwarding requests are permitted.
.It Cm PermitRootLogin
Specifies whether root can log in using
@@ -927,16 +1224,19 @@
.Xr ssh 1 .
The argument must be
.Dq yes ,
+.Dq prohibit-password ,
.Dq without-password ,
.Dq forced-commands-only ,
or
.Dq no .
The default is
-.Dq yes .
+.Dq prohibit-password .
.Pp
If this option is set to
+.Dq prohibit-password
+or
.Dq without-password ,
-password authentication is disabled for root.
+password and keyboard-interactive authentication are disabled for root.
.Pp
If this option is set to
.Dq forced-commands-only ,
@@ -970,6 +1270,10 @@
.Dq ethernet .
The default is
.Dq no .
+.Pp
+Independent of this setting, the permissions of the selected
+.Xr tun 4
+device must allow access to the user.
.It Cm PermitTTY
Specifies whether
.Xr pty 4
@@ -990,9 +1294,17 @@
Enabling environment processing may enable users to bypass access
restrictions in some configurations using mechanisms such as
.Ev LD_PRELOAD .
+.It Cm PermitUserRC
+Specifies whether any
+.Pa ~/.ssh/rc
+file is executed.
+The default is
+.Dq yes .
.It Cm PidFile
Specifies the file that contains the process ID of the
-SSH daemon.
+SSH daemon, or
+.Dq none
+to not write one.
The default is
.Pa /var/run/sshd.pid .
.It Cm Port
@@ -1032,6 +1344,10 @@
Multiple versions must be comma-separated.
The default is
.Sq 2 .
+Protocol 1 suffers from a number of cryptographic weaknesses and should
+not be used.
+It is only offered to support legacy devices.
+.Pp
Note that the order of the protocol list does not indicate preference,
because the client selects among multiple protocol versions offered
by the server.
@@ -1039,11 +1355,33 @@
.Dq 2,1
is identical to
.Dq 1,2 .
+.It Cm PubkeyAcceptedKeyTypes
+Specifies the key types that will be accepted for public key authentication
+as a comma-separated pattern list.
+Alternately if the specified value begins with a
+.Sq +
+character, then the specified key types will be appended to the default set
+instead of replacing them.
+The default for this option is:
+.Bd -literal -offset 3n
+ecdsa-sha2-nistp256-cert-v01 at openssh.com,
+ecdsa-sha2-nistp384-cert-v01 at openssh.com,
+ecdsa-sha2-nistp521-cert-v01 at openssh.com,
+ssh-ed25519-cert-v01 at openssh.com,
+ssh-rsa-cert-v01 at openssh.com,
+ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ssh-ed25519,ssh-rsa
+.Ed
+.Pp
+The
+.Fl Q
+option of
+.Xr ssh 1
+may be used to list supported key types.
.It Cm PubkeyAuthentication
Specifies whether public key authentication is allowed.
The default is
.Dq yes .
-Note that this option applies to protocol version 2 only.
.It Cm RekeyLimit
Specifies the maximum amount of data that may be transmitted before the
session key is renegotiated, optionally followed a maximum amount of
@@ -1069,9 +1407,10 @@
.Dq default none ,
which means that rekeying is performed after the cipher's default amount
of data has been sent or received and no time based rekeying is done.
-This option applies to protocol version 2 only.
.It Cm RevokedKeys
-Specifies revoked public keys.
+Specifies revoked public keys file, or
+.Dq none
+to not use one.
Keys listed in this file will be refused for public key authentication.
Note that if this file is not readable, then public key authentication will
be refused for all users.
@@ -1093,7 +1432,34 @@
This option applies to protocol version 1 only.
.It Cm ServerKeyBits
Defines the number of bits in the ephemeral protocol version 1 server key.
-The minimum value is 512, and the default is 1024.
+The default and minimum value is 1024.
+.It Cm StreamLocalBindMask
+Sets the octal file creation mode mask
+.Pq umask
+used when creating a Unix-domain socket file for local or remote
+port forwarding.
+This option is only used for port forwarding to a Unix-domain socket file.
+.Pp
+The default value is 0177, which creates a Unix-domain socket file that is
+readable and writable only by the owner.
+Note that not all operating systems honor the file mode on Unix-domain
+socket files.
+.It Cm StreamLocalBindUnlink
+Specifies whether to remove an existing Unix-domain socket file for local
+or remote port forwarding before creating a new one.
+If the socket file already exists and
+.Cm StreamLocalBindUnlink
+is not enabled,
+.Nm sshd
+will be unable to forward the port to the Unix-domain socket file.
+This option is only used for port forwarding to a Unix-domain socket file.
+.Pp
+The argument must be
+.Dq yes
+or
+.Dq no .
+The default is
+.Dq no .
.It Cm StrictModes
Specifies whether
.Xr sshd 8
@@ -1127,7 +1493,6 @@
to force a different filesystem root on clients.
.Pp
By default no subsystems are defined.
-Note that this option applies to protocol version 2 only.
.It Cm SyslogFacility
Gives the facility code that is used when logging messages from
.Xr sshd 8 .
@@ -1157,7 +1522,9 @@
.Dq no .
.It Cm TrustedUserCAKeys
Specifies a file containing public keys of certificate authorities that are
-trusted to sign user certificates for authentication.
+trusted to sign user certificates for authentication, or
+.Dq none
+to not use one.
Keys are listed one per line; empty lines and comments starting with
.Ql #
are allowed.
@@ -1172,11 +1539,20 @@
.It Cm UseDNS
Specifies whether
.Xr sshd 8
-should look up the remote host name and check that
+should look up the remote host name, and to check that
the resolved host name for the remote IP address maps back to the
very same IP address.
-The default is
-.Dq yes .
+.Pp
+If this option is set to
+.Dq no
+(the default) then only addresses and not host names may be used in
+.Pa ~/.ssh/authorized_keys
+.Cm from
+and
+.Nm
+.Cm Match
+.Cm Host
+directives.
.It Cm UseLogin
Specifies whether
.Xr login 1
@@ -1229,8 +1605,11 @@
the privilege of the authenticated user.
The goal of privilege separation is to prevent privilege
escalation by containing any corruption within the unprivileged processes.
-The default is
-.Dq yes .
+The argument must be
+.Dq yes ,
+.Dq no ,
+or
+.Dq sandbox .
If
.Cm UsePrivilegeSeparation
is set to
@@ -1237,6 +1616,8 @@
.Dq sandbox
then the pre-authentication unprivileged process is subject to additional
restrictions.
+The default is
+.Dq sandbox .
.It Cm VersionAddendum
Optionally specifies additional text to append to the SSH protocol banner
sent by the server upon connection.
@@ -1310,7 +1691,9 @@
.It Cm XAuthLocation
Specifies the full pathname of the
.Xr xauth 1
-program.
+program, or
+.Dq none
+to not use one.
The default is
.Pa /usr/X11R6/bin/xauth .
.El
Copied: trunk/crypto/openssh/ssherr.c (from rev 9222, vendor-crypto/openssh/dist/ssherr.c)
===================================================================
--- trunk/crypto/openssh/ssherr.c (rev 0)
+++ trunk/crypto/openssh/ssherr.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,141 @@
+/* $OpenBSD: ssherr.c,v 1.5 2015/09/13 14:39:16 tim Exp $ */
+/*
+ * Copyright (c) 2011 Damien Miller
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <errno.h>
+#include <string.h>
+#include "ssherr.h"
+
+const char *
+ssh_err(int n)
+{
+ switch (n) {
+ case SSH_ERR_SUCCESS:
+ return "success";
+ case SSH_ERR_INTERNAL_ERROR:
+ return "unexpected internal error";
+ case SSH_ERR_ALLOC_FAIL:
+ return "memory allocation failed";
+ case SSH_ERR_MESSAGE_INCOMPLETE:
+ return "incomplete message";
+ case SSH_ERR_INVALID_FORMAT:
+ return "invalid format";
+ case SSH_ERR_BIGNUM_IS_NEGATIVE:
+ return "bignum is negative";
+ case SSH_ERR_STRING_TOO_LARGE:
+ return "string is too large";
+ case SSH_ERR_BIGNUM_TOO_LARGE:
+ return "bignum is too large";
+ case SSH_ERR_ECPOINT_TOO_LARGE:
+ return "elliptic curve point is too large";
+ case SSH_ERR_NO_BUFFER_SPACE:
+ return "insufficient buffer space";
+ case SSH_ERR_INVALID_ARGUMENT:
+ return "invalid argument";
+ case SSH_ERR_KEY_BITS_MISMATCH:
+ return "key bits do not match";
+ case SSH_ERR_EC_CURVE_INVALID:
+ return "invalid elliptic curve";
+ case SSH_ERR_KEY_TYPE_MISMATCH:
+ return "key type does not match";
+ case SSH_ERR_KEY_TYPE_UNKNOWN:
+ return "unknown or unsupported key type";
+ case SSH_ERR_EC_CURVE_MISMATCH:
+ return "elliptic curve does not match";
+ case SSH_ERR_EXPECTED_CERT:
+ return "plain key provided where certificate required";
+ case SSH_ERR_KEY_LACKS_CERTBLOB:
+ return "key lacks certificate data";
+ case SSH_ERR_KEY_CERT_UNKNOWN_TYPE:
+ return "unknown/unsupported certificate type";
+ case SSH_ERR_KEY_CERT_INVALID_SIGN_KEY:
+ return "invalid certificate signing key";
+ case SSH_ERR_KEY_INVALID_EC_VALUE:
+ return "invalid elliptic curve value";
+ case SSH_ERR_SIGNATURE_INVALID:
+ return "incorrect signature";
+ case SSH_ERR_LIBCRYPTO_ERROR:
+ return "error in libcrypto"; /* XXX fetch and return */
+ case SSH_ERR_UNEXPECTED_TRAILING_DATA:
+ return "unexpected bytes remain after decoding";
+ case SSH_ERR_SYSTEM_ERROR:
+ return strerror(errno);
+ case SSH_ERR_KEY_CERT_INVALID:
+ return "invalid certificate";
+ case SSH_ERR_AGENT_COMMUNICATION:
+ return "communication with agent failed";
+ case SSH_ERR_AGENT_FAILURE:
+ return "agent refused operation";
+ case SSH_ERR_DH_GEX_OUT_OF_RANGE:
+ return "DH GEX group out of range";
+ case SSH_ERR_DISCONNECTED:
+ return "disconnected";
+ case SSH_ERR_MAC_INVALID:
+ return "message authentication code incorrect";
+ case SSH_ERR_NO_CIPHER_ALG_MATCH:
+ return "no matching cipher found";
+ case SSH_ERR_NO_MAC_ALG_MATCH:
+ return "no matching MAC found";
+ case SSH_ERR_NO_COMPRESS_ALG_MATCH:
+ return "no matching compression method found";
+ case SSH_ERR_NO_KEX_ALG_MATCH:
+ return "no matching key exchange method found";
+ case SSH_ERR_NO_HOSTKEY_ALG_MATCH:
+ return "no matching host key type found";
+ case SSH_ERR_PROTOCOL_MISMATCH:
+ return "protocol version mismatch";
+ case SSH_ERR_NO_PROTOCOL_VERSION:
+ return "could not read protocol version";
+ case SSH_ERR_NO_HOSTKEY_LOADED:
+ return "could not load host key";
+ case SSH_ERR_NEED_REKEY:
+ return "rekeying not supported by peer";
+ case SSH_ERR_PASSPHRASE_TOO_SHORT:
+ return "passphrase is too short (minimum five characters)";
+ case SSH_ERR_FILE_CHANGED:
+ return "file changed while reading";
+ case SSH_ERR_KEY_UNKNOWN_CIPHER:
+ return "key encrypted using unsupported cipher";
+ case SSH_ERR_KEY_WRONG_PASSPHRASE:
+ return "incorrect passphrase supplied to decrypt private key";
+ case SSH_ERR_KEY_BAD_PERMISSIONS:
+ return "bad permissions";
+ case SSH_ERR_KEY_CERT_MISMATCH:
+ return "certificate does not match key";
+ case SSH_ERR_KEY_NOT_FOUND:
+ return "key not found";
+ case SSH_ERR_AGENT_NOT_PRESENT:
+ return "agent not present";
+ case SSH_ERR_AGENT_NO_IDENTITIES:
+ return "agent contains no identities";
+ case SSH_ERR_BUFFER_READ_ONLY:
+ return "internal error: buffer is read-only";
+ case SSH_ERR_KRL_BAD_MAGIC:
+ return "KRL file has invalid magic number";
+ case SSH_ERR_KEY_REVOKED:
+ return "Key is revoked";
+ case SSH_ERR_CONN_CLOSED:
+ return "Connection closed";
+ case SSH_ERR_CONN_TIMEOUT:
+ return "Connection timed out";
+ case SSH_ERR_CONN_CORRUPT:
+ return "Connection corrupted";
+ case SSH_ERR_PROTOCOL_ERROR:
+ return "Protocol error";
+ default:
+ return "unknown error";
+ }
+}
Copied: trunk/crypto/openssh/ssherr.h (from rev 9222, vendor-crypto/openssh/dist/ssherr.h)
===================================================================
--- trunk/crypto/openssh/ssherr.h (rev 0)
+++ trunk/crypto/openssh/ssherr.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,84 @@
+/* $OpenBSD: ssherr.h,v 1.3 2015/01/30 01:13:33 djm Exp $ */
+/*
+ * Copyright (c) 2011 Damien Miller
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _SSHERR_H
+#define _SSHERR_H
+
+/* XXX are these too granular? not granular enough? I can't decide - djm */
+
+/* Error codes */
+#define SSH_ERR_SUCCESS 0
+#define SSH_ERR_INTERNAL_ERROR -1
+#define SSH_ERR_ALLOC_FAIL -2
+#define SSH_ERR_MESSAGE_INCOMPLETE -3
+#define SSH_ERR_INVALID_FORMAT -4
+#define SSH_ERR_BIGNUM_IS_NEGATIVE -5
+#define SSH_ERR_STRING_TOO_LARGE -6
+#define SSH_ERR_BIGNUM_TOO_LARGE -7
+#define SSH_ERR_ECPOINT_TOO_LARGE -8
+#define SSH_ERR_NO_BUFFER_SPACE -9
+#define SSH_ERR_INVALID_ARGUMENT -10
+#define SSH_ERR_KEY_BITS_MISMATCH -11
+#define SSH_ERR_EC_CURVE_INVALID -12
+#define SSH_ERR_KEY_TYPE_MISMATCH -13
+#define SSH_ERR_KEY_TYPE_UNKNOWN -14 /* XXX UNSUPPORTED? */
+#define SSH_ERR_EC_CURVE_MISMATCH -15
+#define SSH_ERR_EXPECTED_CERT -16
+#define SSH_ERR_KEY_LACKS_CERTBLOB -17
+#define SSH_ERR_KEY_CERT_UNKNOWN_TYPE -18
+#define SSH_ERR_KEY_CERT_INVALID_SIGN_KEY -19
+#define SSH_ERR_KEY_INVALID_EC_VALUE -20
+#define SSH_ERR_SIGNATURE_INVALID -21
+#define SSH_ERR_LIBCRYPTO_ERROR -22
+#define SSH_ERR_UNEXPECTED_TRAILING_DATA -23
+#define SSH_ERR_SYSTEM_ERROR -24
+#define SSH_ERR_KEY_CERT_INVALID -25
+#define SSH_ERR_AGENT_COMMUNICATION -26
+#define SSH_ERR_AGENT_FAILURE -27
+#define SSH_ERR_DH_GEX_OUT_OF_RANGE -28
+#define SSH_ERR_DISCONNECTED -29
+#define SSH_ERR_MAC_INVALID -30
+#define SSH_ERR_NO_CIPHER_ALG_MATCH -31
+#define SSH_ERR_NO_MAC_ALG_MATCH -32
+#define SSH_ERR_NO_COMPRESS_ALG_MATCH -33
+#define SSH_ERR_NO_KEX_ALG_MATCH -34
+#define SSH_ERR_NO_HOSTKEY_ALG_MATCH -35
+#define SSH_ERR_NO_HOSTKEY_LOADED -36
+#define SSH_ERR_PROTOCOL_MISMATCH -37
+#define SSH_ERR_NO_PROTOCOL_VERSION -38
+#define SSH_ERR_NEED_REKEY -39
+#define SSH_ERR_PASSPHRASE_TOO_SHORT -40
+#define SSH_ERR_FILE_CHANGED -41
+#define SSH_ERR_KEY_UNKNOWN_CIPHER -42
+#define SSH_ERR_KEY_WRONG_PASSPHRASE -43
+#define SSH_ERR_KEY_BAD_PERMISSIONS -44
+#define SSH_ERR_KEY_CERT_MISMATCH -45
+#define SSH_ERR_KEY_NOT_FOUND -46
+#define SSH_ERR_AGENT_NOT_PRESENT -47
+#define SSH_ERR_AGENT_NO_IDENTITIES -48
+#define SSH_ERR_BUFFER_READ_ONLY -49
+#define SSH_ERR_KRL_BAD_MAGIC -50
+#define SSH_ERR_KEY_REVOKED -51
+#define SSH_ERR_CONN_CLOSED -52
+#define SSH_ERR_CONN_TIMEOUT -53
+#define SSH_ERR_CONN_CORRUPT -54
+#define SSH_ERR_PROTOCOL_ERROR -55
+
+/* Translate a numeric error code to a human-readable error string */
+const char *ssh_err(int n);
+
+#endif /* _SSHERR_H */
Copied: trunk/crypto/openssh/sshkey.c (from rev 9222, vendor-crypto/openssh/dist/sshkey.c)
===================================================================
--- trunk/crypto/openssh/sshkey.c (rev 0)
+++ trunk/crypto/openssh/sshkey.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,3917 @@
+/* $OpenBSD: sshkey.c,v 1.35 2016/06/19 07:48:02 djm Exp $ */
+/*
+ * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
+ * Copyright (c) 2008 Alexander von Gernler. All rights reserved.
+ * Copyright (c) 2010,2011 Damien Miller. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+
+#include <sys/param.h> /* MIN MAX */
+#include <sys/types.h>
+#include <netinet/in.h>
+
+#ifdef WITH_OPENSSL
+#include <openssl/evp.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#endif
+
+#include "crypto_api.h"
+
+#include <errno.h>
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <resolv.h>
+#ifdef HAVE_UTIL_H
+#include <util.h>
+#endif /* HAVE_UTIL_H */
+
+#include "ssh2.h"
+#include "ssherr.h"
+#include "misc.h"
+#include "sshbuf.h"
+#include "rsa.h"
+#include "cipher.h"
+#include "digest.h"
+#define SSHKEY_INTERNAL
+#include "sshkey.h"
+#include "match.h"
+
+/* openssh private key file format */
+#define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n"
+#define MARK_END "-----END OPENSSH PRIVATE KEY-----\n"
+#define MARK_BEGIN_LEN (sizeof(MARK_BEGIN) - 1)
+#define MARK_END_LEN (sizeof(MARK_END) - 1)
+#define KDFNAME "bcrypt"
+#define AUTH_MAGIC "openssh-key-v1"
+#define SALT_LEN 16
+#define DEFAULT_CIPHERNAME "aes256-cbc"
+#define DEFAULT_ROUNDS 16
+
+/* Version identification string for SSH v1 identity files. */
+#define LEGACY_BEGIN "SSH PRIVATE KEY FILE FORMAT 1.1\n"
+
+static int sshkey_from_blob_internal(struct sshbuf *buf,
+ struct sshkey **keyp, int allow_cert);
+
+/* Supported key types */
+struct keytype {
+ const char *name;
+ const char *shortname;
+ int type;
+ int nid;
+ int cert;
+ int sigonly;
+};
+static const struct keytype keytypes[] = {
+ { "ssh-ed25519", "ED25519", KEY_ED25519, 0, 0, 0 },
+ { "ssh-ed25519-cert-v01 at openssh.com", "ED25519-CERT",
+ KEY_ED25519_CERT, 0, 1, 0 },
+#ifdef WITH_OPENSSL
+ { NULL, "RSA1", KEY_RSA1, 0, 0, 0 },
+ { "ssh-rsa", "RSA", KEY_RSA, 0, 0, 0 },
+ { "rsa-sha2-256", "RSA", KEY_RSA, 0, 0, 1 },
+ { "rsa-sha2-512", "RSA", KEY_RSA, 0, 0, 1 },
+ { "ssh-dss", "DSA", KEY_DSA, 0, 0, 0 },
+# ifdef OPENSSL_HAS_ECC
+ { "ecdsa-sha2-nistp256", "ECDSA", KEY_ECDSA, NID_X9_62_prime256v1, 0, 0 },
+ { "ecdsa-sha2-nistp384", "ECDSA", KEY_ECDSA, NID_secp384r1, 0, 0 },
+# ifdef OPENSSL_HAS_NISTP521
+ { "ecdsa-sha2-nistp521", "ECDSA", KEY_ECDSA, NID_secp521r1, 0, 0 },
+# endif /* OPENSSL_HAS_NISTP521 */
+# endif /* OPENSSL_HAS_ECC */
+ { "ssh-rsa-cert-v01 at openssh.com", "RSA-CERT", KEY_RSA_CERT, 0, 1, 0 },
+ { "ssh-dss-cert-v01 at openssh.com", "DSA-CERT", KEY_DSA_CERT, 0, 1, 0 },
+# ifdef OPENSSL_HAS_ECC
+ { "ecdsa-sha2-nistp256-cert-v01 at openssh.com", "ECDSA-CERT",
+ KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1, 0 },
+ { "ecdsa-sha2-nistp384-cert-v01 at openssh.com", "ECDSA-CERT",
+ KEY_ECDSA_CERT, NID_secp384r1, 1, 0 },
+# ifdef OPENSSL_HAS_NISTP521
+ { "ecdsa-sha2-nistp521-cert-v01 at openssh.com", "ECDSA-CERT",
+ KEY_ECDSA_CERT, NID_secp521r1, 1, 0 },
+# endif /* OPENSSL_HAS_NISTP521 */
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ { NULL, NULL, -1, -1, 0, 0 }
+};
+
+const char *
+sshkey_type(const struct sshkey *k)
+{
+ const struct keytype *kt;
+
+ for (kt = keytypes; kt->type != -1; kt++) {
+ if (kt->type == k->type)
+ return kt->shortname;
+ }
+ return "unknown";
+}
+
+static const char *
+sshkey_ssh_name_from_type_nid(int type, int nid)
+{
+ const struct keytype *kt;
+
+ for (kt = keytypes; kt->type != -1; kt++) {
+ if (kt->type == type && (kt->nid == 0 || kt->nid == nid))
+ return kt->name;
+ }
+ return "ssh-unknown";
+}
+
+int
+sshkey_type_is_cert(int type)
+{
+ const struct keytype *kt;
+
+ for (kt = keytypes; kt->type != -1; kt++) {
+ if (kt->type == type)
+ return kt->cert;
+ }
+ return 0;
+}
+
+const char *
+sshkey_ssh_name(const struct sshkey *k)
+{
+ return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid);
+}
+
+const char *
+sshkey_ssh_name_plain(const struct sshkey *k)
+{
+ return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type),
+ k->ecdsa_nid);
+}
+
+int
+sshkey_type_from_name(const char *name)
+{
+ const struct keytype *kt;
+
+ for (kt = keytypes; kt->type != -1; kt++) {
+ /* Only allow shortname matches for plain key types */
+ if ((kt->name != NULL && strcmp(name, kt->name) == 0) ||
+ (!kt->cert && strcasecmp(kt->shortname, name) == 0))
+ return kt->type;
+ }
+ return KEY_UNSPEC;
+}
+
+int
+sshkey_ecdsa_nid_from_name(const char *name)
+{
+ const struct keytype *kt;
+
+ for (kt = keytypes; kt->type != -1; kt++) {
+ if (kt->type != KEY_ECDSA && kt->type != KEY_ECDSA_CERT)
+ continue;
+ if (kt->name != NULL && strcmp(name, kt->name) == 0)
+ return kt->nid;
+ }
+ return -1;
+}
+
+char *
+key_alg_list(int certs_only, int plain_only)
+{
+ char *tmp, *ret = NULL;
+ size_t nlen, rlen = 0;
+ const struct keytype *kt;
+
+ for (kt = keytypes; kt->type != -1; kt++) {
+ if (kt->name == NULL || kt->sigonly)
+ continue;
+ if ((certs_only && !kt->cert) || (plain_only && kt->cert))
+ continue;
+ if (ret != NULL)
+ ret[rlen++] = '\n';
+ nlen = strlen(kt->name);
+ if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) {
+ free(ret);
+ return NULL;
+ }
+ ret = tmp;
+ memcpy(ret + rlen, kt->name, nlen + 1);
+ rlen += nlen;
+ }
+ return ret;
+}
+
+int
+sshkey_names_valid2(const char *names, int allow_wildcard)
+{
+ char *s, *cp, *p;
+ const struct keytype *kt;
+ int type;
+
+ if (names == NULL || strcmp(names, "") == 0)
+ return 0;
+ if ((s = cp = strdup(names)) == NULL)
+ return 0;
+ for ((p = strsep(&cp, ",")); p && *p != '\0';
+ (p = strsep(&cp, ","))) {
+ type = sshkey_type_from_name(p);
+ if (type == KEY_RSA1) {
+ free(s);
+ return 0;
+ }
+ if (type == KEY_UNSPEC) {
+ if (allow_wildcard) {
+ /*
+ * Try matching key types against the string.
+ * If any has a positive or negative match then
+ * the component is accepted.
+ */
+ for (kt = keytypes; kt->type != -1; kt++) {
+ if (kt->type == KEY_RSA1)
+ continue;
+ if (match_pattern_list(kt->name,
+ p, 0) != 0)
+ break;
+ }
+ if (kt->type != -1)
+ continue;
+ }
+ free(s);
+ return 0;
+ }
+ }
+ free(s);
+ return 1;
+}
+
+u_int
+sshkey_size(const struct sshkey *k)
+{
+ switch (k->type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA1:
+ case KEY_RSA:
+ case KEY_RSA_CERT:
+ return BN_num_bits(k->rsa->n);
+ case KEY_DSA:
+ case KEY_DSA_CERT:
+ return BN_num_bits(k->dsa->p);
+ case KEY_ECDSA:
+ case KEY_ECDSA_CERT:
+ return sshkey_curve_nid_to_bits(k->ecdsa_nid);
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ case KEY_ED25519_CERT:
+ return 256; /* XXX */
+ }
+ return 0;
+}
+
+static int
+sshkey_type_is_valid_ca(int type)
+{
+ switch (type) {
+ case KEY_RSA:
+ case KEY_DSA:
+ case KEY_ECDSA:
+ case KEY_ED25519:
+ return 1;
+ default:
+ return 0;
+ }
+}
+
+int
+sshkey_is_cert(const struct sshkey *k)
+{
+ if (k == NULL)
+ return 0;
+ return sshkey_type_is_cert(k->type);
+}
+
+/* Return the cert-less equivalent to a certified key type */
+int
+sshkey_type_plain(int type)
+{
+ switch (type) {
+ case KEY_RSA_CERT:
+ return KEY_RSA;
+ case KEY_DSA_CERT:
+ return KEY_DSA;
+ case KEY_ECDSA_CERT:
+ return KEY_ECDSA;
+ case KEY_ED25519_CERT:
+ return KEY_ED25519;
+ default:
+ return type;
+ }
+}
+
+#ifdef WITH_OPENSSL
+/* XXX: these are really begging for a table-driven approach */
+int
+sshkey_curve_name_to_nid(const char *name)
+{
+ if (strcmp(name, "nistp256") == 0)
+ return NID_X9_62_prime256v1;
+ else if (strcmp(name, "nistp384") == 0)
+ return NID_secp384r1;
+# ifdef OPENSSL_HAS_NISTP521
+ else if (strcmp(name, "nistp521") == 0)
+ return NID_secp521r1;
+# endif /* OPENSSL_HAS_NISTP521 */
+ else
+ return -1;
+}
+
+u_int
+sshkey_curve_nid_to_bits(int nid)
+{
+ switch (nid) {
+ case NID_X9_62_prime256v1:
+ return 256;
+ case NID_secp384r1:
+ return 384;
+# ifdef OPENSSL_HAS_NISTP521
+ case NID_secp521r1:
+ return 521;
+# endif /* OPENSSL_HAS_NISTP521 */
+ default:
+ return 0;
+ }
+}
+
+int
+sshkey_ecdsa_bits_to_nid(int bits)
+{
+ switch (bits) {
+ case 256:
+ return NID_X9_62_prime256v1;
+ case 384:
+ return NID_secp384r1;
+# ifdef OPENSSL_HAS_NISTP521
+ case 521:
+ return NID_secp521r1;
+# endif /* OPENSSL_HAS_NISTP521 */
+ default:
+ return -1;
+ }
+}
+
+const char *
+sshkey_curve_nid_to_name(int nid)
+{
+ switch (nid) {
+ case NID_X9_62_prime256v1:
+ return "nistp256";
+ case NID_secp384r1:
+ return "nistp384";
+# ifdef OPENSSL_HAS_NISTP521
+ case NID_secp521r1:
+ return "nistp521";
+# endif /* OPENSSL_HAS_NISTP521 */
+ default:
+ return NULL;
+ }
+}
+
+int
+sshkey_ec_nid_to_hash_alg(int nid)
+{
+ int kbits = sshkey_curve_nid_to_bits(nid);
+
+ if (kbits <= 0)
+ return -1;
+
+ /* RFC5656 section 6.2.1 */
+ if (kbits <= 256)
+ return SSH_DIGEST_SHA256;
+ else if (kbits <= 384)
+ return SSH_DIGEST_SHA384;
+ else
+ return SSH_DIGEST_SHA512;
+}
+#endif /* WITH_OPENSSL */
+
+static void
+cert_free(struct sshkey_cert *cert)
+{
+ u_int i;
+
+ if (cert == NULL)
+ return;
+ sshbuf_free(cert->certblob);
+ sshbuf_free(cert->critical);
+ sshbuf_free(cert->extensions);
+ free(cert->key_id);
+ for (i = 0; i < cert->nprincipals; i++)
+ free(cert->principals[i]);
+ free(cert->principals);
+ sshkey_free(cert->signature_key);
+ explicit_bzero(cert, sizeof(*cert));
+ free(cert);
+}
+
+static struct sshkey_cert *
+cert_new(void)
+{
+ struct sshkey_cert *cert;
+
+ if ((cert = calloc(1, sizeof(*cert))) == NULL)
+ return NULL;
+ if ((cert->certblob = sshbuf_new()) == NULL ||
+ (cert->critical = sshbuf_new()) == NULL ||
+ (cert->extensions = sshbuf_new()) == NULL) {
+ cert_free(cert);
+ return NULL;
+ }
+ cert->key_id = NULL;
+ cert->principals = NULL;
+ cert->signature_key = NULL;
+ return cert;
+}
+
+struct sshkey *
+sshkey_new(int type)
+{
+ struct sshkey *k;
+#ifdef WITH_OPENSSL
+ RSA *rsa;
+ DSA *dsa;
+#endif /* WITH_OPENSSL */
+
+ if ((k = calloc(1, sizeof(*k))) == NULL)
+ return NULL;
+ k->type = type;
+ k->ecdsa = NULL;
+ k->ecdsa_nid = -1;
+ k->dsa = NULL;
+ k->rsa = NULL;
+ k->cert = NULL;
+ k->ed25519_sk = NULL;
+ k->ed25519_pk = NULL;
+ switch (k->type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA1:
+ case KEY_RSA:
+ case KEY_RSA_CERT:
+ if ((rsa = RSA_new()) == NULL ||
+ (rsa->n = BN_new()) == NULL ||
+ (rsa->e = BN_new()) == NULL) {
+ if (rsa != NULL)
+ RSA_free(rsa);
+ free(k);
+ return NULL;
+ }
+ k->rsa = rsa;
+ break;
+ case KEY_DSA:
+ case KEY_DSA_CERT:
+ if ((dsa = DSA_new()) == NULL ||
+ (dsa->p = BN_new()) == NULL ||
+ (dsa->q = BN_new()) == NULL ||
+ (dsa->g = BN_new()) == NULL ||
+ (dsa->pub_key = BN_new()) == NULL) {
+ if (dsa != NULL)
+ DSA_free(dsa);
+ free(k);
+ return NULL;
+ }
+ k->dsa = dsa;
+ break;
+ case KEY_ECDSA:
+ case KEY_ECDSA_CERT:
+ /* Cannot do anything until we know the group */
+ break;
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ case KEY_ED25519_CERT:
+ /* no need to prealloc */
+ break;
+ case KEY_UNSPEC:
+ break;
+ default:
+ free(k);
+ return NULL;
+ break;
+ }
+
+ if (sshkey_is_cert(k)) {
+ if ((k->cert = cert_new()) == NULL) {
+ sshkey_free(k);
+ return NULL;
+ }
+ }
+
+ return k;
+}
+
+int
+sshkey_add_private(struct sshkey *k)
+{
+ switch (k->type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA1:
+ case KEY_RSA:
+ case KEY_RSA_CERT:
+#define bn_maybe_alloc_failed(p) (p == NULL && (p = BN_new()) == NULL)
+ if (bn_maybe_alloc_failed(k->rsa->d) ||
+ bn_maybe_alloc_failed(k->rsa->iqmp) ||
+ bn_maybe_alloc_failed(k->rsa->q) ||
+ bn_maybe_alloc_failed(k->rsa->p) ||
+ bn_maybe_alloc_failed(k->rsa->dmq1) ||
+ bn_maybe_alloc_failed(k->rsa->dmp1))
+ return SSH_ERR_ALLOC_FAIL;
+ break;
+ case KEY_DSA:
+ case KEY_DSA_CERT:
+ if (bn_maybe_alloc_failed(k->dsa->priv_key))
+ return SSH_ERR_ALLOC_FAIL;
+ break;
+#undef bn_maybe_alloc_failed
+ case KEY_ECDSA:
+ case KEY_ECDSA_CERT:
+ /* Cannot do anything until we know the group */
+ break;
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ case KEY_ED25519_CERT:
+ /* no need to prealloc */
+ break;
+ case KEY_UNSPEC:
+ break;
+ default:
+ return SSH_ERR_INVALID_ARGUMENT;
+ }
+ return 0;
+}
+
+struct sshkey *
+sshkey_new_private(int type)
+{
+ struct sshkey *k = sshkey_new(type);
+
+ if (k == NULL)
+ return NULL;
+ if (sshkey_add_private(k) != 0) {
+ sshkey_free(k);
+ return NULL;
+ }
+ return k;
+}
+
+void
+sshkey_free(struct sshkey *k)
+{
+ if (k == NULL)
+ return;
+ switch (k->type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA1:
+ case KEY_RSA:
+ case KEY_RSA_CERT:
+ if (k->rsa != NULL)
+ RSA_free(k->rsa);
+ k->rsa = NULL;
+ break;
+ case KEY_DSA:
+ case KEY_DSA_CERT:
+ if (k->dsa != NULL)
+ DSA_free(k->dsa);
+ k->dsa = NULL;
+ break;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ case KEY_ECDSA_CERT:
+ if (k->ecdsa != NULL)
+ EC_KEY_free(k->ecdsa);
+ k->ecdsa = NULL;
+ break;
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ case KEY_ED25519_CERT:
+ if (k->ed25519_pk) {
+ explicit_bzero(k->ed25519_pk, ED25519_PK_SZ);
+ free(k->ed25519_pk);
+ k->ed25519_pk = NULL;
+ }
+ if (k->ed25519_sk) {
+ explicit_bzero(k->ed25519_sk, ED25519_SK_SZ);
+ free(k->ed25519_sk);
+ k->ed25519_sk = NULL;
+ }
+ break;
+ case KEY_UNSPEC:
+ break;
+ default:
+ break;
+ }
+ if (sshkey_is_cert(k))
+ cert_free(k->cert);
+ explicit_bzero(k, sizeof(*k));
+ free(k);
+}
+
+static int
+cert_compare(struct sshkey_cert *a, struct sshkey_cert *b)
+{
+ if (a == NULL && b == NULL)
+ return 1;
+ if (a == NULL || b == NULL)
+ return 0;
+ if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob))
+ return 0;
+ if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob),
+ sshbuf_len(a->certblob)) != 0)
+ return 0;
+ return 1;
+}
+
+/*
+ * Compare public portions of key only, allowing comparisons between
+ * certificates and plain keys too.
+ */
+int
+sshkey_equal_public(const struct sshkey *a, const struct sshkey *b)
+{
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+ BN_CTX *bnctx;
+#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
+
+ if (a == NULL || b == NULL ||
+ sshkey_type_plain(a->type) != sshkey_type_plain(b->type))
+ return 0;
+
+ switch (a->type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA1:
+ case KEY_RSA_CERT:
+ case KEY_RSA:
+ return a->rsa != NULL && b->rsa != NULL &&
+ BN_cmp(a->rsa->e, b->rsa->e) == 0 &&
+ BN_cmp(a->rsa->n, b->rsa->n) == 0;
+ case KEY_DSA_CERT:
+ case KEY_DSA:
+ return a->dsa != NULL && b->dsa != NULL &&
+ BN_cmp(a->dsa->p, b->dsa->p) == 0 &&
+ BN_cmp(a->dsa->q, b->dsa->q) == 0 &&
+ BN_cmp(a->dsa->g, b->dsa->g) == 0 &&
+ BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA_CERT:
+ case KEY_ECDSA:
+ if (a->ecdsa == NULL || b->ecdsa == NULL ||
+ EC_KEY_get0_public_key(a->ecdsa) == NULL ||
+ EC_KEY_get0_public_key(b->ecdsa) == NULL)
+ return 0;
+ if ((bnctx = BN_CTX_new()) == NULL)
+ return 0;
+ if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa),
+ EC_KEY_get0_group(b->ecdsa), bnctx) != 0 ||
+ EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa),
+ EC_KEY_get0_public_key(a->ecdsa),
+ EC_KEY_get0_public_key(b->ecdsa), bnctx) != 0) {
+ BN_CTX_free(bnctx);
+ return 0;
+ }
+ BN_CTX_free(bnctx);
+ return 1;
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ case KEY_ED25519_CERT:
+ return a->ed25519_pk != NULL && b->ed25519_pk != NULL &&
+ memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0;
+ default:
+ return 0;
+ }
+ /* NOTREACHED */
+}
+
+int
+sshkey_equal(const struct sshkey *a, const struct sshkey *b)
+{
+ if (a == NULL || b == NULL || a->type != b->type)
+ return 0;
+ if (sshkey_is_cert(a)) {
+ if (!cert_compare(a->cert, b->cert))
+ return 0;
+ }
+ return sshkey_equal_public(a, b);
+}
+
+static int
+to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain)
+{
+ int type, ret = SSH_ERR_INTERNAL_ERROR;
+ const char *typename;
+
+ if (key == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+
+ if (sshkey_is_cert(key)) {
+ if (key->cert == NULL)
+ return SSH_ERR_EXPECTED_CERT;
+ if (sshbuf_len(key->cert->certblob) == 0)
+ return SSH_ERR_KEY_LACKS_CERTBLOB;
+ }
+ type = force_plain ? sshkey_type_plain(key->type) : key->type;
+ typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid);
+
+ switch (type) {
+#ifdef WITH_OPENSSL
+ case KEY_DSA_CERT:
+ case KEY_ECDSA_CERT:
+ case KEY_RSA_CERT:
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519_CERT:
+ /* Use the existing blob */
+ /* XXX modified flag? */
+ if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0)
+ return ret;
+ break;
+#ifdef WITH_OPENSSL
+ case KEY_DSA:
+ if (key->dsa == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
+ (ret = sshbuf_put_bignum2(b, key->dsa->p)) != 0 ||
+ (ret = sshbuf_put_bignum2(b, key->dsa->q)) != 0 ||
+ (ret = sshbuf_put_bignum2(b, key->dsa->g)) != 0 ||
+ (ret = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0)
+ return ret;
+ break;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ if (key->ecdsa == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
+ (ret = sshbuf_put_cstring(b,
+ sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 ||
+ (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0)
+ return ret;
+ break;
+# endif
+ case KEY_RSA:
+ if (key->rsa == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
+ (ret = sshbuf_put_bignum2(b, key->rsa->e)) != 0 ||
+ (ret = sshbuf_put_bignum2(b, key->rsa->n)) != 0)
+ return ret;
+ break;
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ if (key->ed25519_pk == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((ret = sshbuf_put_cstring(b, typename)) != 0 ||
+ (ret = sshbuf_put_string(b,
+ key->ed25519_pk, ED25519_PK_SZ)) != 0)
+ return ret;
+ break;
+ default:
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
+ }
+ return 0;
+}
+
+int
+sshkey_putb(const struct sshkey *key, struct sshbuf *b)
+{
+ return to_blob_buf(key, b, 0);
+}
+
+int
+sshkey_puts(const struct sshkey *key, struct sshbuf *b)
+{
+ struct sshbuf *tmp;
+ int r;
+
+ if ((tmp = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ r = to_blob_buf(key, tmp, 0);
+ if (r == 0)
+ r = sshbuf_put_stringb(b, tmp);
+ sshbuf_free(tmp);
+ return r;
+}
+
+int
+sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b)
+{
+ return to_blob_buf(key, b, 1);
+}
+
+static int
+to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain)
+{
+ int ret = SSH_ERR_INTERNAL_ERROR;
+ size_t len;
+ struct sshbuf *b = NULL;
+
+ if (lenp != NULL)
+ *lenp = 0;
+ if (blobp != NULL)
+ *blobp = NULL;
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((ret = to_blob_buf(key, b, force_plain)) != 0)
+ goto out;
+ len = sshbuf_len(b);
+ if (lenp != NULL)
+ *lenp = len;
+ if (blobp != NULL) {
+ if ((*blobp = malloc(len)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ memcpy(*blobp, sshbuf_ptr(b), len);
+ }
+ ret = 0;
+ out:
+ sshbuf_free(b);
+ return ret;
+}
+
+int
+sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp)
+{
+ return to_blob(key, blobp, lenp, 0);
+}
+
+int
+sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp)
+{
+ return to_blob(key, blobp, lenp, 1);
+}
+
+int
+sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg,
+ u_char **retp, size_t *lenp)
+{
+ u_char *blob = NULL, *ret = NULL;
+ size_t blob_len = 0;
+ int r = SSH_ERR_INTERNAL_ERROR;
+
+ if (retp != NULL)
+ *retp = NULL;
+ if (lenp != NULL)
+ *lenp = 0;
+ if (ssh_digest_bytes(dgst_alg) == 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+
+ if (k->type == KEY_RSA1) {
+#ifdef WITH_OPENSSL
+ int nlen = BN_num_bytes(k->rsa->n);
+ int elen = BN_num_bytes(k->rsa->e);
+
+ blob_len = nlen + elen;
+ if (nlen >= INT_MAX - elen ||
+ (blob = malloc(blob_len)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ BN_bn2bin(k->rsa->n, blob);
+ BN_bn2bin(k->rsa->e, blob + nlen);
+#endif /* WITH_OPENSSL */
+ } else if ((r = to_blob(k, &blob, &blob_len, 1)) != 0)
+ goto out;
+ if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = ssh_digest_memory(dgst_alg, blob, blob_len,
+ ret, SSH_DIGEST_MAX_LENGTH)) != 0)
+ goto out;
+ /* success */
+ if (retp != NULL) {
+ *retp = ret;
+ ret = NULL;
+ }
+ if (lenp != NULL)
+ *lenp = ssh_digest_bytes(dgst_alg);
+ r = 0;
+ out:
+ free(ret);
+ if (blob != NULL) {
+ explicit_bzero(blob, blob_len);
+ free(blob);
+ }
+ return r;
+}
+
+static char *
+fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len)
+{
+ char *ret;
+ size_t plen = strlen(alg) + 1;
+ size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1;
+ int r;
+
+ if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL)
+ return NULL;
+ strlcpy(ret, alg, rlen);
+ strlcat(ret, ":", rlen);
+ if (dgst_raw_len == 0)
+ return ret;
+ if ((r = b64_ntop(dgst_raw, dgst_raw_len,
+ ret + plen, rlen - plen)) == -1) {
+ explicit_bzero(ret, rlen);
+ free(ret);
+ return NULL;
+ }
+ /* Trim padding characters from end */
+ ret[strcspn(ret, "=")] = '\0';
+ return ret;
+}
+
+static char *
+fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len)
+{
+ char *retval, hex[5];
+ size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2;
+
+ if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL)
+ return NULL;
+ strlcpy(retval, alg, rlen);
+ strlcat(retval, ":", rlen);
+ for (i = 0; i < dgst_raw_len; i++) {
+ snprintf(hex, sizeof(hex), "%s%02x",
+ i > 0 ? ":" : "", dgst_raw[i]);
+ strlcat(retval, hex, rlen);
+ }
+ return retval;
+}
+
+static char *
+fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len)
+{
+ char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' };
+ char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm',
+ 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' };
+ u_int i, j = 0, rounds, seed = 1;
+ char *retval;
+
+ rounds = (dgst_raw_len / 2) + 1;
+ if ((retval = calloc(rounds, 6)) == NULL)
+ return NULL;
+ retval[j++] = 'x';
+ for (i = 0; i < rounds; i++) {
+ u_int idx0, idx1, idx2, idx3, idx4;
+ if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) {
+ idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) +
+ seed) % 6;
+ idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15;
+ idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) +
+ (seed / 6)) % 6;
+ retval[j++] = vowels[idx0];
+ retval[j++] = consonants[idx1];
+ retval[j++] = vowels[idx2];
+ if ((i + 1) < rounds) {
+ idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15;
+ idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15;
+ retval[j++] = consonants[idx3];
+ retval[j++] = '-';
+ retval[j++] = consonants[idx4];
+ seed = ((seed * 5) +
+ ((((u_int)(dgst_raw[2 * i])) * 7) +
+ ((u_int)(dgst_raw[(2 * i) + 1])))) % 36;
+ }
+ } else {
+ idx0 = seed % 6;
+ idx1 = 16;
+ idx2 = seed / 6;
+ retval[j++] = vowels[idx0];
+ retval[j++] = consonants[idx1];
+ retval[j++] = vowels[idx2];
+ }
+ }
+ retval[j++] = 'x';
+ retval[j++] = '\0';
+ return retval;
+}
+
+/*
+ * Draw an ASCII-Art representing the fingerprint so human brain can
+ * profit from its built-in pattern recognition ability.
+ * This technique is called "random art" and can be found in some
+ * scientific publications like this original paper:
+ *
+ * "Hash Visualization: a New Technique to improve Real-World Security",
+ * Perrig A. and Song D., 1999, International Workshop on Cryptographic
+ * Techniques and E-Commerce (CrypTEC '99)
+ * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
+ *
+ * The subject came up in a talk by Dan Kaminsky, too.
+ *
+ * If you see the picture is different, the key is different.
+ * If the picture looks the same, you still know nothing.
+ *
+ * The algorithm used here is a worm crawling over a discrete plane,
+ * leaving a trace (augmenting the field) everywhere it goes.
+ * Movement is taken from dgst_raw 2bit-wise. Bumping into walls
+ * makes the respective movement vector be ignored for this turn.
+ * Graphs are not unambiguous, because circles in graphs can be
+ * walked in either direction.
+ */
+
+/*
+ * Field sizes for the random art. Have to be odd, so the starting point
+ * can be in the exact middle of the picture, and FLDBASE should be >=8 .
+ * Else pictures would be too dense, and drawing the frame would
+ * fail, too, because the key type would not fit in anymore.
+ */
+#define FLDBASE 8
+#define FLDSIZE_Y (FLDBASE + 1)
+#define FLDSIZE_X (FLDBASE * 2 + 1)
+static char *
+fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len,
+ const struct sshkey *k)
+{
+ /*
+ * Chars to be used after each other every time the worm
+ * intersects with itself. Matter of taste.
+ */
+ char *augmentation_string = " .o+=*BOX@%&#/^SE";
+ char *retval, *p, title[FLDSIZE_X], hash[FLDSIZE_X];
+ u_char field[FLDSIZE_X][FLDSIZE_Y];
+ size_t i, tlen, hlen;
+ u_int b;
+ int x, y, r;
+ size_t len = strlen(augmentation_string) - 1;
+
+ if ((retval = calloc((FLDSIZE_X + 3), (FLDSIZE_Y + 2))) == NULL)
+ return NULL;
+
+ /* initialize field */
+ memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char));
+ x = FLDSIZE_X / 2;
+ y = FLDSIZE_Y / 2;
+
+ /* process raw key */
+ for (i = 0; i < dgst_raw_len; i++) {
+ int input;
+ /* each byte conveys four 2-bit move commands */
+ input = dgst_raw[i];
+ for (b = 0; b < 4; b++) {
+ /* evaluate 2 bit, rest is shifted later */
+ x += (input & 0x1) ? 1 : -1;
+ y += (input & 0x2) ? 1 : -1;
+
+ /* assure we are still in bounds */
+ x = MAX(x, 0);
+ y = MAX(y, 0);
+ x = MIN(x, FLDSIZE_X - 1);
+ y = MIN(y, FLDSIZE_Y - 1);
+
+ /* augment the field */
+ if (field[x][y] < len - 2)
+ field[x][y]++;
+ input = input >> 2;
+ }
+ }
+
+ /* mark starting point and end point*/
+ field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1;
+ field[x][y] = len;
+
+ /* assemble title */
+ r = snprintf(title, sizeof(title), "[%s %u]",
+ sshkey_type(k), sshkey_size(k));
+ /* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */
+ if (r < 0 || r > (int)sizeof(title))
+ r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k));
+ tlen = (r <= 0) ? 0 : strlen(title);
+
+ /* assemble hash ID. */
+ r = snprintf(hash, sizeof(hash), "[%s]", alg);
+ hlen = (r <= 0) ? 0 : strlen(hash);
+
+ /* output upper border */
+ p = retval;
+ *p++ = '+';
+ for (i = 0; i < (FLDSIZE_X - tlen) / 2; i++)
+ *p++ = '-';
+ memcpy(p, title, tlen);
+ p += tlen;
+ for (i += tlen; i < FLDSIZE_X; i++)
+ *p++ = '-';
+ *p++ = '+';
+ *p++ = '\n';
+
+ /* output content */
+ for (y = 0; y < FLDSIZE_Y; y++) {
+ *p++ = '|';
+ for (x = 0; x < FLDSIZE_X; x++)
+ *p++ = augmentation_string[MIN(field[x][y], len)];
+ *p++ = '|';
+ *p++ = '\n';
+ }
+
+ /* output lower border */
+ *p++ = '+';
+ for (i = 0; i < (FLDSIZE_X - hlen) / 2; i++)
+ *p++ = '-';
+ memcpy(p, hash, hlen);
+ p += hlen;
+ for (i += hlen; i < FLDSIZE_X; i++)
+ *p++ = '-';
+ *p++ = '+';
+
+ return retval;
+}
+
+char *
+sshkey_fingerprint(const struct sshkey *k, int dgst_alg,
+ enum sshkey_fp_rep dgst_rep)
+{
+ char *retval = NULL;
+ u_char *dgst_raw;
+ size_t dgst_raw_len;
+
+ if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0)
+ return NULL;
+ switch (dgst_rep) {
+ case SSH_FP_DEFAULT:
+ if (dgst_alg == SSH_DIGEST_MD5) {
+ retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg),
+ dgst_raw, dgst_raw_len);
+ } else {
+ retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg),
+ dgst_raw, dgst_raw_len);
+ }
+ break;
+ case SSH_FP_HEX:
+ retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg),
+ dgst_raw, dgst_raw_len);
+ break;
+ case SSH_FP_BASE64:
+ retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg),
+ dgst_raw, dgst_raw_len);
+ break;
+ case SSH_FP_BUBBLEBABBLE:
+ retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len);
+ break;
+ case SSH_FP_RANDOMART:
+ retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg),
+ dgst_raw, dgst_raw_len, k);
+ break;
+ default:
+ explicit_bzero(dgst_raw, dgst_raw_len);
+ free(dgst_raw);
+ return NULL;
+ }
+ explicit_bzero(dgst_raw, dgst_raw_len);
+ free(dgst_raw);
+ return retval;
+}
+
+#ifdef WITH_SSH1
+/*
+ * Reads a multiple-precision integer in decimal from the buffer, and advances
+ * the pointer. The integer must already be initialized. This function is
+ * permitted to modify the buffer. This leaves *cpp to point just beyond the
+ * last processed character.
+ */
+static int
+read_decimal_bignum(char **cpp, BIGNUM *v)
+{
+ char *cp;
+ size_t e;
+ int skip = 1; /* skip white space */
+
+ cp = *cpp;
+ while (*cp == ' ' || *cp == '\t')
+ cp++;
+ e = strspn(cp, "0123456789");
+ if (e == 0)
+ return SSH_ERR_INVALID_FORMAT;
+ if (e > SSHBUF_MAX_BIGNUM * 3)
+ return SSH_ERR_BIGNUM_TOO_LARGE;
+ if (cp[e] == '\0')
+ skip = 0;
+ else if (strchr(" \t\r\n", cp[e]) == NULL)
+ return SSH_ERR_INVALID_FORMAT;
+ cp[e] = '\0';
+ if (BN_dec2bn(&v, cp) <= 0)
+ return SSH_ERR_INVALID_FORMAT;
+ *cpp = cp + e + skip;
+ return 0;
+}
+#endif /* WITH_SSH1 */
+
+/* returns 0 ok, and < 0 error */
+int
+sshkey_read(struct sshkey *ret, char **cpp)
+{
+ struct sshkey *k;
+ int retval = SSH_ERR_INVALID_FORMAT;
+ char *ep, *cp, *space;
+ int r, type, curve_nid = -1;
+ struct sshbuf *blob;
+#ifdef WITH_SSH1
+ u_long bits;
+#endif /* WITH_SSH1 */
+
+ cp = *cpp;
+
+ switch (ret->type) {
+ case KEY_RSA1:
+#ifdef WITH_SSH1
+ /* Get number of bits. */
+ bits = strtoul(cp, &ep, 10);
+ if (*cp == '\0' || strchr(" \t\r\n", *ep) == NULL ||
+ bits == 0 || bits > SSHBUF_MAX_BIGNUM * 8)
+ return SSH_ERR_INVALID_FORMAT; /* Bad bit count... */
+ /* Get public exponent, public modulus. */
+ if ((r = read_decimal_bignum(&ep, ret->rsa->e)) < 0)
+ return r;
+ if ((r = read_decimal_bignum(&ep, ret->rsa->n)) < 0)
+ return r;
+ /* validate the claimed number of bits */
+ if (BN_num_bits(ret->rsa->n) != (int)bits)
+ return SSH_ERR_KEY_BITS_MISMATCH;
+ *cpp = ep;
+ retval = 0;
+#endif /* WITH_SSH1 */
+ break;
+ case KEY_UNSPEC:
+ case KEY_RSA:
+ case KEY_DSA:
+ case KEY_ECDSA:
+ case KEY_ED25519:
+ case KEY_DSA_CERT:
+ case KEY_ECDSA_CERT:
+ case KEY_RSA_CERT:
+ case KEY_ED25519_CERT:
+ space = strchr(cp, ' ');
+ if (space == NULL)
+ return SSH_ERR_INVALID_FORMAT;
+ *space = '\0';
+ type = sshkey_type_from_name(cp);
+ if (sshkey_type_plain(type) == KEY_ECDSA &&
+ (curve_nid = sshkey_ecdsa_nid_from_name(cp)) == -1)
+ return SSH_ERR_EC_CURVE_INVALID;
+ *space = ' ';
+ if (type == KEY_UNSPEC)
+ return SSH_ERR_INVALID_FORMAT;
+ cp = space+1;
+ if (*cp == '\0')
+ return SSH_ERR_INVALID_FORMAT;
+ if (ret->type != KEY_UNSPEC && ret->type != type)
+ return SSH_ERR_KEY_TYPE_MISMATCH;
+ if ((blob = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ /* trim comment */
+ space = strchr(cp, ' ');
+ if (space) {
+ /* advance 'space': skip whitespace */
+ *space++ = '\0';
+ while (*space == ' ' || *space == '\t')
+ space++;
+ ep = space;
+ } else
+ ep = cp + strlen(cp);
+ if ((r = sshbuf_b64tod(blob, cp)) != 0) {
+ sshbuf_free(blob);
+ return r;
+ }
+ if ((r = sshkey_from_blob(sshbuf_ptr(blob),
+ sshbuf_len(blob), &k)) != 0) {
+ sshbuf_free(blob);
+ return r;
+ }
+ sshbuf_free(blob);
+ if (k->type != type) {
+ sshkey_free(k);
+ return SSH_ERR_KEY_TYPE_MISMATCH;
+ }
+ if (sshkey_type_plain(type) == KEY_ECDSA &&
+ curve_nid != k->ecdsa_nid) {
+ sshkey_free(k);
+ return SSH_ERR_EC_CURVE_MISMATCH;
+ }
+ ret->type = type;
+ if (sshkey_is_cert(ret)) {
+ if (!sshkey_is_cert(k)) {
+ sshkey_free(k);
+ return SSH_ERR_EXPECTED_CERT;
+ }
+ if (ret->cert != NULL)
+ cert_free(ret->cert);
+ ret->cert = k->cert;
+ k->cert = NULL;
+ }
+ switch (sshkey_type_plain(ret->type)) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA:
+ if (ret->rsa != NULL)
+ RSA_free(ret->rsa);
+ ret->rsa = k->rsa;
+ k->rsa = NULL;
+#ifdef DEBUG_PK
+ RSA_print_fp(stderr, ret->rsa, 8);
+#endif
+ break;
+ case KEY_DSA:
+ if (ret->dsa != NULL)
+ DSA_free(ret->dsa);
+ ret->dsa = k->dsa;
+ k->dsa = NULL;
+#ifdef DEBUG_PK
+ DSA_print_fp(stderr, ret->dsa, 8);
+#endif
+ break;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ if (ret->ecdsa != NULL)
+ EC_KEY_free(ret->ecdsa);
+ ret->ecdsa = k->ecdsa;
+ ret->ecdsa_nid = k->ecdsa_nid;
+ k->ecdsa = NULL;
+ k->ecdsa_nid = -1;
+#ifdef DEBUG_PK
+ sshkey_dump_ec_key(ret->ecdsa);
+#endif
+ break;
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ free(ret->ed25519_pk);
+ ret->ed25519_pk = k->ed25519_pk;
+ k->ed25519_pk = NULL;
+#ifdef DEBUG_PK
+ /* XXX */
+#endif
+ break;
+ }
+ *cpp = ep;
+ retval = 0;
+/*XXXX*/
+ sshkey_free(k);
+ if (retval != 0)
+ break;
+ break;
+ default:
+ return SSH_ERR_INVALID_ARGUMENT;
+ }
+ return retval;
+}
+
+int
+sshkey_to_base64(const struct sshkey *key, char **b64p)
+{
+ int r = SSH_ERR_INTERNAL_ERROR;
+ struct sshbuf *b = NULL;
+ char *uu = NULL;
+
+ if (b64p != NULL)
+ *b64p = NULL;
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshkey_putb(key, b)) != 0)
+ goto out;
+ if ((uu = sshbuf_dtob64(b)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ /* Success */
+ if (b64p != NULL) {
+ *b64p = uu;
+ uu = NULL;
+ }
+ r = 0;
+ out:
+ sshbuf_free(b);
+ free(uu);
+ return r;
+}
+
+static int
+sshkey_format_rsa1(const struct sshkey *key, struct sshbuf *b)
+{
+ int r = SSH_ERR_INTERNAL_ERROR;
+#ifdef WITH_SSH1
+ u_int bits = 0;
+ char *dec_e = NULL, *dec_n = NULL;
+
+ if (key->rsa == NULL || key->rsa->e == NULL ||
+ key->rsa->n == NULL) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL ||
+ (dec_n = BN_bn2dec(key->rsa->n)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ /* size of modulus 'n' */
+ if ((bits = BN_num_bits(key->rsa->n)) <= 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((r = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0)
+ goto out;
+
+ /* Success */
+ r = 0;
+ out:
+ if (dec_e != NULL)
+ OPENSSL_free(dec_e);
+ if (dec_n != NULL)
+ OPENSSL_free(dec_n);
+#endif /* WITH_SSH1 */
+
+ return r;
+}
+
+static int
+sshkey_format_text(const struct sshkey *key, struct sshbuf *b)
+{
+ int r = SSH_ERR_INTERNAL_ERROR;
+ char *uu = NULL;
+
+ if (key->type == KEY_RSA1) {
+ if ((r = sshkey_format_rsa1(key, b)) != 0)
+ goto out;
+ } else {
+ /* Unsupported key types handled in sshkey_to_base64() */
+ if ((r = sshkey_to_base64(key, &uu)) != 0)
+ goto out;
+ if ((r = sshbuf_putf(b, "%s %s",
+ sshkey_ssh_name(key), uu)) != 0)
+ goto out;
+ }
+ r = 0;
+ out:
+ free(uu);
+ return r;
+}
+
+int
+sshkey_write(const struct sshkey *key, FILE *f)
+{
+ struct sshbuf *b = NULL;
+ int r = SSH_ERR_INTERNAL_ERROR;
+
+ if ((b = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshkey_format_text(key, b)) != 0)
+ goto out;
+ if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) {
+ if (feof(f))
+ errno = EPIPE;
+ r = SSH_ERR_SYSTEM_ERROR;
+ goto out;
+ }
+ /* Success */
+ r = 0;
+ out:
+ sshbuf_free(b);
+ return r;
+}
+
+const char *
+sshkey_cert_type(const struct sshkey *k)
+{
+ switch (k->cert->type) {
+ case SSH2_CERT_TYPE_USER:
+ return "user";
+ case SSH2_CERT_TYPE_HOST:
+ return "host";
+ default:
+ return "unknown";
+ }
+}
+
+#ifdef WITH_OPENSSL
+static int
+rsa_generate_private_key(u_int bits, RSA **rsap)
+{
+ RSA *private = NULL;
+ BIGNUM *f4 = NULL;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+
+ if (rsap == NULL ||
+ bits < SSH_RSA_MINIMUM_MODULUS_SIZE ||
+ bits > SSHBUF_MAX_BIGNUM * 8)
+ return SSH_ERR_INVALID_ARGUMENT;
+ *rsap = NULL;
+ if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (!BN_set_word(f4, RSA_F4) ||
+ !RSA_generate_key_ex(private, bits, f4, NULL)) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ *rsap = private;
+ private = NULL;
+ ret = 0;
+ out:
+ if (private != NULL)
+ RSA_free(private);
+ if (f4 != NULL)
+ BN_free(f4);
+ return ret;
+}
+
+static int
+dsa_generate_private_key(u_int bits, DSA **dsap)
+{
+ DSA *private;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+
+ if (dsap == NULL || bits != 1024)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if ((private = DSA_new()) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ *dsap = NULL;
+ if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL,
+ NULL, NULL) || !DSA_generate_key(private)) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ *dsap = private;
+ private = NULL;
+ ret = 0;
+ out:
+ if (private != NULL)
+ DSA_free(private);
+ return ret;
+}
+
+# ifdef OPENSSL_HAS_ECC
+int
+sshkey_ecdsa_key_to_nid(EC_KEY *k)
+{
+ EC_GROUP *eg;
+ int nids[] = {
+ NID_X9_62_prime256v1,
+ NID_secp384r1,
+# ifdef OPENSSL_HAS_NISTP521
+ NID_secp521r1,
+# endif /* OPENSSL_HAS_NISTP521 */
+ -1
+ };
+ int nid;
+ u_int i;
+ BN_CTX *bnctx;
+ const EC_GROUP *g = EC_KEY_get0_group(k);
+
+ /*
+ * The group may be stored in a ASN.1 encoded private key in one of two
+ * ways: as a "named group", which is reconstituted by ASN.1 object ID
+ * or explicit group parameters encoded into the key blob. Only the
+ * "named group" case sets the group NID for us, but we can figure
+ * it out for the other case by comparing against all the groups that
+ * are supported.
+ */
+ if ((nid = EC_GROUP_get_curve_name(g)) > 0)
+ return nid;
+ if ((bnctx = BN_CTX_new()) == NULL)
+ return -1;
+ for (i = 0; nids[i] != -1; i++) {
+ if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) {
+ BN_CTX_free(bnctx);
+ return -1;
+ }
+ if (EC_GROUP_cmp(g, eg, bnctx) == 0)
+ break;
+ EC_GROUP_free(eg);
+ }
+ BN_CTX_free(bnctx);
+ if (nids[i] != -1) {
+ /* Use the group with the NID attached */
+ EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE);
+ if (EC_KEY_set_group(k, eg) != 1) {
+ EC_GROUP_free(eg);
+ return -1;
+ }
+ }
+ return nids[i];
+}
+
+static int
+ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap)
+{
+ EC_KEY *private;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+
+ if (nid == NULL || ecdsap == NULL ||
+ (*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1)
+ return SSH_ERR_INVALID_ARGUMENT;
+ *ecdsap = NULL;
+ if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (EC_KEY_generate_key(private) != 1) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE);
+ *ecdsap = private;
+ private = NULL;
+ ret = 0;
+ out:
+ if (private != NULL)
+ EC_KEY_free(private);
+ return ret;
+}
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+
+int
+sshkey_generate(int type, u_int bits, struct sshkey **keyp)
+{
+ struct sshkey *k;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+
+ if (keyp == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+ *keyp = NULL;
+ if ((k = sshkey_new(KEY_UNSPEC)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ switch (type) {
+ case KEY_ED25519:
+ if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL ||
+ (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ break;
+ }
+ crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk);
+ ret = 0;
+ break;
+#ifdef WITH_OPENSSL
+ case KEY_DSA:
+ ret = dsa_generate_private_key(bits, &k->dsa);
+ break;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid,
+ &k->ecdsa);
+ break;
+# endif /* OPENSSL_HAS_ECC */
+ case KEY_RSA:
+ case KEY_RSA1:
+ ret = rsa_generate_private_key(bits, &k->rsa);
+ break;
+#endif /* WITH_OPENSSL */
+ default:
+ ret = SSH_ERR_INVALID_ARGUMENT;
+ }
+ if (ret == 0) {
+ k->type = type;
+ *keyp = k;
+ } else
+ sshkey_free(k);
+ return ret;
+}
+
+int
+sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key)
+{
+ u_int i;
+ const struct sshkey_cert *from;
+ struct sshkey_cert *to;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+
+ if (to_key->cert != NULL) {
+ cert_free(to_key->cert);
+ to_key->cert = NULL;
+ }
+
+ if ((from = from_key->cert) == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+
+ if ((to = to_key->cert = cert_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+
+ if ((ret = sshbuf_putb(to->certblob, from->certblob)) != 0 ||
+ (ret = sshbuf_putb(to->critical, from->critical)) != 0 ||
+ (ret = sshbuf_putb(to->extensions, from->extensions)) != 0)
+ return ret;
+
+ to->serial = from->serial;
+ to->type = from->type;
+ if (from->key_id == NULL)
+ to->key_id = NULL;
+ else if ((to->key_id = strdup(from->key_id)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ to->valid_after = from->valid_after;
+ to->valid_before = from->valid_before;
+ if (from->signature_key == NULL)
+ to->signature_key = NULL;
+ else if ((ret = sshkey_from_private(from->signature_key,
+ &to->signature_key)) != 0)
+ return ret;
+
+ if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (from->nprincipals > 0) {
+ if ((to->principals = calloc(from->nprincipals,
+ sizeof(*to->principals))) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ for (i = 0; i < from->nprincipals; i++) {
+ to->principals[i] = strdup(from->principals[i]);
+ if (to->principals[i] == NULL) {
+ to->nprincipals = i;
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ }
+ }
+ to->nprincipals = from->nprincipals;
+ return 0;
+}
+
+int
+sshkey_from_private(const struct sshkey *k, struct sshkey **pkp)
+{
+ struct sshkey *n = NULL;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+
+ *pkp = NULL;
+ switch (k->type) {
+#ifdef WITH_OPENSSL
+ case KEY_DSA:
+ case KEY_DSA_CERT:
+ if ((n = sshkey_new(k->type)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) ||
+ (BN_copy(n->dsa->q, k->dsa->q) == NULL) ||
+ (BN_copy(n->dsa->g, k->dsa->g) == NULL) ||
+ (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL)) {
+ sshkey_free(n);
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ break;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ case KEY_ECDSA_CERT:
+ if ((n = sshkey_new(k->type)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ n->ecdsa_nid = k->ecdsa_nid;
+ n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
+ if (n->ecdsa == NULL) {
+ sshkey_free(n);
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ if (EC_KEY_set_public_key(n->ecdsa,
+ EC_KEY_get0_public_key(k->ecdsa)) != 1) {
+ sshkey_free(n);
+ return SSH_ERR_LIBCRYPTO_ERROR;
+ }
+ break;
+# endif /* OPENSSL_HAS_ECC */
+ case KEY_RSA:
+ case KEY_RSA1:
+ case KEY_RSA_CERT:
+ if ((n = sshkey_new(k->type)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) ||
+ (BN_copy(n->rsa->e, k->rsa->e) == NULL)) {
+ sshkey_free(n);
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ break;
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ case KEY_ED25519_CERT:
+ if ((n = sshkey_new(k->type)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if (k->ed25519_pk != NULL) {
+ if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) {
+ sshkey_free(n);
+ return SSH_ERR_ALLOC_FAIL;
+ }
+ memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ);
+ }
+ break;
+ default:
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
+ }
+ if (sshkey_is_cert(k)) {
+ if ((ret = sshkey_cert_copy(k, n)) != 0) {
+ sshkey_free(n);
+ return ret;
+ }
+ }
+ *pkp = n;
+ return 0;
+}
+
+static int
+cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf)
+{
+ struct sshbuf *principals = NULL, *crit = NULL;
+ struct sshbuf *exts = NULL, *ca = NULL;
+ u_char *sig = NULL;
+ size_t signed_len = 0, slen = 0, kidlen = 0;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+
+ /* Copy the entire key blob for verification and later serialisation */
+ if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0)
+ return ret;
+
+ /* Parse body of certificate up to signature */
+ if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 ||
+ (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 ||
+ (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 ||
+ (ret = sshbuf_froms(b, &principals)) != 0 ||
+ (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 ||
+ (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 ||
+ (ret = sshbuf_froms(b, &crit)) != 0 ||
+ (ret = sshbuf_froms(b, &exts)) != 0 ||
+ (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0 ||
+ (ret = sshbuf_froms(b, &ca)) != 0) {
+ /* XXX debug print error for ret */
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+
+ /* Signature is left in the buffer so we can calculate this length */
+ signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b);
+
+ if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+
+ if (key->cert->type != SSH2_CERT_TYPE_USER &&
+ key->cert->type != SSH2_CERT_TYPE_HOST) {
+ ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE;
+ goto out;
+ }
+
+ /* Parse principals section */
+ while (sshbuf_len(principals) > 0) {
+ char *principal = NULL;
+ char **oprincipals = NULL;
+
+ if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if ((ret = sshbuf_get_cstring(principals, &principal,
+ NULL)) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ oprincipals = key->cert->principals;
+ key->cert->principals = reallocarray(key->cert->principals,
+ key->cert->nprincipals + 1, sizeof(*key->cert->principals));
+ if (key->cert->principals == NULL) {
+ free(principal);
+ key->cert->principals = oprincipals;
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ key->cert->principals[key->cert->nprincipals++] = principal;
+ }
+
+ /*
+ * Stash a copies of the critical options and extensions sections
+ * for later use.
+ */
+ if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 ||
+ (exts != NULL &&
+ (ret = sshbuf_putb(key->cert->extensions, exts)) != 0))
+ goto out;
+
+ /*
+ * Validate critical options and extensions sections format.
+ */
+ while (sshbuf_len(crit) != 0) {
+ if ((ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0 ||
+ (ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0) {
+ sshbuf_reset(key->cert->critical);
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ }
+ while (exts != NULL && sshbuf_len(exts) != 0) {
+ if ((ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0 ||
+ (ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0) {
+ sshbuf_reset(key->cert->extensions);
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ }
+
+ /* Parse CA key and check signature */
+ if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) {
+ ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY;
+ goto out;
+ }
+ if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) {
+ ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY;
+ goto out;
+ }
+ if ((ret = sshkey_verify(key->cert->signature_key, sig, slen,
+ sshbuf_ptr(key->cert->certblob), signed_len, 0)) != 0)
+ goto out;
+
+ /* Success */
+ ret = 0;
+ out:
+ sshbuf_free(ca);
+ sshbuf_free(crit);
+ sshbuf_free(exts);
+ sshbuf_free(principals);
+ free(sig);
+ return ret;
+}
+
+static int
+sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp,
+ int allow_cert)
+{
+ int type, ret = SSH_ERR_INTERNAL_ERROR;
+ char *ktype = NULL, *curve = NULL;
+ struct sshkey *key = NULL;
+ size_t len;
+ u_char *pk = NULL;
+ struct sshbuf *copy;
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+ EC_POINT *q = NULL;
+#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
+
+#ifdef DEBUG_PK /* XXX */
+ sshbuf_dump(b, stderr);
+#endif
+ if (keyp != NULL)
+ *keyp = NULL;
+ if ((copy = sshbuf_fromb(b)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (sshbuf_get_cstring(b, &ktype, NULL) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+
+ type = sshkey_type_from_name(ktype);
+ if (!allow_cert && sshkey_type_is_cert(type)) {
+ ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY;
+ goto out;
+ }
+ switch (type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA_CERT:
+ /* Skip nonce */
+ if (sshbuf_get_string_direct(b, NULL, NULL) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ /* FALLTHROUGH */
+ case KEY_RSA:
+ if ((key = sshkey_new(type)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (sshbuf_get_bignum2(b, key->rsa->e) != 0 ||
+ sshbuf_get_bignum2(b, key->rsa->n) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+#ifdef DEBUG_PK
+ RSA_print_fp(stderr, key->rsa, 8);
+#endif
+ break;
+ case KEY_DSA_CERT:
+ /* Skip nonce */
+ if (sshbuf_get_string_direct(b, NULL, NULL) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ /* FALLTHROUGH */
+ case KEY_DSA:
+ if ((key = sshkey_new(type)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (sshbuf_get_bignum2(b, key->dsa->p) != 0 ||
+ sshbuf_get_bignum2(b, key->dsa->q) != 0 ||
+ sshbuf_get_bignum2(b, key->dsa->g) != 0 ||
+ sshbuf_get_bignum2(b, key->dsa->pub_key) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+#ifdef DEBUG_PK
+ DSA_print_fp(stderr, key->dsa, 8);
+#endif
+ break;
+ case KEY_ECDSA_CERT:
+ /* Skip nonce */
+ if (sshbuf_get_string_direct(b, NULL, NULL) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ /* FALLTHROUGH */
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ if ((key = sshkey_new(type)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype);
+ if (sshbuf_get_cstring(b, &curve, NULL) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) {
+ ret = SSH_ERR_EC_CURVE_MISMATCH;
+ goto out;
+ }
+ if (key->ecdsa != NULL)
+ EC_KEY_free(key->ecdsa);
+ if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid))
+ == NULL) {
+ ret = SSH_ERR_EC_CURVE_INVALID;
+ goto out;
+ }
+ if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa)) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa),
+ q) != 0) {
+ ret = SSH_ERR_KEY_INVALID_EC_VALUE;
+ goto out;
+ }
+ if (EC_KEY_set_public_key(key->ecdsa, q) != 1) {
+ /* XXX assume it is a allocation error */
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+#ifdef DEBUG_PK
+ sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q);
+#endif
+ break;
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519_CERT:
+ /* Skip nonce */
+ if (sshbuf_get_string_direct(b, NULL, NULL) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ /* FALLTHROUGH */
+ case KEY_ED25519:
+ if ((ret = sshbuf_get_string(b, &pk, &len)) != 0)
+ goto out;
+ if (len != ED25519_PK_SZ) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if ((key = sshkey_new(type)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ key->ed25519_pk = pk;
+ pk = NULL;
+ break;
+ case KEY_UNSPEC:
+ if ((key = sshkey_new(type)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ break;
+ default:
+ ret = SSH_ERR_KEY_TYPE_UNKNOWN;
+ goto out;
+ }
+
+ /* Parse certificate potion */
+ if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0)
+ goto out;
+
+ if (key != NULL && sshbuf_len(b) != 0) {
+ ret = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ ret = 0;
+ if (keyp != NULL) {
+ *keyp = key;
+ key = NULL;
+ }
+ out:
+ sshbuf_free(copy);
+ sshkey_free(key);
+ free(ktype);
+ free(curve);
+ free(pk);
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+ if (q != NULL)
+ EC_POINT_free(q);
+#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
+ return ret;
+}
+
+int
+sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp)
+{
+ struct sshbuf *b;
+ int r;
+
+ if ((b = sshbuf_from(blob, blen)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ r = sshkey_from_blob_internal(b, keyp, 1);
+ sshbuf_free(b);
+ return r;
+}
+
+int
+sshkey_fromb(struct sshbuf *b, struct sshkey **keyp)
+{
+ return sshkey_from_blob_internal(b, keyp, 1);
+}
+
+int
+sshkey_froms(struct sshbuf *buf, struct sshkey **keyp)
+{
+ struct sshbuf *b;
+ int r;
+
+ if ((r = sshbuf_froms(buf, &b)) != 0)
+ return r;
+ r = sshkey_from_blob_internal(b, keyp, 1);
+ sshbuf_free(b);
+ return r;
+}
+
+int
+sshkey_sign(const struct sshkey *key,
+ u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, const char *alg, u_int compat)
+{
+ if (sigp != NULL)
+ *sigp = NULL;
+ if (lenp != NULL)
+ *lenp = 0;
+ if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE)
+ return SSH_ERR_INVALID_ARGUMENT;
+ switch (key->type) {
+#ifdef WITH_OPENSSL
+ case KEY_DSA_CERT:
+ case KEY_DSA:
+ return ssh_dss_sign(key, sigp, lenp, data, datalen, compat);
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA_CERT:
+ case KEY_ECDSA:
+ return ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat);
+# endif /* OPENSSL_HAS_ECC */
+ case KEY_RSA_CERT:
+ case KEY_RSA:
+ return ssh_rsa_sign(key, sigp, lenp, data, datalen, alg);
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ case KEY_ED25519_CERT:
+ return ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat);
+ default:
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
+ }
+}
+
+/*
+ * ssh_key_verify returns 0 for a correct signature and < 0 on error.
+ */
+int
+sshkey_verify(const struct sshkey *key,
+ const u_char *sig, size_t siglen,
+ const u_char *data, size_t dlen, u_int compat)
+{
+ if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE)
+ return SSH_ERR_INVALID_ARGUMENT;
+ switch (key->type) {
+#ifdef WITH_OPENSSL
+ case KEY_DSA_CERT:
+ case KEY_DSA:
+ return ssh_dss_verify(key, sig, siglen, data, dlen, compat);
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA_CERT:
+ case KEY_ECDSA:
+ return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat);
+# endif /* OPENSSL_HAS_ECC */
+ case KEY_RSA_CERT:
+ case KEY_RSA:
+ return ssh_rsa_verify(key, sig, siglen, data, dlen);
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ case KEY_ED25519_CERT:
+ return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat);
+ default:
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
+ }
+}
+
+/* Converts a private to a public key */
+int
+sshkey_demote(const struct sshkey *k, struct sshkey **dkp)
+{
+ struct sshkey *pk;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+
+ *dkp = NULL;
+ if ((pk = calloc(1, sizeof(*pk))) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ pk->type = k->type;
+ pk->flags = k->flags;
+ pk->ecdsa_nid = k->ecdsa_nid;
+ pk->dsa = NULL;
+ pk->ecdsa = NULL;
+ pk->rsa = NULL;
+ pk->ed25519_pk = NULL;
+ pk->ed25519_sk = NULL;
+
+ switch (k->type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA_CERT:
+ if ((ret = sshkey_cert_copy(k, pk)) != 0)
+ goto fail;
+ /* FALLTHROUGH */
+ case KEY_RSA1:
+ case KEY_RSA:
+ if ((pk->rsa = RSA_new()) == NULL ||
+ (pk->rsa->e = BN_dup(k->rsa->e)) == NULL ||
+ (pk->rsa->n = BN_dup(k->rsa->n)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto fail;
+ }
+ break;
+ case KEY_DSA_CERT:
+ if ((ret = sshkey_cert_copy(k, pk)) != 0)
+ goto fail;
+ /* FALLTHROUGH */
+ case KEY_DSA:
+ if ((pk->dsa = DSA_new()) == NULL ||
+ (pk->dsa->p = BN_dup(k->dsa->p)) == NULL ||
+ (pk->dsa->q = BN_dup(k->dsa->q)) == NULL ||
+ (pk->dsa->g = BN_dup(k->dsa->g)) == NULL ||
+ (pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto fail;
+ }
+ break;
+ case KEY_ECDSA_CERT:
+ if ((ret = sshkey_cert_copy(k, pk)) != 0)
+ goto fail;
+ /* FALLTHROUGH */
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ pk->ecdsa = EC_KEY_new_by_curve_name(pk->ecdsa_nid);
+ if (pk->ecdsa == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto fail;
+ }
+ if (EC_KEY_set_public_key(pk->ecdsa,
+ EC_KEY_get0_public_key(k->ecdsa)) != 1) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto fail;
+ }
+ break;
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519_CERT:
+ if ((ret = sshkey_cert_copy(k, pk)) != 0)
+ goto fail;
+ /* FALLTHROUGH */
+ case KEY_ED25519:
+ if (k->ed25519_pk != NULL) {
+ if ((pk->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto fail;
+ }
+ memcpy(pk->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ);
+ }
+ break;
+ default:
+ ret = SSH_ERR_KEY_TYPE_UNKNOWN;
+ fail:
+ sshkey_free(pk);
+ return ret;
+ }
+ *dkp = pk;
+ return 0;
+}
+
+/* Convert a plain key to their _CERT equivalent */
+int
+sshkey_to_certified(struct sshkey *k)
+{
+ int newtype;
+
+ switch (k->type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA:
+ newtype = KEY_RSA_CERT;
+ break;
+ case KEY_DSA:
+ newtype = KEY_DSA_CERT;
+ break;
+ case KEY_ECDSA:
+ newtype = KEY_ECDSA_CERT;
+ break;
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ newtype = KEY_ED25519_CERT;
+ break;
+ default:
+ return SSH_ERR_INVALID_ARGUMENT;
+ }
+ if ((k->cert = cert_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ k->type = newtype;
+ return 0;
+}
+
+/* Convert a certificate to its raw key equivalent */
+int
+sshkey_drop_cert(struct sshkey *k)
+{
+ if (!sshkey_type_is_cert(k->type))
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
+ cert_free(k->cert);
+ k->cert = NULL;
+ k->type = sshkey_type_plain(k->type);
+ return 0;
+}
+
+/* Sign a certified key, (re-)generating the signed certblob. */
+int
+sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg)
+{
+ struct sshbuf *principals = NULL;
+ u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32];
+ size_t i, ca_len, sig_len;
+ int ret = SSH_ERR_INTERNAL_ERROR;
+ struct sshbuf *cert;
+
+ if (k == NULL || k->cert == NULL ||
+ k->cert->certblob == NULL || ca == NULL)
+ return SSH_ERR_INVALID_ARGUMENT;
+ if (!sshkey_is_cert(k))
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
+ if (!sshkey_type_is_valid_ca(ca->type))
+ return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY;
+
+ if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0)
+ return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY;
+
+ cert = k->cert->certblob; /* for readability */
+ sshbuf_reset(cert);
+ if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0)
+ goto out;
+
+ /* -v01 certs put nonce first */
+ arc4random_buf(&nonce, sizeof(nonce));
+ if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0)
+ goto out;
+
+ /* XXX this substantially duplicates to_blob(); refactor */
+ switch (k->type) {
+#ifdef WITH_OPENSSL
+ case KEY_DSA_CERT:
+ if ((ret = sshbuf_put_bignum2(cert, k->dsa->p)) != 0 ||
+ (ret = sshbuf_put_bignum2(cert, k->dsa->q)) != 0 ||
+ (ret = sshbuf_put_bignum2(cert, k->dsa->g)) != 0 ||
+ (ret = sshbuf_put_bignum2(cert, k->dsa->pub_key)) != 0)
+ goto out;
+ break;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA_CERT:
+ if ((ret = sshbuf_put_cstring(cert,
+ sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 ||
+ (ret = sshbuf_put_ec(cert,
+ EC_KEY_get0_public_key(k->ecdsa),
+ EC_KEY_get0_group(k->ecdsa))) != 0)
+ goto out;
+ break;
+# endif /* OPENSSL_HAS_ECC */
+ case KEY_RSA_CERT:
+ if ((ret = sshbuf_put_bignum2(cert, k->rsa->e)) != 0 ||
+ (ret = sshbuf_put_bignum2(cert, k->rsa->n)) != 0)
+ goto out;
+ break;
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519_CERT:
+ if ((ret = sshbuf_put_string(cert,
+ k->ed25519_pk, ED25519_PK_SZ)) != 0)
+ goto out;
+ break;
+ default:
+ ret = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+
+ if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 ||
+ (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 ||
+ (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0)
+ goto out;
+
+ if ((principals = sshbuf_new()) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ for (i = 0; i < k->cert->nprincipals; i++) {
+ if ((ret = sshbuf_put_cstring(principals,
+ k->cert->principals[i])) != 0)
+ goto out;
+ }
+ if ((ret = sshbuf_put_stringb(cert, principals)) != 0 ||
+ (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 ||
+ (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 ||
+ (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 ||
+ (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 ||
+ (ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */
+ (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0)
+ goto out;
+
+ /* Sign the whole mess */
+ if ((ret = sshkey_sign(ca, &sig_blob, &sig_len, sshbuf_ptr(cert),
+ sshbuf_len(cert), alg, 0)) != 0)
+ goto out;
+
+ /* Append signature and we are done */
+ if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0)
+ goto out;
+ ret = 0;
+ out:
+ if (ret != 0)
+ sshbuf_reset(cert);
+ free(sig_blob);
+ free(ca_blob);
+ sshbuf_free(principals);
+ return ret;
+}
+
+int
+sshkey_cert_check_authority(const struct sshkey *k,
+ int want_host, int require_principal,
+ const char *name, const char **reason)
+{
+ u_int i, principal_matches;
+ time_t now = time(NULL);
+
+ if (reason != NULL)
+ *reason = NULL;
+
+ if (want_host) {
+ if (k->cert->type != SSH2_CERT_TYPE_HOST) {
+ *reason = "Certificate invalid: not a host certificate";
+ return SSH_ERR_KEY_CERT_INVALID;
+ }
+ } else {
+ if (k->cert->type != SSH2_CERT_TYPE_USER) {
+ *reason = "Certificate invalid: not a user certificate";
+ return SSH_ERR_KEY_CERT_INVALID;
+ }
+ }
+ if (now < 0) {
+ /* yikes - system clock before epoch! */
+ *reason = "Certificate invalid: not yet valid";
+ return SSH_ERR_KEY_CERT_INVALID;
+ }
+ if ((u_int64_t)now < k->cert->valid_after) {
+ *reason = "Certificate invalid: not yet valid";
+ return SSH_ERR_KEY_CERT_INVALID;
+ }
+ if ((u_int64_t)now >= k->cert->valid_before) {
+ *reason = "Certificate invalid: expired";
+ return SSH_ERR_KEY_CERT_INVALID;
+ }
+ if (k->cert->nprincipals == 0) {
+ if (require_principal) {
+ *reason = "Certificate lacks principal list";
+ return SSH_ERR_KEY_CERT_INVALID;
+ }
+ } else if (name != NULL) {
+ principal_matches = 0;
+ for (i = 0; i < k->cert->nprincipals; i++) {
+ if (strcmp(name, k->cert->principals[i]) == 0) {
+ principal_matches = 1;
+ break;
+ }
+ }
+ if (!principal_matches) {
+ *reason = "Certificate invalid: name is not a listed "
+ "principal";
+ return SSH_ERR_KEY_CERT_INVALID;
+ }
+ }
+ return 0;
+}
+
+size_t
+sshkey_format_cert_validity(const struct sshkey_cert *cert, char *s, size_t l)
+{
+ char from[32], to[32], ret[64];
+ time_t tt;
+ struct tm *tm;
+
+ *from = *to = '\0';
+ if (cert->valid_after == 0 &&
+ cert->valid_before == 0xffffffffffffffffULL)
+ return strlcpy(s, "forever", l);
+
+ if (cert->valid_after != 0) {
+ /* XXX revisit INT_MAX in 2038 :) */
+ tt = cert->valid_after > INT_MAX ?
+ INT_MAX : cert->valid_after;
+ tm = localtime(&tt);
+ strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm);
+ }
+ if (cert->valid_before != 0xffffffffffffffffULL) {
+ /* XXX revisit INT_MAX in 2038 :) */
+ tt = cert->valid_before > INT_MAX ?
+ INT_MAX : cert->valid_before;
+ tm = localtime(&tt);
+ strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm);
+ }
+
+ if (cert->valid_after == 0)
+ snprintf(ret, sizeof(ret), "before %s", to);
+ else if (cert->valid_before == 0xffffffffffffffffULL)
+ snprintf(ret, sizeof(ret), "after %s", from);
+ else
+ snprintf(ret, sizeof(ret), "from %s to %s", from, to);
+
+ return strlcpy(s, ret, l);
+}
+
+int
+sshkey_private_serialize(const struct sshkey *key, struct sshbuf *b)
+{
+ int r = SSH_ERR_INTERNAL_ERROR;
+
+ if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0)
+ goto out;
+ switch (key->type) {
+#ifdef WITH_OPENSSL
+ case KEY_RSA:
+ if ((r = sshbuf_put_bignum2(b, key->rsa->n)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->e)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0)
+ goto out;
+ break;
+ case KEY_RSA_CERT:
+ if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0)
+ goto out;
+ break;
+ case KEY_DSA:
+ if ((r = sshbuf_put_bignum2(b, key->dsa->p)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->dsa->q)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->dsa->g)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0)
+ goto out;
+ break;
+ case KEY_DSA_CERT:
+ if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
+ (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0)
+ goto out;
+ break;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ if ((r = sshbuf_put_cstring(b,
+ sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 ||
+ (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 ||
+ (r = sshbuf_put_bignum2(b,
+ EC_KEY_get0_private_key(key->ecdsa))) != 0)
+ goto out;
+ break;
+ case KEY_ECDSA_CERT:
+ if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
+ (r = sshbuf_put_bignum2(b,
+ EC_KEY_get0_private_key(key->ecdsa))) != 0)
+ goto out;
+ break;
+# endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ if ((r = sshbuf_put_string(b, key->ed25519_pk,
+ ED25519_PK_SZ)) != 0 ||
+ (r = sshbuf_put_string(b, key->ed25519_sk,
+ ED25519_SK_SZ)) != 0)
+ goto out;
+ break;
+ case KEY_ED25519_CERT:
+ if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 ||
+ (r = sshbuf_put_string(b, key->ed25519_pk,
+ ED25519_PK_SZ)) != 0 ||
+ (r = sshbuf_put_string(b, key->ed25519_sk,
+ ED25519_SK_SZ)) != 0)
+ goto out;
+ break;
+ default:
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ /* success */
+ r = 0;
+ out:
+ return r;
+}
+
+int
+sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp)
+{
+ char *tname = NULL, *curve = NULL;
+ struct sshkey *k = NULL;
+ size_t pklen = 0, sklen = 0;
+ int type, r = SSH_ERR_INTERNAL_ERROR;
+ u_char *ed25519_pk = NULL, *ed25519_sk = NULL;
+#ifdef WITH_OPENSSL
+ BIGNUM *exponent = NULL;
+#endif /* WITH_OPENSSL */
+
+ if (kp != NULL)
+ *kp = NULL;
+ if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0)
+ goto out;
+ type = sshkey_type_from_name(tname);
+ switch (type) {
+#ifdef WITH_OPENSSL
+ case KEY_DSA:
+ if ((k = sshkey_new_private(type)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_get_bignum2(buf, k->dsa->p)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->dsa->q)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->dsa->g)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->dsa->pub_key)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0)
+ goto out;
+ break;
+ case KEY_DSA_CERT:
+ if ((r = sshkey_froms(buf, &k)) != 0 ||
+ (r = sshkey_add_private(k)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0)
+ goto out;
+ break;
+# ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ if ((k = sshkey_new_private(type)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0)
+ goto out;
+ if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) {
+ r = SSH_ERR_EC_CURVE_MISMATCH;
+ goto out;
+ }
+ k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
+ if (k->ecdsa == NULL || (exponent = BN_new()) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, exponent)))
+ goto out;
+ if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
+ EC_KEY_get0_public_key(k->ecdsa))) != 0 ||
+ (r = sshkey_ec_validate_private(k->ecdsa)) != 0)
+ goto out;
+ break;
+ case KEY_ECDSA_CERT:
+ if ((exponent = BN_new()) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if ((r = sshkey_froms(buf, &k)) != 0 ||
+ (r = sshkey_add_private(k)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, exponent)) != 0)
+ goto out;
+ if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa),
+ EC_KEY_get0_public_key(k->ecdsa))) != 0 ||
+ (r = sshkey_ec_validate_private(k->ecdsa)) != 0)
+ goto out;
+ break;
+# endif /* OPENSSL_HAS_ECC */
+ case KEY_RSA:
+ if ((k = sshkey_new_private(type)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_get_bignum2(buf, k->rsa->n)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->e)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 ||
+ (r = rsa_generate_additional_parameters(k->rsa)) != 0)
+ goto out;
+ break;
+ case KEY_RSA_CERT:
+ if ((r = sshkey_froms(buf, &k)) != 0 ||
+ (r = sshkey_add_private(k)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 ||
+ (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 ||
+ (r = rsa_generate_additional_parameters(k->rsa)) != 0)
+ goto out;
+ break;
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ if ((k = sshkey_new_private(type)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
+ (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0)
+ goto out;
+ if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ k->ed25519_pk = ed25519_pk;
+ k->ed25519_sk = ed25519_sk;
+ ed25519_pk = ed25519_sk = NULL;
+ break;
+ case KEY_ED25519_CERT:
+ if ((r = sshkey_froms(buf, &k)) != 0 ||
+ (r = sshkey_add_private(k)) != 0 ||
+ (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 ||
+ (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0)
+ goto out;
+ if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ k->ed25519_pk = ed25519_pk;
+ k->ed25519_sk = ed25519_sk;
+ ed25519_pk = ed25519_sk = NULL;
+ break;
+ default:
+ r = SSH_ERR_KEY_TYPE_UNKNOWN;
+ goto out;
+ }
+#ifdef WITH_OPENSSL
+ /* enable blinding */
+ switch (k->type) {
+ case KEY_RSA:
+ case KEY_RSA_CERT:
+ case KEY_RSA1:
+ if (RSA_blinding_on(k->rsa, NULL) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ break;
+ }
+#endif /* WITH_OPENSSL */
+ /* success */
+ r = 0;
+ if (kp != NULL) {
+ *kp = k;
+ k = NULL;
+ }
+ out:
+ free(tname);
+ free(curve);
+#ifdef WITH_OPENSSL
+ if (exponent != NULL)
+ BN_clear_free(exponent);
+#endif /* WITH_OPENSSL */
+ sshkey_free(k);
+ if (ed25519_pk != NULL) {
+ explicit_bzero(ed25519_pk, pklen);
+ free(ed25519_pk);
+ }
+ if (ed25519_sk != NULL) {
+ explicit_bzero(ed25519_sk, sklen);
+ free(ed25519_sk);
+ }
+ return r;
+}
+
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
+int
+sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public)
+{
+ BN_CTX *bnctx;
+ EC_POINT *nq = NULL;
+ BIGNUM *order, *x, *y, *tmp;
+ int ret = SSH_ERR_KEY_INVALID_EC_VALUE;
+
+ if ((bnctx = BN_CTX_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ BN_CTX_start(bnctx);
+
+ /*
+ * We shouldn't ever hit this case because bignum_get_ecpoint()
+ * refuses to load GF2m points.
+ */
+ if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
+ NID_X9_62_prime_field)
+ goto out;
+
+ /* Q != infinity */
+ if (EC_POINT_is_at_infinity(group, public))
+ goto out;
+
+ if ((x = BN_CTX_get(bnctx)) == NULL ||
+ (y = BN_CTX_get(bnctx)) == NULL ||
+ (order = BN_CTX_get(bnctx)) == NULL ||
+ (tmp = BN_CTX_get(bnctx)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */
+ if (EC_GROUP_get_order(group, order, bnctx) != 1 ||
+ EC_POINT_get_affine_coordinates_GFp(group, public,
+ x, y, bnctx) != 1) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if (BN_num_bits(x) <= BN_num_bits(order) / 2 ||
+ BN_num_bits(y) <= BN_num_bits(order) / 2)
+ goto out;
+
+ /* nQ == infinity (n == order of subgroup) */
+ if ((nq = EC_POINT_new(group)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (EC_POINT_mul(group, nq, NULL, public, order, bnctx) != 1) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if (EC_POINT_is_at_infinity(group, nq) != 1)
+ goto out;
+
+ /* x < order - 1, y < order - 1 */
+ if (!BN_sub(tmp, order, BN_value_one())) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0)
+ goto out;
+ ret = 0;
+ out:
+ BN_CTX_free(bnctx);
+ if (nq != NULL)
+ EC_POINT_free(nq);
+ return ret;
+}
+
+int
+sshkey_ec_validate_private(const EC_KEY *key)
+{
+ BN_CTX *bnctx;
+ BIGNUM *order, *tmp;
+ int ret = SSH_ERR_KEY_INVALID_EC_VALUE;
+
+ if ((bnctx = BN_CTX_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ BN_CTX_start(bnctx);
+
+ if ((order = BN_CTX_get(bnctx)) == NULL ||
+ (tmp = BN_CTX_get(bnctx)) == NULL) {
+ ret = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ /* log2(private) > log2(order)/2 */
+ if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, bnctx) != 1) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if (BN_num_bits(EC_KEY_get0_private_key(key)) <=
+ BN_num_bits(order) / 2)
+ goto out;
+
+ /* private < order - 1 */
+ if (!BN_sub(tmp, order, BN_value_one())) {
+ ret = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0)
+ goto out;
+ ret = 0;
+ out:
+ BN_CTX_free(bnctx);
+ return ret;
+}
+
+void
+sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point)
+{
+ BIGNUM *x, *y;
+ BN_CTX *bnctx;
+
+ if (point == NULL) {
+ fputs("point=(NULL)\n", stderr);
+ return;
+ }
+ if ((bnctx = BN_CTX_new()) == NULL) {
+ fprintf(stderr, "%s: BN_CTX_new failed\n", __func__);
+ return;
+ }
+ BN_CTX_start(bnctx);
+ if ((x = BN_CTX_get(bnctx)) == NULL ||
+ (y = BN_CTX_get(bnctx)) == NULL) {
+ fprintf(stderr, "%s: BN_CTX_get failed\n", __func__);
+ return;
+ }
+ if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
+ NID_X9_62_prime_field) {
+ fprintf(stderr, "%s: group is not a prime field\n", __func__);
+ return;
+ }
+ if (EC_POINT_get_affine_coordinates_GFp(group, point, x, y,
+ bnctx) != 1) {
+ fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n",
+ __func__);
+ return;
+ }
+ fputs("x=", stderr);
+ BN_print_fp(stderr, x);
+ fputs("\ny=", stderr);
+ BN_print_fp(stderr, y);
+ fputs("\n", stderr);
+ BN_CTX_free(bnctx);
+}
+
+void
+sshkey_dump_ec_key(const EC_KEY *key)
+{
+ const BIGNUM *exponent;
+
+ sshkey_dump_ec_point(EC_KEY_get0_group(key),
+ EC_KEY_get0_public_key(key));
+ fputs("exponent=", stderr);
+ if ((exponent = EC_KEY_get0_private_key(key)) == NULL)
+ fputs("(NULL)", stderr);
+ else
+ BN_print_fp(stderr, EC_KEY_get0_private_key(key));
+ fputs("\n", stderr);
+}
+#endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */
+
+static int
+sshkey_private_to_blob2(const struct sshkey *prv, struct sshbuf *blob,
+ const char *passphrase, const char *comment, const char *ciphername,
+ int rounds)
+{
+ u_char *cp, *key = NULL, *pubkeyblob = NULL;
+ u_char salt[SALT_LEN];
+ char *b64 = NULL;
+ size_t i, pubkeylen, keylen, ivlen, blocksize, authlen;
+ u_int check;
+ int r = SSH_ERR_INTERNAL_ERROR;
+ struct sshcipher_ctx ciphercontext;
+ const struct sshcipher *cipher;
+ const char *kdfname = KDFNAME;
+ struct sshbuf *encoded = NULL, *encrypted = NULL, *kdf = NULL;
+
+ memset(&ciphercontext, 0, sizeof(ciphercontext));
+
+ if (rounds <= 0)
+ rounds = DEFAULT_ROUNDS;
+ if (passphrase == NULL || !strlen(passphrase)) {
+ ciphername = "none";
+ kdfname = "none";
+ } else if (ciphername == NULL)
+ ciphername = DEFAULT_CIPHERNAME;
+ else if (cipher_number(ciphername) != SSH_CIPHER_SSH2) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((cipher = cipher_by_name(ciphername)) == NULL) {
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
+ }
+
+ if ((kdf = sshbuf_new()) == NULL ||
+ (encoded = sshbuf_new()) == NULL ||
+ (encrypted = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ blocksize = cipher_blocksize(cipher);
+ keylen = cipher_keylen(cipher);
+ ivlen = cipher_ivlen(cipher);
+ authlen = cipher_authlen(cipher);
+ if ((key = calloc(1, keylen + ivlen)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (strcmp(kdfname, "bcrypt") == 0) {
+ arc4random_buf(salt, SALT_LEN);
+ if (bcrypt_pbkdf(passphrase, strlen(passphrase),
+ salt, SALT_LEN, key, keylen + ivlen, rounds) < 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
+ if ((r = sshbuf_put_string(kdf, salt, SALT_LEN)) != 0 ||
+ (r = sshbuf_put_u32(kdf, rounds)) != 0)
+ goto out;
+ } else if (strcmp(kdfname, "none") != 0) {
+ /* Unsupported KDF type */
+ r = SSH_ERR_KEY_UNKNOWN_CIPHER;
+ goto out;
+ }
+ if ((r = cipher_init(&ciphercontext, cipher, key, keylen,
+ key + keylen, ivlen, 1)) != 0)
+ goto out;
+
+ if ((r = sshbuf_put(encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC))) != 0 ||
+ (r = sshbuf_put_cstring(encoded, ciphername)) != 0 ||
+ (r = sshbuf_put_cstring(encoded, kdfname)) != 0 ||
+ (r = sshbuf_put_stringb(encoded, kdf)) != 0 ||
+ (r = sshbuf_put_u32(encoded, 1)) != 0 || /* number of keys */
+ (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 ||
+ (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0)
+ goto out;
+
+ /* set up the buffer that will be encrypted */
+
+ /* Random check bytes */
+ check = arc4random();
+ if ((r = sshbuf_put_u32(encrypted, check)) != 0 ||
+ (r = sshbuf_put_u32(encrypted, check)) != 0)
+ goto out;
+
+ /* append private key and comment*/
+ if ((r = sshkey_private_serialize(prv, encrypted)) != 0 ||
+ (r = sshbuf_put_cstring(encrypted, comment)) != 0)
+ goto out;
+
+ /* padding */
+ i = 0;
+ while (sshbuf_len(encrypted) % blocksize) {
+ if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0)
+ goto out;
+ }
+
+ /* length in destination buffer */
+ if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0)
+ goto out;
+
+ /* encrypt */
+ if ((r = sshbuf_reserve(encoded,
+ sshbuf_len(encrypted) + authlen, &cp)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&ciphercontext, 0, cp,
+ sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0)
+ goto out;
+
+ /* uuencode */
+ if ((b64 = sshbuf_dtob64(encoded)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ sshbuf_reset(blob);
+ if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0)
+ goto out;
+ for (i = 0; i < strlen(b64); i++) {
+ if ((r = sshbuf_put_u8(blob, b64[i])) != 0)
+ goto out;
+ /* insert line breaks */
+ if (i % 70 == 69 && (r = sshbuf_put_u8(blob, '\n')) != 0)
+ goto out;
+ }
+ if (i % 70 != 69 && (r = sshbuf_put_u8(blob, '\n')) != 0)
+ goto out;
+ if ((r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0)
+ goto out;
+
+ /* success */
+ r = 0;
+
+ out:
+ sshbuf_free(kdf);
+ sshbuf_free(encoded);
+ sshbuf_free(encrypted);
+ cipher_cleanup(&ciphercontext);
+ explicit_bzero(salt, sizeof(salt));
+ if (key != NULL) {
+ explicit_bzero(key, keylen + ivlen);
+ free(key);
+ }
+ if (pubkeyblob != NULL) {
+ explicit_bzero(pubkeyblob, pubkeylen);
+ free(pubkeyblob);
+ }
+ if (b64 != NULL) {
+ explicit_bzero(b64, strlen(b64));
+ free(b64);
+ }
+ return r;
+}
+
+static int
+sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase,
+ struct sshkey **keyp, char **commentp)
+{
+ char *comment = NULL, *ciphername = NULL, *kdfname = NULL;
+ const struct sshcipher *cipher = NULL;
+ const u_char *cp;
+ int r = SSH_ERR_INTERNAL_ERROR;
+ size_t encoded_len;
+ size_t i, keylen = 0, ivlen = 0, authlen = 0, slen = 0;
+ struct sshbuf *encoded = NULL, *decoded = NULL;
+ struct sshbuf *kdf = NULL, *decrypted = NULL;
+ struct sshcipher_ctx ciphercontext;
+ struct sshkey *k = NULL;
+ u_char *key = NULL, *salt = NULL, *dp, pad, last;
+ u_int blocksize, rounds, nkeys, encrypted_len, check1, check2;
+
+ memset(&ciphercontext, 0, sizeof(ciphercontext));
+ if (keyp != NULL)
+ *keyp = NULL;
+ if (commentp != NULL)
+ *commentp = NULL;
+
+ if ((encoded = sshbuf_new()) == NULL ||
+ (decoded = sshbuf_new()) == NULL ||
+ (decrypted = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ /* check preamble */
+ cp = sshbuf_ptr(blob);
+ encoded_len = sshbuf_len(blob);
+ if (encoded_len < (MARK_BEGIN_LEN + MARK_END_LEN) ||
+ memcmp(cp, MARK_BEGIN, MARK_BEGIN_LEN) != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ cp += MARK_BEGIN_LEN;
+ encoded_len -= MARK_BEGIN_LEN;
+
+ /* Look for end marker, removing whitespace as we go */
+ while (encoded_len > 0) {
+ if (*cp != '\n' && *cp != '\r') {
+ if ((r = sshbuf_put_u8(encoded, *cp)) != 0)
+ goto out;
+ }
+ last = *cp;
+ encoded_len--;
+ cp++;
+ if (last == '\n') {
+ if (encoded_len >= MARK_END_LEN &&
+ memcmp(cp, MARK_END, MARK_END_LEN) == 0) {
+ /* \0 terminate */
+ if ((r = sshbuf_put_u8(encoded, 0)) != 0)
+ goto out;
+ break;
+ }
+ }
+ }
+ if (encoded_len == 0) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+
+ /* decode base64 */
+ if ((r = sshbuf_b64tod(decoded, (char *)sshbuf_ptr(encoded))) != 0)
+ goto out;
+
+ /* check magic */
+ if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC) ||
+ memcmp(sshbuf_ptr(decoded), AUTH_MAGIC, sizeof(AUTH_MAGIC))) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ /* parse public portion of key */
+ if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 ||
+ (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 ||
+ (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 ||
+ (r = sshbuf_froms(decoded, &kdf)) != 0 ||
+ (r = sshbuf_get_u32(decoded, &nkeys)) != 0 ||
+ (r = sshbuf_skip_string(decoded)) != 0 || /* pubkey */
+ (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0)
+ goto out;
+
+ if ((cipher = cipher_by_name(ciphername)) == NULL) {
+ r = SSH_ERR_KEY_UNKNOWN_CIPHER;
+ goto out;
+ }
+ if ((passphrase == NULL || strlen(passphrase) == 0) &&
+ strcmp(ciphername, "none") != 0) {
+ /* passphrase required */
+ r = SSH_ERR_KEY_WRONG_PASSPHRASE;
+ goto out;
+ }
+ if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) {
+ r = SSH_ERR_KEY_UNKNOWN_CIPHER;
+ goto out;
+ }
+ if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if (nkeys != 1) {
+ /* XXX only one key supported */
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+
+ /* check size of encrypted key blob */
+ blocksize = cipher_blocksize(cipher);
+ if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+
+ /* setup key */
+ keylen = cipher_keylen(cipher);
+ ivlen = cipher_ivlen(cipher);
+ authlen = cipher_authlen(cipher);
+ if ((key = calloc(1, keylen + ivlen)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (strcmp(kdfname, "bcrypt") == 0) {
+ if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 ||
+ (r = sshbuf_get_u32(kdf, &rounds)) != 0)
+ goto out;
+ if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen,
+ key, keylen + ivlen, rounds) < 0) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ }
+
+ /* check that an appropriate amount of auth data is present */
+ if (sshbuf_len(decoded) < encrypted_len + authlen) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+
+ /* decrypt private portion of key */
+ if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 ||
+ (r = cipher_init(&ciphercontext, cipher, key, keylen,
+ key + keylen, ivlen, 0)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&ciphercontext, 0, dp, sshbuf_ptr(decoded),
+ encrypted_len, 0, authlen)) != 0) {
+ /* an integrity error here indicates an incorrect passphrase */
+ if (r == SSH_ERR_MAC_INVALID)
+ r = SSH_ERR_KEY_WRONG_PASSPHRASE;
+ goto out;
+ }
+ if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0)
+ goto out;
+ /* there should be no trailing data */
+ if (sshbuf_len(decoded) != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+
+ /* check check bytes */
+ if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 ||
+ (r = sshbuf_get_u32(decrypted, &check2)) != 0)
+ goto out;
+ if (check1 != check2) {
+ r = SSH_ERR_KEY_WRONG_PASSPHRASE;
+ goto out;
+ }
+
+ /* Load the private key and comment */
+ if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 ||
+ (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0)
+ goto out;
+
+ /* Check deterministic padding */
+ i = 0;
+ while (sshbuf_len(decrypted)) {
+ if ((r = sshbuf_get_u8(decrypted, &pad)) != 0)
+ goto out;
+ if (pad != (++i & 0xff)) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ }
+
+ /* XXX decode pubkey and check against private */
+
+ /* success */
+ r = 0;
+ if (keyp != NULL) {
+ *keyp = k;
+ k = NULL;
+ }
+ if (commentp != NULL) {
+ *commentp = comment;
+ comment = NULL;
+ }
+ out:
+ pad = 0;
+ cipher_cleanup(&ciphercontext);
+ free(ciphername);
+ free(kdfname);
+ free(comment);
+ if (salt != NULL) {
+ explicit_bzero(salt, slen);
+ free(salt);
+ }
+ if (key != NULL) {
+ explicit_bzero(key, keylen + ivlen);
+ free(key);
+ }
+ sshbuf_free(encoded);
+ sshbuf_free(decoded);
+ sshbuf_free(kdf);
+ sshbuf_free(decrypted);
+ sshkey_free(k);
+ return r;
+}
+
+#if WITH_SSH1
+/*
+ * Serialises the authentication (private) key to a blob, encrypting it with
+ * passphrase. The identification of the blob (lowest 64 bits of n) will
+ * precede the key to provide identification of the key without needing a
+ * passphrase.
+ */
+static int
+sshkey_private_rsa1_to_blob(struct sshkey *key, struct sshbuf *blob,
+ const char *passphrase, const char *comment)
+{
+ struct sshbuf *buffer = NULL, *encrypted = NULL;
+ u_char buf[8];
+ int r, cipher_num;
+ struct sshcipher_ctx ciphercontext;
+ const struct sshcipher *cipher;
+ u_char *cp;
+
+ /*
+ * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting
+ * to another cipher; otherwise use SSH_AUTHFILE_CIPHER.
+ */
+ cipher_num = (strcmp(passphrase, "") == 0) ?
+ SSH_CIPHER_NONE : SSH_CIPHER_3DES;
+ if ((cipher = cipher_by_number(cipher_num)) == NULL)
+ return SSH_ERR_INTERNAL_ERROR;
+
+ /* This buffer is used to build the secret part of the private key. */
+ if ((buffer = sshbuf_new()) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+
+ /* Put checkbytes for checking passphrase validity. */
+ if ((r = sshbuf_reserve(buffer, 4, &cp)) != 0)
+ goto out;
+ arc4random_buf(cp, 2);
+ memcpy(cp + 2, cp, 2);
+
+ /*
+ * Store the private key (n and e will not be stored because they
+ * will be stored in plain text, and storing them also in encrypted
+ * format would just give known plaintext).
+ * Note: q and p are stored in reverse order to SSL.
+ */
+ if ((r = sshbuf_put_bignum1(buffer, key->rsa->d)) != 0 ||
+ (r = sshbuf_put_bignum1(buffer, key->rsa->iqmp)) != 0 ||
+ (r = sshbuf_put_bignum1(buffer, key->rsa->q)) != 0 ||
+ (r = sshbuf_put_bignum1(buffer, key->rsa->p)) != 0)
+ goto out;
+
+ /* Pad the part to be encrypted to a size that is a multiple of 8. */
+ explicit_bzero(buf, 8);
+ if ((r = sshbuf_put(buffer, buf, 8 - (sshbuf_len(buffer) % 8))) != 0)
+ goto out;
+
+ /* This buffer will be used to contain the data in the file. */
+ if ((encrypted = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ /* First store keyfile id string. */
+ if ((r = sshbuf_put(encrypted, LEGACY_BEGIN,
+ sizeof(LEGACY_BEGIN))) != 0)
+ goto out;
+
+ /* Store cipher type and "reserved" field. */
+ if ((r = sshbuf_put_u8(encrypted, cipher_num)) != 0 ||
+ (r = sshbuf_put_u32(encrypted, 0)) != 0)
+ goto out;
+
+ /* Store public key. This will be in plain text. */
+ if ((r = sshbuf_put_u32(encrypted, BN_num_bits(key->rsa->n))) != 0 ||
+ (r = sshbuf_put_bignum1(encrypted, key->rsa->n)) != 0 ||
+ (r = sshbuf_put_bignum1(encrypted, key->rsa->e)) != 0 ||
+ (r = sshbuf_put_cstring(encrypted, comment)) != 0)
+ goto out;
+
+ /* Allocate space for the private part of the key in the buffer. */
+ if ((r = sshbuf_reserve(encrypted, sshbuf_len(buffer), &cp)) != 0)
+ goto out;
+
+ if ((r = cipher_set_key_string(&ciphercontext, cipher, passphrase,
+ CIPHER_ENCRYPT)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&ciphercontext, 0, cp,
+ sshbuf_ptr(buffer), sshbuf_len(buffer), 0, 0)) != 0)
+ goto out;
+ if ((r = cipher_cleanup(&ciphercontext)) != 0)
+ goto out;
+
+ r = sshbuf_putb(blob, encrypted);
+
+ out:
+ explicit_bzero(&ciphercontext, sizeof(ciphercontext));
+ explicit_bzero(buf, sizeof(buf));
+ sshbuf_free(buffer);
+ sshbuf_free(encrypted);
+
+ return r;
+}
+#endif /* WITH_SSH1 */
+
+#ifdef WITH_OPENSSL
+/* convert SSH v2 key in OpenSSL PEM format */
+static int
+sshkey_private_pem_to_blob(struct sshkey *key, struct sshbuf *blob,
+ const char *_passphrase, const char *comment)
+{
+ int success, r;
+ int blen, len = strlen(_passphrase);
+ u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL;
+#if (OPENSSL_VERSION_NUMBER < 0x00907000L)
+ const EVP_CIPHER *cipher = (len > 0) ? EVP_des_ede3_cbc() : NULL;
+#else
+ const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL;
+#endif
+ const u_char *bptr;
+ BIO *bio = NULL;
+
+ if (len > 0 && len <= 4)
+ return SSH_ERR_PASSPHRASE_TOO_SHORT;
+ if ((bio = BIO_new(BIO_s_mem())) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+
+ switch (key->type) {
+ case KEY_DSA:
+ success = PEM_write_bio_DSAPrivateKey(bio, key->dsa,
+ cipher, passphrase, len, NULL, NULL);
+ break;
+#ifdef OPENSSL_HAS_ECC
+ case KEY_ECDSA:
+ success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa,
+ cipher, passphrase, len, NULL, NULL);
+ break;
+#endif
+ case KEY_RSA:
+ success = PEM_write_bio_RSAPrivateKey(bio, key->rsa,
+ cipher, passphrase, len, NULL, NULL);
+ break;
+ default:
+ success = 0;
+ break;
+ }
+ if (success == 0) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0) {
+ r = SSH_ERR_INTERNAL_ERROR;
+ goto out;
+ }
+ if ((r = sshbuf_put(blob, bptr, blen)) != 0)
+ goto out;
+ r = 0;
+ out:
+ BIO_free(bio);
+ return r;
+}
+#endif /* WITH_OPENSSL */
+
+/* Serialise "key" to buffer "blob" */
+int
+sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
+ const char *passphrase, const char *comment,
+ int force_new_format, const char *new_format_cipher, int new_format_rounds)
+{
+ switch (key->type) {
+#ifdef WITH_SSH1
+ case KEY_RSA1:
+ return sshkey_private_rsa1_to_blob(key, blob,
+ passphrase, comment);
+#endif /* WITH_SSH1 */
+#ifdef WITH_OPENSSL
+ case KEY_DSA:
+ case KEY_ECDSA:
+ case KEY_RSA:
+ if (force_new_format) {
+ return sshkey_private_to_blob2(key, blob, passphrase,
+ comment, new_format_cipher, new_format_rounds);
+ }
+ return sshkey_private_pem_to_blob(key, blob,
+ passphrase, comment);
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ return sshkey_private_to_blob2(key, blob, passphrase,
+ comment, new_format_cipher, new_format_rounds);
+ default:
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
+ }
+}
+
+#ifdef WITH_SSH1
+/*
+ * Parse the public, unencrypted portion of a RSA1 key.
+ */
+int
+sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob,
+ struct sshkey **keyp, char **commentp)
+{
+ int r;
+ struct sshkey *pub = NULL;
+ struct sshbuf *copy = NULL;
+
+ if (keyp != NULL)
+ *keyp = NULL;
+ if (commentp != NULL)
+ *commentp = NULL;
+
+ /* Check that it is at least big enough to contain the ID string. */
+ if (sshbuf_len(blob) < sizeof(LEGACY_BEGIN))
+ return SSH_ERR_INVALID_FORMAT;
+
+ /*
+ * Make sure it begins with the id string. Consume the id string
+ * from the buffer.
+ */
+ if (memcmp(sshbuf_ptr(blob), LEGACY_BEGIN, sizeof(LEGACY_BEGIN)) != 0)
+ return SSH_ERR_INVALID_FORMAT;
+ /* Make a working copy of the keyblob and skip past the magic */
+ if ((copy = sshbuf_fromb(blob)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
+ if ((r = sshbuf_consume(copy, sizeof(LEGACY_BEGIN))) != 0)
+ goto out;
+
+ /* Skip cipher type, reserved data and key bits. */
+ if ((r = sshbuf_get_u8(copy, NULL)) != 0 || /* cipher type */
+ (r = sshbuf_get_u32(copy, NULL)) != 0 || /* reserved */
+ (r = sshbuf_get_u32(copy, NULL)) != 0) /* key bits */
+ goto out;
+
+ /* Read the public key from the buffer. */
+ if ((pub = sshkey_new(KEY_RSA1)) == NULL ||
+ (r = sshbuf_get_bignum1(copy, pub->rsa->n)) != 0 ||
+ (r = sshbuf_get_bignum1(copy, pub->rsa->e)) != 0)
+ goto out;
+
+ /* Finally, the comment */
+ if ((r = sshbuf_get_string(copy, (u_char**)commentp, NULL)) != 0)
+ goto out;
+
+ /* The encrypted private part is not parsed by this function. */
+
+ r = 0;
+ if (keyp != NULL) {
+ *keyp = pub;
+ pub = NULL;
+ }
+ out:
+ sshbuf_free(copy);
+ sshkey_free(pub);
+ return r;
+}
+
+static int
+sshkey_parse_private_rsa1(struct sshbuf *blob, const char *passphrase,
+ struct sshkey **keyp, char **commentp)
+{
+ int r;
+ u_int16_t check1, check2;
+ u_int8_t cipher_type;
+ struct sshbuf *decrypted = NULL, *copy = NULL;
+ u_char *cp;
+ char *comment = NULL;
+ struct sshcipher_ctx ciphercontext;
+ const struct sshcipher *cipher;
+ struct sshkey *prv = NULL;
+
+ if (keyp != NULL)
+ *keyp = NULL;
+ if (commentp != NULL)
+ *commentp = NULL;
+
+ /* Check that it is at least big enough to contain the ID string. */
+ if (sshbuf_len(blob) < sizeof(LEGACY_BEGIN))
+ return SSH_ERR_INVALID_FORMAT;
+
+ /*
+ * Make sure it begins with the id string. Consume the id string
+ * from the buffer.
+ */
+ if (memcmp(sshbuf_ptr(blob), LEGACY_BEGIN, sizeof(LEGACY_BEGIN)) != 0)
+ return SSH_ERR_INVALID_FORMAT;
+
+ if ((prv = sshkey_new_private(KEY_RSA1)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((copy = sshbuf_fromb(blob)) == NULL ||
+ (decrypted = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = sshbuf_consume(copy, sizeof(LEGACY_BEGIN))) != 0)
+ goto out;
+
+ /* Read cipher type. */
+ if ((r = sshbuf_get_u8(copy, &cipher_type)) != 0 ||
+ (r = sshbuf_get_u32(copy, NULL)) != 0) /* reserved */
+ goto out;
+
+ /* Read the public key and comment from the buffer. */
+ if ((r = sshbuf_get_u32(copy, NULL)) != 0 || /* key bits */
+ (r = sshbuf_get_bignum1(copy, prv->rsa->n)) != 0 ||
+ (r = sshbuf_get_bignum1(copy, prv->rsa->e)) != 0 ||
+ (r = sshbuf_get_cstring(copy, &comment, NULL)) != 0)
+ goto out;
+
+ /* Check that it is a supported cipher. */
+ cipher = cipher_by_number(cipher_type);
+ if (cipher == NULL) {
+ r = SSH_ERR_KEY_UNKNOWN_CIPHER;
+ goto out;
+ }
+ /* Initialize space for decrypted data. */
+ if ((r = sshbuf_reserve(decrypted, sshbuf_len(copy), &cp)) != 0)
+ goto out;
+
+ /* Rest of the buffer is encrypted. Decrypt it using the passphrase. */
+ if ((r = cipher_set_key_string(&ciphercontext, cipher, passphrase,
+ CIPHER_DECRYPT)) != 0)
+ goto out;
+ if ((r = cipher_crypt(&ciphercontext, 0, cp,
+ sshbuf_ptr(copy), sshbuf_len(copy), 0, 0)) != 0) {
+ cipher_cleanup(&ciphercontext);
+ goto out;
+ }
+ if ((r = cipher_cleanup(&ciphercontext)) != 0)
+ goto out;
+
+ if ((r = sshbuf_get_u16(decrypted, &check1)) != 0 ||
+ (r = sshbuf_get_u16(decrypted, &check2)) != 0)
+ goto out;
+ if (check1 != check2) {
+ r = SSH_ERR_KEY_WRONG_PASSPHRASE;
+ goto out;
+ }
+
+ /* Read the rest of the private key. */
+ if ((r = sshbuf_get_bignum1(decrypted, prv->rsa->d)) != 0 ||
+ (r = sshbuf_get_bignum1(decrypted, prv->rsa->iqmp)) != 0 ||
+ (r = sshbuf_get_bignum1(decrypted, prv->rsa->q)) != 0 ||
+ (r = sshbuf_get_bignum1(decrypted, prv->rsa->p)) != 0)
+ goto out;
+
+ /* calculate p-1 and q-1 */
+ if ((r = rsa_generate_additional_parameters(prv->rsa)) != 0)
+ goto out;
+
+ /* enable blinding */
+ if (RSA_blinding_on(prv->rsa, NULL) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ r = 0;
+ if (keyp != NULL) {
+ *keyp = prv;
+ prv = NULL;
+ }
+ if (commentp != NULL) {
+ *commentp = comment;
+ comment = NULL;
+ }
+ out:
+ explicit_bzero(&ciphercontext, sizeof(ciphercontext));
+ free(comment);
+ sshkey_free(prv);
+ sshbuf_free(copy);
+ sshbuf_free(decrypted);
+ return r;
+}
+#endif /* WITH_SSH1 */
+
+#ifdef WITH_OPENSSL
+static int
+sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
+ const char *passphrase, struct sshkey **keyp)
+{
+ EVP_PKEY *pk = NULL;
+ struct sshkey *prv = NULL;
+ BIO *bio = NULL;
+ int r;
+
+ if (keyp != NULL)
+ *keyp = NULL;
+
+ if ((bio = BIO_new(BIO_s_mem())) == NULL || sshbuf_len(blob) > INT_MAX)
+ return SSH_ERR_ALLOC_FAIL;
+ if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) !=
+ (int)sshbuf_len(blob)) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ if ((pk = PEM_read_bio_PrivateKey(bio, NULL, NULL,
+ (char *)passphrase)) == NULL) {
+ r = SSH_ERR_KEY_WRONG_PASSPHRASE;
+ goto out;
+ }
+ if (pk->type == EVP_PKEY_RSA &&
+ (type == KEY_UNSPEC || type == KEY_RSA)) {
+ if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ prv->rsa = EVP_PKEY_get1_RSA(pk);
+ prv->type = KEY_RSA;
+#ifdef DEBUG_PK
+ RSA_print_fp(stderr, prv->rsa, 8);
+#endif
+ if (RSA_blinding_on(prv->rsa, NULL) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ } else if (pk->type == EVP_PKEY_DSA &&
+ (type == KEY_UNSPEC || type == KEY_DSA)) {
+ if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ prv->dsa = EVP_PKEY_get1_DSA(pk);
+ prv->type = KEY_DSA;
+#ifdef DEBUG_PK
+ DSA_print_fp(stderr, prv->dsa, 8);
+#endif
+#ifdef OPENSSL_HAS_ECC
+ } else if (pk->type == EVP_PKEY_EC &&
+ (type == KEY_UNSPEC || type == KEY_ECDSA)) {
+ if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk);
+ prv->type = KEY_ECDSA;
+ prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa);
+ if (prv->ecdsa_nid == -1 ||
+ sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL ||
+ sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa),
+ EC_KEY_get0_public_key(prv->ecdsa)) != 0 ||
+ sshkey_ec_validate_private(prv->ecdsa) != 0) {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+# ifdef DEBUG_PK
+ if (prv != NULL && prv->ecdsa != NULL)
+ sshkey_dump_ec_key(prv->ecdsa);
+# endif
+#endif /* OPENSSL_HAS_ECC */
+ } else {
+ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ r = 0;
+ if (keyp != NULL) {
+ *keyp = prv;
+ prv = NULL;
+ }
+ out:
+ BIO_free(bio);
+ if (pk != NULL)
+ EVP_PKEY_free(pk);
+ sshkey_free(prv);
+ return r;
+}
+#endif /* WITH_OPENSSL */
+
+int
+sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
+ const char *passphrase, struct sshkey **keyp, char **commentp)
+{
+ if (keyp != NULL)
+ *keyp = NULL;
+ if (commentp != NULL)
+ *commentp = NULL;
+
+ switch (type) {
+#ifdef WITH_SSH1
+ case KEY_RSA1:
+ return sshkey_parse_private_rsa1(blob, passphrase,
+ keyp, commentp);
+#endif /* WITH_SSH1 */
+#ifdef WITH_OPENSSL
+ case KEY_DSA:
+ case KEY_ECDSA:
+ case KEY_RSA:
+ return sshkey_parse_private_pem_fileblob(blob, type,
+ passphrase, keyp);
+#endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+ return sshkey_parse_private2(blob, type, passphrase,
+ keyp, commentp);
+ case KEY_UNSPEC:
+ if (sshkey_parse_private2(blob, type, passphrase, keyp,
+ commentp) == 0)
+ return 0;
+#ifdef WITH_OPENSSL
+ return sshkey_parse_private_pem_fileblob(blob, type,
+ passphrase, keyp);
+#else
+ return SSH_ERR_INVALID_FORMAT;
+#endif /* WITH_OPENSSL */
+ default:
+ return SSH_ERR_KEY_TYPE_UNKNOWN;
+ }
+}
+
+int
+sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase,
+ struct sshkey **keyp, char **commentp)
+{
+ if (keyp != NULL)
+ *keyp = NULL;
+ if (commentp != NULL)
+ *commentp = NULL;
+
+#ifdef WITH_SSH1
+ /* it's a SSH v1 key if the public key part is readable */
+ if (sshkey_parse_public_rsa1_fileblob(buffer, NULL, NULL) == 0) {
+ return sshkey_parse_private_fileblob_type(buffer, KEY_RSA1,
+ passphrase, keyp, commentp);
+ }
+#endif /* WITH_SSH1 */
+ return sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC,
+ passphrase, keyp, commentp);
+}
Copied: trunk/crypto/openssh/sshkey.h (from rev 9222, vendor-crypto/openssh/dist/sshkey.h)
===================================================================
--- trunk/crypto/openssh/sshkey.h (rev 0)
+++ trunk/crypto/openssh/sshkey.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,230 @@
+/* $OpenBSD: sshkey.h,v 1.13 2016/05/02 09:36:42 djm Exp $ */
+
+/*
+ * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef SSHKEY_H
+#define SSHKEY_H
+
+#include <sys/types.h>
+
+#ifdef WITH_OPENSSL
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+# ifdef OPENSSL_HAS_ECC
+# include <openssl/ec.h>
+# else /* OPENSSL_HAS_ECC */
+# define EC_KEY void
+# define EC_GROUP void
+# define EC_POINT void
+# endif /* OPENSSL_HAS_ECC */
+#else /* WITH_OPENSSL */
+# define RSA void
+# define DSA void
+# define EC_KEY void
+# define EC_GROUP void
+# define EC_POINT void
+#endif /* WITH_OPENSSL */
+
+#define SSH_RSA_MINIMUM_MODULUS_SIZE 768
+#define SSH_KEY_MAX_SIGN_DATA_SIZE (1 << 20)
+
+struct sshbuf;
+
+/* Key types */
+enum sshkey_types {
+ KEY_RSA1,
+ KEY_RSA,
+ KEY_DSA,
+ KEY_ECDSA,
+ KEY_ED25519,
+ KEY_RSA_CERT,
+ KEY_DSA_CERT,
+ KEY_ECDSA_CERT,
+ KEY_ED25519_CERT,
+ KEY_UNSPEC
+};
+
+/* Default fingerprint hash */
+#define SSH_FP_HASH_DEFAULT SSH_DIGEST_SHA256
+
+/* Fingerprint representation formats */
+enum sshkey_fp_rep {
+ SSH_FP_DEFAULT = 0,
+ SSH_FP_HEX,
+ SSH_FP_BASE64,
+ SSH_FP_BUBBLEBABBLE,
+ SSH_FP_RANDOMART
+};
+
+/* key is stored in external hardware */
+#define SSHKEY_FLAG_EXT 0x0001
+
+#define SSHKEY_CERT_MAX_PRINCIPALS 256
+/* XXX opaquify? */
+struct sshkey_cert {
+ struct sshbuf *certblob; /* Kept around for use on wire */
+ u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
+ u_int64_t serial;
+ char *key_id;
+ u_int nprincipals;
+ char **principals;
+ u_int64_t valid_after, valid_before;
+ struct sshbuf *critical;
+ struct sshbuf *extensions;
+ struct sshkey *signature_key;
+};
+
+/* XXX opaquify? */
+struct sshkey {
+ int type;
+ int flags;
+ RSA *rsa;
+ DSA *dsa;
+ int ecdsa_nid; /* NID of curve */
+ EC_KEY *ecdsa;
+ u_char *ed25519_sk;
+ u_char *ed25519_pk;
+ struct sshkey_cert *cert;
+};
+
+#define ED25519_SK_SZ crypto_sign_ed25519_SECRETKEYBYTES
+#define ED25519_PK_SZ crypto_sign_ed25519_PUBLICKEYBYTES
+
+struct sshkey *sshkey_new(int);
+int sshkey_add_private(struct sshkey *);
+struct sshkey *sshkey_new_private(int);
+void sshkey_free(struct sshkey *);
+int sshkey_demote(const struct sshkey *, struct sshkey **);
+int sshkey_equal_public(const struct sshkey *,
+ const struct sshkey *);
+int sshkey_equal(const struct sshkey *, const struct sshkey *);
+char *sshkey_fingerprint(const struct sshkey *,
+ int, enum sshkey_fp_rep);
+int sshkey_fingerprint_raw(const struct sshkey *k,
+ int, u_char **retp, size_t *lenp);
+const char *sshkey_type(const struct sshkey *);
+const char *sshkey_cert_type(const struct sshkey *);
+int sshkey_write(const struct sshkey *, FILE *);
+int sshkey_read(struct sshkey *, char **);
+u_int sshkey_size(const struct sshkey *);
+
+int sshkey_generate(int type, u_int bits, struct sshkey **keyp);
+int sshkey_from_private(const struct sshkey *, struct sshkey **);
+int sshkey_type_from_name(const char *);
+int sshkey_is_cert(const struct sshkey *);
+int sshkey_type_is_cert(int);
+int sshkey_type_plain(int);
+int sshkey_to_certified(struct sshkey *);
+int sshkey_drop_cert(struct sshkey *);
+int sshkey_certify(struct sshkey *, struct sshkey *, const char *);
+int sshkey_cert_copy(const struct sshkey *, struct sshkey *);
+int sshkey_cert_check_authority(const struct sshkey *, int, int,
+ const char *, const char **);
+size_t sshkey_format_cert_validity(const struct sshkey_cert *,
+ char *, size_t) __attribute__((__bounded__(__string__, 2, 3)));
+
+int sshkey_ecdsa_nid_from_name(const char *);
+int sshkey_curve_name_to_nid(const char *);
+const char * sshkey_curve_nid_to_name(int);
+u_int sshkey_curve_nid_to_bits(int);
+int sshkey_ecdsa_bits_to_nid(int);
+int sshkey_ecdsa_key_to_nid(EC_KEY *);
+int sshkey_ec_nid_to_hash_alg(int nid);
+int sshkey_ec_validate_public(const EC_GROUP *, const EC_POINT *);
+int sshkey_ec_validate_private(const EC_KEY *);
+const char *sshkey_ssh_name(const struct sshkey *);
+const char *sshkey_ssh_name_plain(const struct sshkey *);
+int sshkey_names_valid2(const char *, int);
+char *key_alg_list(int, int);
+
+int sshkey_from_blob(const u_char *, size_t, struct sshkey **);
+int sshkey_fromb(struct sshbuf *, struct sshkey **);
+int sshkey_froms(struct sshbuf *, struct sshkey **);
+int sshkey_to_blob(const struct sshkey *, u_char **, size_t *);
+int sshkey_to_base64(const struct sshkey *, char **);
+int sshkey_putb(const struct sshkey *, struct sshbuf *);
+int sshkey_puts(const struct sshkey *, struct sshbuf *);
+int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *);
+int sshkey_putb_plain(const struct sshkey *, struct sshbuf *);
+
+int sshkey_sign(const struct sshkey *, u_char **, size_t *,
+ const u_char *, size_t, const char *, u_int);
+int sshkey_verify(const struct sshkey *, const u_char *, size_t,
+ const u_char *, size_t, u_int);
+
+/* for debug */
+void sshkey_dump_ec_point(const EC_GROUP *, const EC_POINT *);
+void sshkey_dump_ec_key(const EC_KEY *);
+
+/* private key parsing and serialisation */
+int sshkey_private_serialize(const struct sshkey *key, struct sshbuf *buf);
+int sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **keyp);
+
+/* private key file format parsing and serialisation */
+int sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
+ const char *passphrase, const char *comment,
+ int force_new_format, const char *new_format_cipher, int new_format_rounds);
+int sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob,
+ struct sshkey **keyp, char **commentp);
+int sshkey_parse_private_fileblob(struct sshbuf *buffer,
+ const char *passphrase, struct sshkey **keyp, char **commentp);
+int sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type,
+ const char *passphrase, struct sshkey **keyp, char **commentp);
+
+#ifdef SSHKEY_INTERNAL
+int ssh_rsa_sign(const struct sshkey *key,
+ u_char **sigp, size_t *lenp, const u_char *data, size_t datalen,
+ const char *ident);
+int ssh_rsa_verify(const struct sshkey *key,
+ const u_char *sig, size_t siglen, const u_char *data, size_t datalen);
+int ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, u_int compat);
+int ssh_dss_verify(const struct sshkey *key,
+ const u_char *signature, size_t signaturelen,
+ const u_char *data, size_t datalen, u_int compat);
+int ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, u_int compat);
+int ssh_ecdsa_verify(const struct sshkey *key,
+ const u_char *signature, size_t signaturelen,
+ const u_char *data, size_t datalen, u_int compat);
+int ssh_ed25519_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen, u_int compat);
+int ssh_ed25519_verify(const struct sshkey *key,
+ const u_char *signature, size_t signaturelen,
+ const u_char *data, size_t datalen, u_int compat);
+#endif
+
+#if !defined(WITH_OPENSSL)
+# undef RSA
+# undef DSA
+# undef EC_KEY
+# undef EC_GROUP
+# undef EC_POINT
+#elif !defined(OPENSSL_HAS_ECC)
+# undef EC_KEY
+# undef EC_GROUP
+# undef EC_POINT
+#endif
+
+#endif /* SSHKEY_H */
Modified: trunk/crypto/openssh/sshlogin.c
===================================================================
--- trunk/crypto/openssh/sshlogin.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshlogin.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshlogin.c,v 1.28 2014/01/31 16:39:19 tedu Exp $ */
+/* $OpenBSD: sshlogin.c,v 1.32 2015/12/26 20:51:35 guenther Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -42,7 +42,6 @@
#include "includes.h"
#include <sys/types.h>
-#include <sys/param.h>
#include <sys/socket.h>
#include <netinet/in.h>
@@ -54,10 +53,12 @@
#include <string.h>
#include <time.h>
#include <unistd.h>
+#include <limits.h>
#include "loginrec.h"
#include "log.h"
#include "buffer.h"
+#include "misc.h"
#include "servconf.h"
extern Buffer loginmsg;
@@ -87,7 +88,7 @@
store_lastlog_message(const char *user, uid_t uid)
{
#ifndef NO_SSH_LASTLOG
- char *time_string, hostname[MAXHOSTNAMELEN] = "", buf[512];
+ char *time_string, hostname[HOST_NAME_MAX+1] = "", buf[512];
time_t last_login_time;
if (!options.print_lastlog)
Modified: trunk/crypto/openssh/sshpty.c
===================================================================
--- trunk/crypto/openssh/sshpty.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/sshpty.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshpty.c,v 1.28 2007/09/11 23:49:09 stevesk Exp $ */
+/* $OpenBSD: sshpty.c,v 1.30 2015/07/30 23:09:15 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -85,12 +85,12 @@
void
pty_release(const char *tty)
{
-#ifndef __APPLE_PRIVPTY__
+#if !defined(__APPLE_PRIVPTY__) && !defined(HAVE_OPENPTY)
if (chown(tty, (uid_t) 0, (gid_t) 0) < 0)
error("chown %.100s 0 0 failed: %.100s", tty, strerror(errno));
if (chmod(tty, (mode_t) 0666) < 0)
error("chmod %.100s 0666 failed: %.100s", tty, strerror(errno));
-#endif /* __APPLE_PRIVPTY__ */
+#endif /* !__APPLE_PRIVPTY__ && !HAVE_OPENPTY */
}
/* Makes the tty the process's controlling tty and sets it to sane modes. */
@@ -99,9 +99,6 @@
pty_make_controlling_tty(int *ttyfd, const char *tty)
{
int fd;
-#ifdef USE_VHANGUP
- void *old;
-#endif /* USE_VHANGUP */
#ifdef _UNICOS
if (setsid() < 0)
@@ -157,21 +154,11 @@
if (setpgrp(0,0) < 0)
error("SETPGRP %s",strerror(errno));
#endif /* NEED_SETPGRP */
-#ifdef USE_VHANGUP
- old = signal(SIGHUP, SIG_IGN);
- vhangup();
- signal(SIGHUP, old);
-#endif /* USE_VHANGUP */
fd = open(tty, O_RDWR);
if (fd < 0) {
error("%.100s: %.100s", tty, strerror(errno));
} else {
-#ifdef USE_VHANGUP
- close(*ttyfd);
- *ttyfd = fd;
-#else /* USE_VHANGUP */
close(fd);
-#endif /* USE_VHANGUP */
}
/* Verify that we now have a controlling tty. */
fd = open(_PATH_TTY, O_WRONLY);
@@ -209,13 +196,8 @@
/* Determine the group to make the owner of the tty. */
grp = getgrnam("tty");
- if (grp) {
- gid = grp->gr_gid;
- mode = S_IRUSR | S_IWUSR | S_IWGRP;
- } else {
- gid = pw->pw_gid;
- mode = S_IRUSR | S_IWUSR | S_IWGRP | S_IWOTH;
- }
+ gid = (grp != NULL) ? grp->gr_gid : pw->pw_gid;
+ mode = (grp != NULL) ? 0620 : 0600;
/*
* Change owner and mode of the tty as required.
Modified: trunk/crypto/openssh/ttymodes.c
===================================================================
--- trunk/crypto/openssh/ttymodes.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ttymodes.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ttymodes.c,v 1.29 2008/11/02 00:16:16 stevesk Exp $ */
+/* $OpenBSD: ttymodes.c,v 1.30 2016/05/04 14:22:33 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -54,7 +54,6 @@
#include "packet.h"
#include "log.h"
-#include "ssh1.h"
#include "compat.h"
#include "buffer.h"
Modified: trunk/crypto/openssh/ttymodes.h
===================================================================
--- trunk/crypto/openssh/ttymodes.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/ttymodes.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: ttymodes.h,v 1.14 2006/03/25 22:22:43 djm Exp $ */
+/* $OpenBSD: ttymodes.h,v 1.15 2016/05/03 09:03:49 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -127,6 +127,9 @@
#ifdef IMAXBEL
TTYMODE(IMAXBEL,c_iflag, 41)
#endif /* IMAXBEL */
+#ifdef IUTF8
+TTYMODE(IUTF8, c_iflag, 42)
+#endif /* IUTF8 */
TTYMODE(ISIG, c_lflag, 50)
TTYMODE(ICANON, c_lflag, 51)
Modified: trunk/crypto/openssh/uidswap.c
===================================================================
--- trunk/crypto/openssh/uidswap.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/uidswap.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: uidswap.c,v 1.36 2013/11/08 11:15:19 dtucker Exp $ */
+/* $OpenBSD: uidswap.c,v 1.39 2015/06/24 01:49:19 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -14,11 +14,11 @@
#include "includes.h"
-#include <sys/param.h>
#include <errno.h>
#include <pwd.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
#include <stdarg.h>
#include <stdlib.h>
@@ -86,7 +86,7 @@
if (saved_egroupslen < 0)
fatal("getgroups: %.100s", strerror(errno));
if (saved_egroupslen > 0) {
- saved_egroups = xrealloc(saved_egroups,
+ saved_egroups = xreallocarray(saved_egroups,
saved_egroupslen, sizeof(gid_t));
if (getgroups(saved_egroupslen, saved_egroups) < 0)
fatal("getgroups: %.100s", strerror(errno));
@@ -104,7 +104,7 @@
if (user_groupslen < 0)
fatal("getgroups: %.100s", strerror(errno));
if (user_groupslen > 0) {
- user_groups = xrealloc(user_groups,
+ user_groups = xreallocarray(user_groups,
user_groupslen, sizeof(gid_t));
if (getgroups(user_groupslen, user_groups) < 0)
fatal("getgroups: %.100s", strerror(errno));
@@ -134,7 +134,7 @@
void
permanently_drop_suid(uid_t uid)
{
-#ifndef HAVE_CYGWIN
+#ifndef NO_UID_RESTORATION_TEST
uid_t old_uid = getuid();
#endif
@@ -142,8 +142,14 @@
if (setresuid(uid, uid, uid) < 0)
fatal("setresuid %u: %.100s", (u_int)uid, strerror(errno));
-#ifndef HAVE_CYGWIN
- /* Try restoration of UID if changed (test clearing of saved uid) */
+#ifndef NO_UID_RESTORATION_TEST
+ /*
+ * Try restoration of UID if changed (test clearing of saved uid).
+ *
+ * Note that we don't do this on Cygwin, or on Solaris-based platforms
+ * where fine-grained privileges are available (the user might be
+ * deliberately allowed the right to setuid back to root).
+ */
if (old_uid != uid &&
(setuid(old_uid) != -1 || seteuid(old_uid) != -1))
fatal("%s: was able to restore old [e]uid", __func__);
@@ -199,7 +205,7 @@
void
permanently_set_uid(struct passwd *pw)
{
-#ifndef HAVE_CYGWIN
+#ifndef NO_UID_RESTORATION_TEST
uid_t old_uid = getuid();
gid_t old_gid = getgid();
#endif
@@ -227,7 +233,7 @@
if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) < 0)
fatal("setresuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno));
-#ifndef HAVE_CYGWIN
+#ifndef NO_UID_RESTORATION_TEST
/* Try restoration of GID if changed (test clearing of saved gid) */
if (old_gid != pw->pw_gid && pw->pw_uid != 0 &&
(setgid(old_gid) != -1 || setegid(old_gid) != -1))
@@ -241,7 +247,7 @@
(u_int)pw->pw_gid);
}
-#ifndef HAVE_CYGWIN
+#ifndef NO_UID_RESTORATION_TEST
/* Try restoration of UID if changed (test clearing of saved uid) */
if (old_uid != pw->pw_uid &&
(setuid(old_uid) != -1 || seteuid(old_uid) != -1))
Modified: trunk/crypto/openssh/umac.c
===================================================================
--- trunk/crypto/openssh/umac.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/umac.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: umac.c,v 1.8 2013/11/08 00:39:15 djm Exp $ */
+/* $OpenBSD: umac.c,v 1.11 2014/07/22 07:13:42 guenther Exp $ */
/* -----------------------------------------------------------------------
*
* umac.c -- C Implementation UMAC Message Authentication
@@ -73,13 +73,15 @@
#include "includes.h"
#include <sys/types.h>
-
-#include "xmalloc.h"
-#include "umac.h"
#include <string.h>
+#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
+#include "xmalloc.h"
+#include "umac.h"
+#include "misc.h"
+
/* ---------------------------------------------------------------------- */
/* --- Primitive Data Types --- */
/* ---------------------------------------------------------------------- */
@@ -131,41 +133,17 @@
/* --- Endian Conversion --- Forcing assembly on some platforms */
/* ---------------------------------------------------------------------- */
-#if HAVE_SWAP32
-#define LOAD_UINT32_REVERSED(p) (swap32(*(const UINT32 *)(p)))
-#define STORE_UINT32_REVERSED(p,v) (*(UINT32 *)(p) = swap32(v))
-#else /* HAVE_SWAP32 */
-
-static UINT32 LOAD_UINT32_REVERSED(const void *ptr)
-{
- UINT32 temp = *(const UINT32 *)ptr;
- temp = (temp >> 24) | ((temp & 0x00FF0000) >> 8 )
- | ((temp & 0x0000FF00) << 8 ) | (temp << 24);
- return (UINT32)temp;
-}
-
-# if (__LITTLE_ENDIAN__)
-static void STORE_UINT32_REVERSED(void *ptr, UINT32 x)
-{
- UINT32 i = (UINT32)x;
- *(UINT32 *)ptr = (i >> 24) | ((i & 0x00FF0000) >> 8 )
- | ((i & 0x0000FF00) << 8 ) | (i << 24);
-}
-# endif /* __LITTLE_ENDIAN */
-#endif /* HAVE_SWAP32 */
-
-/* The following definitions use the above reversal-primitives to do the right
- * thing on endian specific load and stores.
- */
-
#if (__LITTLE_ENDIAN__)
-#define LOAD_UINT32_LITTLE(ptr) (*(const UINT32 *)(ptr))
-#define STORE_UINT32_BIG(ptr,x) STORE_UINT32_REVERSED(ptr,x)
+#define LOAD_UINT32_REVERSED(p) get_u32(p)
+#define STORE_UINT32_REVERSED(p,v) put_u32(p,v)
#else
-#define LOAD_UINT32_LITTLE(ptr) LOAD_UINT32_REVERSED(ptr)
-#define STORE_UINT32_BIG(ptr,x) (*(UINT32 *)(ptr) = (UINT32)(x))
+#define LOAD_UINT32_REVERSED(p) get_u32_le(p)
+#define STORE_UINT32_REVERSED(p,v) put_u32_le(p,v)
#endif
+#define LOAD_UINT32_LITTLE(p) (get_u32_le(p))
+#define STORE_UINT32_BIG(p,v) put_u32(p, v)
+
/* ---------------------------------------------------------------------- */
/* ---------------------------------------------------------------------- */
/* ----- Begin KDF & PDF Section ---------------------------------------- */
@@ -176,6 +154,7 @@
#define AES_BLOCK_LEN 16
/* OpenSSL's AES */
+#ifdef WITH_OPENSSL
#include "openbsd-compat/openssl-compat.h"
#ifndef USE_BUILTIN_RIJNDAEL
# include <openssl/aes.h>
@@ -185,6 +164,16 @@
AES_encrypt((u_char *)(in),(u_char *)(out),(AES_KEY *)int_key)
#define aes_key_setup(key,int_key) \
AES_set_encrypt_key((const u_char *)(key),UMAC_KEY_LEN*8,int_key)
+#else
+#include "rijndael.h"
+#define AES_ROUNDS ((UMAC_KEY_LEN / 4) + 6)
+typedef UINT8 aes_int_key[AES_ROUNDS+1][4][4]; /* AES internal */
+#define aes_encryption(in,out,int_key) \
+ rijndaelEncrypt((u32 *)(int_key), AES_ROUNDS, (u8 *)(in), (u8 *)(out))
+#define aes_key_setup(key,int_key) \
+ rijndaelKeySetupEnc((u32 *)(int_key), (const unsigned char *)(key), \
+ UMAC_KEY_LEN*8)
+#endif
/* The user-supplied UMAC key is stretched using AES in a counter
* mode to supply all random bits needed by UMAC. The kdf function takes
Copied: trunk/crypto/openssh/utf8.c (from rev 9222, vendor-crypto/openssh/dist/utf8.c)
===================================================================
--- trunk/crypto/openssh/utf8.c (rev 0)
+++ trunk/crypto/openssh/utf8.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,290 @@
+/* $OpenBSD: utf8.c,v 1.3 2016/05/30 12:57:21 schwarze Exp $ */
+/*
+ * Copyright (c) 2016 Ingo Schwarze <schwarze at openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Utility functions for multibyte-character handling,
+ * in particular to sanitize untrusted strings for terminal output.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#ifdef HAVE_LANGINFO_H
+# include <langinfo.h>
+#endif
+#include <limits.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
+# include <vis.h>
+#endif
+#ifdef HAVE_WCHAR_H
+# include <wchar.h>
+#endif
+
+#include "utf8.h"
+
+static int dangerous_locale(void);
+static int grow_dst(char **, size_t *, size_t, char **, size_t);
+static int vasnmprintf(char **, size_t, int *, const char *, va_list);
+
+
+/*
+ * For US-ASCII and UTF-8 encodings, we can safely recover from
+ * encoding errors and from non-printable characters. For any
+ * other encodings, err to the side of caution and abort parsing:
+ * For state-dependent encodings, recovery is impossible.
+ * For arbitrary encodings, replacement of non-printable
+ * characters would be non-trivial and too fragile.
+ */
+
+static int
+dangerous_locale(void) {
+ char *loc;
+
+ loc = nl_langinfo(CODESET);
+ return strcmp(loc, "US-ASCII") && strcmp(loc, "UTF-8");
+}
+
+static int
+grow_dst(char **dst, size_t *sz, size_t maxsz, char **dp, size_t need)
+{
+ char *tp;
+ size_t tsz;
+
+ if (*dp + need < *dst + *sz)
+ return 0;
+ tsz = *sz + 128;
+ if (tsz > maxsz)
+ tsz = maxsz;
+ if ((tp = realloc(*dst, tsz)) == NULL)
+ return -1;
+ *dp = tp + (*dp - *dst);
+ *dst = tp;
+ *sz = tsz;
+ return 0;
+}
+
+/*
+ * The following two functions limit the number of bytes written,
+ * including the terminating '\0', to sz. Unless wp is NULL,
+ * they limit the number of display columns occupied to *wp.
+ * Whichever is reached first terminates the output string.
+ * To stay close to the standard interfaces, they return the number of
+ * non-NUL bytes that would have been written if both were unlimited.
+ * If wp is NULL, newline, carriage return, and tab are allowed;
+ * otherwise, the actual number of columns occupied by what was
+ * written is returned in *wp.
+ */
+
+static int
+vasnmprintf(char **str, size_t maxsz, int *wp, const char *fmt, va_list ap)
+{
+ char *src; /* Source string returned from vasprintf. */
+ char *sp; /* Pointer into src. */
+ char *dst; /* Destination string to be returned. */
+ char *dp; /* Pointer into dst. */
+ char *tp; /* Temporary pointer for dst. */
+ size_t sz; /* Number of bytes allocated for dst. */
+ wchar_t wc; /* Wide character at sp. */
+ int len; /* Number of bytes in the character at sp. */
+ int ret; /* Number of bytes needed to format src. */
+ int width; /* Display width of the character wc. */
+ int total_width, max_width, print;
+
+ src = NULL;
+ if ((ret = vasprintf(&src, fmt, ap)) <= 0)
+ goto fail;
+
+ sz = strlen(src) + 1;
+ if ((dst = malloc(sz)) == NULL) {
+ free(src);
+ goto fail;
+ }
+
+ if (maxsz > INT_MAX)
+ maxsz = INT_MAX;
+
+ sp = src;
+ dp = dst;
+ ret = 0;
+ print = 1;
+ total_width = 0;
+ max_width = wp == NULL ? INT_MAX : *wp;
+ while (*sp != '\0') {
+ if ((len = mbtowc(&wc, sp, MB_CUR_MAX)) == -1) {
+ (void)mbtowc(NULL, NULL, MB_CUR_MAX);
+ if (dangerous_locale()) {
+ ret = -1;
+ break;
+ }
+ len = 1;
+ width = -1;
+ } else if (wp == NULL &&
+ (wc == L'\n' || wc == L'\r' || wc == L'\t')) {
+ /*
+ * Don't use width uninitialized; the actual
+ * value doesn't matter because total_width
+ * is only returned for wp != NULL.
+ */
+ width = 0;
+ } else if ((width = wcwidth(wc)) == -1 &&
+ dangerous_locale()) {
+ ret = -1;
+ break;
+ }
+
+ /* Valid, printable character. */
+
+ if (width >= 0) {
+ if (print && (dp - dst >= (int)maxsz - len ||
+ total_width > max_width - width))
+ print = 0;
+ if (print) {
+ if (grow_dst(&dst, &sz, maxsz,
+ &dp, len) == -1) {
+ ret = -1;
+ break;
+ }
+ total_width += width;
+ memcpy(dp, sp, len);
+ dp += len;
+ }
+ sp += len;
+ if (ret >= 0)
+ ret += len;
+ continue;
+ }
+
+ /* Escaping required. */
+
+ while (len > 0) {
+ if (print && (dp - dst >= (int)maxsz - 4 ||
+ total_width > max_width - 4))
+ print = 0;
+ if (print) {
+ if (grow_dst(&dst, &sz, maxsz,
+ &dp, 4) == -1) {
+ ret = -1;
+ break;
+ }
+ tp = vis(dp, *sp, VIS_OCTAL | VIS_ALL, 0);
+ width = tp - dp;
+ total_width += width;
+ dp = tp;
+ } else
+ width = 4;
+ len--;
+ sp++;
+ if (ret >= 0)
+ ret += width;
+ }
+ if (len > 0)
+ break;
+ }
+ free(src);
+ *dp = '\0';
+ *str = dst;
+ if (wp != NULL)
+ *wp = total_width;
+
+ /*
+ * If the string was truncated by the width limit but
+ * would have fit into the size limit, the only sane way
+ * to report the problem is using the return value, such
+ * that the usual idiom "if (ret < 0 || ret >= sz) error"
+ * works as expected.
+ */
+
+ if (ret < (int)maxsz && !print)
+ ret = -1;
+ return ret;
+
+fail:
+ if (wp != NULL)
+ *wp = 0;
+ if (ret == 0) {
+ *str = src;
+ return 0;
+ } else {
+ *str = NULL;
+ return -1;
+ }
+}
+
+int
+snmprintf(char *str, size_t sz, int *wp, const char *fmt, ...)
+{
+ va_list ap;
+ char *cp;
+ int ret;
+
+ va_start(ap, fmt);
+ ret = vasnmprintf(&cp, sz, wp, fmt, ap);
+ va_end(ap);
+ if (cp != NULL) {
+ (void)strlcpy(str, cp, sz);
+ free(cp);
+ } else
+ *str = '\0';
+ return ret;
+}
+
+/*
+ * To stay close to the standard interfaces, the following functions
+ * return the number of non-NUL bytes written.
+ */
+
+int
+vfmprintf(FILE *stream, const char *fmt, va_list ap)
+{
+ char *str;
+ int ret;
+
+ if ((ret = vasnmprintf(&str, INT_MAX, NULL, fmt, ap)) < 0)
+ return -1;
+ if (fputs(str, stream) == EOF)
+ ret = -1;
+ free(str);
+ return ret;
+}
+
+int
+fmprintf(FILE *stream, const char *fmt, ...)
+{
+ va_list ap;
+ int ret;
+
+ va_start(ap, fmt);
+ ret = vfmprintf(stream, fmt, ap);
+ va_end(ap);
+ return ret;
+}
+
+int
+mprintf(const char *fmt, ...)
+{
+ va_list ap;
+ int ret;
+
+ va_start(ap, fmt);
+ ret = vfmprintf(stdout, fmt, ap);
+ va_end(ap);
+ return ret;
+}
Copied: trunk/crypto/openssh/utf8.h (from rev 9222, vendor-crypto/openssh/dist/utf8.h)
===================================================================
--- trunk/crypto/openssh/utf8.h (rev 0)
+++ trunk/crypto/openssh/utf8.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -0,0 +1,24 @@
+/* $OpenBSD: utf8.h,v 1.1 2016/05/25 23:48:45 schwarze Exp $ */
+/*
+ * Copyright (c) 2016 Ingo Schwarze <schwarze at openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+int mprintf(const char *, ...)
+ __attribute__((format(printf, 1, 2)));
+int fmprintf(FILE *, const char *, ...)
+ __attribute__((format(printf, 2, 3)));
+int vfmprintf(FILE *, const char *, va_list);
+int snmprintf(char *, size_t, int *, const char *, ...)
+ __attribute__((format(printf, 4, 5)));
Modified: trunk/crypto/openssh/uuencode.c
===================================================================
--- trunk/crypto/openssh/uuencode.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/uuencode.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: uuencode.c,v 1.27 2013/05/17 00:13:14 djm Exp $ */
+/* $OpenBSD: uuencode.c,v 1.28 2015/04/24 01:36:24 deraadt Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -82,7 +82,7 @@
fprintf(fp, "dump_base64: len > 65536\n");
return;
}
- buf = xmalloc(2*len);
+ buf = xreallocarray(NULL, 2, len);
n = uuencode(data, len, buf, 2*len);
for (i = 0; i < n; i++) {
fprintf(fp, "%c", buf[i]);
Modified: trunk/crypto/openssh/version.h
===================================================================
--- trunk/crypto/openssh/version.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/version.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,6 +1,6 @@
-/* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */
+/* $OpenBSD: version.h,v 1.77 2016/07/24 11:45:36 djm Exp $ */
-#define SSH_VERSION "OpenSSH_6.6"
+#define SSH_VERSION "OpenSSH_7.3"
#define SSH_PORTABLE "p1"
#define SSH_RELEASE SSH_VERSION SSH_PORTABLE
Modified: trunk/crypto/openssh/xmalloc.c
===================================================================
--- trunk/crypto/openssh/xmalloc.c 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/xmalloc.c 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: xmalloc.c,v 1.29 2014/01/04 17:50:55 tedu Exp $ */
+/* $OpenBSD: xmalloc.c,v 1.33 2016/02/15 09:47:49 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -15,8 +15,10 @@
#include "includes.h"
-#include <sys/param.h>
#include <stdarg.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -24,6 +26,16 @@
#include "xmalloc.h"
#include "log.h"
+void
+ssh_malloc_init(void)
+{
+#if defined(__OpenBSD__)
+ extern char *malloc_options;
+
+ malloc_options = "S";
+#endif /* __OpenBSD__ */
+}
+
void *
xmalloc(size_t size)
{
@@ -44,8 +56,8 @@
if (size == 0 || nmemb == 0)
fatal("xcalloc: zero size");
- if (SIZE_T_MAX / nmemb < size)
- fatal("xcalloc: nmemb * size > SIZE_T_MAX");
+ if (SIZE_MAX / nmemb < size)
+ fatal("xcalloc: nmemb * size > SIZE_MAX");
ptr = calloc(nmemb, size);
if (ptr == NULL)
fatal("xcalloc: out of memory (allocating %zu bytes)",
@@ -54,22 +66,14 @@
}
void *
-xrealloc(void *ptr, size_t nmemb, size_t size)
+xreallocarray(void *ptr, size_t nmemb, size_t size)
{
void *new_ptr;
- size_t new_size = nmemb * size;
- if (new_size == 0)
- fatal("xrealloc: zero size");
- if (SIZE_T_MAX / nmemb < size)
- fatal("xrealloc: nmemb * size > SIZE_T_MAX");
- if (ptr == NULL)
- new_ptr = malloc(new_size);
- else
- new_ptr = realloc(ptr, new_size);
+ new_ptr = reallocarray(ptr, nmemb, size);
if (new_ptr == NULL)
- fatal("xrealloc: out of memory (new_size %zu bytes)",
- new_size);
+ fatal("xreallocarray: out of memory (%zu elements of %zu bytes)",
+ nmemb, size);
return new_ptr;
}
Modified: trunk/crypto/openssh/xmalloc.h
===================================================================
--- trunk/crypto/openssh/xmalloc.h 2016-11-05 20:33:10 UTC (rev 9222)
+++ trunk/crypto/openssh/xmalloc.h 2016-11-05 20:36:34 UTC (rev 9223)
@@ -1,4 +1,4 @@
-/* $OpenBSD: xmalloc.h,v 1.14 2013/05/17 00:13:14 djm Exp $ */
+/* $OpenBSD: xmalloc.h,v 1.16 2016/02/15 09:47:49 dtucker Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -16,9 +16,10 @@
* called by a name other than "ssh" or "Secure Shell".
*/
+void ssh_malloc_init(void);
void *xmalloc(size_t);
void *xcalloc(size_t, size_t);
-void *xrealloc(void *, size_t, size_t);
+void *xreallocarray(void *, size_t, size_t);
char *xstrdup(const char *);
int xasprintf(char **, const char *, ...)
__attribute__((__format__ (printf, 2, 3)))
More information about the Midnightbsd-cvs
mailing list