Merge pull request #3857 from citrus-it/opensshr52

openssh - update from 9.9p1 to 9.9p2 (r151052)

Author: oetiker

build/openssh/build.sh

@@ -13,12 +13,12 @@
 # }}}
 #
 # Copyright 2015 OmniTI Computer Consulting, Inc.  All rights reserved.
-# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2025 OmniOS Community Edition (OmniOSce) Association.
 
 . ../../lib/build.sh
 
 PROG=openssh
-VER=9.9p1
+VER=9.9p2
 PKG=network/openssh
 SUMMARY="OpenSSH Client and utilities"
 DESC="OpenSSH Secure Shell protocol Client and associated Utilities"

build/openssh/patches/0002-PAM-Support.patch

@@ -26,7 +26,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/servconf.c a/servconf.c
  	if (options->pam_service_name == NULL)
  		options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
 
-@@ -1345,8 +1350,17 @@ process_server_config_line_depth(ServerO
+@@ -1374,8 +1379,17 @@ process_server_config_line_depth(ServerO
  	switch (opcode) {
  	/* Portable-specific options */
  	case sUsePAM:

build/openssh/patches/0006-GSS-store-creds-for-Solaris.patch

@@ -51,15 +51,15 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/gss-serv-krb5.c a/gss-serv-kr
 diff -wpruN --no-dereference '--exclude=*.orig' a~/gss-serv.c a/gss-serv.c
 --- a~/gss-serv.c	1970-01-01 00:00:00
 +++ a/gss-serv.c	1970-01-01 00:00:00
-@@ -44,6 +44,7 @@
+@@ -45,6 +45,7 @@
  #include "session.h"
  #include "misc.h"
  #include "servconf.h"
 +#include "sshbuf.h"
 
  #include "ssh-gss.h"
 
-@@ -319,22 +320,66 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
+@@ -320,22 +321,66 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  void
  ssh_gssapi_cleanup_creds(void)
  {

build/openssh/patches/0008-Add-DisableBanner-option.patch

@@ -21,7 +21,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/readconf.c a/readconf.c
  	{ "tunnel", oTunnel },
  	{ "tunneldevice", oTunnelDevice },
  	{ "localcommand", oLocalCommand },
-@@ -1054,6 +1060,17 @@ parse_multistate_value(const char *arg,
+@@ -1072,6 +1078,17 @@ parse_multistate_value(const char *arg,
  	return -1;
  }
 
@@ -39,7 +39,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/readconf.c a/readconf.c
  /*
   * Processes a single option line as used in the configuration files. This
   * only sets those values that have not already been set.
-@@ -2422,6 +2439,13 @@ parse_pubkey_algos:
+@@ -2440,6 +2457,13 @@ parse_pubkey_algos:
  		}
  		break;
 
@@ -53,7 +53,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/readconf.c a/readconf.c
  	case oDeprecated:
  		debug("%s line %d: Deprecated option \"%s\"",
  		    filename, linenum, keyword);
-@@ -2660,6 +2684,9 @@ initialize_options(Options * options)
+@@ -2678,6 +2702,9 @@ initialize_options(Options * options)
  	options->stdin_null = -1;
  	options->fork_after_authentication = -1;
  	options->proxy_use_fdpass = -1;
@@ -63,7 +63,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/readconf.c a/readconf.c
  	options->ignored_unknown = NULL;
  	options->num_canonical_domains = 0;
  	options->num_permitted_cnames = 0;
-@@ -2867,6 +2894,10 @@ fill_default_options(Options * options)
+@@ -2885,6 +2912,10 @@ fill_default_options(Options * options)
  		options->canonicalize_fallback_local = 1;
  	if (options->canonicalize_hostname == -1)
  		options->canonicalize_hostname = SSH_CANONICALISE_NO;

build/openssh/patches/0010-PAM-enhancements-for-Solaris.patch

@@ -488,7 +488,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/servconf.c a/servconf.c
  #endif
  	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
  	/* Standard Options */
-@@ -1365,6 +1394,21 @@ process_server_config_line_depth(ServerO
+@@ -1394,6 +1423,21 @@ process_server_config_line_depth(ServerO
  		intptr = &options->use_pam;
  		goto parse_flag;
  #endif
@@ -510,7 +510,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/servconf.c a/servconf.c
  	case sPAMServiceName:
  		charptr = &options->pam_service_name;
  		arg = argv_next(&ac, &av);
-@@ -1372,8 +1416,20 @@ process_server_config_line_depth(ServerO
+@@ -1401,8 +1445,20 @@ process_server_config_line_depth(ServerO
  			fatal("%s line %d: missing argument.",
  			    filename, linenum);
  		}

build/openssh/patches/0013-Solaris-Auditing-support.patch

@@ -725,7 +725,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/configure.ac a/configure.ac
 diff -wpruN --no-dereference '--exclude=*.orig' a~/defines.h a/defines.h
 --- a~/defines.h	1970-01-01 00:00:00
 +++ a/defines.h	1970-01-01 00:00:00
-@@ -715,6 +715,11 @@ struct winsize {
+@@ -741,6 +741,11 @@ struct winsize {
  # define CUSTOM_SSH_AUDIT_EVENTS
  #endif
 

build/openssh/patches/0019-PubKeyPlugin-support.patch

@@ -226,7 +226,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/servconf.c a/servconf.c
  	{ "securitykeyprovider", sSecurityKeyProvider, SSHCFG_GLOBAL },
  	{ "requiredrsasize", sRequiredRSASize, SSHCFG_ALL },
  	{ "channeltimeout", sChannelTimeout, SSHCFG_ALL },
-@@ -2755,6 +2758,18 @@ process_server_config_line_depth(ServerO
+@@ -2784,6 +2787,18 @@ process_server_config_line_depth(ServerO
  		multistate_ptr = multistate_flag;
  		goto parse_multistate;
 

build/openssh/patches/0026-Don-t-use-krb5-config-to-check-for-GSSAPI-on-illumos.patch

@@ -6,7 +6,7 @@ Subject: [PATCH 26/34] Don't use krb5-config to check for GSSAPI on illumos
 diff -wpruN --no-dereference '--exclude=*.orig' a~/configure.ac a/configure.ac
 --- a~/configure.ac	1970-01-01 00:00:00
 +++ a/configure.ac	1970-01-01 00:00:00
-@@ -4794,6 +4794,11 @@ AC_ARG_WITH([kerberos5],
+@@ -4793,6 +4793,11 @@ AC_ARG_WITH([kerberos5],
  			AC_PATH_TOOL([KRB5CONF], [krb5-config],
  				     [$KRB5ROOT/bin/krb5-config],
  				     [$KRB5ROOT/bin:$PATH])
@@ -18,7 +18,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/configure.ac a/configure.ac
  			if test -x $KRB5CONF ; then
  				K5CFLAGS="`$KRB5CONF --cflags`"
  				K5LIBS="`$KRB5CONF --libs`"
-@@ -4835,7 +4840,7 @@ AC_ARG_WITH([kerberos5],
+@@ -4834,7 +4839,7 @@ AC_ARG_WITH([kerberos5],
  						 AC_CHECK_LIB([des], [des_cbc_encrypt],
  						   [K5LIBS="$K5LIBS -ldes"])
  					       ], [ AC_MSG_RESULT([no])

build/openssh/patches/0029-Accept-LANG-and-LC_-environment-variables-from-clien.patch

@@ -51,7 +51,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/servconf.c a/servconf.c
  	if (options->client_alive_interval == -1)
  		options->client_alive_interval = 0;
  	if (options->client_alive_count_max == -1)
-@@ -2329,9 +2356,12 @@ process_server_config_line_depth(ServerO
+@@ -2358,9 +2385,12 @@ process_server_config_line_depth(ServerO
  			if (*arg == '\0' || strchr(arg, '=') != NULL)
  				fatal("%s line %d: Invalid environment name.",
  				    filename, linenum);

build/openssh/patches/0031-Restore-tcpwrappers-libwrap-support.patch

@@ -64,7 +64,7 @@ diff -wpruN --no-dereference '--exclude=*.orig' a~/configure.ac a/configure.ac
  # Check whether user wants to use ldns
  LDNS_MSG="no"
  AC_ARG_WITH(ldns,
-@@ -5725,6 +5781,7 @@ echo "                       PAM support
+@@ -5724,6 +5780,7 @@ echo "                       PAM support
  echo "                   OSF SIA support: $SIA_MSG"
  echo "                 KerberosV support: $KRB5_MSG"
  echo "                   SELinux support: $SELINUX_MSG"