Thu Apr 24 03:25:33 UTC 2014

7 files changed, 196 insertions, 75 deletions

diff --git a/core/bash/PKGBUILD b/core/bash/PKGBUILD
index facd6a1ac..8ee46db7c 100644
--- a/core/bash/PKGBUILD
+++ b/core/bash/PKGBUILD
@@ -1,13 +1,13 @@
-# $Id: PKGBUILD 209915 2014-04-08 15:23:40Z anatolik $
+# $Id: PKGBUILD 211713 2014-04-23 18:51:16Z bpiotrowski $
 # Maintainer:  Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
 # Contributor: Allan McRae <allan@archlinux.org>
 # Contributor: Aaron Griffin <aaron@archlinux.org>
 
 pkgname=bash
 _basever=4.3
-_patchlevel=008
+_patchlevel=011
 pkgver=$_basever.$_patchlevel
-pkgrel=2
+pkgrel=1
 pkgdesc='The GNU Bourne Again shell'
 arch=('i686' 'x86_64')
 license=('GPL')
@@ -94,4 +94,10 @@ md5sums=('81348932d5da294953e15d4814c74dd1'
          'dcf471d222bcd83283d3094e6ceeb6f8'
          'SKIP'
          'f7553416646dc26c266454c78a916d36'
+         'SKIP'
+         '7e73d2151f4064b484a4ba2c4b09960e'
+         'SKIP'
+         'a275463d21735bb6d7161f9fbd320d8f'
+         'SKIP'
+         'c17103ee20420d77e46b224c8d3fceda'
          'SKIP')
diff --git a/core/bash/bash-4.2-do-not-use-memcpy-on-overlapping-memory.patch b/core/bash/bash-4.2-do-not-use-memcpy-on-overlapping-memory.patch
deleted file mode 100644
index c621f0af8..000000000
--- a/core/bash/bash-4.2-do-not-use-memcpy-on-overlapping-memory.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur bash-4.2-orig/general.c bash-4.2/general.c
---- bash-4.2-orig/general.c	2010-12-13 06:06:27.000000000 +1000
-+++ bash-4.2/general.c	2013-08-25 21:52:36.681484302 +1000
-@@ -766,7 +766,7 @@
-   *nbeg++ = '.';
- 
-   nlen = nend - ntail;
--  memcpy (nbeg, ntail, nlen);
-+  memmove (nbeg, ntail, nlen);
-   nbeg[nlen] = '\0';
- 
-   return name;
diff --git a/core/bash/bash-4.3-debug-trap.patch b/core/bash/bash-4.3-debug-trap.patch
deleted file mode 100644
index 8d0a73288..000000000
--- a/core/bash/bash-4.3-debug-trap.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-*** ../bash-4.3/trap.c	2014-02-05 10:03:21.000000000 -0500
---- trap.c	2014-02-28 09:51:43.000000000 -0500
-***************
-*** 921,925 ****
-  
-  #if defined (JOB_CONTROL)
-!       save_pipeline (1);	/* XXX only provides one save level */
-  #endif
-  
---- 921,926 ----
-  
-  #if defined (JOB_CONTROL)
-!       if (sig != DEBUG_TRAP)	/* run_debug_trap does this */
-! 	save_pipeline (1);	/* XXX only provides one save level */
-  #endif
-  
-***************
-*** 941,945 ****
-  
-  #if defined (JOB_CONTROL)
-!       restore_pipeline (1);
-  #endif
-  
---- 942,947 ----
-  
-  #if defined (JOB_CONTROL)
-!       if (sig != DEBUG_TRAP)	/* run_debug_trap does this */
-! 	restore_pipeline (1);
-  #endif
-  
diff --git a/core/bash/bash-4.3-test-nameref.patch b/core/bash/bash-4.3-test-nameref.patch
deleted file mode 100644
index d64a3ccfa..000000000
--- a/core/bash/bash-4.3-test-nameref.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-*** ../bash-4.3/test.c	2014-02-04 16:52:58.000000000 -0500
---- test.c	2014-02-28 21:22:44.000000000 -0500
-***************
-*** 647,652 ****
-  
-      case 'R':
-!       v = find_variable (arg);
-!       return (v && invisible_p (v) == 0 && var_isset (v) && nameref_p (v) ? TRUE : FALSE);
-      }
-  
---- 647,652 ----
-  
-      case 'R':
-!       v = find_variable_noref (arg);
-!       return ((v && invisible_p (v) == 0 && var_isset (v) && nameref_p (v)) ? TRUE : FALSE);
-      }
-  
-***************
-*** 724,727 ****
---- 724,728 ----
-      case 'u': case 'v': case 'w': case 'x': case 'z':
-      case 'G': case 'L': case 'O': case 'S': case 'N':
-+     case 'R':
-        return (1);
-      }
diff --git a/core/openssh/PKGBUILD b/core/openssh/PKGBUILD
index 06aba8955..e6b313ec1 100644
--- a/core/openssh/PKGBUILD
+++ b/core/openssh/PKGBUILD
@@ -1,11 +1,11 @@
-# $Id: PKGBUILD 208093 2014-03-17 20:47:18Z bisson $
+# $Id: PKGBUILD 211715 2014-04-23 20:12:34Z bisson $
 # Maintainer: Gaetan Bisson <bisson@archlinux.org>
 # Contributor: Aaron Griffin <aaron@archlinux.org>
 # Contributor: judd <jvinet@zeroflux.org>
 
 pkgname=openssh
 pkgver=6.6p1
-pkgrel=1
+pkgrel=2
 pkgdesc='Free version of the SSH connectivity tools'
 url='http://www.openssh.org/portable.html'
 license=('custom:BSD')
@@ -15,12 +15,14 @@ depends=('krb5' 'openssl' 'libedit' 'ldns')
 optdepends=('xorg-xauth: X11 forwarding'
             'x11-ssh-askpass: input passphrase in X')
 source=("ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/${pkgname}-${pkgver}.tar.gz"{,.asc}
+        'curve25519pad.patch'
         'sshdgenkeys.service'
         'sshd@.service'
         'sshd.service'
         'sshd.socket'
         'sshd.pam')
 sha1sums=('b850fd1af704942d9b3c2eff7ef6b3a59b6a6b6e' 'SKIP'
+          '13b74b57b3d9b9a256eeb44b4fca29a8f27aa7ad'
           'cc1ceec606c98c7407e7ac21ade23aed81e31405'
           '6a0ff3305692cf83aca96e10f3bb51e1c26fccda'
           'ec49c6beba923e201505f5669cea48cad29014db'
@@ -31,6 +33,11 @@ backup=('etc/ssh/ssh_config' 'etc/ssh/sshd_config' 'etc/pam.d/sshd')
 
 install=install
 
+prepare() {
+	cd "${srcdir}/${pkgname}-${pkgver}"
+	patch -p0 -i ../curve25519pad.patch
+}
+
 build() {
 	cd "${srcdir}/${pkgname}-${pkgver}"
 
diff --git a/core/openssh/curve25519pad.patch b/core/openssh/curve25519pad.patch
new file mode 100644
index 000000000..9774a9399
--- /dev/null
+++ b/core/openssh/curve25519pad.patch
@@ -0,0 +1,171 @@
+Hi,
+
+So I screwed up when writing the support for the curve25519 KEX method
+that doesn't depend on OpenSSL's BIGNUM type - a bug in my code left
+leading zero bytes where they should have been skipped. The impact of
+this is that OpenSSH 6.5 and 6.6 will fail during key exchange with a
+peer that implements curve25519-sha256@libssh.org properly about 0.2%
+of the time (one in every 512ish connections).
+
+We've fixed this for OpenSSH 6.7 by avoiding the curve25519-sha256
+key exchange for previous versions, but I'd recommend distributors
+of OpenSSH apply this patch so the affected code doesn't become
+too entrenched in LTS releases.
+
+The patch fixes the bug and makes OpenSSH identify itself as 6.6.1 so as
+to distinguish itself from the incorrect versions so the compatibility
+code to disable the affected KEX isn't activated.
+
+I've committed this on the 6.6 branch too.
+
+Apologies for the hassle.
+
+-d
+
+Index: version.h
+===================================================================
+RCS file: /var/cvs/openssh/version.h,v
+retrieving revision 1.82
+diff -u -p -r1.82 version.h
+--- version.h	27 Feb 2014 23:01:54 -0000	1.82
++++ version.h	20 Apr 2014 03:35:15 -0000
+@@ -1,6 +1,6 @@
+ /* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */
+ 
+-#define SSH_VERSION	"OpenSSH_6.6"
++#define SSH_VERSION	"OpenSSH_6.6.1"
+ 
+ #define SSH_PORTABLE	"p1"
+ #define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
+Index: compat.c
+===================================================================
+RCS file: /var/cvs/openssh/compat.c,v
+retrieving revision 1.82
+retrieving revision 1.85
+diff -u -p -r1.82 -r1.85
+--- compat.c	31 Dec 2013 01:25:41 -0000	1.82
++++ compat.c	20 Apr 2014 03:33:59 -0000	1.85
+@@ -95,6 +95,9 @@ compat_datafellows(const char *version)
+ 		{ "Sun_SSH_1.0*",	SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
+ 		{ "OpenSSH_4*",		0 },
+ 		{ "OpenSSH_5*",		SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT},
++		{ "OpenSSH_6.6.1*",	SSH_NEW_OPENSSH},
++		{ "OpenSSH_6.5*,"
++		  "OpenSSH_6.6*",	SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD},
+ 		{ "OpenSSH*",		SSH_NEW_OPENSSH },
+ 		{ "*MindTerm*",		0 },
+ 		{ "2.1.0*",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
+@@ -251,7 +254,6 @@ compat_cipher_proposal(char *cipher_prop
+ 	return cipher_prop;
+ }
+ 
+-
+ char *
+ compat_pkalg_proposal(char *pkalg_prop)
+ {
+@@ -263,5 +265,18 @@ compat_pkalg_proposal(char *pkalg_prop)
+ 	if (*pkalg_prop == '\0')
+ 		fatal("No supported PK algorithms found");
+ 	return pkalg_prop;
++}
++
++char *
++compat_kex_proposal(char *kex_prop)
++{
++	if (!(datafellows & SSH_BUG_CURVE25519PAD))
++		return kex_prop;
++	debug2("%s: original KEX proposal: %s", __func__, kex_prop);
++	kex_prop = filter_proposal(kex_prop, "curve25519-sha256@libssh.org");
++	debug2("%s: compat KEX proposal: %s", __func__, kex_prop);
++	if (*kex_prop == '\0')
++		fatal("No supported key exchange algorithms found");
++	return kex_prop;
+ }
+ 
+Index: compat.h
+===================================================================
+RCS file: /var/cvs/openssh/compat.h,v
+retrieving revision 1.42
+retrieving revision 1.43
+diff -u -p -r1.42 -r1.43
+--- compat.h	31 Dec 2013 01:25:41 -0000	1.42
++++ compat.h	20 Apr 2014 03:25:31 -0000	1.43
+@@ -59,6 +59,7 @@
+ #define SSH_BUG_RFWD_ADDR	0x02000000
+ #define SSH_NEW_OPENSSH		0x04000000
+ #define SSH_BUG_DYNAMIC_RPORT	0x08000000
++#define SSH_BUG_CURVE25519PAD	0x10000000
+ 
+ void     enable_compat13(void);
+ void     enable_compat20(void);
+@@ -66,6 +67,7 @@ void     compat_datafellows(const char *
+ int	 proto_spec(const char *);
+ char	*compat_cipher_proposal(char *);
+ char	*compat_pkalg_proposal(char *);
++char	*compat_kex_proposal(char *);
+ 
+ extern int compat13;
+ extern int compat20;
+Index: sshd.c
+===================================================================
+RCS file: /var/cvs/openssh/sshd.c,v
+retrieving revision 1.448
+retrieving revision 1.453
+diff -u -p -r1.448 -r1.453
+--- sshd.c	26 Feb 2014 23:20:08 -0000	1.448
++++ sshd.c	20 Apr 2014 03:28:41 -0000	1.453
+@@ -2462,6 +2438,9 @@ do_ssh2_kex(void)
+ 	if (options.kex_algorithms != NULL)
+ 		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
+ 
++	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
++	    myproposal[PROPOSAL_KEX_ALGS]);
++
+ 	if (options.rekey_limit || options.rekey_interval)
+ 		packet_set_rekey_limits((u_int32_t)options.rekey_limit,
+ 		    (time_t)options.rekey_interval);
+Index: sshconnect2.c
+===================================================================
+RCS file: /var/cvs/openssh/sshconnect2.c,v
+retrieving revision 1.197
+retrieving revision 1.199
+diff -u -p -r1.197 -r1.199
+--- sshconnect2.c	4 Feb 2014 00:20:16 -0000	1.197
++++ sshconnect2.c	20 Apr 2014 03:25:31 -0000	1.199
+@@ -195,6 +196,8 @@ ssh_kex2(char *host, struct sockaddr *ho
+ 	}
+ 	if (options.kex_algorithms != NULL)
+ 		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
++	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
++	    myproposal[PROPOSAL_KEX_ALGS]);
+ 
+ 	if (options.rekey_limit || options.rekey_interval)
+ 		packet_set_rekey_limits((u_int32_t)options.rekey_limit,
+Index: bufaux.c
+===================================================================
+RCS file: /var/cvs/openssh/bufaux.c,v
+retrieving revision 1.62
+retrieving revision 1.63
+diff -u -p -r1.62 -r1.63
+--- bufaux.c	4 Feb 2014 00:20:15 -0000	1.62
++++ bufaux.c	20 Apr 2014 03:24:50 -0000	1.63
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: bufaux.c,v 1.56 2014/02/02 03:44:31 djm Exp $ */
++/* $OpenBSD: bufaux.c,v 1.57 2014/04/16 23:22:45 djm Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -372,6 +372,9 @@ buffer_put_bignum2_from_string(Buffer *b
+ 
+ 	if (l > 8 * 1024)
+ 		fatal("%s: length %u too long", __func__, l);
++	/* Skip leading zero bytes */
++	for (; l > 0 && *s == 0; l--, s++)
++		;
+ 	p = buf = xmalloc(l + 1);
+ 	/*
+ 	 * If most significant bit is set then prepend a zero byte to
+_______________________________________________
+openssh-unix-dev mailing list
+openssh-unix-dev@mindrot.org
+https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
\ No newline at end of file
diff --git a/core/readline/PKGBUILD b/core/readline/PKGBUILD
index 4e23bbbe4..41b69608b 100644
--- a/core/readline/PKGBUILD
+++ b/core/readline/PKGBUILD
@@ -1,13 +1,13 @@
-# $Id: PKGBUILD 209916 2014-04-08 15:23:41Z anatolik $
+# $Id: PKGBUILD 211714 2014-04-23 18:51:17Z bpiotrowski $
 # Maintainer:  Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
 # Contributor: Allan McRae <allan@archlinux.org>
 # Contributor: judd <jvinet@zeroflux.org>
 
 pkgname=readline
 _basever=6.3
-_patchlevel=003
+_patchlevel=005
 pkgver=$_basever.$_patchlevel
-pkgrel=2
+pkgrel=1
 pkgdesc='GNU readline library'
 arch=('i686' 'x86_64')
 url='http://tiswww.case.edu/php/chet/readline/rltop.html'
@@ -59,4 +59,8 @@ md5sums=('33c8fb279e981274f485fd91da77e94a'
          '700295212f7e2978577feaee584afddb'
          'SKIP'
          'af4963862f5156fbf9111c2c6fa86ed7'
+         'SKIP'
+         '11f9def89803a5052db3ba72394ce14f'
+         'SKIP'
+         '93721c31cd225393f80cb3aadb165544'
          'SKIP')