path: root/net-misc/openssh/files/openssh-7.3_p1-hpn-update.patch

--- openssh-7_2_P2-hpn-14.10.diff.orig	2016-09-01 10:34:05.905112131 -0700
+++ openssh-7_2_P2-hpn-14.10.diff	2016-09-08 11:35:18.015979358 -0700
@@ -156,145 +156,6 @@
  	compat.o crc32.o deattack.o fatal.o hostfile.o \
  	log.o match.o md-sha256.o moduli.o nchan.o packet.o opacket.o \
  	readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
-diff --git a/auth2.c b/auth2.c
-index 7177962..4af53f0 100644
---- a/auth2.c
-+++ b/auth2.c
-@@ -50,6 +50,7 @@
- #include "dispatch.h"
- #include "pathnames.h"
- #include "buffer.h"
-+#include "canohost.h"
- 
- #ifdef GSSAPI
- #include "ssh-gss.h"
-@@ -73,6 +74,8 @@ extern Authmethod method_hostbased;
- extern Authmethod method_gssapi;
- #endif
- 
-+static int log_flag = 0;
-+
- Authmethod *authmethods[] = {
- 	&method_none,
- 	&method_pubkey,
-@@ -224,6 +227,11 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
- 	service = packet_get_cstring(NULL);
- 	method = packet_get_cstring(NULL);
- 	debug("userauth-request for user %s service %s method %s", user, service, method);
-+	if (!log_flag) {
-+		logit("SSH: Server;Ltype: Authname;Remote: %s-%d;Name: %s",
-+		      get_remote_ipaddr(), get_remote_port(), user);
-+		log_flag = 1;
-+	}
- 	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
- 
- 	if ((style = strchr(user, ':')) != NULL)
-diff --git a/canohost.c b/canohost.c
-index 223964e..db35f73 100644
---- a/canohost.c
-+++ b/canohost.c
-@@ -338,13 +338,13 @@ clear_cached_addr(void)
-  */
- 
- const char *
--get_remote_ipaddr(void)
-+ssh_get_remote_ipaddr(struct ssh *ssh)
- {
- 	/* Check whether we have cached the ipaddr. */
- 	if (canonical_host_ip == NULL) {
--		if (packet_connection_is_on_socket()) {
-+		if (ssh_packet_connection_is_on_socket(ssh)) {
- 			canonical_host_ip =
--			    get_peer_ipaddr(packet_get_connection_in());
-+			    get_peer_ipaddr(ssh_packet_get_connection_in(ssh));
- 			if (canonical_host_ip == NULL)
- 				cleanup_exit(255);
- 		} else {
-@@ -356,6 +356,12 @@ get_remote_ipaddr(void)
- }
- 
- const char *
-+get_remote_ipaddr(void)
-+{
-+  return ssh_get_remote_ipaddr(active_state);
-+}
-+
-+const char *
- get_remote_name_or_ip(u_int utmp_len, int use_dns)
- {
- 	static const char *remote = "";
-@@ -410,17 +416,17 @@ get_sock_port(int sock, int local)
- /* Returns remote/local port number for the current connection. */
- 
- static int
--get_port(int local)
-+get_port(struct ssh *ssh, int local)
- {
- 	/*
- 	 * If the connection is not a socket, return 65535.  This is
- 	 * intentionally chosen to be an unprivileged port number.
- 	 */
--	if (!packet_connection_is_on_socket())
-+	if (!ssh_packet_connection_is_on_socket(ssh))
- 		return 65535;
- 
- 	/* Get socket and return the port number. */
--	return get_sock_port(packet_get_connection_in(), local);
-+	return get_sock_port(ssh_packet_get_connection_in(ssh), local);
- }
- 
- int
-@@ -430,17 +436,23 @@ get_peer_port(int sock)
- }
- 
- int
--get_remote_port(void)
-+ssh_get_remote_port(struct ssh *ssh)
- {
- 	/* Cache to avoid getpeername() on a dead connection */
- 	if (cached_port == -1)
--		cached_port = get_port(0);
-+		cached_port = get_port(ssh, 0);
- 
- 	return cached_port;
- }
- 
- int
-+get_remote_port(void)
-+{
-+	return ssh_get_remote_port(active_state);
-+}
-+
-+int
- get_local_port(void)
- {
--	return get_port(1);
-+	return get_port(active_state, 1);
- }
-diff --git a/canohost.h b/canohost.h
-index 4c8636f..4d60b27 100644
---- a/canohost.h
-+++ b/canohost.h
-@@ -12,8 +12,11 @@
-  * called by a name other than "ssh" or "Secure Shell".
-  */
- 
-+struct ssh;
-+
- const char	*get_canonical_hostname(int);
- const char	*get_remote_ipaddr(void);
-+const char	*ssh_get_remote_ipaddr(struct ssh *);
- const char	*get_remote_name_or_ip(u_int, int);
- 
- char		*get_peer_ipaddr(int);
-@@ -22,6 +25,7 @@ char		*get_local_ipaddr(int);
- char		*get_local_name(int);
- 
- int		 get_remote_port(void);
-+int		 ssh_get_remote_port(struct ssh *);
- int		 get_local_port(void);
- int		 get_sock_port(int, int);
- void		 clear_cached_addr(void);
 diff --git a/channels.c b/channels.c
 index c9d2015..13b30a1 100644
 --- a/channels.c
@@ -519,7 +380,7 @@
 index 0000000..fdc9b2f
 --- /dev/null
 +++ b/cipher-ctr-mt.c
-@@ -0,0 +1,533 @@
+@@ -0,0 +1,585 @@
 +/*
 + * OpenSSH Multi-threaded AES-CTR Cipher
 + *
@@ -649,7 +510,7 @@
 +	u_char		keys[KQLEN][AES_BLOCK_SIZE];
 +	u_char		ctr[AES_BLOCK_SIZE];
 +	u_char		pad0[CACHELINE_LEN];
-+	volatile int	qstate;
++	int		qstate;
 +	pthread_mutex_t	lock;
 +	pthread_cond_t	cond;
 +	u_char		pad1[CACHELINE_LEN];
@@ -663,6 +524,9 @@
 +	STATS_STRUCT(stats);
 +	u_char		aes_counter[AES_BLOCK_SIZE];
 +	pthread_t	tid[CIPHER_THREADS];
++	pthread_rwlock_t tid_lock;
++	pthread_rwlock_t stop_lock;
++	int		exit_flag;
 +	int		state;
 +	int		qidx;
 +	int		ridx;
@@ -709,6 +573,19 @@
 +	pthread_mutex_unlock((pthread_mutex_t *)x);
 +}
 +
++static void
++thread_loop_check_exit(struct ssh_aes_ctr_ctx *c)
++{
++	int exit_flag;
++
++	pthread_rwlock_rdlock(&c->stop_lock);
++	exit_flag = c->exit_flag;
++	pthread_rwlock_unlock(&c->stop_lock);
++
++	if (exit_flag == TRUE)
++		pthread_exit(NULL);
++}
++
 +/*
 + * The life of a pregen thread:
 + *    Find empty keystream queues and fill them using their counter.
@@ -723,6 +600,7 @@
 +	struct kq *q;
 +	int i;
 +	int qidx;
++	pthread_t first_tid;
 +
 +	/* Threads stats on cancellation */
 +	STATS_INIT(stats);
@@ -733,11 +611,15 @@
 +	/* Thread local copy of AES key */
 +	memcpy(&key, &c->aes_ctx, sizeof(key));
 +
++	pthread_rwlock_rdlock(&c->tid_lock);
++	first_tid = c->tid[0];
++	pthread_rwlock_unlock(&c->tid_lock);
++
 +	/*
 +	 * Handle the special case of startup, one thread must fill
 +	 * the first KQ then mark it as draining. Lock held throughout.
 +	 */
-+	if (pthread_equal(pthread_self(), c->tid[0])) {
++	if (pthread_equal(pthread_self(), first_tid)) {
 +		q = &c->q[0];
 +		pthread_mutex_lock(&q->lock);
 +		if (q->qstate == KQINIT) {
@@ -764,8 +646,8 @@
 +	 * others will move on to fill, skip, or wait on the next queue.
 +	 */
 +	for (qidx = 1;; qidx = (qidx + 1) % NUMKQ) {
-+		/* Check if I was cancelled, also checked in cond_wait */
-+		pthread_testcancel();
++		/* Check if we should exit */
++		thread_loop_check_exit(c);
 +
 +		/* Lock queue and block if its draining */
 +		q = &c->q[qidx];
@@ -773,6 +655,7 @@
 +		pthread_cleanup_push(thread_loop_cleanup, &q->lock);
 +		while (q->qstate == KQDRAINING || q->qstate == KQINIT) {
 +			STATS_WAIT(stats);
++			thread_loop_check_exit(c);
 +			pthread_cond_wait(&q->cond, &q->lock);
 +		}
 +		pthread_cleanup_pop(0);
@@ -790,6 +673,7 @@
 +		 * can see that it's being filled.
 +		 */
 +		q->qstate = KQFILLING;
++		pthread_cond_broadcast(&q->cond);
 +		pthread_mutex_unlock(&q->lock);
 +		for (i = 0; i < KQLEN; i++) {
 +			AES_encrypt(q->ctr, q->keys[i], &key);
@@ -801,7 +685,7 @@
 +		ssh_ctr_add(q->ctr, KQLEN * (NUMKQ - 1), AES_BLOCK_SIZE);
 +		q->qstate = KQFULL;
 +		STATS_FILL(stats);
-+		pthread_cond_signal(&q->cond);
++		pthread_cond_broadcast(&q->cond);
 +		pthread_mutex_unlock(&q->lock);
 +	}
 +
@@ -893,6 +777,7 @@
 +				pthread_cond_wait(&q->cond, &q->lock);
 +			}
 +			q->qstate = KQDRAINING;
++			pthread_cond_broadcast(&q->cond);
 +			pthread_mutex_unlock(&q->lock);
 +
 +			/* Mark consumed queue empty and signal producers */
@@ -919,6 +804,9 @@
 +
 +	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
 +		c = xmalloc(sizeof(*c));
++		pthread_rwlock_init(&c->tid_lock, NULL);
++		pthread_rwlock_init(&c->stop_lock, NULL);
++		c->exit_flag = FALSE;
 +
 +		c->state = HAVE_NONE;
 +		for (i = 0; i < NUMKQ; i++) {
@@ -931,11 +819,19 @@
 +	}
 +
 +	if (c->state == (HAVE_KEY | HAVE_IV)) {
-+		/* Cancel pregen threads */
-+		for (i = 0; i < CIPHER_THREADS; i++)
-+			pthread_cancel(c->tid[i]);
++		/* tell the pregen threads to exit */
++		pthread_rwlock_wrlock(&c->stop_lock);
++		c->exit_flag = TRUE;
++		pthread_rwlock_unlock(&c->stop_lock);
++
++		for (i = 0; i < NUMKQ; i++) {
++			pthread_mutex_lock(&c->q[i].lock);
++			pthread_cond_broadcast(&c->q[i].cond);
++			pthread_mutex_unlock(&c->q[i].lock);
++		}
 +		for (i = 0; i < CIPHER_THREADS; i++)
 +			pthread_join(c->tid[i], NULL);
++
 +		/* Start over getting key & iv */
 +		c->state = HAVE_NONE;
 +	}
@@ -966,10 +862,12 @@
 +		/* Start threads */
 +		for (i = 0; i < CIPHER_THREADS; i++) {
 +			debug("spawned a thread");
++			pthread_rwlock_wrlock(&c->tid_lock);
 +			pthread_create(&c->tid[i], NULL, thread_loop, c);
++			pthread_rwlock_unlock(&c->tid_lock);
 +		}
 +		pthread_mutex_lock(&c->q[0].lock);
-+		while (c->q[0].qstate != KQDRAINING)
++		while (c->q[0].qstate == KQINIT)
 +			pthread_cond_wait(&c->q[0].cond, &c->q[0].lock);
 +		pthread_mutex_unlock(&c->q[0].lock);
 +	}
@@ -985,9 +883,15 @@
 +	struct ssh_aes_ctr_ctx *c;
 +	int i;
 +	c = EVP_CIPHER_CTX_get_app_data(ctx);
-+	/* destroy threads */
-+	for (i = 0; i < CIPHER_THREADS; i++) {
-+		pthread_cancel(c->tid[i]);
++	/* notify threads that they should exit */
++	pthread_rwlock_wrlock(&c->stop_lock);
++	c->exit_flag = TRUE;
++	pthread_rwlock_unlock(&c->stop_lock);
++
++	for (i = 0; i < NUMKQ; i++) {
++		pthread_mutex_lock(&c->q[i].lock);
++		pthread_cond_broadcast(&c->q[i].cond);
++		pthread_mutex_unlock(&c->q[i].lock);
 +	}
 +	for (i = 0; i < CIPHER_THREADS; i++) {
 +		pthread_join(c->tid[i], NULL);
@@ -1003,7 +907,9 @@
 +	/* reconstruct threads */
 +	for (i = 0; i < CIPHER_THREADS; i++) {
 +		debug("spawned a thread");
++		pthread_rwlock_wrlock(&c->tid_lock);
 +		pthread_create(&c->tid[i], NULL, thread_loop, c);
++		pthread_rwlock_unlock(&c->tid_lock);
 +	}
 +}
 +
@@ -1018,9 +924,16 @@
 +		debug("main thread: %u drains, %u waits", c->stats.drains,
 +				c->stats.waits);
 +#endif
-+		/* Cancel pregen threads */
-+		for (i = 0; i < CIPHER_THREADS; i++)
-+			pthread_cancel(c->tid[i]);
++		/* tell the pregen threads to exit */
++		pthread_rwlock_wrlock(&c->stop_lock);
++		c->exit_flag = TRUE;
++		pthread_rwlock_unlock(&c->stop_lock);
++
++		for (i = 0; i < NUMKQ; i++) {
++			pthread_mutex_lock(&c->q[i].lock);
++			pthread_cond_broadcast(&c->q[i].cond);
++			pthread_mutex_unlock(&c->q[i].lock);
++		}
 +		for (i = 0; i < CIPHER_THREADS; i++)
 +			pthread_join(c->tid[i], NULL);
 +
@@ -1270,7 +1183,7 @@
  
  #include "ssherr.h"
  #include "sshbuf.h"
-+#include "canohost.h"
++#include "packet.h"
  #include "digest.h"
  
  #if OPENSSL_VERSION_NUMBER >= 0x00907000L
@@ -1312,8 +1225,8 @@
 +		 */
 +		if (ctos && !log_flag) {
 +			logit("SSH: Server;Ltype: Kex;Remote: %s-%d;Enc: %s;MAC: %s;Comp: %s",
-+			    ssh_get_remote_ipaddr(ssh),
-+			    ssh_get_remote_port(ssh),
++			    ssh_remote_ipaddr(ssh),
++			    ssh_remote_port(ssh),
 +			    newkeys->enc.name,
 +			    authlen == 0 ? newkeys->mac.name : "<implicit>",
 +			    newkeys->comp.name);
@@ -1430,7 +1343,7 @@
 +		rekey_requested = 0;
 +		return 1;
 +	}
-+	
++
  	/* Time-based rekeying */
  	if (state->rekey_interval != 0 &&
  	    state->rekey_time + state->rekey_interval <= monotime())
@@ -1490,7 +1403,7 @@
  
  	transferred = *counter - (cur_pos ? cur_pos : start_pos);
  	cur_pos = *counter;
- 	now = monotime();
+ 	now = monotime_double();
  	bytes_left = end_pos - cur_pos;
  
 +	delta_pos = cur_pos - last_pos;
@@ -1564,8 +1477,8 @@
  	{ "canonicaldomains", oCanonicalDomains },
  	{ "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
 @@ -282,6 +287,11 @@ static struct {
- 	{ "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
  	{ "ignoreunknown", oIgnoreUnknown },
+ 	{ "proxyjump", oProxyJump },
  
 +	{ "tcprcvbufpoll", oTcpRcvBufPoll },
 +	{ "tcprcvbuf", oTcpRcvBuf },
@@ -1736,8 +1649,8 @@
  	off_t size, statbytes;
  	unsigned long long ull;
  	int setimes, targisdir, wrerrno = 0;
--	char ch, *cp, *np, *targ, *why, *vect[1], buf[2048];
-+	char ch, *cp, *np, *targ, *why, *vect[1], buf[16384];
+-	char ch, *cp, *np, *targ, *why, *vect[1], buf[2048], visbuf[2048];
++	char ch, *cp, *np, *targ, *why, *vect[1], buf[16384], visbuf[16384];
  	struct timeval tv[2];
  
  #define	atime	tv[0]
@@ -1956,32 +1869,6 @@
  }
  
  /*
-@@ -820,11 +836,13 @@ void
- server_loop2(Authctxt *authctxt)
- {
- 	fd_set *readset = NULL, *writeset = NULL;
-+	double start_time, total_time;
- 	int max_fd;
- 	u_int nalloc = 0;
- 	u_int64_t rekey_timeout_ms = 0;
- 
- 	debug("Entering interactive session for SSH2.");
-+	start_time = get_current_time();
- 
- 	mysignal(SIGCHLD, sigchld_handler);
- 	child_terminated = 0;
-@@ -883,6 +901,11 @@ server_loop2(Authctxt *authctxt)
- 
- 	/* free remaining sessions, e.g. remove wtmp entries */
- 	session_destroy_all(NULL);
-+	total_time = get_current_time() - start_time;
-+	logit("SSH: Server;LType: Throughput;Remote: %s-%d;IN: %lu;OUT: %lu;Duration: %.1f;tPut_in: %.1f;tPut_out: %.1f",
-+	      get_remote_ipaddr(), get_remote_port(),
-+	      stdin_bytes, fdout_bytes, total_time, stdin_bytes / total_time,
-+	      fdout_bytes / total_time);
- }
- 
- static int
 @@ -1041,8 +1064,12 @@ server_request_tun(void)
  	sock = tun_open(tun, mode);
  	if (sock < 0)
@@ -2372,10 +2259,10 @@
  	debug("Client protocol version %d.%d; client software version %.100s",
  	    remote_major, remote_minor, remote_version);
 +	logit("SSH: Server;Ltype: Version;Remote: %s-%d;Protocol: %d.%d;Client: %.100s",
-+	      get_remote_ipaddr(), get_remote_port(),
++	      ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
 +	    remote_major, remote_minor, remote_version);
  
- 	active_state->compat = compat_datafellows(remote_version);
+ 	ssh->compat = compat_datafellows(remote_version);
  
 @@ -1160,6 +1163,8 @@ server_listen(void)
  	int ret, listen_sock, on = 1;
@@ -2413,7 +2300,7 @@
  	if (options.challenge_response_authentication)
  		options.kbd_interactive_authentication = 1;
 @@ -2151,6 +2168,9 @@ main(int ac, char **av)
- 	    remote_ip, remote_port, laddr,  get_local_port());
+ 	    remote_ip, remote_port, laddr,  ssh_local_port(ssh));
  	free(laddr);
  
 +	/* set the HPN options for the child */
@@ -2486,11 +2373,10 @@
 index eb4e948..3692722 100644
 --- a/version.h
 +++ b/version.h
-@@ -3,4 +3,6 @@
- #define SSH_VERSION	"OpenSSH_7.2"
+@@ -3,4 +3,5 @@
+ #define SSH_VERSION	"OpenSSH_7.3"
  
- #define SSH_PORTABLE	"p2"
+ #define SSH_PORTABLE	"p1"
 -#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
 +#define SSH_HPN         "-hpn14v11"
 +#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN
-+