gentoo resync : 13.03.2018

9 files changed, 53 insertions, 806 deletions

diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 0f9d213856f8..5dea347c9b39 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -6,12 +6,9 @@ AUX openssh-7.5_p1-cross-cache.patch 1220 BLAKE2B 7176b86024b072ff601421143f8567
 AUX openssh-7.5_p1-hpn-x509-10.2-glue.patch 2847 BLAKE2B 8a6151ab121871e4f2d93ace0e07dce1106c6841031cacfb197e00cc76fc1d0cf153aae52757dcf98a5fb89971125493d0572bd4964d0e59cb3f391fd1256aef SHA512 bc23fdf5995ae38ff166f12f64082f79a2135ca28f2240e89bee42b1e3ba39ce94467ece9ddea99173f1829b09b069dbf56a0bce7dfd1ae5f63c12f73b5ffba7
 AUX openssh-7.5_p1-s390-seccomp.patch 624 BLAKE2B 0bf595d72cd65993dde4e5aae0a3e091bb48021ef8affa84c988d55d9fe6a823b0329b6d9707c88e1556d45c304b6630ade7008f63fd649975594a75f570bb33 SHA512 058dc269eb032151e88e0ac79a0b0fd6fcd56d489e90e299ee431b1475a8f8080e8f4649244864af33e743820b081c9f90b32a1a93b8b60feeb491c0201a4d61
 AUX openssh-7.5_p1-x32-typo.patch 772 BLAKE2B 3f27d669ee76e191f2f6f7c7d86b1d9cb7297cecf17b2d88d86ef498c9ca35231adb0edc9fb811698ec86fd65527cc3fe9f2ce514836aebe5dc27bca2a3a55dc SHA512 20d19301873d4b8e908527f462f40c2f4a513d0bb89d4c7b885f9fc7eb5d483eea544eb108d87ff6aaa3d988d360c2029910c18f7125c96e8367485553f59a5e
-AUX openssh-7.6_p1-hpn-x509-11.0-glue.patch 2182 BLAKE2B 02953663257816c71734fc8bf9f9b4619860d75cd49e7758d8895d8368acda7fb8117322747af61cac6a8b57f24a5080397af4307f9f681b0cf25caa75cc9cff SHA512 387222fe9b46f0f2df3cb9f6125995c46f7428955784175c718e902a36e90994f5bcecfbbe160d28fc810e4e43e6f070937c39546f0df36ebb9b47bda3c3e032
-AUX openssh-7.6_p1-hpn-x509-11.1-glue.patch 2188 BLAKE2B 2be559ea9fbe4dcd619cb13334b9b10005d93d83284f895c18ae56b1059c81faf5e0d71ed02000ad14beac201b0af7a698882b1dc6fcc646f3e5bf7444e693ff SHA512 db93c85430bdfa802ae950de6170f9867bc82fad222b153433d14c6728f94bed3fbeb04e30c8960361dcb92aa6d3bc6480b2d02f0fa01e4ea70bc0039fa6e52f
 AUX openssh-7.6_p1-hpn-x509-11.2-glue.patch 2188 BLAKE2B 2be559ea9fbe4dcd619cb13334b9b10005d93d83284f895c18ae56b1059c81faf5e0d71ed02000ad14beac201b0af7a698882b1dc6fcc646f3e5bf7444e693ff SHA512 db93c85430bdfa802ae950de6170f9867bc82fad222b153433d14c6728f94bed3fbeb04e30c8960361dcb92aa6d3bc6480b2d02f0fa01e4ea70bc0039fa6e52f
+AUX openssh-7.6_p1-permitopen.patch 1857 BLAKE2B f2f7e091b99d96e77ec95353789cfd8051ced60a198219a88ae409cdedde8751af9bea5b048c76a610411f86a4e802e488fb2c5b4045e1410a6b2f2cc1a34227 SHA512 1fc3410f52e86930af5188cadf9e9f1046e7a695639e27b95da9e25a781e8f4445e279c54cd010d280e7b4df58da404b97fce8e6192ae5d456d33b498aaf00c7
 AUX openssh-7.6_p1-warnings.patch 324 BLAKE2B d9fb6e710f797b687b285f70b7c7b32abaa34bd57aeb32558f5d9978df5b5eb5ba5dc1ac8c46ed430619318fa3cfd3475a9c24e3f594ad05d081decd0e4c2f36 SHA512 08a9caf1cbb4dbde2828f14075b41762dad24a8a88882cc61cb133783caa1200f63f052824409b0334c832365c0d934f44b2eeac947228ff52be24a09548cd22
-AUX openssh-7.6_p1-x509-11.0-libressl.patch 570 BLAKE2B 0b22cca997909743ec3247a80a9efffda7e85235274df98fd8aebf549a1a7cddb3906dd4cc678bf4176f634c5e4b123a00af9d0690672e9bee06e848800eb1ff SHA512 795d3e99d81cbd76533196b6a73a9c9a6db800f9de1f6c7860b56058d0a319c6633ab09b8a149ed6d840b3c9a43162ce299e2a16e334a66802260fbdc35b2b17
-AUX openssh-7.6_p1-x509-11.1-libressl.patch 570 BLAKE2B 9b8baee7a209108ae5bd11fb8c121e77e1908e85210d8ae65d5037521dc7c75f8c9712b20fd1c3ba99eadf588b7f5510486c1f2f915a7652c545d3bd6e14508f SHA512 a503ad8363400fa32d7ba916641a3d5008c9e6dfab4ca63c7b81125e5214733c38375c415dd4ada2b08ace4c9a17ee6f23c578e626289f5140461d01fffa014d
 AUX sshd.confd 396 BLAKE2B 2fc146e83512d729e120cfe331441e8fe27eba804906cc0c463b938ddaf052e7392efbcda6699467afde22652c599e7d55b0ce18a344137263cd78647fea255f SHA512 b9ae816af54a55e134a9307e376f05367b815f1b3fd545c2a2c312d18aedcf907f413e8bad8db980cdd9aad4011a72a79e1e94594f69500939a9cb46287f2f81
 AUX sshd.pam_include.2 156 BLAKE2B 91ebefbb1264fe3fe98df0a72ac22a4cd8a787b3b391af5769798e0b0185f0a588bc089d229c76138fd2db39fbe6bd33924f0d53e0513074d9c2d7abf88dcb78 SHA512 d3f7e6ca8c9f2b5060ebccb259316bb59c9a7e158e8ef9466765a20db263a4043a590811f1a3ab072b718dbd70898bc69b77e0b19603d7f394b5ac1bd0a4a56c
 AUX sshd.rc6.4 2108 BLAKE2B 55b66dddb45aadccde794667195f716f84c521576d886a3acc56f6f66087f0ff7167bde629c876da4ee1306a4995b8a4cd089eece35037616d17ee4b691b4cf8 SHA512 fe58e950514743a72467233ff2f2a63112c50e5db843d61e141a5ca3dd8ef8f42a616cd9de7748ae582054c47c2cc38ce48b638e2d88be39c1387f77e79c83e1
@@ -23,17 +20,12 @@ DIST openssh-7.5p1+x509-10.2.diff.gz 467040 BLAKE2B 4048b0f016bf7d43276f88117fc2
 DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 BLAKE2B 15702338877e50c2143b33b93bfc87d0aa0fa55915db1f0cab9c22e55f8aa0c6eeb5a56f438d849544d1650bdc574384b851292d621b79f673b78bc37617aa0b SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9
 DIST openssh-7.5p1.tar.gz 1510857 BLAKE2B 505764a210018136456c0f5dd40ad9f1383551c3ae037593d4296305df189e0a6f1383adc89b1970d58b8dcfff391878b7a29b848cc244a99705a164bec5d734 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81
 DIST openssh-7.6_p1-sctp.patch.xz 6996 BLAKE2B 4a857afdc8fa5cb2bfb9dd1805ac6343e774ac7423e2f4439f2adf585aae18fcf55d63f7f5421e716d76e2dd0205b186b6fea1f53132453ea82f0821cea3124c SHA512 8445a9a8ae8e8baa67c8f386117877ba3f39f33c9cdaff341c8d5fb4ce9dfe22f26d5aedc2b0d4aab67864994ec5a6a487d18b728bd5d5c6efe14175eb9c8151
-DIST openssh-7.6p1+x509-11.0.diff.gz 440219 BLAKE2B 9329a7cf8575c21c31ec73f8ca1084708de34a5b530699d8be2a2a75e1ce0d37210a897c894ab75ee8e2ad0f0802d483d041b1bf3cf3ea46a4a423f1350f42d2 SHA512 add86ecdaa696d997f869e6878aaaef285590cc5eddf301be651944bbc6c80af6a891bad6f6aaa4b6e9919ad865a27dc6f45a6e0b923ca52c04f06523fa3197a
-DIST openssh-7.6p1+x509-11.1.diff.gz 451725 BLAKE2B 1397c05539ce7532f5e6bf33fc16d5661c32365e127ab1134c0a12c70f0645b05eb05d3ebd9bf64ed59cb94a63cbe8466ac87c9831605230d1ccd578a736904b SHA512 8d445911d8b28fb922a2a0ddb4b7783f81bc258af708148541d30cb79012789cc319bc2031b4584c4c5504480b70077e675be01070fd3065dc4f5ddee89ad8f1
 DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2c64ae6b9e49704f46f46a21496a71d5ebd051ab648446bf71ef141e2114f4a03363d8cd043f5813f957c2c5f2e2eb193931d SHA512 1c0fea91037bfcaed7aa3f0cb01d262410a99d3e1b98a25a012db5d683f3275ab52f78f1e446bd7e543c78f9d406b1dce2bb3997214534ae94e11c254658080f
 DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
-DIST openssh-7.6p1-hpnssh14v12.tar.xz 15392 BLAKE2B 6888ea4054a470116b2ab3d115f54e3ee54e0d05a24d3331613c241e684a43354b6100ee2be76e5b2dcc8f0444fbae5d146830d634e53a85124d5e553759a552 SHA512 0e2c62cdec360090b359edfd5bbe894fb25d22e387677e8a5d6cf6a0807b0572fda30b90c30390d5b68e359e9958cb1c65abae4afd9af5892c3f64f6f8001956
 DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
 DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
 DIST openssh-lpk-7.6p1-0.3.14.patch.xz 17044 BLAKE2B a31dcb15848d3a22306108a4e181b1d52b195e6adcd2a78d5c7bf57f33c8ed62c3affa434c8d31c07eae84b59f1a3968a3f2a92e702f9225b121127616cb9d61 SHA512 e9a2b18fd6a58354198b6e48199059d055451a5f09c99bf7293d0d54137a59c581a9cb3bd906f31589e03d8450fb017b9015e18c67b7b6ae840e336039436974
 EBUILD openssh-7.5_p1-r4.ebuild 11115 BLAKE2B 31bfee62343a2124e48733c4db1367fcce121d5eff25008135d2e715a34a45a176c02a5fcee99271db723d437a62d0e79297cb17df1b1ab6a12534ad2cb0c0b5 SHA512 00dbc65bf70747906f2ae5ae538579b5bd4935bae224c59ad2de92820fc64f969ca2bddc1bf0ed8924f7b6825e5665730e3fa65b5682a7f7a170233b41b73acb
-EBUILD openssh-7.6_p1-r2.ebuild 11172 BLAKE2B ce0c8101f1e13686c748aaeeb4603244618a1efce52f2a7fc7eaef8d4bf7acf0f19c41e5393d03cb8179a813b0aaae91eca1f86b30c22bafcfec542fa9e0f7f7 SHA512 4d725eee7492aac558b3c5a73a52521278f80777be96cbb8fb7e195bd4463dca19806a35ff276c00ac081f071fba6f2edbe39a1981c14c52c99a453fb78c3d3d
-EBUILD openssh-7.6_p1-r3.ebuild 11160 BLAKE2B ae47330e350d828199cfa0218e7aab64638baf63b5c4dda71872c0c5a3b729b8dcab63cc3aae5098dbb6958c013b9ece73dae46fd6185918ac2294171c9e55c2 SHA512 1ab8699ae71d2949960f252894fd1b64c8997abc384cc8a85f221c6ef5c16ab54ad4e8b297b6796e9d3d1aa693dce203ba38f72e74ce7a74c9ec76a41c956c49
 EBUILD openssh-7.6_p1-r4.ebuild 11099 BLAKE2B 975314f6b62e9191bf6300becb51f6282e52edc889407996ba640b07755dc713f28f9669e84a7f269d2be58764c561d7c2a14ff9af03ea7664794eb7f8656d9a SHA512 40276711daceea7e595a57b9805d5a4099e644650c6d2b501d581f5297bfc59bc20b325db455ce9e959d1a8d85bc25471e873177af5feadf1813f50205d6bb35
-EBUILD openssh-7.6_p1.ebuild 11171 BLAKE2B 0c91399c7dbd07f7101c609eba7ae19d91f5c270f817f7d1311935faf5520b22a0ddfd2e4cf1953055fcc601092370d37d223714cb597be798ffe4019af3bbca SHA512 5b3c82f8999a4e59ca481eb7c6b77571ec33341c8f2a7b949dc3894c13d8adb93c6df4270216d2ecee4576f3c5f96aa29873b0caca841aae54adcc998e54f27a
+EBUILD openssh-7.6_p1-r5.ebuild 11143 BLAKE2B 1746247964bb636a9427969be1470f59ccbb96fd117885827c172904c8029d426aaa9fefc4b1952ee2e2a518cd96e118f73644587748e46f1f8ca403e8dcdddd SHA512 28989a23b7ed00e608dfc9fb672ec7db2a960ae3e78924bf445ee8ee092f8ec15b9374075a4dee4f39f704512e289fa60689a079cd9bf711cab8b961979ecea9
 MISC metadata.xml 2212 BLAKE2B 889550b17d2ba8072686ca5f398c64946fc04721fd7093c88fd7c1c5c7e4610fb01964f8e3d78e20cd0e9b9343895439772fee43b5635db893f3fc13ae9437cb SHA512 958845fbdfb4f1d267fdbc3a005c6338da54c6a0715180a1982416a841ab4865c536de5f10bb8493d07830e182786d0c3f2ac710c9168434b3d077a59ed2ddd5
diff --git a/net-misc/openssh/files/openssh-7.6_p1-hpn-x509-11.0-glue.patch b/net-misc/openssh/files/openssh-7.6_p1-hpn-x509-11.0-glue.patch
deleted file mode 100644
index d55656aae974..000000000000
--- a/net-misc/openssh/files/openssh-7.6_p1-hpn-x509-11.0-glue.patch
+++ /dev/null
@@ -1,50 +0,0 @@
---- a/openssh-7.6p1-hpnssh14v12/0004-support-dynamically-sized-receive-buffers.patch	2017-10-11 15:02:11.850912525 -0700
-+++ b/openssh-7.6p1-hpnssh14v12/0004-support-dynamically-sized-receive-buffers.patch	2017-10-11 15:35:06.223424844 -0700
-@@ -907,9 +907,9 @@
- @@ -517,7 +544,7 @@ send_client_banner(int connection_out, int minor1)
-  {
-  	/* Send our own protocol version identification. */
-- 	xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n",
---	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION);
--+	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE);
-+ 	xasprintf(&client_version_string, "SSH-%d.%d-%.100s PKIX[%s]\r\n",
-+-	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, PACKAGE_VERSION);
-++	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, PACKAGE_VERSION);
-  	if (atomicio(vwrite, connection_out, client_version_string,
-  	    strlen(client_version_string)) != strlen(client_version_string))
-  		fatal("write: %.100s", strerror(errno));
-@@ -918,11 +918,11 @@
- --- a/sshd.c
- +++ b/sshd.c
- @@ -367,7 +367,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
-- 	char remote_version[256];	/* Must be at least as big as buf. */
-+ 	}
-  
-- 	xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n",
---	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION,
--+	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
-+	xasprintf(&server_version_string, "SSH-%d.%d-%s%s%s%s\r\n",
-+-	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, pkix_comment,
-++	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, pkix_comment,
-  	    *options.version_addendum == '\0' ? "" : " ",
-  	    options.version_addendum);
-  
-@@ -982,13 +982,14 @@
- index e093f623..83f0932d 100644
- --- a/version.h
- +++ b/version.h
--@@ -3,4 +3,5 @@
-+@@ -3,3 +3,6 @@
-  #define SSH_VERSION	"OpenSSH_7.6"
-  
-- #define SSH_PORTABLE	"p1"
---#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
-+-#define SSH_RELEASE	PACKAGE_STRING ", " SSH_VERSION "p1"
-++#define SSH_PORTABLE	"p1"
- +#define SSH_HPN		"-hpn14v12"
-++#define SSH_X509		"-PKIXSSH-11.0"
--+#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN
-++#define SSH_RELEASE	PACKAGE_STRING ", " SSH_VERSION "p1" SSH_HPN
- -- 
- 2.14.2
- 
diff --git a/net-misc/openssh/files/openssh-7.6_p1-hpn-x509-11.1-glue.patch b/net-misc/openssh/files/openssh-7.6_p1-hpn-x509-11.1-glue.patch
deleted file mode 100644
index 2ed6a7b54a66..000000000000
--- a/net-misc/openssh/files/openssh-7.6_p1-hpn-x509-11.1-glue.patch
+++ /dev/null
@@ -1,50 +0,0 @@
---- a/openssh-7.6p1-hpnssh14v12-r1/0003-support-dynamically-sized-receive-buffers.patch	2017-10-11 15:02:11.850912525 -0700
-+++ b/openssh-7.6p1-hpnssh14v12-r1/0003-support-dynamically-sized-receive-buffers.patch	2017-10-11 15:35:06.223424844 -0700
-@@ -907,9 +907,9 @@
- @@ -517,7 +544,7 @@ send_client_banner(int connection_out, int minor1)
-  {
-  	/* Send our own protocol version identification. */
-- 	xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n",
---	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION);
--+	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE);
-+ 	xasprintf(&client_version_string, "SSH-%d.%d-%.100s PKIX[%s]\r\n",
-+-	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, PACKAGE_VERSION);
-++	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, PACKAGE_VERSION);
-  	if (atomicio(vwrite, connection_out, client_version_string,
-  	    strlen(client_version_string)) != strlen(client_version_string))
-  		fatal("write: %.100s", strerror(errno));
-@@ -918,11 +918,11 @@
- --- a/sshd.c
- +++ b/sshd.c
- @@ -367,7 +367,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
-- 	char remote_version[256];	/* Must be at least as big as buf. */
-+ 	}
-  
-- 	xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n",
---	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION,
--+	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
-+	xasprintf(&server_version_string, "SSH-%d.%d-%s%s%s%s\r\n",
-+-	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, pkix_comment,
-++	    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, pkix_comment,
-  	    *options.version_addendum == '\0' ? "" : " ",
-  	    options.version_addendum);
-  
-@@ -982,13 +982,14 @@
- index e093f623..83f0932d 100644
- --- a/version.h
- +++ b/version.h
--@@ -3,4 +3,5 @@
-+@@ -3,3 +3,6 @@
-  #define SSH_VERSION	"OpenSSH_7.6"
-  
-- #define SSH_PORTABLE	"p1"
---#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
-+-#define SSH_RELEASE	PACKAGE_STRING ", " SSH_VERSION "p1"
-++#define SSH_PORTABLE	"p1"
- +#define SSH_HPN		"-hpn14v12"
-++#define SSH_X509		"-PKIXSSH-11.0"
--+#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN
-++#define SSH_RELEASE	PACKAGE_STRING ", " SSH_VERSION "p1" SSH_HPN
- -- 
- 2.14.2
- 
diff --git a/net-misc/openssh/files/openssh-7.6_p1-permitopen.patch b/net-misc/openssh/files/openssh-7.6_p1-permitopen.patch
new file mode 100644
index 000000000000..5dc96d4d0a37
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.6_p1-permitopen.patch
@@ -0,0 +1,49 @@
+From 69bda0228861f3dacd4fb3d28b60ce9d103d254b Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 4 Oct 2017 18:49:30 +0000
+Subject: [PATCH] upstream commit
+
+fix (another) problem in PermitOpen introduced during the
+channels.c refactor: the third and subsequent arguments to PermitOpen were
+being silently ignored; ok markus@
+
+Upstream-ID: 067c89f1f53cbc381628012ba776d6861e6782fd
+---
+ servconf.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+index 2c321a4a..95686295 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -1,5 +1,5 @@
+ 
+-/* $OpenBSD: servconf.c,v 1.312 2017/10/02 19:33:20 djm Exp $ */
++/* $OpenBSD: servconf.c,v 1.313 2017/10/04 18:49:30 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+  *                    All rights reserved
+@@ -1663,9 +1663,9 @@ process_server_config_line(ServerOptions *options, char *line,
+ 		if (!arg || *arg == '\0')
+ 			fatal("%s line %d: missing PermitOpen specification",
+ 			    filename, linenum);
+-		i = options->num_permitted_opens;	/* modified later */
++		value = options->num_permitted_opens;	/* modified later */
+ 		if (strcmp(arg, "any") == 0 || strcmp(arg, "none") == 0) {
+-			if (*activep && i == 0) {
++			if (*activep && value == 0) {
+ 				options->num_permitted_opens = 1;
+ 				options->permitted_opens = xcalloc(1,
+ 				    sizeof(*options->permitted_opens));
+@@ -1683,7 +1683,7 @@ process_server_config_line(ServerOptions *options, char *line,
+ 			if (arg == NULL || ((port = permitopen_port(arg)) < 0))
+ 				fatal("%s line %d: bad port number in "
+ 				    "PermitOpen", filename, linenum);
+-			if (*activep && i == 0) {
++			if (*activep && value == 0) {
+ 				options->permitted_opens = xrecallocarray(
+ 				    options->permitted_opens,
+ 				    options->num_permitted_opens,
+-- 
+2.16.1
+
diff --git a/net-misc/openssh/files/openssh-7.6_p1-x509-11.0-libressl.patch b/net-misc/openssh/files/openssh-7.6_p1-x509-11.0-libressl.patch
deleted file mode 100644
index b84ee64e4f7c..000000000000
--- a/net-misc/openssh/files/openssh-7.6_p1-x509-11.0-libressl.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/openssh-7.6p1+x509-11.0.diff	2017-11-06 17:16:28.334140140 -0800
-+++ b/openssh-7.6p1+x509-11.0.diff	2017-11-06 17:16:55.338223563 -0800
-@@ -54732,7 +54732,7 @@
- +int/*bool*/ ssh_x509store_addlocations(const X509StoreOptions *locations);
- +
- +typedef char SSHXSTOREPATH;
--+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- +DECLARE_STACK_OF(SSHXSTOREPATH)
- +# define sk_SSHXSTOREPATH_new_null()	SKM_sk_new_null(SSHXSTOREPATH)
- +# define sk_SSHXSTOREPATH_num(st)	SKM_sk_num(SSHXSTOREPATH, (st))
diff --git a/net-misc/openssh/files/openssh-7.6_p1-x509-11.1-libressl.patch b/net-misc/openssh/files/openssh-7.6_p1-x509-11.1-libressl.patch
deleted file mode 100644
index c3b6b4d61a3e..000000000000
--- a/net-misc/openssh/files/openssh-7.6_p1-x509-11.1-libressl.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/openssh-7.6p1+x509-11.1.diff	2017-11-06 17:16:28.334140140 -0800
-+++ b/openssh-7.6p1+x509-11.1.diff	2017-11-06 17:16:55.338223563 -0800
-@@ -54732,7 +54732,7 @@
- +int/*bool*/ ssh_x509store_addlocations(const X509StoreOptions *locations);
- +
- +typedef char SSHXSTOREPATH;
--+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- +DECLARE_STACK_OF(SSHXSTOREPATH)
- +# define sk_SSHXSTOREPATH_new_null()	SKM_sk_new_null(SSHXSTOREPATH)
- +# define sk_SSHXSTOREPATH_num(st)	SKM_sk_num(SSHXSTOREPATH, (st))
diff --git a/net-misc/openssh/openssh-7.6_p1-r2.ebuild b/net-misc/openssh/openssh-7.6_p1-r2.ebuild
deleted file mode 100644
index ce99373986b0..000000000000
--- a/net-misc/openssh/openssh-7.6_p1-r2.ebuild
+++ /dev/null
@@ -1,336 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-#HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
-	${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
-	${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
-	${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
-	${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
-	"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
-	pie? ( !static )
-	static? ( !kerberos !pam )
-	X509? ( !ldap !sctp ssl )
-	test? ( ssl )"
-
-LIB_DEPEND="
-	audit? ( sys-process/audit[static-libs(+)] )
-	ldns? (
-		net-libs/ldns[static-libs(+)]
-		!bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
-		bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
-	)
-	libedit? ( dev-libs/libedit:=[static-libs(+)] )
-	sctp? ( net-misc/lksctp-tools[static-libs(+)] )
-	selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
-	skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
-	ssl? (
-		!libressl? (
-			>=dev-libs/openssl-1.0.1:0=[bindist=]
-			dev-libs/openssl:0=[static-libs(+)]
-		)
-		libressl? ( dev-libs/libressl:0=[static-libs(+)] )
-	)
-	>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
-	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
-	pam? ( virtual/pam )
-	kerberos? ( virtual/krb5 )
-	ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-	virtual/pkgconfig
-	virtual/os-headers
-	sys-devel/autoconf"
-RDEPEND="${RDEPEND}
-	pam? ( >=sys-auth/pambase-20081028 )
-	userland_GNU? ( virtual/shadow )
-	X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
-	# this sucks, but i'd rather have people unable to `emerge -u openssh`
-	# than not be able to log in to their server any more
-	maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
-	local fail="
-		$(use X509 && maybe_fail X509 X509_PATCH)
-		$(use ldap && maybe_fail ldap LDAP_PATCH)
-		$(use hpn && maybe_fail hpn HPN_PATCH)
-	"
-	fail=$(echo ${fail})
-	if [[ -n ${fail} ]] ; then
-		eerror "Sorry, but this version does not yet support features"
-		eerror "that you requested:	 ${fail}"
-		eerror "Please mask ${PF} for now and check back later:"
-		eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
-		die "booooo"
-	fi
-
-	# Make sure people who are using tcp wrappers are notified of its removal. #531156
-	if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
-		ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
-		ewarn "you're trying to use it.  Update your ${EROOT}etc/hosts.{allow,deny} please."
-	fi
-}
-
-save_version() {
-	# version.h patch conflict avoidence
-	mv version.h version.h.$1
-	cp -f version.h.pristine version.h
-}
-
-src_prepare() {
-	sed -i \
-		-e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
-		pathnames.h || die
-	# keep this as we need it to avoid the conflict between LPK and HPN changing
-	# this file.
-	cp version.h version.h.pristine
-
-	eapply "${FILESDIR}/${P}-warnings.patch"
-
-	# don't break .ssh/authorized_keys2 for fun
-	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
-	if use X509 ; then
-		if use hpn ; then
-			pushd "${WORKDIR}" >/dev/null
-			eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
-			eapply "${FILESDIR}"/${P}-x509-${X509_VER}-libressl.patch
-			popd >/dev/null
-		fi
-		save_version X509
-		eapply "${WORKDIR}"/${X509_PATCH%.*}
-	fi
-
-	if use ldap ; then
-		eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-		save_version LPK
-	fi
-
-	eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
-	eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
-	use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-	use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
-	if use hpn ; then
-		elog "Applying HPN patchset ..."
-		eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
-		save_version HPN
-	fi
-
-	tc-export PKG_CONFIG
-	local sed_args=(
-		-e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
-		# Disable PATH reset, trust what portage gives us #254615
-		-e 's:^PATH=/:#PATH=/:'
-		# Disable fortify flags ... our gcc does this for us
-		-e 's:-D_FORTIFY_SOURCE=2::'
-	)
-	# The -ftrapv flag ICEs on hppa #505182
-	use hppa && sed_args+=(
-		-e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
-		-e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
-	)
-	# _XOPEN_SOURCE causes header conflicts on Solaris
-	[[ ${CHOST} == *-solaris* ]] && sed_args+=(
-		-e 's/-D_XOPEN_SOURCE//'
-	)
-	sed -i "${sed_args[@]}" configure{.ac,} || die
-
-	eapply_user #473004
-
-	# Now we can build a sane merged version.h
-	(
-		sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
-		macros=()
-		for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
-		printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
-	) > version.h
-
-	eautoreconf
-}
-
-src_configure() {
-	addwrite /dev/ptmx
-
-	use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
-	use static && append-ldflags -static
-
-	local myconf=(
-		--with-ldflags="${LDFLAGS}"
-		--disable-strip
-		--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
-		--sysconfdir="${EPREFIX}"/etc/ssh
-		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
-		--datadir="${EPREFIX}"/usr/share/openssh
-		--with-privsep-path="${EPREFIX}"/var/empty
-		--with-privsep-user=sshd
-		$(use_with audit audit linux)
-		$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
-		# We apply the ldap patch conditionally, so can't pass --without-ldap
-		# unconditionally else we get unknown flag warnings.
-		$(use ldap && use_with ldap)
-		$(use_with ldns)
-		$(use_with libedit)
-		$(use_with pam)
-		$(use_with pie)
-		$(use X509 || use_with sctp)
-		$(use_with selinux)
-		$(use_with skey)
-		$(use_with ssl openssl)
-		$(use_with ssl md5-passwords)
-		$(use_with ssl ssl-engine)
-	)
-
-	# The seccomp sandbox is broken on x32, so use the older method for now. #553748
-	use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
-	econf "${myconf[@]}"
-}
-
-src_install() {
-	emake install-nokeys DESTDIR="${D}"
-	fperms 600 /etc/ssh/sshd_config
-	dobin contrib/ssh-copy-id
-	newinitd "${FILESDIR}"/sshd.rc6.4 sshd
-	newconfd "${FILESDIR}"/sshd.confd sshd
-
-	newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-	if use pam ; then
-		sed -i \
-			-e "/^#UsePAM /s:.*:UsePAM yes:" \
-			-e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
-			-e "/^#PrintMotd /s:.*:PrintMotd no:" \
-			-e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
-			"${ED}"/etc/ssh/sshd_config || die
-	fi
-
-	# Gentoo tweaks to default config files
-	cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
-	# Allow client to pass locale environment variables #367017
-	AcceptEnv LANG LC_*
-	EOF
-	cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
-	# Send locale environment variables #367017
-	SendEnv LANG LC_*
-	EOF
-
-	if use livecd ; then
-		sed -i \
-			-e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
-			"${ED}"/etc/ssh/sshd_config || die
-	fi
-
-	if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
-		insinto /etc/openldap/schema/
-		newins openssh-lpk_openldap.schema openssh-lpk.schema
-	fi
-
-	doman contrib/ssh-copy-id.1
-	dodoc CREDITS OVERVIEW README* TODO sshd_config
-	use X509 || dodoc ChangeLog
-
-	diropts -m 0700
-	dodir /etc/skel/.ssh
-
-	systemd_dounit "${FILESDIR}"/sshd.{service,socket}
-	systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
-	local t skipped=() failed=() passed=()
-	local tests=( interop-tests compat-tests )
-
-	local shell=$(egetshell "${UID}")
-	if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
-		elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
-		elog "user, so we will run a subset only."
-		skipped+=( tests )
-	else
-		tests+=( tests )
-	fi
-
-	# It will also attempt to write to the homedir .ssh.
-	local sshhome=${T}/homedir
-	mkdir -p "${sshhome}"/.ssh
-	for t in "${tests[@]}" ; do
-		# Some tests read from stdin ...
-		HOMEDIR="${sshhome}" HOME="${sshhome}" \
-		emake -k -j1 ${t} </dev/null \
-			&& passed+=( "${t}" ) \
-			|| failed+=( "${t}" )
-	done
-
-	einfo "Passed tests: ${passed[*]}"
-	[[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
-	[[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
-	enewgroup sshd 22
-	enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
-	if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
-		elog "Starting with openssh-5.8p1, the server will default to a newer key"
-		elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
-		elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
-		elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
-		elog "Make sure to update any configs that you might have.  Note that xinetd might"
-		elog "be an alternative for you as it supports USE=tcpd."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
-		elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
-		elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
-		elog "adding to your sshd_config or ~/.ssh/config files:"
-		elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
-		elog "You should however generate new keys using rsa or ed25519."
-
-		elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
-		elog "to 'prohibit-password'.  That means password auth for root users no longer works"
-		elog "out of the box.  If you need this, please update your sshd_config explicitly."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
-		elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
-		elog "Furthermore, rsa keys with less than 1024 bits will be refused."
-	fi
-	if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
-		elog "Be aware that by disabling openssl support in openssh, the server and clients"
-		elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
-		elog "and update all clients/servers that utilize them."
-	fi
-
-	# remove this if aes-ctr-mt gets fixed
-	if use hpn; then
-		elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
-		elog "set since it does not (yet) work with >=openssh-7.6p1."
-	fi
-}
diff --git a/net-misc/openssh/openssh-7.6_p1-r3.ebuild b/net-misc/openssh/openssh-7.6_p1-r5.ebuild
index 131e6e1da0d8..e19d5f0f30b4 100644
--- a/net-misc/openssh/openssh-7.6_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r5.ebuild
@@ -12,7 +12,7 @@ PARCH=${P/_}
 HPN_PATCH="${PARCH}-hpnssh14v12-r1.tar.xz"
 SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
 LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.1" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
+X509_VER="11.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
 
 DESCRIPTION="Port of OpenBSD's free SSH release"
 HOMEPAGE="http://www.openssh.org/"
@@ -110,6 +110,7 @@ src_prepare() {
 	cp version.h version.h.pristine
 
 	eapply "${FILESDIR}/${P}-warnings.patch"
+	eapply "${FILESDIR}/${P}-permitopen.patch"
 
 	# don't break .ssh/authorized_keys2 for fun
 	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
@@ -118,7 +119,6 @@ src_prepare() {
 		if use hpn ; then
 			pushd "${WORKDIR}" >/dev/null
 			eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
-			eapply "${FILESDIR}"/${P}-x509-${X509_VER}-libressl.patch
 			popd >/dev/null
 			save_version X509
 		fi
diff --git a/net-misc/openssh/openssh-7.6_p1.ebuild b/net-misc/openssh/openssh-7.6_p1.ebuild
deleted file mode 100644
index ff5b2fc3ad58..000000000000
--- a/net-misc/openssh/openssh-7.6_p1.ebuild
+++ /dev/null
@@ -1,336 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.0" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
-	${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
-	${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
-	${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
-	${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
-	"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
-	pie? ( !static )
-	static? ( !kerberos !pam )
-	X509? ( !ldap !sctp ssl )
-	test? ( ssl )"
-
-LIB_DEPEND="
-	audit? ( sys-process/audit[static-libs(+)] )
-	ldns? (
-		net-libs/ldns[static-libs(+)]
-		!bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
-		bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
-	)
-	libedit? ( dev-libs/libedit:=[static-libs(+)] )
-	sctp? ( net-misc/lksctp-tools[static-libs(+)] )
-	selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
-	skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
-	ssl? (
-		!libressl? (
-			>=dev-libs/openssl-1.0.1:0=[bindist=]
-			dev-libs/openssl:0=[static-libs(+)]
-		)
-		libressl? ( dev-libs/libressl:0=[static-libs(+)] )
-	)
-	>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
-	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
-	pam? ( virtual/pam )
-	kerberos? ( virtual/krb5 )
-	ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-	virtual/pkgconfig
-	virtual/os-headers
-	sys-devel/autoconf"
-RDEPEND="${RDEPEND}
-	pam? ( >=sys-auth/pambase-20081028 )
-	userland_GNU? ( virtual/shadow )
-	X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
-	# this sucks, but i'd rather have people unable to `emerge -u openssh`
-	# than not be able to log in to their server any more
-	maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
-	local fail="
-		$(use X509 && maybe_fail X509 X509_PATCH)
-		$(use ldap && maybe_fail ldap LDAP_PATCH)
-		$(use hpn && maybe_fail hpn HPN_PATCH)
-	"
-	fail=$(echo ${fail})
-	if [[ -n ${fail} ]] ; then
-		eerror "Sorry, but this version does not yet support features"
-		eerror "that you requested:	 ${fail}"
-		eerror "Please mask ${PF} for now and check back later:"
-		eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
-		die "booooo"
-	fi
-
-	# Make sure people who are using tcp wrappers are notified of its removal. #531156
-	if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
-		ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
-		ewarn "you're trying to use it.  Update your ${EROOT}etc/hosts.{allow,deny} please."
-	fi
-}
-
-save_version() {
-	# version.h patch conflict avoidence
-	mv version.h version.h.$1
-	cp -f version.h.pristine version.h
-}
-
-src_prepare() {
-	sed -i \
-		-e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
-		pathnames.h || die
-	# keep this as we need it to avoid the conflict between LPK and HPN changing
-	# this file.
-	cp version.h version.h.pristine
-
-	eapply "${FILESDIR}/${P}-warnings.patch"
-
-	# don't break .ssh/authorized_keys2 for fun
-	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
-	if use X509 ; then
-		if use hpn ; then
-			pushd "${WORKDIR}" >/dev/null
-			eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
-			eapply "${FILESDIR}"/${P}-x509-${X509_VER}-libressl.patch
-			popd >/dev/null
-		fi
-		save_version X509
-		eapply "${WORKDIR}"/${X509_PATCH%.*}
-	fi
-
-	if use ldap ; then
-		eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-		save_version LPK
-	fi
-
-	eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
-	eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
-	use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-	use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
-	if use hpn ; then
-		elog "Applying HPN patchset ..."
-		eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
-		save_version HPN
-	fi
-
-	tc-export PKG_CONFIG
-	local sed_args=(
-		-e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
-		# Disable PATH reset, trust what portage gives us #254615
-		-e 's:^PATH=/:#PATH=/:'
-		# Disable fortify flags ... our gcc does this for us
-		-e 's:-D_FORTIFY_SOURCE=2::'
-	)
-	# The -ftrapv flag ICEs on hppa #505182
-	use hppa && sed_args+=(
-		-e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
-		-e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
-	)
-	# _XOPEN_SOURCE causes header conflicts on Solaris
-	[[ ${CHOST} == *-solaris* ]] && sed_args+=(
-		-e 's/-D_XOPEN_SOURCE//'
-	)
-	sed -i "${sed_args[@]}" configure{.ac,} || die
-
-	eapply_user #473004
-
-	# Now we can build a sane merged version.h
-	(
-		sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
-		macros=()
-		for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
-		printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
-	) > version.h
-
-	eautoreconf
-}
-
-src_configure() {
-	addwrite /dev/ptmx
-
-	use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
-	use static && append-ldflags -static
-
-	local myconf=(
-		--with-ldflags="${LDFLAGS}"
-		--disable-strip
-		--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
-		--sysconfdir="${EPREFIX}"/etc/ssh
-		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
-		--datadir="${EPREFIX}"/usr/share/openssh
-		--with-privsep-path="${EPREFIX}"/var/empty
-		--with-privsep-user=sshd
-		$(use_with audit audit linux)
-		$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
-		# We apply the ldap patch conditionally, so can't pass --without-ldap
-		# unconditionally else we get unknown flag warnings.
-		$(use ldap && use_with ldap)
-		$(use_with ldns)
-		$(use_with libedit)
-		$(use_with pam)
-		$(use_with pie)
-		$(use X509 || use_with sctp)
-		$(use_with selinux)
-		$(use_with skey)
-		$(use_with ssl openssl)
-		$(use_with ssl md5-passwords)
-		$(use_with ssl ssl-engine)
-	)
-
-	# The seccomp sandbox is broken on x32, so use the older method for now. #553748
-	use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
-	econf "${myconf[@]}"
-}
-
-src_install() {
-	emake install-nokeys DESTDIR="${D}"
-	fperms 600 /etc/ssh/sshd_config
-	dobin contrib/ssh-copy-id
-	newinitd "${FILESDIR}"/sshd.rc6.4 sshd
-	newconfd "${FILESDIR}"/sshd.confd sshd
-
-	newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-	if use pam ; then
-		sed -i \
-			-e "/^#UsePAM /s:.*:UsePAM yes:" \
-			-e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
-			-e "/^#PrintMotd /s:.*:PrintMotd no:" \
-			-e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
-			"${ED}"/etc/ssh/sshd_config || die
-	fi
-
-	# Gentoo tweaks to default config files
-	cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
-	# Allow client to pass locale environment variables #367017
-	AcceptEnv LANG LC_*
-	EOF
-	cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
-	# Send locale environment variables #367017
-	SendEnv LANG LC_*
-	EOF
-
-	if use livecd ; then
-		sed -i \
-			-e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
-			"${ED}"/etc/ssh/sshd_config || die
-	fi
-
-	if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
-		insinto /etc/openldap/schema/
-		newins openssh-lpk_openldap.schema openssh-lpk.schema
-	fi
-
-	doman contrib/ssh-copy-id.1
-	dodoc CREDITS OVERVIEW README* TODO sshd_config
-	use X509 || dodoc ChangeLog
-
-	diropts -m 0700
-	dodir /etc/skel/.ssh
-
-	systemd_dounit "${FILESDIR}"/sshd.{service,socket}
-	systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
-	local t skipped=() failed=() passed=()
-	local tests=( interop-tests compat-tests )
-
-	local shell=$(egetshell "${UID}")
-	if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
-		elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
-		elog "user, so we will run a subset only."
-		skipped+=( tests )
-	else
-		tests+=( tests )
-	fi
-
-	# It will also attempt to write to the homedir .ssh.
-	local sshhome=${T}/homedir
-	mkdir -p "${sshhome}"/.ssh
-	for t in "${tests[@]}" ; do
-		# Some tests read from stdin ...
-		HOMEDIR="${sshhome}" HOME="${sshhome}" \
-		emake -k -j1 ${t} </dev/null \
-			&& passed+=( "${t}" ) \
-			|| failed+=( "${t}" )
-	done
-
-	einfo "Passed tests: ${passed[*]}"
-	[[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
-	[[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
-	enewgroup sshd 22
-	enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
-	if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
-		elog "Starting with openssh-5.8p1, the server will default to a newer key"
-		elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
-		elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
-		elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
-		elog "Make sure to update any configs that you might have.  Note that xinetd might"
-		elog "be an alternative for you as it supports USE=tcpd."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
-		elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
-		elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
-		elog "adding to your sshd_config or ~/.ssh/config files:"
-		elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
-		elog "You should however generate new keys using rsa or ed25519."
-
-		elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
-		elog "to 'prohibit-password'.  That means password auth for root users no longer works"
-		elog "out of the box.  If you need this, please update your sshd_config explicitly."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
-		elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
-		elog "Furthermore, rsa keys with less than 1024 bits will be refused."
-	fi
-	if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
-		elog "Be aware that by disabling openssl support in openssh, the server and clients"
-		elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
-		elog "and update all clients/servers that utilize them."
-	fi
-
-	# remove this if aes-ctr-mt gets fixed
-	if use hpn; then
-		elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
-		elog "set since it does not (yet) work with >=openssh-7.6p1."
-	fi
-}