Only in b: .openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff.un~ diff -ur a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff --- a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-05-27 13:52:27.704108928 -0700 +++ b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-05-27 13:52:49.803967500 -0700 @@ -3,9 +3,9 @@ --- a/Makefile.in +++ b/Makefile.in @@ -42,7 +42,7 @@ CC=@CC@ - LD=@LD@ - CFLAGS=@CFLAGS@ + CFLAGS_NOPIE=@CFLAGS_NOPIE@ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@ + PICFLAG=@PICFLAG@ -LIBS=@LIBS@ +LIBS=@LIBS@ -lpthread K5LIBS=@K5LIBS@ @@ -902,14 +902,14 @@ /* @@ -2118,6 +2125,8 @@ fill_default_options(Options * options) + options->canonicalize_hostname = SSH_CANONICALISE_NO; + if (options->fingerprint_hash == -1) options->fingerprint_hash = SSH_FP_HASH_DEFAULT; - if (options->update_hostkeys == -1) - options->update_hostkeys = 0; + if (options->disable_multithreaded == -1) + options->disable_multithreaded = 0; - - /* Expand KEX name lists */ - all_cipher = cipher_alg_list(',', 0); + #ifdef ENABLE_SK_INTERNAL + if (options->sk_provider == NULL) + options->sk_provider = xstrdup("internal"); diff --git a/readconf.h b/readconf.h index 8e36bf32..c803eca7 100644 --- a/readconf.h @@ -952,9 +952,9 @@ sPort, sHostKeyFile, sLoginGraceTime, sPermitRootLogin, sLogFacility, sLogLevel, @@ -643,6 +647,7 @@ static struct { - { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL }, { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, + { "include", sInclude, SSHCFG_ALL }, + { "disableMTAES", sDisableMTAES, SSHCFG_ALL }, { "ipqos", sIPQoS, SSHCFG_ALL }, { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, diff -ur a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff --- a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-05-27 13:52:27.705108921 -0700 +++ b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-05-27 14:03:57.888683100 -0700 @@ -409,18 +409,10 @@ index 817da43b..b2bcf78f 100644 --- a/packet.c +++ b/packet.c -@@ -925,6 +925,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode) +@@ -925,6 +925,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode) return 0; } -+/* this supports the forced rekeying required for the NONE cipher */ -+int rekey_requested = 0; -+void -+packet_request_rekeying(void) -+{ -+ rekey_requested = 1; -+} -+ +/* used to determine if pre or post auth when rekeying for aes-ctr + * and none cipher switch */ +int @@ -434,20 +426,6 @@ #define MAX_PACKETS (1U<<31) static int ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) -@@ -951,6 +969,13 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) - if (state->p_send.packets == 0 && state->p_read.packets == 0) - return 0; - -+ /* used to force rekeying when called for by the none -+ * cipher switch methods -cjr */ -+ if (rekey_requested == 1) { -+ rekey_requested = 0; -+ return 1; -+ } -+ - /* Time-based rekeying */ - if (state->rekey_interval != 0 && - (int64_t)state->rekey_time + state->rekey_interval <= monotime()) diff --git a/packet.h b/packet.h index 8ccfd2e0..1ad9bc06 100644 --- a/packet.h @@ -476,9 +454,9 @@ /* Format of the configuration file: @@ -167,6 +168,8 @@ typedef enum { - oHashKnownHosts, oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, oRemoteCommand, + oDisableMTAES, + oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize, + oNoneEnabled, oNoneSwitch, oVisualHostKey, @@ -615,9 +593,9 @@ int ip_qos_bulk; /* IP ToS/DSCP/class for bulk traffic */ SyslogFacility log_facility; /* Facility for system logging. */ @@ -112,7 +116,10 @@ typedef struct { - int enable_ssh_keysign; int64_t rekey_limit; + int disable_multithreaded; /*disable multithreaded aes-ctr*/ + int none_switch; /* Use none cipher */ + int none_enabled; /* Allow none to be used */ int rekey_interval; @@ -700,9 +678,9 @@ + options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT; + } + + if (options->disable_multithreaded == -1) + options->disable_multithreaded = 0; if (options->ip_qos_interactive == -1) - options->ip_qos_interactive = IPTOS_DSCP_AF21; - if (options->ip_qos_bulk == -1) @@ -486,6 +532,8 @@ typedef enum { sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress, sAddressFamily, @@ -731,11 +709,10 @@ *flags = keywords[i].flags; return keywords[i].opcode; } -@@ -1424,10 +1477,27 @@ process_server_config_line(ServerOptions *options, char *line, - multistate_ptr = multistate_flag; +@@ -1424,12 +1477,28 @@ process_server_config_line(ServerOptions *options, char *line, + multistate_ptr = multistate_ignore_rhosts; goto parse_multistate; -+ + case sTcpRcvBufPoll: + intptr = &options->tcp_rcv_buf_poll; + goto parse_flag; @@ -750,7 +727,9 @@ + case sIgnoreUserKnownHosts: intptr = &options->ignore_user_known_hosts; - goto parse_flag; + parse_flag: + multistate_ptr = multistate_flag; + goto parse_multistate; + case sNoneEnabled: + intptr = &options->none_enabled; @@ -1079,11 +1058,11 @@ xxx_host = host; xxx_hostaddr = hostaddr; -@@ -422,6 +433,28 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, +@@ -422,7 +433,28 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, if (!authctxt.success) fatal("Authentication failed."); -+ + + /* + * If the user wants to use the none cipher, do it post authentication + * and only if the right conditions are met -- both of the NONE commands @@ -1105,9 +1084,9 @@ + } + } + - debug("Authentication succeeded (%s).", authctxt.method->name); - } - + #ifdef WITH_OPENSSL + if (options.disable_multithreaded == 0) { + /* if we are using aes-ctr there can be issues in either a fork or sandbox diff --git a/sshd.c b/sshd.c index 11571c01..23a06022 100644 --- a/sshd.c