API tools faq
paste
Advertisement
Guest User

openssh-6.0p1-hpn13v13-ismo.diff

a guest
May 27th, 2014
427
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Diff 64.07 KB | None | 0 0
raw download clone embed print report
  1. diff -NupwB canonical/auth2.c kitchen/auth2.c
  2. --- canonical/auth2.c   2011-12-18 18:52:51.000000000 -0500
  3. +++ kitchen/auth2.c 2012-11-07 15:28:16.000000000 -0500
  4. @@ -49,6 +49,7 @@
  5.  #include "dispatch.h"
  6.  #include "pathnames.h"
  7.  #include "buffer.h"
  8. +#include "canohost.h"
  9.  
  10.  #ifdef GSSAPI
  11.  #include "ssh-gss.h"
  12. @@ -75,6 +76,8 @@ extern Authmethod method_gssapi;
  13.  extern Authmethod method_jpake;
  14.  #endif
  15.  
  16. +static int log_flag = 0;
  17. +
  18.  Authmethod *authmethods[] = {
  19.     &method_none,
  20.     &method_pubkey,
  21. @@ -227,6 +230,12 @@ input_userauth_request(int type, u_int32
  22.     debug("userauth-request for user %s service %s method %s", user, service, method);
  23.     debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  24.  
  25. +   if (!log_flag) {
  26. +       logit("SSH: Server;Ltype: Authname;Remote: %s-%d;Name: %s",
  27. +           get_remote_ipaddr(), get_remote_port(), user);
  28. +       log_flag = 1;
  29. +   }
  30. +
  31.     if ((style = strchr(user, ':')) != NULL)
  32.         *style++ = 0;
  33.  
  34. diff -NupwB canonical/buffer.c kitchen/buffer.c
  35. --- canonical/buffer.c  2010-02-11 17:23:40.000000000 -0500
  36. +++ kitchen/buffer.c    2012-11-07 15:28:16.000000000 -0500
  37. @@ -127,7 +127,7 @@ restart:
  38.  
  39.     /* Increase the size of the buffer and retry. */
  40.     newlen = roundup(buffer->alloc + len, BUFFER_ALLOCSZ);
  41. -   if (newlen > BUFFER_MAX_LEN)
  42. +   if (newlen > BUFFER_MAX_LEN_HPN)
  43.         fatal("buffer_append_space: alloc %u not supported",
  44.             newlen);
  45.     buffer->buf = xrealloc(buffer->buf, 1, newlen);
  46. diff -NupwB canonical/buffer.h kitchen/buffer.h
  47. --- canonical/buffer.h  2010-09-09 21:39:27.000000000 -0400
  48. +++ kitchen/buffer.h    2012-11-07 15:28:16.000000000 -0500
  49. @@ -16,6 +16,9 @@
  50.  #ifndef BUFFER_H
  51.  #define BUFFER_H
  52.  
  53. +/* move the following to a more appropriate place and name */
  54. +#define BUFFER_MAX_LEN_HPN          0x4000000  /* 64MB */
  55. +
  56.  typedef struct {
  57.     u_char  *buf;       /* Buffer for data. */
  58.     u_int    alloc;     /* Number of bytes allocated for data. */
  59. diff -NupwB canonical/channels.c kitchen/channels.c
  60. --- canonical/channels.c    2011-10-02 03:59:03.000000000 -0400
  61. +++ kitchen/channels.c  2012-11-07 15:28:16.000000000 -0500
  62. @@ -173,8 +173,10 @@ static void port_open_helper(Channel *c,
  63.  static int connect_next(struct channel_connect *);
  64.  static void channel_connect_ctx_free(struct channel_connect *);
  65.  
  66. -/* -- channel core */
  67. +static int hpn_disabled = 0;
  68. +static int hpn_buffer_size = 2 * 1024 * 1024;
  69.  
  70. +/* -- channel core */
  71.  Channel *
  72.  channel_by_id(int id)
  73.  {
  74. @@ -318,6 +320,7 @@ channel_new(char *ctype, int type, int r
  75.     c->local_window_max = window;
  76.     c->local_consumed = 0;
  77.     c->local_maxpacket = maxpack;
  78. +   c->dynamic_window = 0;
  79.     c->remote_id = -1;
  80.     c->remote_name = xstrdup(remote_name);
  81.     c->remote_window = 0;
  82. @@ -817,11 +820,36 @@ channel_pre_open_13(Channel *c, fd_set *
  83.         FD_SET(c->sock, writeset);
  84.  }
  85.  
  86. +int channel_tcpwinsz () {
  87. +        u_int32_t tcpwinsz = 0;
  88. +        socklen_t optsz = sizeof(tcpwinsz);
  89. +   int ret = -1;
  90. +
  91. +   /* if we aren't on a socket return 128KB*/
  92. +   if(!packet_connection_is_on_socket())
  93. +       return(128*1024);
  94. +   ret = getsockopt(packet_get_connection_in(),
  95. +            SOL_SOCKET, SO_RCVBUF, &tcpwinsz, &optsz);
  96. +   /* return no more than 64MB */
  97. +   if ((ret == 0) && tcpwinsz > BUFFER_MAX_LEN_HPN)
  98. +       tcpwinsz = BUFFER_MAX_LEN_HPN;
  99. +   debug2("tcpwinsz: %d for connection: %d", tcpwinsz,
  100. +          packet_get_connection_in());
  101. +   return(tcpwinsz);
  102. +}
  103. +
  104.  static void
  105.  channel_pre_open(Channel *c, fd_set *readset, fd_set *writeset)
  106.  {
  107.     u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
  108.  
  109. +        /* check buffer limits */
  110. +   if ((!c->tcpwinsz) || (c->dynamic_window > 0))
  111. +           c->tcpwinsz = channel_tcpwinsz();
  112. +  
  113. +   limit = MIN(limit, 2 * c->tcpwinsz);
  114. +
  115. +
  116.     if (c->istate == CHAN_INPUT_OPEN &&
  117.         limit > 0 &&
  118.         buffer_len(&c->input) < limit &&
  119. @@ -1798,6 +1826,17 @@ channel_check_window(Channel *c)
  120.         c->local_maxpacket*3) ||
  121.         c->local_window < c->local_window_max/2) &&
  122.         c->local_consumed > 0) {
  123. +       u_int addition = 0;
  124. +       /* adjust max window size if we are in a dynamic environment */
  125. +       if (c->dynamic_window && (c->tcpwinsz > c->local_window_max)) {
  126. +       /* grow the window somewhat aggressively to maintain pressure */
  127. +           addition = 1.5*(c->tcpwinsz - c->local_window_max);
  128. +           c->local_window_max += addition;
  129. +       }
  130. +       packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
  131. +       packet_put_int(c->remote_id);
  132. +       packet_put_int(c->local_consumed + addition);
  133. +
  134.         packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
  135.         packet_put_int(c->remote_id);
  136.         packet_put_int(c->local_consumed);
  137. @@ -1805,7 +1844,7 @@ channel_check_window(Channel *c)
  138.         debug2("channel %d: window %d sent adjust %d",
  139.             c->self, c->local_window,
  140.             c->local_consumed);
  141. -       c->local_window += c->local_consumed;
  142. +       c->local_window += c->local_consumed + addition;
  143.         c->local_consumed = 0;
  144.     }
  145.     return 1;
  146. @@ -2137,11 +2176,12 @@ channel_after_select(fd_set *readset, fd
  147.  
  148.  
  149.  /* If there is data to send to the connection, enqueue some of it now. */
  150. -void
  151. +int
  152.  channel_output_poll(void)
  153.  {
  154.     Channel *c;
  155.     u_int i, len;
  156. +   int packet_length = 0;
  157.  
  158.     for (i = 0; i < channels_alloc; i++) {
  159.         c = channels[i];
  160. @@ -2189,7 +2229,7 @@ channel_output_poll(void)
  161.                     packet_start(SSH2_MSG_CHANNEL_DATA);
  162.                     packet_put_int(c->remote_id);
  163.                     packet_put_string(data, dlen);
  164. -                   packet_send();
  165. +                   packet_length = packet_send();
  166.                     c->remote_window -= dlen + 4;
  167.                     xfree(data);
  168.                 }
  169. @@ -2219,7 +2259,7 @@ channel_output_poll(void)
  170.                     SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
  171.                 packet_put_int(c->remote_id);
  172.                 packet_put_string(buffer_ptr(&c->input), len);
  173. -               packet_send();
  174. +               packet_length = packet_send();
  175.                 buffer_consume(&c->input, len);
  176.                 c->remote_window -= len;
  177.             }
  178. @@ -2254,12 +2294,13 @@ channel_output_poll(void)
  179.             packet_put_int(c->remote_id);
  180.             packet_put_int(SSH2_EXTENDED_DATA_STDERR);
  181.             packet_put_string(buffer_ptr(&c->extended), len);
  182. -           packet_send();
  183. +           packet_length = packet_send();
  184.             buffer_consume(&c->extended, len);
  185.             c->remote_window -= len;
  186.             debug2("channel %d: sent ext data %d", c->self, len);
  187.         }
  188.     }
  189. +   return (packet_length);
  190.  }
  191.  
  192.  
  193. @@ -2683,6 +2724,14 @@ channel_fwd_bind_addr(const char *listen
  194.     return addr;
  195.  }
  196.  
  197. +void
  198. +channel_set_hpn(int external_hpn_disabled, int external_hpn_buffer_size)
  199. +{
  200. +       hpn_disabled = external_hpn_disabled;
  201. +   hpn_buffer_size = external_hpn_buffer_size;
  202. +   debug("HPN Disabled: %d, HPN Buffer Size: %d", hpn_disabled, hpn_buffer_size);
  203. +}
  204. +
  205.  static int
  206.  channel_setup_fwd_listener(int type, const char *listen_addr,
  207.      u_short listen_port, int *allocated_listen_port,
  208. @@ -2809,9 +2858,15 @@ channel_setup_fwd_listener(int type, con
  209.         }
  210.  
  211.         /* Allocate a channel number for the socket. */
  212. +       /* explicitly test for hpn disabled option. if true use smaller window size */
  213. +       if (hpn_disabled)
  214.         c = channel_new("port listener", type, sock, sock, -1,
  215.             CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
  216.             0, "port listener", 1);
  217. +       else
  218. +           c = channel_new("port listener", type, sock, sock, -1,
  219. +                 hpn_buffer_size, CHAN_TCP_PACKET_DEFAULT,
  220. +                 0, "port listener", 1);
  221.         c->path = xstrdup(host);
  222.         c->host_port = port_to_connect;
  223.         c->listening_addr = addr == NULL ? NULL : xstrdup(addr);
  224. @@ -3456,10 +3511,17 @@ x11_create_display_inet(int x11_display_
  225.     *chanids = xcalloc(num_socks + 1, sizeof(**chanids));
  226.     for (n = 0; n < num_socks; n++) {
  227.         sock = socks[n];
  228. +       /* Is this really necassary? */
  229. +       if (hpn_disabled)
  230.         nc = channel_new("x11 listener",
  231.             SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
  232.             CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
  233.             0, "X11 inet listener", 1);
  234. +       else
  235. +           nc = channel_new("x11 listener",
  236. +               SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
  237. +               hpn_buffer_size, CHAN_X11_PACKET_DEFAULT,
  238. +               0, "X11 inet listener", 1);
  239.         nc->single_connection = single_connection;
  240.         (*chanids)[n] = nc->self;
  241.     }
  242. diff -NupwB canonical/channels.h kitchen/channels.h
  243. --- canonical/channels.h    2011-10-02 03:59:03.000000000 -0400
  244. +++ kitchen/channels.h  2012-11-07 15:28:16.000000000 -0500
  245. @@ -126,10 +126,12 @@ struct Channel {
  246.     u_int   remote_maxpacket;
  247.     u_int   local_window;
  248.     u_int   local_window_max;
  249. +   int dynamic_window;
  250.     u_int   local_consumed;
  251.     u_int   local_maxpacket;
  252.     int     extended_usage;
  253.     int single_connection;
  254. +   u_int   tcpwinsz;
  255.  
  256.     char   *ctype;      /* type */
  257.  
  258. @@ -164,9 +166,11 @@ struct Channel {
  259.  
  260.  /* default window/packet sizes for tcp/x11-fwd-channel */
  261.  #define CHAN_SES_PACKET_DEFAULT    (32*1024)
  262. -#define CHAN_SES_WINDOW_DEFAULT    (64*CHAN_SES_PACKET_DEFAULT)
  263. +#define CHAN_SES_WINDOW_DEFAULT    (4*CHAN_SES_PACKET_DEFAULT)
  264. +
  265.  #define CHAN_TCP_PACKET_DEFAULT    (32*1024)
  266. -#define CHAN_TCP_WINDOW_DEFAULT    (64*CHAN_TCP_PACKET_DEFAULT)
  267. +#define CHAN_TCP_WINDOW_DEFAULT    (4*CHAN_TCP_PACKET_DEFAULT)
  268. +
  269.  #define CHAN_X11_PACKET_DEFAULT    (16*1024)
  270.  #define CHAN_X11_WINDOW_DEFAULT    (4*CHAN_X11_PACKET_DEFAULT)
  271.  
  272. @@ -240,7 +244,7 @@ void     channel_input_status_confirm(int,
  273.  
  274.  void    channel_prepare_select(fd_set **, fd_set **, int *, u_int*, int);
  275.  void     channel_after_select(fd_set *, fd_set *);
  276. -void     channel_output_poll(void);
  277. +int      channel_output_poll(void);
  278.  
  279.  int      channel_not_very_much_buffered_data(void);
  280.  void     channel_close_all(void);
  281. @@ -300,4 +304,8 @@ void     chan_rcvd_ieof(Channel *);
  282.  void    chan_write_failed(Channel *);
  283.  void    chan_obuf_empty(Channel *);
  284.  
  285. +/* hpn handler */
  286. +void     channel_set_hpn(int, int);
  287. +
  288. +
  289.  #endif
  290. diff -NupwB canonical/cipher.c kitchen/cipher.c
  291. --- canonical/cipher.c  2009-01-28 00:38:41.000000000 -0500
  292. +++ kitchen/cipher.c    2012-11-07 15:28:16.000000000 -0500
  293. @@ -55,6 +55,7 @@ extern const EVP_CIPHER *evp_ssh1_bf(voi
  294.  extern const EVP_CIPHER *evp_ssh1_3des(void);
  295.  extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
  296.  extern const EVP_CIPHER *evp_aes_128_ctr(void);
  297. +extern const EVP_CIPHER *evp_aes_ctr_mt(void);
  298.  extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
  299.  
  300.  struct Cipher {
  301. @@ -82,9 +83,9 @@ struct Cipher {
  302.     { "aes256-cbc",     SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
  303.     { "rijndael-cbc@lysator.liu.se",
  304.                 SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
  305. -   { "aes128-ctr",     SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_128_ctr },
  306. -   { "aes192-ctr",     SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_128_ctr },
  307. -   { "aes256-ctr",     SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_128_ctr },
  308. +   { "aes128-ctr",     SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_ctr_mt },
  309. +   { "aes192-ctr",     SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_ctr_mt },
  310. +   { "aes256-ctr",     SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_ctr_mt },
  311.  #ifdef USE_CIPHER_ACSS
  312.     { "acss@openssh.org",   SSH_CIPHER_SSH2, 16, 5, 0, 0, EVP_acss },
  313.  #endif
  314. @@ -163,7 +164,7 @@ ciphers_valid(const char *names)
  315.     for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
  316.         (p = strsep(&cp, CIPHER_SEP))) {
  317.         c = cipher_by_name(p);
  318. -       if (c == NULL || c->number != SSH_CIPHER_SSH2) {
  319. +       if (c == NULL || (c->number != SSH_CIPHER_SSH2 && c->number != SSH_CIPHER_NONE)) {
  320.             debug("bad cipher %s [%s]", p, names);
  321.             xfree(cipher_list);
  322.             return 0;
  323. @@ -337,6 +338,7 @@ cipher_get_keyiv(CipherContext *cc, u_ch
  324.     int evplen;
  325.  
  326.     switch (c->number) {
  327. +   case SSH_CIPHER_NONE:
  328.     case SSH_CIPHER_SSH2:
  329.     case SSH_CIPHER_DES:
  330.     case SSH_CIPHER_BLOWFISH:
  331. @@ -371,6 +373,7 @@ cipher_set_keyiv(CipherContext *cc, u_ch
  332.     int evplen = 0;
  333.  
  334.     switch (c->number) {
  335. +   case SSH_CIPHER_NONE:
  336.     case SSH_CIPHER_SSH2:
  337.     case SSH_CIPHER_DES:
  338.     case SSH_CIPHER_BLOWFISH:
  339. diff -NupwB canonical/cipher-ctr-mt.c kitchen/cipher-ctr-mt.c
  340. --- canonical/cipher-ctr-mt.c   1969-12-31 19:00:00.000000000 -0500
  341. +++ kitchen/cipher-ctr-mt.c 2012-11-07 15:28:16.000000000 -0500
  342. @@ -0,0 +1,473 @@
  343. +/*
  344. + * OpenSSH Multi-threaded AES-CTR Cipher
  345. + *
  346. + * Author: Benjamin Bennett <ben@psc.edu>
  347. + * Copyright (c) 2008 Pittsburgh Supercomputing Center. All rights reserved.
  348. + *
  349. + * Based on original OpenSSH AES-CTR cipher. Small portions remain unchanged,
  350. + * Copyright (c) 2003 Markus Friedl <markus@openbsd.org>
  351. + *
  352. + * Permission to use, copy, modify, and distribute this software for any
  353. + * purpose with or without fee is hereby granted, provided that the above
  354. + * copyright notice and this permission notice appear in all copies.
  355. + *
  356. + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  357. + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  358. + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  359. + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  360. + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  361. + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  362. + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  363. + */
  364. +#include "includes.h"
  365. +
  366. +#include <sys/types.h>
  367. +
  368. +#include <stdarg.h>
  369. +#include <string.h>
  370. +
  371. +#include <openssl/evp.h>
  372. +
  373. +#include "xmalloc.h"
  374. +#include "log.h"
  375. +
  376. +/* compatibility with old or broken OpenSSL versions */
  377. +#include "openbsd-compat/openssl-compat.h"
  378. +
  379. +#ifndef USE_BUILTIN_RIJNDAEL
  380. +#include <openssl/aes.h>
  381. +#endif
  382. +
  383. +#include <pthread.h>
  384. +
  385. +/*-------------------- TUNABLES --------------------*/
  386. +/* Number of pregen threads to use */
  387. +#define CIPHER_THREADS 2
  388. +
  389. +/* Number of keystream queues */
  390. +#define NUMKQ      (CIPHER_THREADS + 2)
  391. +
  392. +/* Length of a keystream queue */
  393. +#define KQLEN      4096
  394. +
  395. +/* Processor cacheline length */
  396. +#define CACHELINE_LEN  64
  397. +
  398. +/* Collect thread stats and print at cancellation when in debug mode */
  399. +/* #define CIPHER_THREAD_STATS */
  400. +
  401. +/* Use single-byte XOR instead of 8-byte XOR */
  402. +/* #define CIPHER_BYTE_XOR */
  403. +/*-------------------- END TUNABLES --------------------*/
  404. +
  405. +
  406. +const EVP_CIPHER *evp_aes_ctr_mt(void);
  407. +
  408. +#ifdef CIPHER_THREAD_STATS
  409. +/*
  410. + * Struct to collect thread stats
  411. + */
  412. +struct thread_stats {
  413. +   u_int   fills;
  414. +   u_int   skips;
  415. +   u_int   waits;
  416. +   u_int   drains;
  417. +};
  418. +
  419. +/*
  420. + * Debug print the thread stats
  421. + * Use with pthread_cleanup_push for displaying at thread cancellation
  422. + */
  423. +static void
  424. +thread_loop_stats(void *x)
  425. +{
  426. +   struct thread_stats *s = x;
  427. +
  428. +   debug("tid %lu - %u fills, %u skips, %u waits", pthread_self(),
  429. +           s->fills, s->skips, s->waits);
  430. +}
  431. +
  432. + #define STATS_STRUCT(s)   struct thread_stats s
  433. + #define STATS_INIT(s)     { memset(&s, 0, sizeof(s)); }
  434. + #define STATS_FILL(s)     { s.fills++; }
  435. + #define STATS_SKIP(s)     { s.skips++; }
  436. + #define STATS_WAIT(s)     { s.waits++; }
  437. + #define STATS_DRAIN(s)        { s.drains++; }
  438. +#else
  439. + #define STATS_STRUCT(s)
  440. + #define STATS_INIT(s)
  441. + #define STATS_FILL(s)
  442. + #define STATS_SKIP(s)
  443. + #define STATS_WAIT(s)
  444. + #define STATS_DRAIN(s)
  445. +#endif
  446. +
  447. +/* Keystream Queue state */
  448. +enum {
  449. +   KQINIT,
  450. +   KQEMPTY,
  451. +   KQFILLING,
  452. +   KQFULL,
  453. +   KQDRAINING
  454. +};
  455. +
  456. +/* Keystream Queue struct */
  457. +struct kq {
  458. +   u_char      keys[KQLEN][AES_BLOCK_SIZE];
  459. +   u_char      ctr[AES_BLOCK_SIZE];
  460. +   u_char      pad0[CACHELINE_LEN];
  461. +   volatile int    qstate;
  462. +   pthread_mutex_t lock;
  463. +   pthread_cond_t  cond;
  464. +   u_char      pad1[CACHELINE_LEN];
  465. +};
  466. +
  467. +/* Context struct */
  468. +struct ssh_aes_ctr_ctx
  469. +{
  470. +   struct kq   q[NUMKQ];
  471. +   AES_KEY     aes_ctx;
  472. +   STATS_STRUCT(stats);
  473. +   u_char      aes_counter[AES_BLOCK_SIZE];
  474. +   pthread_t   tid[CIPHER_THREADS];
  475. +   int     state;
  476. +   int     qidx;
  477. +   int     ridx;
  478. +};
  479. +
  480. +/* <friedl>
  481. + * increment counter 'ctr',
  482. + * the counter is of size 'len' bytes and stored in network-byte-order.
  483. + * (LSB at ctr[len-1], MSB at ctr[0])
  484. + */
  485. +static void
  486. +ssh_ctr_inc(u_char *ctr, u_int len)
  487. +{
  488. +   int i;
  489. +
  490. +   for (i = len - 1; i >= 0; i--)
  491. +       if (++ctr[i])   /* continue on overflow */
  492. +           return;
  493. +}
  494. +
  495. +/*
  496. + * Add num to counter 'ctr'
  497. + */
  498. +static void
  499. +ssh_ctr_add(u_char *ctr, uint32_t num, u_int len)
  500. +{
  501. +   int i;
  502. +   uint16_t n;
  503. +
  504. +   for (n = 0, i = len - 1; i >= 0 && (num || n); i--) {
  505. +       n = ctr[i] + (num & 0xff) + n;
  506. +       num >>= 8;
  507. +       ctr[i] = n & 0xff;
  508. +       n >>= 8;
  509. +   }
  510. +}
  511. +
  512. +/*
  513. + * Threads may be cancelled in a pthread_cond_wait, we must free the mutex
  514. + */
  515. +static void
  516. +thread_loop_cleanup(void *x)
  517. +{
  518. +   pthread_mutex_unlock((pthread_mutex_t *)x);
  519. +}
  520. +
  521. +/*
  522. + * The life of a pregen thread:
  523. + *    Find empty keystream queues and fill them using their counter.
  524. + *    When done, update counter for the next fill.
  525. + */
  526. +static void *
  527. +thread_loop(void *x)
  528. +{
  529. +   AES_KEY key;
  530. +   STATS_STRUCT(stats);
  531. +   struct ssh_aes_ctr_ctx *c = x;
  532. +   struct kq *q;
  533. +   int i;
  534. +   int qidx;
  535. +
  536. +   /* Threads stats on cancellation */
  537. +   STATS_INIT(stats);
  538. +#ifdef CIPHER_THREAD_STATS
  539. +   pthread_cleanup_push(thread_loop_stats, &stats);
  540. +#endif
  541. +
  542. +   /* Thread local copy of AES key */
  543. +   memcpy(&key, &c->aes_ctx, sizeof(key));
  544. +
  545. +   /*
  546. +    * Handle the special case of startup, one thread must fill
  547. +    * the first KQ then mark it as draining. Lock held throughout.
  548. +    */
  549. +   if (pthread_equal(pthread_self(), c->tid[0])) {
  550. +       q = &c->q[0];
  551. +       pthread_mutex_lock(&q->lock);
  552. +       if (q->qstate == KQINIT) {
  553. +           for (i = 0; i < KQLEN; i++) {
  554. +               AES_encrypt(q->ctr, q->keys[i], &key);
  555. +               ssh_ctr_inc(q->ctr, AES_BLOCK_SIZE);
  556. +           }
  557. +           ssh_ctr_add(q->ctr, KQLEN * (NUMKQ - 1), AES_BLOCK_SIZE);
  558. +           q->qstate = KQDRAINING;
  559. +           STATS_FILL(stats);
  560. +           pthread_cond_broadcast(&q->cond);
  561. +       }
  562. +       pthread_mutex_unlock(&q->lock);
  563. +   }
  564. +   else
  565. +       STATS_SKIP(stats);
  566. +
  567. +   /*
  568. +    * Normal case is to find empty queues and fill them, skipping over
  569. +    * queues already filled by other threads and stopping to wait for
  570. +    * a draining queue to become empty.
  571. +    *
  572. +    * Multiple threads may be waiting on a draining queue and awoken
  573. +    * when empty.  The first thread to wake will mark it as filling,
  574. +    * others will move on to fill, skip, or wait on the next queue.
  575. +    */
  576. +   for (qidx = 1;; qidx = (qidx + 1) % NUMKQ) {
  577. +       /* Check if I was cancelled, also checked in cond_wait */
  578. +       pthread_testcancel();
  579. +
  580. +       /* Lock queue and block if its draining */
  581. +       q = &c->q[qidx];
  582. +       pthread_mutex_lock(&q->lock);
  583. +       pthread_cleanup_push(thread_loop_cleanup, &q->lock);
  584. +       while (q->qstate == KQDRAINING || q->qstate == KQINIT) {
  585. +           STATS_WAIT(stats);
  586. +           pthread_cond_wait(&q->cond, &q->lock);
  587. +       }
  588. +       pthread_cleanup_pop(0);
  589. +
  590. +       /* If filling or full, somebody else got it, skip */
  591. +       if (q->qstate != KQEMPTY) {
  592. +           pthread_mutex_unlock(&q->lock);
  593. +           STATS_SKIP(stats);
  594. +           continue;
  595. +       }
  596. +
  597. +       /*
  598. +        * Empty, let's fill it.
  599. +        * Queue lock is relinquished while we do this so others
  600. +        * can see that it's being filled.
  601. +        */
  602. +       q->qstate = KQFILLING;
  603. +       pthread_mutex_unlock(&q->lock);
  604. +       for (i = 0; i < KQLEN; i++) {
  605. +           AES_encrypt(q->ctr, q->keys[i], &key);
  606. +           ssh_ctr_inc(q->ctr, AES_BLOCK_SIZE);
  607. +       }
  608. +
  609. +       /* Re-lock, mark full and signal consumer */
  610. +       pthread_mutex_lock(&q->lock);
  611. +       ssh_ctr_add(q->ctr, KQLEN * (NUMKQ - 1), AES_BLOCK_SIZE);
  612. +       q->qstate = KQFULL;
  613. +       STATS_FILL(stats);
  614. +       pthread_cond_signal(&q->cond);
  615. +       pthread_mutex_unlock(&q->lock);
  616. +   }
  617. +
  618. +#ifdef CIPHER_THREAD_STATS
  619. +   /* Stats */
  620. +   pthread_cleanup_pop(1);
  621. +#endif
  622. +
  623. +   return NULL;
  624. +}
  625. +
  626. +static int
  627. +ssh_aes_ctr(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src,
  628. +    u_int len)
  629. +{
  630. +   struct ssh_aes_ctr_ctx *c;
  631. +   struct kq *q, *oldq;
  632. +   int ridx;
  633. +   u_char *buf;
  634. +
  635. +   if (len == 0)
  636. +       return (1);
  637. +   if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL)
  638. +       return (0);
  639. +
  640. +   q = &c->q[c->qidx];
  641. +   ridx = c->ridx;
  642. +
  643. +   /* src already padded to block multiple */
  644. +   while (len > 0) {
  645. +       buf = q->keys[ridx];
  646. +
  647. +#ifdef CIPHER_BYTE_XOR
  648. +       dest[0] = src[0] ^ buf[0];
  649. +       dest[1] = src[1] ^ buf[1];
  650. +       dest[2] = src[2] ^ buf[2];
  651. +       dest[3] = src[3] ^ buf[3];
  652. +       dest[4] = src[4] ^ buf[4];
  653. +       dest[5] = src[5] ^ buf[5];
  654. +       dest[6] = src[6] ^ buf[6];
  655. +       dest[7] = src[7] ^ buf[7];
  656. +       dest[8] = src[8] ^ buf[8];
  657. +       dest[9] = src[9] ^ buf[9];
  658. +       dest[10] = src[10] ^ buf[10];
  659. +       dest[11] = src[11] ^ buf[11];
  660. +       dest[12] = src[12] ^ buf[12];
  661. +       dest[13] = src[13] ^ buf[13];
  662. +       dest[14] = src[14] ^ buf[14];
  663. +       dest[15] = src[15] ^ buf[15];
  664. +#else
  665. +       *(uint64_t *)dest = *(uint64_t *)src ^ *(uint64_t *)buf;
  666. +       *(uint64_t *)(dest + 8) = *(uint64_t *)(src + 8) ^
  667. +                       *(uint64_t *)(buf + 8);
  668. +#endif
  669. +
  670. +       dest += 16;
  671. +       src += 16;
  672. +       len -= 16;
  673. +       ssh_ctr_inc(ctx->iv, AES_BLOCK_SIZE);
  674. +
  675. +       /* Increment read index, switch queues on rollover */
  676. +       if ((ridx = (ridx + 1) % KQLEN) == 0) {
  677. +           oldq = q;
  678. +
  679. +           /* Mark next queue draining, may need to wait */
  680. +           c->qidx = (c->qidx + 1) % NUMKQ;
  681. +           q = &c->q[c->qidx];
  682. +           pthread_mutex_lock(&q->lock);
  683. +           while (q->qstate != KQFULL) {
  684. +               STATS_WAIT(c->stats);
  685. +               pthread_cond_wait(&q->cond, &q->lock);
  686. +           }
  687. +           q->qstate = KQDRAINING;
  688. +           pthread_mutex_unlock(&q->lock);
  689. +
  690. +           /* Mark consumed queue empty and signal producers */
  691. +           pthread_mutex_lock(&oldq->lock);
  692. +           oldq->qstate = KQEMPTY;
  693. +           STATS_DRAIN(c->stats);
  694. +           pthread_cond_broadcast(&oldq->cond);
  695. +           pthread_mutex_unlock(&oldq->lock);
  696. +       }
  697. +   }
  698. +   c->ridx = ridx;
  699. +   return (1);
  700. +}
  701. +
  702. +#define HAVE_NONE       0
  703. +#define HAVE_KEY        1
  704. +#define HAVE_IV         2
  705. +static int
  706. +ssh_aes_ctr_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
  707. +    int enc)
  708. +{
  709. +   struct ssh_aes_ctr_ctx *c;
  710. +   int i;
  711. +
  712. +   if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
  713. +       c = xmalloc(sizeof(*c));
  714. +
  715. +       c->state = HAVE_NONE;
  716. +       for (i = 0; i < NUMKQ; i++) {
  717. +           pthread_mutex_init(&c->q[i].lock, NULL);
  718. +           pthread_cond_init(&c->q[i].cond, NULL);
  719. +       }
  720. +
  721. +       STATS_INIT(c->stats);
  722. +      
  723. +       EVP_CIPHER_CTX_set_app_data(ctx, c);
  724. +   }
  725. +
  726. +   if (c->state == (HAVE_KEY | HAVE_IV)) {
  727. +       /* Cancel pregen threads */
  728. +       for (i = 0; i < CIPHER_THREADS; i++)
  729. +           pthread_cancel(c->tid[i]);
  730. +       for (i = 0; i < CIPHER_THREADS; i++)
  731. +           pthread_join(c->tid[i], NULL);
  732. +       /* Start over getting key & iv */
  733. +       c->state = HAVE_NONE;
  734. +   }
  735. +
  736. +   if (key != NULL) {
  737. +       AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
  738. +           &c->aes_ctx);
  739. +       c->state |= HAVE_KEY;
  740. +   }
  741. +
  742. +   if (iv != NULL) {
  743. +       memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
  744. +       c->state |= HAVE_IV;
  745. +   }
  746. +
  747. +   if (c->state == (HAVE_KEY | HAVE_IV)) {
  748. +       /* Clear queues */
  749. +       memcpy(c->q[0].ctr, ctx->iv, AES_BLOCK_SIZE);
  750. +       c->q[0].qstate = KQINIT;
  751. +       for (i = 1; i < NUMKQ; i++) {
  752. +           memcpy(c->q[i].ctr, ctx->iv, AES_BLOCK_SIZE);
  753. +           ssh_ctr_add(c->q[i].ctr, i * KQLEN, AES_BLOCK_SIZE);
  754. +           c->q[i].qstate = KQEMPTY;
  755. +       }
  756. +       c->qidx = 0;
  757. +       c->ridx = 0;
  758. +
  759. +       /* Start threads */
  760. +       for (i = 0; i < CIPHER_THREADS; i++) {
  761. +           pthread_create(&c->tid[i], NULL, thread_loop, c);
  762. +       }
  763. +       pthread_mutex_lock(&c->q[0].lock);
  764. +       while (c->q[0].qstate != KQDRAINING)
  765. +           pthread_cond_wait(&c->q[0].cond, &c->q[0].lock);
  766. +       pthread_mutex_unlock(&c->q[0].lock);
  767. +      
  768. +   }
  769. +   return (1);
  770. +}
  771. +
  772. +static int
  773. +ssh_aes_ctr_cleanup(EVP_CIPHER_CTX *ctx)
  774. +{
  775. +   struct ssh_aes_ctr_ctx *c;
  776. +   int i;
  777. +
  778. +   if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {
  779. +#ifdef CIPHER_THREAD_STATS
  780. +       debug("main thread: %u drains, %u waits", c->stats.drains,
  781. +               c->stats.waits);
  782. +#endif
  783. +       /* Cancel pregen threads */
  784. +       for (i = 0; i < CIPHER_THREADS; i++)
  785. +           pthread_cancel(c->tid[i]);
  786. +       for (i = 0; i < CIPHER_THREADS; i++)
  787. +           pthread_join(c->tid[i], NULL);
  788. +
  789. +       memset(c, 0, sizeof(*c));
  790. +       xfree(c);
  791. +       EVP_CIPHER_CTX_set_app_data(ctx, NULL);
  792. +   }
  793. +   return (1);
  794. +}
  795. +
  796. +/* <friedl> */
  797. +const EVP_CIPHER *
  798. +evp_aes_ctr_mt(void)
  799. +{
  800. +   static EVP_CIPHER aes_ctr;
  801. +
  802. +   memset(&aes_ctr, 0, sizeof(EVP_CIPHER));
  803. +   aes_ctr.nid = NID_undef;
  804. +   aes_ctr.block_size = AES_BLOCK_SIZE;
  805. +   aes_ctr.iv_len = AES_BLOCK_SIZE;
  806. +   aes_ctr.key_len = 16;
  807. +   aes_ctr.init = ssh_aes_ctr_init;
  808. +   aes_ctr.cleanup = ssh_aes_ctr_cleanup;
  809. +   aes_ctr.do_cipher = ssh_aes_ctr;
  810. +#ifndef SSH_OLD_EVP
  811. +   aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
  812. +       EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
  813. +#endif
  814. +   return (&aes_ctr);
  815. +}
  816. diff -NupwB canonical/clientloop.c kitchen/clientloop.c
  817. --- canonical/clientloop.c  2012-02-10 16:18:17.000000000 -0500
  818. +++ kitchen/clientloop.c    2012-11-07 15:28:16.000000000 -0500
  819. @@ -1825,9 +1825,15 @@ client_request_x11(const char *request_t
  820.     sock = x11_connect_display();
  821.     if (sock < 0)
  822.         return NULL;
  823. +   /* again is this really necessary for X11? */
  824. +   if (options.hpn_disabled)
  825.     c = channel_new("x11",
  826.         SSH_CHANNEL_X11_OPEN, sock, sock, -1,
  827.         CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
  828. +   else
  829. +       c = channel_new("x11",
  830. +           SSH_CHANNEL_X11_OPEN, sock, sock, -1,
  831. +           options.hpn_buffer_size, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
  832.     c->force_drain = 1;
  833.     return c;
  834.  }
  835. @@ -1879,6 +1885,14 @@ client_request_tun_fwd(int tun_mode, int
  836.  
  837.     c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
  838.         CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
  839. +   if(options.hpn_disabled)
  840. +   c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
  841. +               CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
  842. +               0, "tun", 1);
  843. +   else
  844. +   c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
  845. +               options.hpn_buffer_size, CHAN_TCP_PACKET_DEFAULT,
  846. +               0, "tun", 1);
  847.     c->datagram = 1;
  848.  
  849.  #if defined(SSH_TUN_FILTER)
  850. diff -NupwB canonical/compat.c kitchen/compat.c
  851. --- canonical/compat.c  2011-10-02 03:59:03.000000000 -0400
  852. +++ kitchen/compat.c    2012-11-07 15:28:16.000000000 -0500
  853. @@ -171,6 +171,15 @@ compat_datafellows(const char *version)
  854.             strlen(check[i].pat), 0) == 1) {
  855.             debug("match: %s pat %s", version, check[i].pat);
  856.             datafellows = check[i].bugs;
  857. +           /* Check to see if the remote side is OpenSSH and not HPN */
  858. +           if(strstr(version,"OpenSSH") != NULL)
  859. +           {
  860. +               if (strstr(version,"hpn") == NULL)
  861. +               {
  862. +                   datafellows |= SSH_BUG_LARGEWINDOW;
  863. +                   debug("Remote is NON-HPN aware");
  864. +               }
  865. +           }
  866.             return;
  867.         }
  868.     }
  869. diff -NupwB canonical/compat.h kitchen/compat.h
  870. --- canonical/compat.h  2011-10-02 03:59:03.000000000 -0400
  871. +++ kitchen/compat.h    2012-11-07 15:29:51.000000000 -0500
  872. @@ -59,6 +59,7 @@
  873.  #define SSH_BUG_RFWD_ADDR  0x02000000
  874.  #define SSH_NEW_OPENSSH        0x04000000
  875.  #define SSH_BUG_DYNAMIC_RPORT  0x08000000
  876. +#define SSH_BUG_LARGEWINDOW     0x10000000
  877.  
  878.  void     enable_compat13(void);
  879.  void     enable_compat20(void);
  880. Common subdirectories: canonical/contrib and kitchen/contrib
  881. diff -NupwB canonical/kex.c kitchen/kex.c
  882. --- canonical/kex.c 2010-09-24 08:11:14.000000000 -0400
  883. +++ kitchen/kex.c   2012-11-07 15:28:16.000000000 -0500
  884. @@ -49,6 +49,7 @@
  885.  #include "dispatch.h"
  886.  #include "monitor.h"
  887.  #include "roaming.h"
  888. +#include "canohost.h"
  889.  
  890.  #if OPENSSL_VERSION_NUMBER >= 0x00907000L
  891.  # if defined(HAVE_EVP_SHA256)
  892. @@ -91,7 +92,8 @@ kex_names_valid(const char *names)
  893.  }
  894.  
  895.  /* put algorithm proposal into buffer */
  896. -static void
  897. +/* used in sshconnect.c as well as kex.c */
  898. +void
  899.  kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
  900.  {
  901.     u_int i;
  902. @@ -408,6 +410,14 @@ kex_choose_conf(Kex *kex)
  903.     u_int mode, ctos, need;
  904.     int first_kex_follows, type;
  905.  
  906. +   int log_flag = 0;
  907. +
  908. +   int auth_flag;
  909. +
  910. +   auth_flag = packet_authentication_state();
  911. +
  912. +   debug ("AUTH STATE IS %d", auth_flag);
  913. +
  914.     my   = kex_buf2prop(&kex->my, NULL);
  915.     peer = kex_buf2prop(&kex->peer, &first_kex_follows);
  916.  
  917. @@ -441,11 +451,34 @@ kex_choose_conf(Kex *kex)
  918.         choose_enc (&newkeys->enc,  cprop[nenc],  sprop[nenc]);
  919.         choose_mac (&newkeys->mac,  cprop[nmac],  sprop[nmac]);
  920.         choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
  921. +       debug("REQUESTED ENC.NAME is '%s'", newkeys->enc.name);
  922. +       if (strcmp(newkeys->enc.name, "none") == 0) {
  923. +               debug("Requesting NONE. Authflag is %d", auth_flag);           
  924. +           if (auth_flag == 1) {
  925. +               debug("None requested post authentication.");
  926. +           } else {
  927. +               fatal("Pre-authentication none cipher requests are not allowed.");
  928. +           }
  929. +       }
  930.         debug("kex: %s %s %s %s",
  931.             ctos ? "client->server" : "server->client",
  932.             newkeys->enc.name,
  933.             newkeys->mac.name,
  934.             newkeys->comp.name);
  935. +       /* client starts withctos = 0 && log flag = 0 and no log*/
  936. +       /* 2nd client pass ctos=1 and flag = 1 so no log*/
  937. +       /* server starts with ctos =1 && log_flag = 0 so log */
  938. +       /* 2nd sever pass ctos = 1 && log flag = 1 so no log*/
  939. +       /* -cjr*/
  940. +       if (ctos && !log_flag) {
  941. +           logit("SSH: Server;Ltype: Kex;Remote: %s-%d;Enc: %s;MAC: %s;Comp: %s",
  942. +                 get_remote_ipaddr(),
  943. +                 get_remote_port(),
  944. +                 newkeys->enc.name,
  945. +                 newkeys->mac.name,
  946. +                 newkeys->comp.name);
  947. +       }
  948. +       log_flag = 1;
  949.     }
  950.     choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
  951.     choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
  952. diff -NupwB canonical/kex.h kitchen/kex.h
  953. --- canonical/kex.h 2010-09-24 08:11:14.000000000 -0400
  954. +++ kitchen/kex.h   2012-11-07 15:28:16.000000000 -0500
  955. @@ -138,6 +138,8 @@ struct Kex {
  956.     void    (*kex[KEX_MAX])(Kex *);
  957.  };
  958.  
  959. +void kex_prop2buf(Buffer *, char *proposal[PROPOSAL_MAX]);
  960. +
  961.  int     kex_names_valid(const char *);
  962.  
  963.  Kex    *kex_setup(char *[PROPOSAL_MAX]);
  964. diff -NupwB canonical/Makefile.in kitchen/Makefile.in
  965. --- canonical/Makefile.in   2012-04-03 21:27:57.000000000 -0400
  966. +++ kitchen/Makefile.in 2012-11-07 15:28:16.000000000 -0500
  967. @@ -43,7 +43,7 @@ CC=@CC@
  968.  LD=@LD@
  969.  CFLAGS=@CFLAGS@
  970.  CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
  971. -LIBS=@LIBS@
  972. +LIBS=@LIBS@ -lpthread
  973.  SSHLIBS=@SSHLIBS@
  974.  SSHDLIBS=@SSHDLIBS@
  975.  LIBEDIT=@LIBEDIT@
  976. @@ -63,7 +63,7 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-a
  977.  
  978.  LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
  979.     canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
  980. -   cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
  981. +   cipher-bf1.o cipher-ctr.o cipher-ctr-mt.o cipher-3des1.o cleanup.o \
  982.     compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
  983.     log.o match.o md-sha256.o moduli.o nchan.o packet.o \
  984.     readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
  985. diff -NupwB canonical/myproposal.h kitchen/myproposal.h
  986. --- canonical/myproposal.h  2011-08-16 20:29:03.000000000 -0400
  987. +++ kitchen/myproposal.h    2012-11-07 15:28:16.000000000 -0500
  988. @@ -75,6 +75,8 @@
  989.     "arcfour256,arcfour128," \
  990.     "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \
  991.     "aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se"
  992. +#define KEX_ENCRYPT_INCLUDE_NONE KEX_DEFAULT_ENCRYPT \
  993. +   ",none"
  994.  #ifdef HAVE_EVP_SHA256
  995.  #define    SHA2_HMAC_MODES \
  996.     "hmac-sha2-256," \
  997. Common subdirectories: canonical/openbsd-compat and kitchen/openbsd-compat
  998. diff -NupwB canonical/packet.c kitchen/packet.c
  999. --- canonical/packet.c  2012-03-08 18:28:07.000000000 -0500
  1000. +++ kitchen/packet.c    2012-11-07 15:28:16.000000000 -0500
  1001. @@ -838,7 +838,7 @@ packet_enable_delayed_compress(void)
  1002.  /*
  1003.   * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
  1004.   */
  1005. -static void
  1006. +static int
  1007.  packet_send2_wrapped(void)
  1008.  {
  1009.     u_char type, *cp, *macbuf = NULL;
  1010. @@ -957,11 +957,13 @@ packet_send2_wrapped(void)
  1011.         set_newkeys(MODE_OUT);
  1012.     else if (type == SSH2_MSG_USERAUTH_SUCCESS && active_state->server_side)
  1013.         packet_enable_delayed_compress();
  1014. +   return(packet_length);
  1015.  }
  1016.  
  1017. -static void
  1018. +static int
  1019.  packet_send2(void)
  1020.  {
  1021. +   static int packet_length = 0;
  1022.     struct packet *p;
  1023.     u_char type, *cp;
  1024.  
  1025. @@ -981,7 +983,7 @@ packet_send2(void)
  1026.                 sizeof(Buffer));
  1027.             buffer_init(&active_state->outgoing_packet);
  1028.             TAILQ_INSERT_TAIL(&active_state->outgoing, p, next);
  1029. -           return;
  1030. +           return(sizeof(Buffer));
  1031.         }
  1032.     }
  1033.  
  1034. @@ -1002,19 +1004,22 @@ packet_send2(void)
  1035.                 sizeof(Buffer));
  1036.             TAILQ_REMOVE(&active_state->outgoing, p, next);
  1037.             xfree(p);
  1038. -           packet_send2_wrapped();
  1039. +           packet_length += packet_send2_wrapped();
  1040.         }
  1041.     }
  1042. +   return(packet_length);
  1043.  }
  1044.  
  1045. -void
  1046. +int
  1047.  packet_send(void)
  1048.  {
  1049. + int packet_len = 0;
  1050.     if (compat20)
  1051. -       packet_send2();
  1052. +       packet_len = packet_send2();
  1053.     else
  1054.         packet_send1();
  1055.     DBG(debug("packet_send done"));
  1056. +   return(packet_len);
  1057.  }
  1058.  
  1059.  /*
  1060. @@ -1647,12 +1652,14 @@ packet_disconnect(const char *fmt,...)
  1061.  
  1062.  /* Checks if there is any buffered output, and tries to write some of the output. */
  1063.  
  1064. -void
  1065. +int
  1066.  packet_write_poll(void)
  1067.  {
  1068. -   int len = buffer_len(&active_state->output);
  1069. +   int len = 0;
  1070.     int cont;
  1071.  
  1072. +   len = buffer_len(&active_state->output);
  1073. +
  1074.     if (len > 0) {
  1075.         cont = 0;
  1076.         len = roaming_write(active_state->connection_out,
  1077. @@ -1660,13 +1667,14 @@ packet_write_poll(void)
  1078.         if (len == -1) {
  1079.             if (errno == EINTR || errno == EAGAIN ||
  1080.                 errno == EWOULDBLOCK)
  1081. -               return;
  1082. +               return (0);
  1083.             fatal("Write failed: %.100s", strerror(errno));
  1084.         }
  1085.         if (len == 0 && !cont)
  1086.             fatal("Write connection closed");
  1087.         buffer_consume(&active_state->output, len);
  1088.     }
  1089. +   return(len);
  1090.  }
  1091.  
  1092.  /*
  1093. @@ -1867,12 +1875,24 @@ packet_send_ignore(int nbytes)
  1094.     }
  1095.  }
  1096.  
  1097. +int rekey_requested = 0;
  1098. +void
  1099. +packet_request_rekeying(void)
  1100. +{
  1101. +   rekey_requested = 1;
  1102. +}
  1103. +
  1104.  #define MAX_PACKETS    (1U<<31)
  1105.  int
  1106.  packet_need_rekeying(void)
  1107.  {
  1108.     if (datafellows & SSH_BUG_NOREKEY)
  1109.         return 0;
  1110. +   if (rekey_requested == 1)
  1111. +   {
  1112. +       rekey_requested = 0;
  1113. +       return 1;
  1114. +   }
  1115.     return
  1116.         (active_state->p_send.packets > MAX_PACKETS) ||
  1117.         (active_state->p_read.packets > MAX_PACKETS) ||
  1118. @@ -1964,3 +1984,8 @@ packet_restore_state(void)
  1119.         add_recv_bytes(len);
  1120.     }
  1121.  }
  1122. +int
  1123. +packet_authentication_state(void)
  1124. +{
  1125. +   return(active_state->after_authentication);
  1126. +}
  1127. diff -NupwB canonical/packet.h kitchen/packet.h
  1128. --- canonical/packet.h  2012-02-10 16:19:21.000000000 -0500
  1129. +++ kitchen/packet.h    2012-11-07 15:28:16.000000000 -0500
  1130. @@ -19,6 +19,8 @@
  1131.  #include <termios.h>
  1132.  
  1133.  #include <openssl/bn.h>
  1134. +void
  1135. +packet_request_rekeying(void);
  1136.  #ifdef OPENSSL_HAS_ECC
  1137.  #include <openssl/ec.h>
  1138.  #endif
  1139. @@ -38,6 +40,7 @@ void     packet_set_interactive(int, int
  1140.  int      packet_is_interactive(void);
  1141.  void     packet_set_server(void);
  1142.  void     packet_set_authenticated(void);
  1143. +int     packet_authentication_state(void);
  1144.  
  1145.  void     packet_start(u_char);
  1146.  void     packet_put_char(int ch);
  1147. @@ -51,7 +54,7 @@ void     packet_put_ecpoint(const EC_GRO
  1148.  void     packet_put_string(const void *buf, u_int len);
  1149.  void     packet_put_cstring(const char *str);
  1150.  void     packet_put_raw(const void *buf, u_int len);
  1151. -void     packet_send(void);
  1152. +int     packet_send(void);
  1153.  
  1154.  int      packet_read(void);
  1155.  void     packet_read_expect(int type);
  1156. @@ -85,7 +88,7 @@ int    packet_get_ssh1_cipher(void);
  1157.  void    packet_set_iv(int, u_char *);
  1158.  void   *packet_get_newkeys(int);
  1159.  
  1160. -void     packet_write_poll(void);
  1161. +int     packet_write_poll(void);
  1162.  void     packet_write_wait(void);
  1163.  int      packet_have_data_to_write(void);
  1164.  int      packet_not_very_much_data_to_write(void);
  1165. diff -NupwB canonical/progressmeter.c kitchen/progressmeter.c
  1166. --- canonical/progressmeter.c   2006-08-04 22:39:40.000000000 -0400
  1167. +++ kitchen/progressmeter.c 2012-11-07 15:28:16.000000000 -0500
  1168. @@ -68,6 +68,8 @@ static time_t last_update;    /* last progr
  1169.  static char *file;     /* name of the file being transferred */
  1170.  static off_t end_pos;      /* ending position of transfer */
  1171.  static off_t cur_pos;      /* transfer position as of last refresh */
  1172. +static off_t last_pos;
  1173. +static off_t max_delta_pos = 0;
  1174.  static volatile off_t *counter;    /* progress counter */
  1175.  static long stalled;       /* how long we have been stalled */
  1176.  static int bytes_per_second;   /* current speed in bytes per second */
  1177. @@ -128,12 +130,17 @@ refresh_progress_meter(void)
  1178.     int hours, minutes, seconds;
  1179.     int i, len;
  1180.     int file_len;
  1181. +   off_t delta_pos;
  1182.  
  1183.     transferred = *counter - cur_pos;
  1184.     cur_pos = *counter;
  1185.     now = time(NULL);
  1186.     bytes_left = end_pos - cur_pos;
  1187.  
  1188. +   delta_pos = cur_pos - last_pos;
  1189. +   if (delta_pos > max_delta_pos)
  1190. +       max_delta_pos = delta_pos;
  1191. +
  1192.     if (bytes_left > 0)
  1193.         elapsed = now - last_update;
  1194.     else {
  1195. @@ -158,7 +165,7 @@ refresh_progress_meter(void)
  1196.  
  1197.     /* filename */
  1198.     buf[0] = '\0';
  1199. -   file_len = win_size - 35;
  1200. +   file_len = win_size - 45;
  1201.     if (file_len > 0) {
  1202.         len = snprintf(buf, file_len + 1, "\r%s", file);
  1203.         if (len < 0)
  1204. @@ -175,7 +182,7 @@ refresh_progress_meter(void)
  1205.         percent = ((float)cur_pos / end_pos) * 100;
  1206.     else
  1207.         percent = 100;
  1208. -   snprintf(buf + strlen(buf), win_size - strlen(buf),
  1209. +   snprintf(buf + strlen(buf), win_size - strlen(buf-8),
  1210.         " %3d%% ", percent);
  1211.  
  1212.     /* amount transferred */
  1213. @@ -183,6 +190,15 @@ refresh_progress_meter(void)
  1214.         cur_pos);
  1215.     strlcat(buf, " ", win_size);
  1216.  
  1217. +   /* instantaneous rate */
  1218. +   if (bytes_left > 0)
  1219. +       format_rate(buf + strlen(buf), win_size - strlen(buf),
  1220. +               delta_pos);
  1221. +   else
  1222. +       format_rate(buf + strlen(buf), win_size - strlen(buf),
  1223. +               max_delta_pos);
  1224. +   strlcat(buf, "/s ", win_size);
  1225. +
  1226.     /* bandwidth usage */
  1227.     format_rate(buf + strlen(buf), win_size - strlen(buf),
  1228.         (off_t)bytes_per_second);
  1229. @@ -224,6 +240,7 @@ refresh_progress_meter(void)
  1230.  
  1231.     atomicio(vwrite, STDOUT_FILENO, buf, win_size - 1);
  1232.     last_update = now;
  1233. +   last_pos = cur_pos;
  1234.  }
  1235.  
  1236.  /*ARGSUSED*/
  1237. diff -NupwB canonical/readconf.c kitchen/readconf.c
  1238. --- canonical/readconf.c    2011-10-02 03:59:03.000000000 -0400
  1239. +++ kitchen/readconf.c  2012-11-07 15:28:16.000000000 -0500
  1240. @@ -140,6 +140,8 @@ typedef enum {
  1241.     oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
  1242.     oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,
  1243.     oKexAlgorithms, oIPQoS, oRequestTTY,
  1244. +   oNoneEnabled, oTcpRcvBufPoll, oTcpRcvBuf, oNoneSwitch, oHPNDisabled,
  1245. +   oHPNBufferSize,
  1246.     oProtocolKeepAlives, oSetupTimeOut,
  1247.     oDeprecated, oUnsupported
  1248.  } OpCodes;
  1249. @@ -247,6 +249,13 @@ static struct {
  1250.     { "ipqos", oIPQoS },
  1251.     { "requesttty", oRequestTTY },
  1252.  
  1253. +   { "noneenabled", oNoneEnabled },
  1254. +   { "tcprcvbufpoll", oTcpRcvBufPoll },
  1255. +   { "tcprcvbuf", oTcpRcvBuf },
  1256. +   { "noneswitch", oNoneSwitch },
  1257. +   { "hpndisabled", oHPNDisabled },
  1258. +   { "hpnbuffersize", oHPNBufferSize },
  1259. +
  1260.     { NULL, oBadOption }
  1261.  };
  1262.  
  1263. @@ -495,6 +504,36 @@ parse_flag:
  1264.         intptr = &options->check_host_ip;
  1265.         goto parse_flag;
  1266.  
  1267. +   case oNoneEnabled:
  1268. +       intptr = &options->none_enabled;
  1269. +       goto parse_flag;
  1270. +
  1271. +   /* we check to see if the command comes from the */
  1272. +   /* command line or not. If it does then enable it */
  1273. +   /* otherwise fail. NONE should never be a default configuration */
  1274. +   case oNoneSwitch:
  1275. +       if(strcmp(filename,"command-line") == 0) {
  1276. +           intptr = &options->none_switch;
  1277. +           goto parse_flag;
  1278. +       } else {
  1279. +           error("NoneSwitch is found in %.200s.\nYou may only use this configuration option from the command line", filename);
  1280. +           error("Continuing...");
  1281. +           debug("NoneSwitch directive found in %.200s.", filename);
  1282. +           return 0;
  1283. +       }
  1284. +
  1285. +   case oHPNDisabled:
  1286. +       intptr = &options->hpn_disabled;
  1287. +       goto parse_flag;
  1288. +
  1289. +   case oHPNBufferSize:
  1290. +       intptr = &options->hpn_buffer_size;
  1291. +       goto parse_int;
  1292. +
  1293. +   case oTcpRcvBufPoll:
  1294. +       intptr = &options->tcp_rcv_buf_poll;
  1295. +       goto parse_flag;
  1296. +
  1297.     case oVerifyHostKeyDNS:
  1298.         intptr = &options->verify_host_key_dns;
  1299.         goto parse_yesnoask;
  1300. @@ -680,6 +719,10 @@ parse_int:
  1301.         intptr = &options->connection_attempts;
  1302.         goto parse_int;
  1303.  
  1304. +   case oTcpRcvBuf:
  1305. +       intptr = &options->tcp_rcv_buf;
  1306. +       goto parse_int;
  1307. +
  1308.     case oCipher:
  1309.         intptr = &options->cipher;
  1310.         arg = strdelim(&s);
  1311. @@ -1203,6 +1246,13 @@ initialize_options(Options * options)
  1312.     options->ip_qos_interactive = -1;
  1313.     options->ip_qos_bulk = -1;
  1314.     options->request_tty = -1;
  1315. +
  1316. +   options->none_switch = -1;
  1317. +   options->none_enabled = -1;
  1318. +   options->hpn_disabled = -1;
  1319. +   options->hpn_buffer_size = -1;
  1320. +   options->tcp_rcv_buf_poll = -1;
  1321. +   options->tcp_rcv_buf = -1;
  1322.  }
  1323.  
  1324.  /*
  1325. @@ -1339,6 +1389,30 @@ fill_default_options(Options * options)
  1326.         options->server_alive_interval = 0;
  1327.     if (options->server_alive_count_max == -1)
  1328.         options->server_alive_count_max = 3;
  1329. +   if (options->none_switch == -1)
  1330. +           options->none_switch = 0;
  1331. +   if (options->hpn_disabled == -1)
  1332. +           options->hpn_disabled = 0;
  1333. +   if (options->hpn_buffer_size > -1)
  1334. +   {
  1335. +     /* if a user tries to set the size to 0 set it to 1KB */
  1336. +       if (options->hpn_buffer_size == 0)
  1337. +       options->hpn_buffer_size = 1;
  1338. +       /*limit the buffer to 64MB*/
  1339. +       if (options->hpn_buffer_size > 64*1024)
  1340. +       {
  1341. +           options->hpn_buffer_size = 64*1024*1024;
  1342. +           debug("User requested buffer larger than 64MB. Request reverted to 64MB");
  1343. +       }
  1344. +       else options->hpn_buffer_size *= 1024;
  1345. +       debug("hpn_buffer_size set to %d", options->hpn_buffer_size);
  1346. +   }
  1347. +   if (options->tcp_rcv_buf == 0)
  1348. +       options->tcp_rcv_buf = 1;
  1349. +   if (options->tcp_rcv_buf > -1)
  1350. +       options->tcp_rcv_buf *=1024;
  1351. +   if (options->tcp_rcv_buf_poll == -1)
  1352. +       options->tcp_rcv_buf_poll = 1;
  1353.     if (options->control_master == -1)
  1354.         options->control_master = 0;
  1355.     if (options->control_persist == -1) {
  1356. diff -NupwB canonical/readconf.h kitchen/readconf.h
  1357. --- canonical/readconf.h    2011-10-02 03:59:03.000000000 -0400
  1358. +++ kitchen/readconf.h  2012-11-07 15:28:16.000000000 -0500
  1359. @@ -61,6 +61,11 @@ typedef struct {
  1360.     int     compression_level;  /* Compression level 1 (fast) to 9
  1361.                      * (best). */
  1362.     int     tcp_keep_alive; /* Set SO_KEEPALIVE. */
  1363. +        int     tcp_rcv_buf; /* user switch to set tcp recv buffer */
  1364. +   int tcp_rcv_buf_poll; /* Option to poll recv buf every window transfer */
  1365. +   int     hpn_disabled;    /* Switch to disable HPN buffer management */
  1366. +   int hpn_buffer_size; /* User definable size for HPN buffer window */
  1367. +
  1368.     int ip_qos_interactive; /* IP ToS/DSCP/class for interactive */
  1369.     int ip_qos_bulk;        /* IP ToS/DSCP/class for bulk traffic */
  1370.     LogLevel log_level; /* Level for logging. */
  1371. @@ -109,6 +114,8 @@ typedef struct {
  1372.  
  1373.     int enable_ssh_keysign;
  1374.     int64_t rekey_limit;
  1375. +   int     none_switch;    /* Use none cipher */
  1376. +   int     none_enabled;   /* Allow none to be used */
  1377.     int no_host_authentication_for_localhost;
  1378.     int identities_only;
  1379.     int server_alive_interval;
  1380. Common subdirectories: canonical/regress and kitchen/regress
  1381. Common subdirectories: canonical/scard and kitchen/scard
  1382. diff -NupwB canonical/scp.c kitchen/scp.c
  1383. --- canonical/scp.c 2011-09-22 07:38:01.000000000 -0400
  1384. +++ kitchen/scp.c   2012-11-07 15:28:16.000000000 -0500
  1385. @@ -731,7 +731,7 @@ source(int argc, char **argv)
  1386.     off_t i, statbytes;
  1387.     size_t amt;
  1388.     int fd = -1, haderr, indx;
  1389. -   char *last, *name, buf[2048], encname[MAXPATHLEN];
  1390. +   char *last, *name, buf[16384], encname[MAXPATHLEN];
  1391.     int len;
  1392.  
  1393.     for (indx = 0; indx < argc; ++indx) {
  1394. @@ -913,7 +913,7 @@ sink(int argc, char **argv)
  1395.     mode_t mode, omode, mask;
  1396.     off_t size, statbytes;
  1397.     int setimes, targisdir, wrerrno = 0;
  1398. -   char ch, *cp, *np, *targ, *why, *vect[1], buf[2048];
  1399. +   char ch, *cp, *np, *targ, *why, *vect[1], buf[16384];
  1400.     struct timeval tv[2];
  1401.  
  1402.  #define    atime   tv[0]
  1403. diff -NupwB canonical/servconf.c kitchen/servconf.c
  1404. --- canonical/servconf.c    2011-10-02 03:57:38.000000000 -0400
  1405. +++ kitchen/servconf.c  2012-11-07 15:28:16.000000000 -0500
  1406. @@ -136,6 +136,10 @@ initialize_server_options(ServerOptions
  1407.     options->revoked_keys_file = NULL;
  1408.     options->trusted_user_ca_keys = NULL;
  1409.     options->authorized_principals_file = NULL;
  1410. +   options->none_enabled = -1;
  1411. +   options->tcp_rcv_buf_poll = -1;
  1412. +   options->hpn_disabled = -1;
  1413. +   options->hpn_buffer_size = -1;
  1414.     options->ip_qos_interactive = -1;
  1415.     options->ip_qos_bulk = -1;
  1416.  }
  1417. @@ -143,6 +147,11 @@ initialize_server_options(ServerOptions
  1418.  void
  1419.  fill_default_server_options(ServerOptions *options)
  1420.  {
  1421. +   /* needed for hpn socket tests */
  1422. +   int sock;
  1423. +   int socksize;
  1424. +   int socksizelen = sizeof(int);
  1425. +
  1426.     /* Portable-specific options */
  1427.     if (options->use_pam == -1)
  1428.         options->use_pam = 0;
  1429. @@ -273,6 +282,43 @@ fill_default_server_options(ServerOption
  1430.         options->permit_tun = SSH_TUNMODE_NO;
  1431.     if (options->zero_knowledge_password_authentication == -1)
  1432.         options->zero_knowledge_password_authentication = 0;
  1433. +   if (options->hpn_disabled == -1)
  1434. +       options->hpn_disabled = 0;
  1435. +
  1436. +   if (options->hpn_buffer_size == -1) {
  1437. +       /* option not explicitly set. Now we have to figure out */
  1438. +       /* what value to use */
  1439. +       if (options->hpn_disabled == 1) {
  1440. +           options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
  1441. +       } else {
  1442. +           /* get the current RCV size and set it to that */
  1443. +           /*create a socket but don't connect it */
  1444. +           /* we use that the get the rcv socket size */
  1445. +           sock = socket(AF_INET, SOCK_STREAM, 0);
  1446. +           getsockopt(sock, SOL_SOCKET, SO_RCVBUF,
  1447. +                  &socksize, &socksizelen);
  1448. +           close(sock);
  1449. +           options->hpn_buffer_size = socksize;
  1450. +           debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
  1451. +          
  1452. +       }
  1453. +   } else {
  1454. +       /* we have to do this incase the user sets both values in a contradictory */
  1455. +       /* manner. hpn_disabled overrrides hpn_buffer_size*/
  1456. +       if (options->hpn_disabled <= 0) {
  1457. +           if (options->hpn_buffer_size == 0)
  1458. +               options->hpn_buffer_size = 1;
  1459. +           /* limit the maximum buffer to 64MB */
  1460. +           if (options->hpn_buffer_size > 64*1024) {
  1461. +               options->hpn_buffer_size = 64*1024*1024;
  1462. +           } else {
  1463. +               options->hpn_buffer_size *= 1024;
  1464. +           }
  1465. +       } else
  1466. +           options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
  1467. +   }
  1468. +
  1469. +
  1470.     if (options->ip_qos_interactive == -1)
  1471.         options->ip_qos_interactive = IPTOS_LOWDELAY;
  1472.     if (options->ip_qos_bulk == -1)
  1473. @@ -323,6 +369,7 @@ typedef enum {
  1474.     sUsePrivilegeSeparation, sAllowAgentForwarding,
  1475.     sZeroKnowledgePasswordAuthentication, sHostCertificate,
  1476.     sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
  1477. +   sNoneEnabled, sTcpRcvBufPoll, sHPNDisabled, sHPNBufferSize,
  1478.     sKexAlgorithms, sIPQoS,
  1479.     sDeprecated, sUnsupported
  1480.  } ServerOpCodes;
  1481. @@ -446,6 +493,10 @@ static struct {
  1482.     { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
  1483.     { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
  1484.     { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
  1485. +   { "noneenabled", sNoneEnabled, SSHCFG_ALL },
  1486. +   { "hpndisabled", sHPNDisabled, SSHCFG_ALL },
  1487. +   { "hpnbuffersize", sHPNBufferSize, SSHCFG_ALL },
  1488. +   { "tcprcvbufpoll", sTcpRcvBufPoll, SSHCFG_ALL },
  1489.     { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
  1490.     { "ipqos", sIPQoS, SSHCFG_ALL },
  1491.     { NULL, sBadOption, 0 }
  1492. @@ -474,6 +525,7 @@ parse_token(const char *cp, const char *
  1493.  
  1494.     for (i = 0; keywords[i].name; i++)
  1495.         if (strcasecmp(cp, keywords[i].name) == 0) {
  1496. +           debug ("Config token is %s", keywords[i].name);
  1497.             *flags = keywords[i].flags;
  1498.             return keywords[i].opcode;
  1499.         }
  1500. @@ -918,6 +970,23 @@ process_server_config_line(ServerOptions
  1501.             *intptr = value;
  1502.         break;
  1503.  
  1504. +
  1505. +   case sNoneEnabled:
  1506. +       intptr = &options->none_enabled;
  1507. +       goto parse_flag;
  1508. +
  1509. +   case sTcpRcvBufPoll:
  1510. +       intptr = &options->tcp_rcv_buf_poll;
  1511. +       goto parse_flag;
  1512. +
  1513. +   case sHPNDisabled:
  1514. +       intptr = &options->hpn_disabled;
  1515. +       goto parse_flag;
  1516. +
  1517. +   case sHPNBufferSize:
  1518. +       intptr = &options->hpn_buffer_size;
  1519. +       goto parse_int;
  1520. +
  1521.     case sIgnoreUserKnownHosts:
  1522.         intptr = &options->ignore_user_known_hosts;
  1523.         goto parse_flag;
  1524. diff -NupwB canonical/servconf.h kitchen/servconf.h
  1525. --- canonical/servconf.h    2011-06-22 18:30:03.000000000 -0400
  1526. +++ kitchen/servconf.h  2012-11-07 15:28:16.000000000 -0500
  1527. @@ -158,6 +158,11 @@ typedef struct {
  1528.  
  1529.     int use_pam;        /* Enable auth via PAM */
  1530.  
  1531. +        int     none_enabled;           /* enable NONE cipher switch */
  1532. +        int     tcp_rcv_buf_poll;       /* poll tcp rcv window in autotuning kernels*/
  1533. +   int hpn_disabled;       /* disable hpn functionality. false by default */
  1534. +   int hpn_buffer_size;    /* set the hpn buffer size - default 3MB */
  1535. +
  1536.     int permit_tun;
  1537.  
  1538.     int num_permitted_opens;
  1539. diff -NupwB canonical/serverloop.c kitchen/serverloop.c
  1540. --- canonical/serverloop.c  2011-05-20 05:02:50.000000000 -0400
  1541. +++ kitchen/serverloop.c    2012-11-07 15:28:16.000000000 -0500
  1542. @@ -94,10 +94,10 @@ static int fdin;        /* Descriptor for stdi
  1543.  static int fdout;      /* Descriptor for stdout (for reading);
  1544.                    May be same number as fdin. */
  1545.  static int fderr;      /* Descriptor for stderr.  May be -1. */
  1546. -static long stdin_bytes = 0;   /* Number of bytes written to stdin. */
  1547. -static long stdout_bytes = 0;  /* Number of stdout bytes sent to client. */
  1548. -static long stderr_bytes = 0;  /* Number of stderr bytes sent to client. */
  1549. -static long fdout_bytes = 0;   /* Number of stdout bytes read from program. */
  1550. +static u_long stdin_bytes = 0; /* Number of bytes written to stdin. */
  1551. +static u_long stdout_bytes = 0;    /* Number of stdout bytes sent to client. */
  1552. +static u_long stderr_bytes = 0;    /* Number of stderr bytes sent to client. */
  1553. +static u_long fdout_bytes = 0; /* Number of stdout bytes read from program. */
  1554.  static int stdin_eof = 0;  /* EOF message received from client. */
  1555.  static int fdout_eof = 0;  /* EOF encountered reading from fdout. */
  1556.  static int fderr_eof = 0;  /* EOF encountered readung from fderr. */
  1557. @@ -122,6 +122,20 @@ static volatile sig_atomic_t received_si
  1558.  static void server_init_dispatch(void);
  1559.  
  1560.  /*
  1561. + * Returns current time in seconds from Jan 1, 1970 with the maximum
  1562. + * available resolution.
  1563. + */
  1564. +
  1565. +static double
  1566. +get_current_time(void)
  1567. +{
  1568. +   struct timeval tv;
  1569. +   gettimeofday(&tv, NULL);
  1570. +   return (double) tv.tv_sec + (double) tv.tv_usec / 1000000.0;
  1571. +}
  1572. +
  1573. +
  1574. +/*
  1575.   * we write to this pipe if a SIGCHLD is caught in order to avoid
  1576.   * the race between select() and child_terminated
  1577.   */
  1578. @@ -436,6 +450,7 @@ process_input(fd_set *readset)
  1579.         } else {
  1580.             buffer_append(&stdout_buffer, buf, len);
  1581.             fdout_bytes += len;
  1582. +           debug ("FD out now: %ld", fdout_bytes);
  1583.         }
  1584.     }
  1585.     /* Read and buffer any available stderr data from the program. */
  1586. @@ -503,7 +518,7 @@ process_output(fd_set *writeset)
  1587.     }
  1588.     /* Send any buffered packet data to the client. */
  1589.     if (FD_ISSET(connection_out, writeset))
  1590. -       packet_write_poll();
  1591. +       stdin_bytes += packet_write_poll();
  1592.  }
  1593.  
  1594.  /*
  1595. @@ -820,8 +835,10 @@ server_loop2(Authctxt *authctxt)
  1596.  {
  1597.     fd_set *readset = NULL, *writeset = NULL;
  1598.     int rekeying = 0, max_fd, nalloc = 0;
  1599. +   double start_time, total_time;
  1600.  
  1601.     debug("Entering interactive session for SSH2.");
  1602. +   start_time = get_current_time();
  1603.  
  1604.     mysignal(SIGCHLD, sigchld_handler);
  1605.     child_terminated = 0;
  1606. @@ -883,6 +900,11 @@ server_loop2(Authctxt *authctxt)
  1607.  
  1608.     /* free remaining sessions, e.g. remove wtmp entries */
  1609.     session_destroy_all(NULL);
  1610. +   total_time = get_current_time() - start_time;
  1611. +   logit("SSH: Server;LType: Throughput;Remote: %s-%d;IN: %lu;OUT: %lu;Duration: %.1f;tPut_in: %.1f;tPut_out: %.1f",
  1612. +         get_remote_ipaddr(), get_remote_port(),
  1613. +         stdin_bytes, fdout_bytes, total_time, stdin_bytes / total_time,
  1614. +         fdout_bytes / total_time);
  1615.  }
  1616.  
  1617.  static void
  1618. @@ -998,8 +1020,12 @@ server_request_tun(void)
  1619.     sock = tun_open(tun, mode);
  1620.     if (sock < 0)
  1621.         goto done;
  1622. +   if (options.hpn_disabled)
  1623.     c = channel_new("tun", SSH_CHANNEL_OPEN, sock, sock, -1,
  1624.         CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
  1625. +   else
  1626. +       c = channel_new("tun", SSH_CHANNEL_OPEN, sock, sock, -1,
  1627. +           options.hpn_buffer_size, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
  1628.     c->datagram = 1;
  1629.  #if defined(SSH_TUN_FILTER)
  1630.     if (mode == SSH_TUNMODE_POINTOPOINT)
  1631. @@ -1035,6 +1061,8 @@ server_request_session(void)
  1632.     c = channel_new("session", SSH_CHANNEL_LARVAL,
  1633.         -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT,
  1634.         0, "server-session", 1);
  1635. +   if ((options.tcp_rcv_buf_poll) && (!options.hpn_disabled))
  1636. +       c->dynamic_window = 1;
  1637.     if (session_open(the_authctxt, c->self) != 1) {
  1638.         debug("session open failed, free channel %d", c->self);
  1639.         channel_free(c);
  1640. diff -NupwB canonical/session.c kitchen/session.c
  1641. --- canonical/session.c 2011-11-03 19:55:24.000000000 -0400
  1642. +++ kitchen/session.c   2012-11-07 15:28:16.000000000 -0500
  1643. @@ -236,6 +236,7 @@ auth_input_request_forwarding(struct pas
  1644.     }
  1645.  
  1646.     /* Allocate a channel for the authentication agent socket. */
  1647. +   /* this shouldn't matter if its hpn or not - cjr */
  1648.     nc = channel_new("auth socket",
  1649.         SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
  1650.         CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
  1651. @@ -2278,10 +2279,16 @@ session_set_fds(Session *s, int fdin, in
  1652.      */
  1653.     if (s->chanid == -1)
  1654.         fatal("no channel for session %d", s->self);
  1655. +   if (options.hpn_disabled)
  1656.     channel_set_fds(s->chanid,
  1657.         fdout, fdin, fderr,
  1658.         ignore_fderr ? CHAN_EXTENDED_IGNORE : CHAN_EXTENDED_READ,
  1659.         1, is_tty, CHAN_SES_WINDOW_DEFAULT);
  1660. +   else
  1661. +       channel_set_fds(s->chanid,
  1662. +           fdout, fdin, fderr,
  1663. +           ignore_fderr ? CHAN_EXTENDED_IGNORE : CHAN_EXTENDED_READ,
  1664. +           1, is_tty, options.hpn_buffer_size);
  1665.  }
  1666.  
  1667.  /*
  1668. diff -NupwB canonical/sftp.1 kitchen/sftp.1
  1669. --- canonical/sftp.1    2011-09-22 07:34:15.000000000 -0400
  1670. +++ kitchen/sftp.1  2012-11-07 15:28:16.000000000 -0500
  1671. @@ -247,7 +247,8 @@ diagnostic messages from
  1672.  Specify how many requests may be outstanding at any one time.
  1673.  Increasing this may slightly improve file transfer speed
  1674.  but will increase memory usage.
  1675. -The default is 64 outstanding requests.
  1676. +The default is 256 outstanding requests providing for 8MB
  1677. +of outstanding data with a 32KB buffer.
  1678.  .It Fl r
  1679.  Recursively copy entire directories when uploading and downloading.
  1680.  Note that
  1681. diff -NupwB canonical/sftp.c kitchen/sftp.c
  1682. --- canonical/sftp.c    2011-11-24 21:53:50.000000000 -0500
  1683. +++ kitchen/sftp.c  2012-11-07 15:28:16.000000000 -0500
  1684. @@ -69,7 +69,7 @@ typedef void EditLine;
  1685.  #include "sftp-client.h"
  1686.  
  1687.  #define DEFAULT_COPY_BUFLEN    32768   /* Size of buffer for up/download */
  1688. -#define DEFAULT_NUM_REQUESTS   64  /* # concurrent outstanding requests */
  1689. +#define DEFAULT_NUM_REQUESTS   256 /* # concurrent outstanding requests */
  1690.  
  1691.  /* File to read commands from */
  1692.  FILE* infile;
  1693. diff -NupwB canonical/ssh.c kitchen/ssh.c
  1694. --- canonical/ssh.c 2011-11-03 19:54:22.000000000 -0400
  1695. +++ kitchen/ssh.c   2012-11-07 15:28:16.000000000 -0500
  1696. @@ -577,9 +577,6 @@ main(int ac, char **av)
  1697.             no_shell_flag = 1;
  1698.             options.request_tty = REQUEST_TTY_NO;
  1699.             break;
  1700. -       case 'T':
  1701. -           options.request_tty = REQUEST_TTY_NO;
  1702. -           break;
  1703.         case 'o':
  1704.             dummy = 1;
  1705.             line = xstrdup(optarg);
  1706. @@ -588,6 +585,13 @@ main(int ac, char **av)
  1707.                 exit(255);
  1708.             xfree(line);
  1709.             break;
  1710. +       case 'T':
  1711. +           no_shell_flag = 1;
  1712. +           /* ensure that the user doesn't try to backdoor a */
  1713. +           /* null cipher switch on an interactive session */
  1714. +           /* so explicitly disable it no matter what */
  1715. +           options.none_switch=0;
  1716. +           break;
  1717.         case 's':
  1718.             subsystem_flag = 1;
  1719.             break;
  1720. @@ -1369,6 +1373,9 @@ ssh_session2_open(void)
  1721.  {
  1722.     Channel *c;
  1723.     int window, packetmax, in, out, err;
  1724. +   int sock;
  1725. +   int socksize;
  1726. +   int socksizelen = sizeof(int);
  1727.  
  1728.     if (stdin_null_flag) {
  1729.         in = open(_PATH_DEVNULL, O_RDONLY);
  1730. @@ -1389,9 +1396,71 @@ ssh_session2_open(void)
  1731.     if (!isatty(err))
  1732.         set_nonblock(err);
  1733.  
  1734. -   window = CHAN_SES_WINDOW_DEFAULT;
  1735. +   /* we need to check to see if what they want to do about buffer */
  1736. +   /* sizes here. In a hpn to nonhpn connection we want to limit */
  1737. +   /* the window size to something reasonable in case the far side */
  1738. +   /* has the large window bug. In hpn to hpn connection we want to */
  1739. +   /* use the max window size but allow the user to override it */
  1740. +   /* lastly if they disabled hpn then use the ssh std window size */
  1741. +
  1742. +   /* so why don't we just do a getsockopt() here and set the */
  1743. +   /* ssh window to that? In the case of a autotuning receive */
  1744. +   /* window the window would get stuck at the initial buffer */
  1745. +   /* size generally less than 96k. Therefore we need to set the */
  1746. +   /* maximum ssh window size to the maximum hpn buffer size */
  1747. +   /* unless the user has specifically set the tcprcvbufpoll */
  1748. +   /* to no. In which case we *can* just set the window to the */
  1749. +   /* minimum of the hpn buffer size and tcp receive buffer size */
  1750. +  
  1751. +   if (tty_flag)
  1752. +       options.hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
  1753. +   else
  1754. +       options.hpn_buffer_size = 2*1024*1024;
  1755. +
  1756. +   if (datafellows & SSH_BUG_LARGEWINDOW)
  1757. +   {
  1758. +       debug("HPN to Non-HPN Connection");
  1759. +   }
  1760. +   else
  1761. +   {
  1762. +       if (options.tcp_rcv_buf_poll <= 0)
  1763. +       {
  1764. +           sock = socket(AF_INET, SOCK_STREAM, 0);
  1765. +           getsockopt(sock, SOL_SOCKET, SO_RCVBUF,
  1766. +                  &socksize, &socksizelen);
  1767. +           close(sock);
  1768. +           debug("socksize %d", socksize);
  1769. +           options.hpn_buffer_size = socksize;
  1770. +           debug ("HPNBufferSize set to TCP RWIN: %d", options.hpn_buffer_size);
  1771. +       }
  1772. +       else
  1773. +       {
  1774. +           if (options.tcp_rcv_buf > 0)
  1775. +           {
  1776. +               /*create a socket but don't connect it */
  1777. +               /* we use that the get the rcv socket size */
  1778. +               sock = socket(AF_INET, SOCK_STREAM, 0);
  1779. +               /* if they are using the tcp_rcv_buf option */
  1780. +               /* attempt to set the buffer size to that */
  1781. +               if (options.tcp_rcv_buf)
  1782. +                   setsockopt(sock, SOL_SOCKET, SO_RCVBUF, (void *)&options.tcp_rcv_buf,
  1783. +                          sizeof(options.tcp_rcv_buf));
  1784. +               getsockopt(sock, SOL_SOCKET, SO_RCVBUF,
  1785. +                      &socksize, &socksizelen);
  1786. +               close(sock);
  1787. +               debug("socksize %d", socksize);
  1788. +               options.hpn_buffer_size = socksize;
  1789. +               debug ("HPNBufferSize set to user TCPRcvBuf: %d", options.hpn_buffer_size);
  1790. +           }
  1791. +       }
  1792. +
  1793. +   }
  1794. +   debug("Final hpn_buffer_size = %d", options.hpn_buffer_size);
  1795. +   window = options.hpn_buffer_size;
  1796. +   channel_set_hpn(options.hpn_disabled, options.hpn_buffer_size);
  1797.     packetmax = CHAN_SES_PACKET_DEFAULT;
  1798.     if (tty_flag) {
  1799. +       window = 4*CHAN_SES_PACKET_DEFAULT;
  1800.         window >>= 1;
  1801.         packetmax >>= 1;
  1802.     }
  1803. @@ -1400,6 +1469,11 @@ ssh_session2_open(void)
  1804.         window, packetmax, CHAN_EXTENDED_WRITE,
  1805.         "client-session", /*nonblock*/0);
  1806.  
  1807. +   if ((options.tcp_rcv_buf_poll > 0) && (!options.hpn_disabled)) {
  1808. +       c->dynamic_window = 1;
  1809. +       debug ("Enabled Dynamic Window Scaling\n");
  1810. +   }
  1811. +
  1812.     debug3("ssh_session2_open: channel_new: %d", c->self);
  1813.  
  1814.     channel_send_open(c->self);
  1815. diff -NupwB canonical/sshconnect2.c kitchen/sshconnect2.c
  1816. --- canonical/sshconnect2.c 2011-05-29 07:42:34.000000000 -0400
  1817. +++ kitchen/sshconnect2.c   2012-11-07 15:28:16.000000000 -0500
  1818. @@ -81,6 +81,11 @@
  1819.  extern char *client_version_string;
  1820.  extern char *server_version_string;
  1821.  extern Options options;
  1822. +extern Kex *xxx_kex;
  1823. +
  1824. +/* tty_flag is set in ssh.c. use this in ssh_userauth2 */
  1825. +/* if it is set then prevent the switch to the null cipher */
  1826. +extern int tty_flag;
  1827.  
  1828.  /*
  1829.   * SSH2 key exchange
  1830. @@ -420,6 +425,29 @@ ssh_userauth2(const char *local_user, co
  1831.     pubkey_cleanup(&authctxt);
  1832.     dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
  1833.  
  1834. +   /* if the user wants to use the none cipher do it */
  1835. +   /* post authentication and only if the right conditions are met */
  1836. +   /* both of the NONE commands must be true and there must be no */
  1837. +   /* tty allocated */
  1838. +   if ((options.none_switch == 1) && (options.none_enabled == 1))
  1839. +   {
  1840. +       if (!tty_flag) /* no null on tty sessions */
  1841. +       {
  1842. +           debug("Requesting none rekeying...");
  1843. +           myproposal[PROPOSAL_ENC_ALGS_STOC] = "none";
  1844. +           myproposal[PROPOSAL_ENC_ALGS_CTOS] = "none";
  1845. +           kex_prop2buf(&xxx_kex->my,myproposal);
  1846. +           packet_request_rekeying();
  1847. +           fprintf(stderr, "WARNING: ENABLED NONE CIPHER\n");
  1848. +       }
  1849. +       else
  1850. +       {
  1851. +           /* requested NONE cipher when in a tty */
  1852. +           debug("Cannot switch to NONE cipher with tty allocated");
  1853. +           fprintf(stderr, "NONE cipher switch disabled when a TTY is allocated\n");
  1854. +       }
  1855. +   }
  1856. +
  1857.     debug("Authentication succeeded (%s).", authctxt.method->name);
  1858.  }
  1859.  
  1860. diff -NupwB canonical/sshconnect.c kitchen/sshconnect.c
  1861. --- canonical/sshconnect.c  2011-05-29 07:42:34.000000000 -0400
  1862. +++ kitchen/sshconnect.c    2012-11-07 15:28:16.000000000 -0500
  1863. @@ -182,6 +182,33 @@ ssh_kill_proxy_command(void)
  1864.  }
  1865.  
  1866.  /*
  1867. +
  1868. + /*
  1869. + * Set TCP receive buffer if requested.
  1870. + * Note: tuning needs to happen after the socket is
  1871. + * created but before the connection happens
  1872. + * so winscale is negotiated properly -cjr
  1873. + */
  1874. +static void
  1875. +ssh_set_socket_recvbuf(int sock)
  1876. +{
  1877. +   void *buf = (void *)&options.tcp_rcv_buf;
  1878. +   int sz = sizeof(options.tcp_rcv_buf);
  1879. +   int socksize;
  1880. +   int socksizelen = sizeof(int);
  1881. +
  1882. +   debug("setsockopt Attempting to set SO_RCVBUF to %d", options.tcp_rcv_buf);
  1883. +   if (setsockopt(sock, SOL_SOCKET, SO_RCVBUF, buf, sz) >= 0) {
  1884. +     getsockopt(sock, SOL_SOCKET, SO_RCVBUF, &socksize, &socksizelen);
  1885. +     debug("setsockopt SO_RCVBUF: %.100s %d", strerror(errno), socksize);
  1886. +   }
  1887. +   else
  1888. +       error("Couldn't set socket receive buffer to %d: %.100s",
  1889. +           options.tcp_rcv_buf, strerror(errno));
  1890. +}
  1891. +
  1892. +
  1893. +/*
  1894.   * Creates a (possibly privileged) socket for use as the ssh connection.
  1895.   */
  1896.  static int
  1897. @@ -204,6 +231,8 @@ ssh_create_socket(int privileged, struct
  1898.                 strerror(errno));
  1899.         else
  1900.             debug("Allocated local port %d.", p);
  1901. +       if (options.tcp_rcv_buf > 0)
  1902. +           ssh_set_socket_recvbuf(sock);
  1903.         return sock;
  1904.     }
  1905.     sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
  1906. @@ -213,6 +242,10 @@ ssh_create_socket(int privileged, struct
  1907.     }
  1908.     fcntl(sock, F_SETFD, FD_CLOEXEC);
  1909.  
  1910. +   if (options.tcp_rcv_buf > 0)
  1911. +       ssh_set_socket_recvbuf(sock);
  1912. +
  1913. +
  1914.     /* Bind the socket to an alternative local IP address */
  1915.     if (options.bind_address == NULL)
  1916.         return sock;
  1917. diff -NupwB canonical/sshd.c kitchen/sshd.c
  1918. --- canonical/sshd.c    2012-02-14 13:03:31.000000000 -0500
  1919. +++ kitchen/sshd.c  2012-11-07 15:28:16.000000000 -0500
  1920. @@ -138,6 +138,8 @@ int deny_severity;
  1921.  #define REEXEC_CONFIG_PASS_FD      (STDERR_FILENO + 3)
  1922.  #define REEXEC_MIN_FREE_FD     (STDERR_FILENO + 4)
  1923.  
  1924. +int myflag = 0;
  1925. +
  1926.  extern char *__progname;
  1927.  
  1928.  /* Server configuration options. */
  1929. @@ -472,6 +474,10 @@ sshd_exchange_identification(int sock_in
  1930.     debug("Client protocol version %d.%d; client software version %.100s",
  1931.         remote_major, remote_minor, remote_version);
  1932.  
  1933. +   logit("SSH: Server;Ltype: Version;Remote: %s-%d;Protocol: %d.%d;Client: %.100s",
  1934. +         get_remote_ipaddr(), get_remote_port(),
  1935. +       remote_major, remote_minor, remote_version);
  1936. +
  1937.     compat_datafellows(remote_version);
  1938.  
  1939.     if (datafellows & SSH_BUG_PROBE) {
  1940. @@ -1028,6 +1034,9 @@ server_listen(void)
  1941.     struct addrinfo *ai;
  1942.     char ntop[NI_MAXHOST], strport[NI_MAXSERV];
  1943.  
  1944. +   int socksize;
  1945. +   int socksizelen = sizeof(int);
  1946. +
  1947.     for (ai = options.listen_addrs; ai; ai = ai->ai_next) {
  1948.         if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
  1949.             continue;
  1950. @@ -1067,6 +1076,12 @@ server_listen(void)
  1951.  
  1952.         debug("Bind to port %s on %s.", strport, ntop);
  1953.  
  1954. +       getsockopt(listen_sock, SOL_SOCKET, SO_RCVBUF,
  1955. +                  &socksize, &socksizelen);
  1956. +       debug("Server TCP RWIN socket size: %d", socksize);
  1957. +       debug("HPN Buffer Size: %d", options.hpn_buffer_size);
  1958. +
  1959. +
  1960.         /* Bind the socket to the desired port. */
  1961.         if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) < 0) {
  1962.             error("Bind to port %s on %s failed: %.200s.",
  1963. @@ -1948,6 +1963,9 @@ main(int ac, char **av)
  1964.     /* Log the connection. */
  1965.     verbose("Connection from %.500s port %d", remote_ip, remote_port);
  1966.  
  1967. +   /* set the HPN options for the child */
  1968. +   channel_set_hpn(options.hpn_disabled, options.hpn_buffer_size);
  1969. +
  1970.     /*
  1971.      * We don't want to listen forever unless the other side
  1972.      * successfully authenticates itself.  So we set up an alarm which is
  1973. @@ -2304,9 +2322,16 @@ do_ssh2_kex(void)
  1974.  {
  1975.     Kex *kex;
  1976.  
  1977. +   myflag++;
  1978. +   debug ("MYFLAG IS %d", myflag);
  1979. +
  1980.     if (options.ciphers != NULL) {
  1981.         myproposal[PROPOSAL_ENC_ALGS_CTOS] =
  1982.         myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
  1983. +   } else if (options.none_enabled == 1) {
  1984. +       debug ("WARNING: None cipher enabled");
  1985. +       myproposal[PROPOSAL_ENC_ALGS_CTOS] =
  1986. +       myproposal[PROPOSAL_ENC_ALGS_STOC] = KEX_ENCRYPT_INCLUDE_NONE;
  1987.     }
  1988.     myproposal[PROPOSAL_ENC_ALGS_CTOS] =
  1989.         compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
  1990. diff -NupwB canonical/sshd_config kitchen/sshd_config
  1991. --- canonical/sshd_config   2011-05-29 07:39:39.000000000 -0400
  1992. +++ kitchen/sshd_config 2012-11-07 15:28:16.000000000 -0500
  1993. @@ -114,6 +114,19 @@ AuthorizedKeysFile .ssh/authorized_keys
  1994.  # override default of no subsystems
  1995.  Subsystem  sftp    /usr/libexec/sftp-server
  1996.  
  1997. +# the following are HPN related configuration options
  1998. +# tcp receive buffer polling. disable in non autotuning kernels
  1999. +#TcpRcvBufPoll yes
  2000. +
  2001. +# allow the use of the none cipher
  2002. +#NoneEnabled no
  2003. +
  2004. +# disable hpn performance boosts.
  2005. +#HPNDisabled no
  2006. +
  2007. +# buffer size for hpn to non-hpn connections
  2008. +#HPNBufferSize 2048
  2009. +
  2010.  # Example of overriding settings on a per-user basis
  2011.  #Match User anoncvs
  2012.  #  X11Forwarding no
  2013. diff -NupwB canonical/version.h kitchen/version.h
  2014. --- canonical/version.h 2012-02-10 16:19:44.000000000 -0500
  2015. +++ kitchen/version.h   2012-11-07 16:04:59.000000000 -0500
  2016. @@ -3,7 +3,8 @@
  2017.  #define SSH_VERSION    "OpenSSH_6.0"
  2018.  
  2019.  #define SSH_PORTABLE   "p1"
  2020. -#define SSH_RELEASE_MINIMUM    SSH_VERSION SSH_PORTABLE
  2021. +#define SSH_HPN        "-hpn13v13"
  2022. +#define SSH_RELEASE_MINIMUM    SSH_VERSION SSH_PORTABLE SSH_HPN
  2023.  #ifdef SSH_EXTRAVERSION
  2024.  #define SSH_RELEASE    SSH_RELEASE_MINIMUM " " SSH_EXTRAVERSION
  2025.  #else
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!