ssh_client/third_party/openssh-8.0/openssh-8.0p1.patch

--- a/ssh.c
+++ b/ssh.c
@@ -577,7 +577,12 @@ set_addrinfo_port(struct addrinfo *addrs, int port)
  * Main program for the ssh client.
  */
 int
+#if defined(__pnacl__) || defined(__nacl__)
+ssh_main(int ac, char **av, const char *subsystem)
+#else
+#define subsystem NULL
 main(int ac, char **av)
+#endif
 {
 	struct ssh *ssh = NULL;
 	int i, r, opt, exit_status, use_syslog, direct, timeout_ms;
@@ -1038,6 +1038,21 @@ main(int ac, char **av)
 	if ((command = sshbuf_new()) == NULL)
 		fatal("sshbuf_new failed");
 
+	if (subsystem) {
+		/*
+		 * Hijack the codeflow now that we're done parsing the command line.
+		 * We want all the flags, but none of the command line.  Unless they
+		 * passed in -s themselves.
+		 */
+		if (!subsystem_flag) {
+			subsystem_flag = 1;
+			av = xcalloc(2, sizeof(*av));
+			av[0] = subsystem;
+			av[1] = NULL;
+			ac = 1;
+		}
+	}
+
 	/*
 	 * Save the command to execute on the remote host in a buffer. There
 	 * is no limit on the length of the command, except by the maximum

We hack the agent code to use a fake IP address which the plugin watches for.
We should have the plugin deal with AF_UNIX requests instead, then we won't
have to hack up OpenSSH.

--- a/authfd.c
+++ b/authfd.c
@@ -88,7 +88,10 @@ ssh_get_authentication_socket(int *fdp)
 {
 	const char *authsocket;
 	int sock, oerrno;
-	struct sockaddr_un sunaddr;
+	struct sockaddr_in sunaddr;
+
+	/* Magic value. Keep in sync with //ssh_client/src/file_system.cc */
+	static const int kSshAgentFakeIP = 0x7F010203;
 
 	if (fdp != NULL)
 		*fdp = -1;
@@ -98,10 +101,10 @@ ssh_get_authentication_socket(int *fdp)
 		return SSH_ERR_AGENT_NOT_PRESENT;
 
 	memset(&sunaddr, 0, sizeof(sunaddr));
-	sunaddr.sun_family = AF_UNIX;
-	strlcpy(sunaddr.sun_path, authsocket, sizeof(sunaddr.sun_path));
+	sunaddr.sin_family = AF_INET;
+	sunaddr.sin_addr.s_addr = htonl(kSshAgentFakeIP);
 
-	if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
+	if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0)
 		return SSH_ERR_SYSTEM_ERROR;
 
 	/* close on exec */

the bind_permitted() check doesn't work well in the nacl env.  leave it to the
host os to do the actual check and deny/permit as makes sense.

daemonized() relies on funcs we don't implement (because we don't need them),
and this func is only used in sshd.  disable it to avoid link failures.

--- a/misc.c
+++ b/misc.c
@@ -1576,6 +1576,7 @@ forward_equals(const struct Forward *a, const struct Forward *b)
 	return 1;
 }
 
+#if !defined(__pnacl__) && !defined(__nacl__)
 /* returns 1 if process is already daemonized, 0 otherwise */
 int
 daemonized(void)
@@ -1593,6 +1594,7 @@ daemonized(void)
 	debug3("already daemonized");
 	return 1;
 }
+#endif
 
 
 /*

Upstream Fix pasto in fallback code.

There is no parameter called "pathname", it should simply be "path".
bz#3059, patch from samuel at cendio.se.

--- a/openbsd-compat/bsd-misc.c
+++ b/openbsd-compat/bsd-misc.c
@@ -172,7 +172,7 @@ fchownat(int fd, const char *path, uid_t owner, gid_t group, int flag)
 		return -1;
 	}
 # ifndef HAVE_FCHOWN
-	return chown(pathname, owner, group);
+	return chown(path, owner, group);
 # else
 #  ifdef O_NOFOLLOW
 	if (flag & AT_SYMLINK_NOFOLLOW)
@@ -203,7 +203,7 @@ fchmodat(int fd, const char *path, mode_t mode, int flag)
 		return -1;
 	}
 # ifndef HAVE_FCHMOD
-	return chown(pathname, owner, group);
+	return chmod(path, mode);
 # else
 #  ifdef O_NOFOLLOW
 	if (flag & AT_SYMLINK_NOFOLLOW)

These statvfs defines might not exist.

--- a/sftp-client.c
+++ b/sftp-client.c
@@ -384,8 +384,13 @@ get_decode_statvfs(struct sftp_conn *conn, struct sftp_statvfs *st,
 	    (r = sshbuf_get_u64(msg, &st->f_namemax)) != 0)
 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
+	st->f_flag = 0;
+#ifdef ST_RDONLY
 	st->f_flag = (flag & SSH2_FXE_STATVFS_ST_RDONLY) ? ST_RDONLY : 0;
+#endif
+#ifdef ST_NOSUID
 	st->f_flag |= (flag & SSH2_FXE_STATVFS_ST_NOSUID) ? ST_NOSUID : 0;
+#endif
 
 	sshbuf_free(msg);