--- old/build/openssh/patches/0009-PAM-conversation-fix.patch	Wed Feb 10 16:25:01 2016
+++ /dev/null	Wed Feb 10 16:25:01 2016
@@ -1,104 +0,0 @@
-From 71e2185a3a2301f08c845a9cb884280dcb0d2cff Mon Sep 17 00:00:00 2001
-From: oracle <solaris@oracle.com>
-Date: Mon, 3 Aug 2015 14:36:13 -0700
-Subject: [PATCH 09/30] PAM conversation fix
-
-#
-# This patch contains an important bug fix for the PAM password userauth
-# conversation function. This bug fix was contributed back to the upstream in
-# 2009, but it was not accepted by the upstream.  For more information, see
-# https://bugzilla.mindrot.org/show_bug.cgi?id=1681.
-#
----
- auth-pam.c | 36 ++++++++++++++++++++++++++++++++++++
- 1 file changed, 36 insertions(+)
-
-diff --git a/auth-pam.c b/auth-pam.c
-index d94c828..b941991 100644
---- a/auth-pam.c
-+++ b/auth-pam.c
-@@ -1111,11 +1111,13 @@ free_pam_environment(char **env)
- 	free(env);
- }
- 
-+#ifndef PAM_BUGFIX
- /*
-  * "Blind" conversation function for password authentication.  Assumes that
-  * echo-off prompts are for the password and stores messages for later
-  * display.
-  */
-+#endif
- static int
- sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
-     struct pam_response **resp, void *data)
-@@ -1137,12 +1139,24 @@ sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
- 	for (i = 0; i < n; ++i) {
- 		switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
- 		case PAM_PROMPT_ECHO_OFF:
-+#ifdef PAM_BUGFIX
-+                       /*
-+                        * PAM conversation function for the password userauth
-+			* method (non-interactive) really cannot do any 
-+			* prompting.  We set the PAM_AUTHTOK item in 
-+                        * sshpam_auth_passwd()to avoid conversation. If some
-+			* modules still try to converse, then the password
-+			* userauth will fail.
-+			*/
-+			goto fail;
-+#else
- 			if (sshpam_password == NULL)
- 				goto fail;
- 			if ((reply[i].resp = strdup(sshpam_password)) == NULL)
- 				goto fail;
- 			reply[i].resp_retcode = PAM_SUCCESS;
- 			break;
-+#endif
- 		case PAM_ERROR_MSG:
- 		case PAM_TEXT_INFO:
- 			len = strlen(PAM_MSG_MEMBER(msg, i, msg));
-@@ -1178,6 +1192,9 @@ static struct pam_conv passwd_conv = { sshpam_passwd_conv, NULL };
- int
- sshpam_auth_passwd(Authctxt *authctxt, const char *password)
- {
-+#ifdef PAM_BUGFIX
-+        int set_item_rtn;
-+#endif
- 	int flags = (options.permit_empty_passwd == 0 ?
- 	    PAM_DISALLOW_NULL_AUTHTOK : 0);
- 
-@@ -1197,6 +1214,15 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
- 	    options.permit_root_login != PERMIT_YES))
- 		sshpam_password = badpw;
- 
-+#ifdef PAM_BUGFIX
-+  	sshpam_err = pam_set_item(sshpam_handle, PAM_AUTHTOK, password);
-+	if (sshpam_err != PAM_SUCCESS) {
-+		debug("PAM: %s: failed to set PAM_AUTHTOK: %s", __func__,
-+		    pam_strerror(sshpam_handle, sshpam_err));
-+		return 0;
-+	}
-+#endif
-+
- 	sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
- 	    (const void *)&passwd_conv);
- 	if (sshpam_err != PAM_SUCCESS)
-@@ -1205,6 +1231,16 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
- 
- 	sshpam_err = pam_authenticate(sshpam_handle, flags);
- 	sshpam_password = NULL;
-+
-+#ifdef PAM_BUGFIX
-+        set_item_rtn = pam_set_item(sshpam_handle, PAM_AUTHTOK, NULL);
-+	if (set_item_rtn != PAM_SUCCESS) {
-+		debug("PAM: %s: failed to set PAM_AUTHTOK: %s", __func__,
-+		    pam_strerror(sshpam_handle, set_item_rtn));
-+		return 0;
-+	}
-+#endif
-+
- 	if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
- 		debug("PAM: password authentication accepted for %.100s",
- 		    authctxt->user);
--- 
-2.3.2 (Apple Git-55)
-
--- /dev/null	Wed Feb 10 16:25:01 2016
+++ new/build/openssh/patches/0011-PAM-conversation-fix.patch	Wed Feb 10 16:25:01 2016
@@ -0,0 +1,104 @@
+From 4836dba2499f4c161ea7f18bb35535c366a4cdec Mon Sep 17 00:00:00 2001
+From: oracle <solaris@oracle.com>
+Date: Mon, 3 Aug 2015 14:36:13 -0700
+Subject: [PATCH 11/36] PAM conversation fix
+
+#
+# This patch contains an important bug fix for the PAM password userauth
+# conversation function. This bug fix was contributed back to the upstream in
+# 2009, but it was not accepted by the upstream.  For more information, see
+# https://bugzilla.mindrot.org/show_bug.cgi?id=1681.
+#
+---
+ auth-pam.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+diff --git a/auth-pam.c b/auth-pam.c
+index d94c828..b941991 100644
+--- a/auth-pam.c
++++ b/auth-pam.c
+@@ -1111,11 +1111,13 @@ free_pam_environment(char **env)
+ 	free(env);
+ }
+ 
++#ifndef PAM_BUGFIX
+ /*
+  * "Blind" conversation function for password authentication.  Assumes that
+  * echo-off prompts are for the password and stores messages for later
+  * display.
+  */
++#endif
+ static int
+ sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
+     struct pam_response **resp, void *data)
+@@ -1137,12 +1139,24 @@ sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
+ 	for (i = 0; i < n; ++i) {
+ 		switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
+ 		case PAM_PROMPT_ECHO_OFF:
++#ifdef PAM_BUGFIX
++                       /*
++                        * PAM conversation function for the password userauth
++			* method (non-interactive) really cannot do any 
++			* prompting.  We set the PAM_AUTHTOK item in 
++                        * sshpam_auth_passwd()to avoid conversation. If some
++			* modules still try to converse, then the password
++			* userauth will fail.
++			*/
++			goto fail;
++#else
+ 			if (sshpam_password == NULL)
+ 				goto fail;
+ 			if ((reply[i].resp = strdup(sshpam_password)) == NULL)
+ 				goto fail;
+ 			reply[i].resp_retcode = PAM_SUCCESS;
+ 			break;
++#endif
+ 		case PAM_ERROR_MSG:
+ 		case PAM_TEXT_INFO:
+ 			len = strlen(PAM_MSG_MEMBER(msg, i, msg));
+@@ -1178,6 +1192,9 @@ static struct pam_conv passwd_conv = { sshpam_passwd_conv, NULL };
+ int
+ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
+ {
++#ifdef PAM_BUGFIX
++        int set_item_rtn;
++#endif
+ 	int flags = (options.permit_empty_passwd == 0 ?
+ 	    PAM_DISALLOW_NULL_AUTHTOK : 0);
+ 
+@@ -1197,6 +1214,15 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
+ 	    options.permit_root_login != PERMIT_YES))
+ 		sshpam_password = badpw;
+ 
++#ifdef PAM_BUGFIX
++  	sshpam_err = pam_set_item(sshpam_handle, PAM_AUTHTOK, password);
++	if (sshpam_err != PAM_SUCCESS) {
++		debug("PAM: %s: failed to set PAM_AUTHTOK: %s", __func__,
++		    pam_strerror(sshpam_handle, sshpam_err));
++		return 0;
++	}
++#endif
++
+ 	sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ 	    (const void *)&passwd_conv);
+ 	if (sshpam_err != PAM_SUCCESS)
+@@ -1205,6 +1231,16 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
+ 
+ 	sshpam_err = pam_authenticate(sshpam_handle, flags);
+ 	sshpam_password = NULL;
++
++#ifdef PAM_BUGFIX
++        set_item_rtn = pam_set_item(sshpam_handle, PAM_AUTHTOK, NULL);
++	if (set_item_rtn != PAM_SUCCESS) {
++		debug("PAM: %s: failed to set PAM_AUTHTOK: %s", __func__,
++		    pam_strerror(sshpam_handle, set_item_rtn));
++		return 0;
++	}
++#endif
++
+ 	if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
+ 		debug("PAM: password authentication accepted for %.100s",
+ 		    authctxt->user);
+-- 
+2.5.4 (Apple Git-61)
+
