rpms/openssh
7
0
Fork 1
Code Issues Pull Requests Releases Activity

6.7p1-1 + 0.9.3-4

Browse Source
This commit is contained in:
Petr Lautrbach 2015-01-20 13:18:45 +01:00
parent b457c98bec
commit 1900351913
24 changed files with 1608 additions and 2056 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -13,3 +13,4 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
/openssh-6.3p1.tar.gz
/openssh-6.4p1.tar.gz
/openssh-6.6p1.tar.gz
/openssh-6.7p1.tar.gz

14
openssh-5.6p1-exit-deadlock.patch
View File

@ -1,14 +0,0 @@
diff -up openssh-5.6p1/channels.c.exit-deadlock openssh-5.6p1/channels.c
--- openssh-5.6p1/channels.c.exit-deadlock 2010-08-05 15:09:48.000000000 +0200
+++ openssh-5.6p1/channels.c 2010-08-23 12:41:43.000000000 +0200
@@ -1647,6 +1647,10 @@ channel_handle_wfd(Channel *c, fd_set *r
u_int dlen, olen = 0;
int len;
+ if(c->wfd != -1 && buffer_len(&c->output) > 0 && c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
+ debug("channel %d: forcing write", c->self);
+ FD_SET(c->wfd, writeset);
+ }
/* Send buffered output data to the socket. */
if (c->wfd != -1 &&
FD_ISSET(c->wfd, writeset) &&

72
openssh-5.9p1-edns.patch
View File

@ -1,72 +0,0 @@
diff -up openssh-5.9p1/dns.c.edns openssh-5.9p1/dns.c
--- openssh-5.9p1/dns.c.edns 2010-08-31 14:41:14.000000000 +0200
+++ openssh-5.9p1/dns.c 2011-09-09 08:05:27.782440497 +0200
@@ -177,6 +177,7 @@ verify_host_key_dns(const char *hostname
{
u_int counter;
int result;
+ unsigned int rrset_flags = 0;
struct rrsetinfo *fingerprints = NULL;
u_int8_t hostkey_algorithm;
@@ -200,8 +201,19 @@ verify_host_key_dns(const char *hostname
return -1;
}
+ /*
+ * Original getrrsetbyname function, found on OpenBSD for example,
+ * doesn't accept any flag and prerequisite for obtaining AD bit in
+ * DNS response is set by "options edns0" in resolv.conf.
+ *
+ * Our version is more clever and use RRSET_FORCE_EDNS0 flag.
+ */
+#ifndef HAVE_GETRRSETBYNAME
+ rrset_flags |= RRSET_FORCE_EDNS0;
+#endif
result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
- DNS_RDATATYPE_SSHFP, 0, &fingerprints);
+ DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints);
+
if (result) {
verbose("DNS lookup error: %s", dns_result_totext(result));
return -1;
diff -up openssh-5.9p1/openbsd-compat/getrrsetbyname.c.edns openssh-5.9p1/openbsd-compat/getrrsetbyname.c
--- openssh-5.9p1/openbsd-compat/getrrsetbyname.c.edns 2009-07-13 03:38:23.000000000 +0200
+++ openssh-5.9p1/openbsd-compat/getrrsetbyname.c 2011-09-09 15:03:39.930500801 +0200
@@ -209,8 +209,8 @@ getrrsetbyname(const char *hostname, uns
goto fail;
}
- /* don't allow flags yet, unimplemented */
- if (flags) {
+ /* Allow RRSET_FORCE_EDNS0 flag only. */
+ if ((flags & ~RRSET_FORCE_EDNS0) != 0) {
result = ERRSET_INVAL;
goto fail;
}
@@ -226,9 +226,9 @@ getrrsetbyname(const char *hostname, uns
#endif /* DEBUG */
#ifdef RES_USE_DNSSEC
- /* turn on DNSSEC if EDNS0 is configured */
- if (_resp->options & RES_USE_EDNS0)
- _resp->options |= RES_USE_DNSSEC;
+ /* turn on DNSSEC if required */
+ if (flags & RRSET_FORCE_EDNS0)
+ _resp->options |= (RES_USE_EDNS0|RES_USE_DNSSEC);
#endif /* RES_USE_DNSEC */
/* make query */
diff -up openssh-5.9p1/openbsd-compat/getrrsetbyname.h.edns openssh-5.9p1/openbsd-compat/getrrsetbyname.h
--- openssh-5.9p1/openbsd-compat/getrrsetbyname.h.edns 2007-10-26 08:26:50.000000000 +0200
+++ openssh-5.9p1/openbsd-compat/getrrsetbyname.h 2011-09-09 08:05:27.965438689 +0200
@@ -72,6 +72,9 @@
#ifndef RRSET_VALIDATED
# define RRSET_VALIDATED 1
#endif
+#ifndef RRSET_FORCE_EDNS0
+# define RRSET_FORCE_EDNS0 0x0001
+#endif
/*
* Return codes for getrrsetbyname()

135
openssh-6.2p1-vendor.patch
View File

@ -1,7 +1,8 @@
diff -up openssh-6.2p1/configure.ac.vendor openssh-6.2p1/configure.ac
--- openssh-6.2p1/configure.ac.vendor 2013-03-25 19:34:01.277495179 +0100
+++ openssh-6.2p1/configure.ac 2013-03-25 19:34:01.377495818 +0100
@@ -4420,6 +4420,12 @@ AC_ARG_WITH([lastlog],
diff --git a/configure.ac b/configure.ac
index 6553074..8dedb95 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4676,6 +4676,12 @@ AC_ARG_WITH([lastlog],
fi
]
)
@ -14,7 +15,7 @@ diff -up openssh-6.2p1/configure.ac.vendor openssh-6.2p1/configure.ac
dnl lastlog, [uw]tmpx? detection
dnl NOTE: set the paths in the platform section to avoid the
@@ -4681,6 +4687,7 @@ echo " Translate v4 in v6 hack
@@ -4938,6 +4944,7 @@ echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
echo " BSD Auth support: $BSD_AUTH_MSG"
echo " Random number source: $RAND_MSG"
echo " Privsep sandbox style: $SANDBOX_STYLE"
@ -22,10 +23,11 @@ diff -up openssh-6.2p1/configure.ac.vendor openssh-6.2p1/configure.ac
echo ""
diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
--- openssh-6.2p1/servconf.c.vendor 2013-03-25 19:34:01.197494668 +0100
+++ openssh-6.2p1/servconf.c 2013-03-25 19:34:01.379495831 +0100
@@ -128,6 +128,7 @@ initialize_server_options(ServerOptions
diff --git a/servconf.c b/servconf.c
index e3ebaac..c8a3f28 100644
--- a/servconf.c
+++ b/servconf.c
@@ -141,6 +141,7 @@ initialize_server_options(ServerOptions *options)
options->max_authtries = -1;
options->max_sessions = -1;
options->banner = NULL;
@ -33,17 +35,16 @@ diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
options->use_dns = -1;
options->client_alive_interval = -1;
options->client_alive_count_max = -1;
@@ -287,6 +288,9 @@ fill_default_server_options(ServerOption
@@ -310,6 +311,8 @@ fill_default_server_options(ServerOptions *options)
options->ip_qos_bulk = IPTOS_THROUGHPUT;
if (options->version_addendum == NULL)
options->version_addendum = xstrdup("");
+ if (options->show_patchlevel == -1)
+ options->show_patchlevel = 0;
+
/* Turn privilege separation on by default */
if (use_privsep == -1)
use_privsep = PRIVSEP_NOSANDBOX;
@@ -324,7 +328,7 @@ typedef enum {
if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
options->fwd_opts.streamlocal_bind_mask = 0177;
if (options->fwd_opts.streamlocal_bind_unlink == -1)
@@ -353,7 +356,7 @@ typedef enum {
sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
sMaxStartups, sMaxAuthTries, sMaxSessions,
@ -52,7 +53,7 @@ diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
sClientAliveCountMax, sAuthorizedKeysFile,
sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
@@ -439,6 +443,7 @@ static struct {
@@ -467,6 +470,7 @@ static struct {
{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
{ "maxsessions", sMaxSessions, SSHCFG_ALL },
{ "banner", sBanner, SSHCFG_ALL },
@ -60,7 +61,7 @@ diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
{ "usedns", sUseDNS, SSHCFG_GLOBAL },
{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
@@ -1163,6 +1168,10 @@ process_server_config_line(ServerOptions
@@ -1263,6 +1267,10 @@ process_server_config_line(ServerOptions *options, char *line,
multistate_ptr = multistate_privsep;
goto parse_multistate;
@ -71,18 +72,19 @@ diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
case sAllowUsers:
while ((arg = strdelim(&cp)) && *arg != '\0') {
if (options->num_allow_users >= MAX_ALLOW_USERS)
@@ -1950,6 +1959,7 @@ dump_config(ServerOptions *o)
@@ -2081,6 +2089,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sUseLogin, o->use_login);
dump_cfg_fmtint(sCompression, o->compression);
dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);
+ dump_cfg_fmtint(sShowPatchLevel, o->show_patchlevel);
dump_cfg_fmtint(sUseDNS, o->use_dns);
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
diff -up openssh-6.2p1/servconf.h.vendor openssh-6.2p1/servconf.h
--- openssh-6.2p1/servconf.h.vendor 2013-01-09 05:56:45.000000000 +0100
+++ openssh-6.2p1/servconf.h 2013-03-25 19:34:01.379495831 +0100
@@ -147,6 +147,7 @@ typedef struct {
dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
diff --git a/servconf.h b/servconf.h
index 49b228b..21719e2 100644
--- a/servconf.h
+++ b/servconf.h
@@ -149,6 +149,7 @@ typedef struct {
int max_authtries;
int max_sessions;
char *banner; /* SSH-2 banner message */
@ -90,10 +92,34 @@ diff -up openssh-6.2p1/servconf.h.vendor openssh-6.2p1/servconf.h
int use_dns;
int client_alive_interval; /*
* poke the client this often to
diff -up openssh-6.2p1/sshd_config.vendor openssh-6.2p1/sshd_config
--- openssh-6.2p1/sshd_config.vendor 2013-03-25 19:34:01.380495837 +0100
+++ openssh-6.2p1/sshd_config 2013-03-25 19:44:43.471296362 +0100
@@ -118,6 +118,7 @@ UsePrivilegeSeparation sandbox # Defaul
diff --git a/sshd.c b/sshd.c
index afe9afa..193b206 100644
--- a/sshd.c
+++ b/sshd.c
@@ -432,7 +432,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
}
xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
- major, minor, SSH_VERSION,
+ major, minor, (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
*options.version_addendum == '\0' ? "" : " ",
options.version_addendum, newline);
@@ -1677,7 +1677,8 @@ main(int ac, char **av)
exit(1);
}
- debug("sshd version %s, %s", SSH_VERSION,
+ debug("sshd version %s, %s",
+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
#ifdef WITH_OPENSSL
SSLeay_version(SSLEAY_VERSION)
#else
diff --git a/sshd_config b/sshd_config
index 3092ac6..da3db5d 100644
--- a/sshd_config
+++ b/sshd_config
@@ -119,6 +119,7 @@ UsePrivilegeSeparation sandbox # Default for new installations.
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
@ -101,10 +127,11 @@ diff -up openssh-6.2p1/sshd_config.vendor openssh-6.2p1/sshd_config
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
diff -up openssh-6.2p1/sshd_config.0.vendor openssh-6.2p1/sshd_config.0
--- openssh-6.2p1/sshd_config.0.vendor 2013-03-25 19:34:01.361495716 +0100
+++ openssh-6.2p1/sshd_config.0 2013-03-25 19:34:01.381495844 +0100
@@ -595,6 +595,11 @@ DESCRIPTION
diff --git a/sshd_config.0 b/sshd_config.0
index 43867d3..a3898c3 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -700,6 +700,11 @@ DESCRIPTION
Defines the number of bits in the ephemeral protocol version 1
server key. The minimum value is 512, and the default is 1024.
@ -113,13 +140,14 @@ diff -up openssh-6.2p1/sshd_config.0.vendor openssh-6.2p1/sshd_config.0
+ the binary in the server identification string. The patch level
+ is set at compile-time. The default is M-bM-^@M-^\noM-bM-^@M-^].
+
StrictModes
Specifies whether sshd(8) should check file modes and ownership
of the user's files and home directory before accepting login.
diff -up openssh-6.2p1/sshd_config.5.vendor openssh-6.2p1/sshd_config.5
--- openssh-6.2p1/sshd_config.5.vendor 2013-03-25 19:34:01.362495722 +0100
+++ openssh-6.2p1/sshd_config.5 2013-03-25 19:34:01.382495850 +0100
@@ -1019,6 +1019,14 @@ This option applies to protocol version
StreamLocalBindMask
Sets the octal file creation mode mask (umask) used when creating
a Unix-domain socket file for local or remote port forwarding.
diff --git a/sshd_config.5 b/sshd_config.5
index 89a0cf2..cccb310 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -1200,6 +1200,13 @@ This option applies to protocol version 1 only.
.It Cm ServerKeyBits
Defines the number of bits in the ephemeral protocol version 1 server key.
The minimum value is 512, and the default is 1024.
@ -130,29 +158,6 @@ diff -up openssh-6.2p1/sshd_config.5.vendor openssh-6.2p1/sshd_config.5
+The patch level is set at compile-time.
+The default is
+.Dq no .
+This option applies to protocol version 1 only.
.It Cm StrictModes
Specifies whether
.Xr sshd 8
diff -up openssh-6.2p1/sshd.c.vendor openssh-6.2p1/sshd.c
--- openssh-6.2p1/sshd.c.vendor 2013-03-25 19:34:01.332495531 +0100
+++ openssh-6.2p1/sshd.c 2013-03-25 19:44:11.864112092 +0100
@@ -442,7 +442,7 @@ sshd_exchange_identification(int sock_in
}
xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
- major, minor, SSH_VERSION,
+ major, minor, (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
*options.version_addendum == '\0' ? "" : " ",
options.version_addendum, newline);
@@ -1675,7 +1675,8 @@ main(int ac, char **av)
exit(1);
}
- debug("sshd version %s, %s", SSH_VERSION,
+ debug("sshd version %s, %s",
+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
SSLeay_version(SSLEAY_VERSION));
/* Store privilege separation user for later use if required. */
.It Cm StreamLocalBindMask
Sets the octal file creation mode mask
.Pq umask

212
openssh-6.6.1p1-audit-pfs.patch
View File

@ -1,212 +0,0 @@
diff --git a/audit-bsm.c b/audit-bsm.c
index 5160869..c7a1b47 100644
--- a/audit-bsm.c
+++ b/audit-bsm.c
@@ -481,7 +481,7 @@ audit_unsupported_body(int what)
}
void
-audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid, uid_t uid)
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid, uid_t uid)
{
/* not implemented */
}
diff --git a/audit-linux.c b/audit-linux.c
index 6954fc1..6686f6a 100644
--- a/audit-linux.c
+++ b/audit-linux.c
@@ -297,7 +297,7 @@ audit_unsupported_body(int what)
const static char *direction[] = { "from-server", "from-client", "both" };
void
-audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid,
uid_t uid)
{
#ifdef AUDIT_CRYPTO_SESSION
@@ -306,8 +306,8 @@ audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
Cipher *cipher = cipher_by_name(enc);
char *s;
- snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d mac=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",
- direction[ctos], enc, cipher ? 8 * cipher->key_len : 0, mac,
+ snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d mac=%s pfs=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",
+ direction[ctos], enc, cipher ? 8 * cipher->key_len : 0, mac, pfs,
(intmax_t)pid, (intmax_t)uid,
get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), get_local_port());
free(s);
diff --git a/audit.c b/audit.c
index 13c6849..5b49434 100644
--- a/audit.c
+++ b/audit.c
@@ -135,9 +135,9 @@ audit_unsupported(int what)
}
void
-audit_kex(int ctos, char *enc, char *mac, char *comp)
+audit_kex(int ctos, char *enc, char *mac, char *comp, char *pfs)
{
- PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
+ PRIVSEP(audit_kex_body(ctos, enc, mac, comp, pfs, getpid(), getuid()));
}
void
@@ -270,11 +270,11 @@ audit_unsupported_body(int what)
* This will be called on succesfull protocol negotiation.
*/
void
-audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid,
uid_t uid)
{
- debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",
- (unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,
+ debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s pfs %s from pid %ld uid %u",
+ (unsigned)geteuid(), ctos, enc, mac, compress, pfs, (long)pid,
(unsigned)uid);
}
diff --git a/audit.h b/audit.h
index a2dc3ff..903df66 100644
--- a/audit.h
+++ b/audit.h
@@ -61,9 +61,9 @@ ssh_audit_event_t audit_classify_auth(const char *);
int audit_keyusage(int, const char *, unsigned, char *, int);
void audit_key(int, int *, const Key *);
void audit_unsupported(int);
-void audit_kex(int, char *, char *, char *);
+void audit_kex(int, char *, char *, char *, char *);
void audit_unsupported_body(int);
-void audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
+void audit_kex_body(int, char *, char *, char *, char *, pid_t, uid_t);
void audit_session_key_free(int ctos);
void audit_session_key_free_body(int ctos, pid_t, uid_t);
void audit_destroy_sensitive_data(const char *, pid_t, uid_t);
diff --git a/auditstub.c b/auditstub.c
index 45817e0..116f460 100644
--- a/auditstub.c
+++ b/auditstub.c
@@ -35,7 +35,7 @@ audit_unsupported(int n)
}
void
-audit_kex(int ctos, char *enc, char *mac, char *comp)
+audit_kex(int ctos, char *enc, char *mac, char *comp, char *pfs)
{
}
diff --git a/kex.c b/kex.c
index ede7b67..eb5f333 100644
--- a/kex.c
+++ b/kex.c
@@ -553,13 +553,12 @@ kex_choose_conf(Kex *kex)
newkeys->enc.name,
authlen == 0 ? newkeys->mac.name : "<implicit>",
newkeys->comp.name);
-#ifdef SSH_AUDIT_EVENTS
- audit_kex(ctos, newkeys->enc.name, newkeys->mac.name, newkeys->comp.name);
-#endif
}
+
choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
+
need = dh_need = 0;
for (mode = 0; mode < MODE_MAX; mode++) {
newkeys = kex->newkeys[mode];
@@ -571,11 +570,16 @@ kex_choose_conf(Kex *kex)
dh_need = MAX(dh_need, newkeys->enc.block_size);
dh_need = MAX(dh_need, newkeys->enc.iv_len);
dh_need = MAX(dh_need, newkeys->mac.key_len);
+ debug("kex: %s need=%d dh_need=%d", kex->name, need, dh_need);
+#ifdef SSH_AUDIT_EVENTS
+ audit_kex(mode, newkeys->enc.name, newkeys->mac.name, newkeys->comp.name, kex->name);
+#endif
}
/* XXX need runden? */
kex->we_need = need;
kex->dh_need = dh_need;
+
/* ignore the next message if the proposals do not match */
if (first_kex_follows && !proposals_match(my, peer) &&
!(datafellows & SSH_BUG_FIRSTKEX)) {
diff --git a/monitor.c b/monitor.c
index 70b9b4c..81bc9c1 100644
--- a/monitor.c
+++ b/monitor.c
@@ -2396,7 +2396,7 @@ int
mm_answer_audit_kex_body(int sock, Buffer *m)
{
int ctos, len;
- char *cipher, *mac, *compress;
+ char *cipher, *mac, *compress, *pfs;
pid_t pid;
uid_t uid;
@@ -2404,14 +2404,16 @@ mm_answer_audit_kex_body(int sock, Buffer *m)
cipher = buffer_get_string(m, &len);
mac = buffer_get_string(m, &len);
compress = buffer_get_string(m, &len);
+ pfs = buffer_get_string(m, &len);
pid = buffer_get_int64(m);
uid = buffer_get_int64(m);
- audit_kex_body(ctos, cipher, mac, compress, pid, uid);
+ audit_kex_body(ctos, cipher, mac, compress, pfs, pid, uid);
free(cipher);
free(mac);
free(compress);
+ free(pfs);
buffer_clear(m);
mm_request_send(sock, MONITOR_ANS_AUDIT_KEX, m);
diff --git a/monitor_wrap.c b/monitor_wrap.c
index 93f6535..69b29d8 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1408,7 +1408,7 @@ mm_audit_unsupported_body(int what)
}
void
-mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress, pid_t pid,
+mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress, char *fps, pid_t pid,
uid_t uid)
{
Buffer m;
@@ -1418,6 +1418,7 @@ mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress, pid_t pid,
buffer_put_cstring(&m, cipher);
buffer_put_cstring(&m, (mac ? mac : ""));
buffer_put_cstring(&m, compress);
+ buffer_put_cstring(&m, fps);
buffer_put_int64(&m, pid);
buffer_put_int64(&m, uid);
diff --git a/monitor_wrap.h b/monitor_wrap.h
index 4cf0c78..e43109f 100644
--- a/monitor_wrap.h
+++ b/monitor_wrap.h
@@ -83,7 +83,7 @@ void mm_audit_event(ssh_audit_event_t);
int mm_audit_run_command(const char *);
void mm_audit_end_command(int, const char *);
void mm_audit_unsupported_body(int);
-void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
+void mm_audit_kex_body(int, char *, char *, char *, char *, pid_t, uid_t);
void mm_audit_session_key_free_body(int, pid_t, uid_t);
void mm_audit_destroy_sensitive_data(const char *, pid_t, uid_t);
#endif
diff --git a/sshd.c b/sshd.c
index ee94825..41a94a7 100644
--- a/sshd.c
+++ b/sshd.c
@@ -2430,7 +2430,7 @@ do_ssh1_kex(void)
packet_disconnect("IP Spoofing check bytes do not match.");
#ifdef SSH_AUDIT_EVENTS
- audit_kex(2, cipher_name(cipher_type), "crc", "none");
+ audit_kex(2, cipher_name(cipher_type), "crc", "none", "none");
#endif
debug("Encryption type: %.200s", cipher_name(cipher_type));

44
openssh-6.6.1p1-log-in-chroot.patch
View File

@ -40,10 +40,10 @@ index ae7df25..30c3310 100644
int log_is_on_stderr(void);
void log_redirect_stderr_to(const char *);
diff --git a/monitor.c b/monitor.c
index 7461fae..da2f766 100644
index 7ebc76e..d97e640 100644
--- a/monitor.c
+++ b/monitor.c
@@ -364,6 +364,8 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
@@ -378,6 +378,8 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
close(pmonitor->m_log_sendfd);
pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;
@ -52,7 +52,7 @@ index 7461fae..da2f766 100644
authctxt = _authctxt;
memset(authctxt, 0, sizeof(*authctxt));
@@ -472,6 +474,8 @@ monitor_child_postauth(struct monitor *pmonitor)
@@ -486,6 +488,8 @@ monitor_child_postauth(struct monitor *pmonitor)
close(pmonitor->m_recvfd);
pmonitor->m_recvfd = -1;
@ -61,7 +61,7 @@ index 7461fae..da2f766 100644
monitor_set_child_handler(pmonitor->m_pid);
signal(SIGHUP, &monitor_child_handler);
signal(SIGTERM, &monitor_child_handler);
@@ -552,7 +556,7 @@ monitor_read_log(struct monitor *pmonitor)
@@ -566,7 +570,7 @@ monitor_read_log(struct monitor *pmonitor)
if (log_level_name(level) == NULL)
fatal("%s: invalid log level %u (corrupted message?)",
__func__, level);
@ -70,7 +70,7 @@ index 7461fae..da2f766 100644
buffer_free(&logmsg);
free(msg);
@@ -2083,13 +2087,28 @@ monitor_init(void)
@@ -2107,13 +2111,28 @@ monitor_init(void)
mm_init_compression(mon->m_zlib);
}
@ -119,7 +119,7 @@ index ff79fbb..00c2028 100644
struct Authctxt;
diff --git a/session.c b/session.c
index e4add93..bc4a8dd 100644
index 9c94d8e..40a681e 100644
--- a/session.c
+++ b/session.c
@@ -160,6 +160,8 @@ login_cap_t *lc;
@ -131,7 +131,7 @@ index e4add93..bc4a8dd 100644
/* Name and directory of socket for authentication agent forwarding. */
static char *auth_sock_name = NULL;
static char *auth_sock_dir = NULL;
@@ -523,8 +525,8 @@ do_exec_no_pty(Session *s, const char *command)
@@ -505,8 +507,8 @@ do_exec_no_pty(Session *s, const char *command)
is_child = 1;
/* Child. Reinitialize the log since the pid has changed. */
@ -142,7 +142,7 @@ index e4add93..bc4a8dd 100644
/*
* Create a new session and process group since the 4.4BSD
@@ -692,8 +694,8 @@ do_exec_pty(Session *s, const char *command)
@@ -674,8 +676,8 @@ do_exec_pty(Session *s, const char *command)
close(ptymaster);
/* Child. Reinitialize the log because the pid has changed. */
@ -153,7 +153,7 @@ index e4add93..bc4a8dd 100644
/* Close the master side of the pseudo tty. */
close(ptyfd);
@@ -797,6 +799,7 @@ do_exec(Session *s, const char *command)
@@ -779,6 +781,7 @@ do_exec(Session *s, const char *command)
int ret;
const char *forced = NULL;
char session_type[1024], *tty = NULL;
@ -161,7 +161,7 @@ index e4add93..bc4a8dd 100644
if (options.adm_forced_command) {
original_command = command;
@@ -854,6 +857,10 @@ do_exec(Session *s, const char *command)
@@ -836,6 +839,10 @@ do_exec(Session *s, const char *command)
tty += 5;
}
@ -172,7 +172,7 @@ index e4add93..bc4a8dd 100644
verbose("Starting session: %s%s%s for %s from %.200s port %d",
session_type,
tty == NULL ? "" : " on ",
@@ -1681,14 +1688,6 @@ child_close_fds(void)
@@ -1677,14 +1684,6 @@ child_close_fds(void)
* descriptors left by system functions. They will be closed later.
*/
endpwent();
@ -187,7 +187,7 @@ index e4add93..bc4a8dd 100644
}
/*
@@ -1834,8 +1833,6 @@ do_child(Session *s, const char *command)
@@ -1830,8 +1829,6 @@ do_child(Session *s, const char *command)
exit(1);
}
@ -196,7 +196,7 @@ index e4add93..bc4a8dd 100644
if (!options.use_login)
do_rc_files(s, shell);
@@ -1859,9 +1856,17 @@ do_child(Session *s, const char *command)
@@ -1855,9 +1852,17 @@ do_child(Session *s, const char *command)
argv[i] = NULL;
optind = optreset = 1;
__progname = argv[0];
@ -227,10 +227,10 @@ index 7e644ab..e162b7a 100644
+ return (sftp_server_main(argc, argv, user_pw, 0));
}
diff --git a/sftp-server.c b/sftp-server.c
index b8eb59c..a0e644c 100644
index 0177130..8fa7fc7 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -1437,7 +1437,7 @@ sftp_server_usage(void)
@@ -1440,7 +1440,7 @@ sftp_server_usage(void)
}
int
@ -239,7 +239,7 @@ index b8eb59c..a0e644c 100644
{
fd_set *rset, *wset;
int i, in, out, max, ch, skipargs = 0, log_stderr = 0;
@@ -1450,7 +1450,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
@@ -1453,7 +1453,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
extern char *__progname;
__progname = ssh_get_progname(argv[0]);
@ -248,15 +248,15 @@ index b8eb59c..a0e644c 100644
pw = pwcopy(user_pw);
@@ -1521,7 +1521,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
@@ -1524,7 +1524,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
}
}
- log_init(__progname, log_level, log_facility, log_stderr);
+ log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
if ((cp = getenv("SSH_CONNECTION")) != NULL) {
client_addr = xstrdup(cp);
#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
/*
diff --git a/sftp.h b/sftp.h
index 2bde8bb..ddf1a39 100644
--- a/sftp.h
@ -269,10 +269,10 @@ index 2bde8bb..ddf1a39 100644
+int sftp_server_main(int, char **, struct passwd *, int);
void sftp_server_cleanup_exit(int) __attribute__((noreturn));
diff --git a/sshd.c b/sshd.c
index 3eee75a..9c00bcb 100644
index 39b9c08..ca55d7f 100644
--- a/sshd.c
+++ b/sshd.c
@@ -745,7 +745,7 @@ privsep_postauth(Authctxt *authctxt)
@@ -737,7 +737,7 @@ privsep_postauth(Authctxt *authctxt)
}
/* New socket pair */
@ -281,7 +281,7 @@ index 3eee75a..9c00bcb 100644
pmonitor->m_pid = fork();
if (pmonitor->m_pid == -1)
@@ -763,6 +763,11 @@ privsep_postauth(Authctxt *authctxt)
@@ -755,6 +755,11 @@ privsep_postauth(Authctxt *authctxt)
close(pmonitor->m_sendfd);
pmonitor->m_sendfd = -1;

14
openssh-6.6.1p1-selinux-contexts.patch
View File

@ -1,16 +1,16 @@
diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
index 0077dd7..e3f2ced 100644
index 8f32464..18a2ca4 100644
--- a/openbsd-compat/port-linux-sshd.c
+++ b/openbsd-compat/port-linux-sshd.c
@@ -31,6 +31,7 @@
#include "xmalloc.h"
@@ -32,6 +32,7 @@
#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */
#include "servconf.h"
#include "port-linux.h"
+#include "misc.h"
#include "key.h"
#include "hostfile.h"
#include "auth.h"
@@ -444,7 +445,7 @@ sshd_selinux_setup_exec_context(char *pwname)
@@ -445,7 +446,7 @@ sshd_selinux_setup_exec_context(char *pwname)
void
sshd_selinux_copy_context(void)
{
@ -19,7 +19,7 @@ index 0077dd7..e3f2ced 100644
if (!sshd_selinux_enabled())
return;
@@ -460,6 +461,58 @@ sshd_selinux_copy_context(void)
@@ -461,6 +462,58 @@ sshd_selinux_copy_context(void)
}
}
@ -104,10 +104,10 @@ index cb51f99..8b7cda2 100644
#ifdef LINUX_OOM_ADJUST
diff --git a/sshd.c b/sshd.c
index 512c7ed..3eee75a 100644
index 2871fe9..39b9c08 100644
--- a/sshd.c
+++ b/sshd.c
@@ -637,7 +637,7 @@ privsep_preauth_child(void)
@@ -629,7 +629,7 @@ privsep_preauth_child(void)
demote_sensitive_data();
#ifdef WITH_SELINUX

38
openssh-6.6p1-GSSAPIEnablek5users.patch
View File

@ -1,5 +1,5 @@
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 0a4930e..a7c0c5f 100644
index 961c564..0fcfd7b 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -260,7 +260,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
@ -20,27 +20,27 @@ index 0a4930e..a7c0c5f 100644
k5login_exists);
}
diff --git a/servconf.c b/servconf.c
index d482e79..ad5869b 100644
index e4164b1..87a311b 100644
--- a/servconf.c
+++ b/servconf.c
@@ -158,6 +158,7 @@ initialize_server_options(ServerOptions *options)
options->ip_qos_bulk = -1;
@@ -164,6 +164,7 @@ initialize_server_options(ServerOptions *options)
options->version_addendum = NULL;
options->fingerprint_hash = -1;
options->use_kuserok = -1;
+ options->enable_k5users = -1;
}
void
@@ -315,6 +316,8 @@ fill_default_server_options(ServerOptions *options)
options->show_patchlevel = 0;
@@ -331,6 +332,8 @@ fill_default_server_options(ServerOptions *options)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
if (options->use_kuserok == -1)
options->use_kuserok = 1;
+ if (options->enable_k5users == -1)
+ options->enable_k5users = 0;
/* Turn privilege separation on by default */
if (use_privsep == -1)
@@ -356,7 +359,7 @@ typedef enum {
use_privsep = PRIVSEP_NOSANDBOX;
@@ -371,7 +374,7 @@ typedef enum {
sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
sClientAliveCountMax, sAuthorizedKeysFile,
@ -49,7 +49,7 @@ index d482e79..ad5869b 100644
sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
sUsePrivilegeSeparation, sAllowAgentForwarding,
@@ -430,6 +433,7 @@ static struct {
@@ -447,6 +450,7 @@ static struct {
{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
@ -57,7 +57,7 @@ index d482e79..ad5869b 100644
#else
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
@@ -437,6 +441,7 @@ static struct {
@@ -454,6 +458,7 @@ static struct {
{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
@ -65,7 +65,7 @@ index d482e79..ad5869b 100644
#endif
{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
@@ -1536,6 +1541,10 @@ process_server_config_line(ServerOptions *options, char *line,
@@ -1566,6 +1571,10 @@ process_server_config_line(ServerOptions *options, char *line,
intptr = &options->use_kuserok;
goto parse_flag;
@ -76,7 +76,7 @@ index d482e79..ad5869b 100644
case sPermitOpen:
arg = strdelim(&cp);
if (!arg || *arg == '\0')
@@ -1824,6 +1833,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
@@ -1884,6 +1893,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
M_CP_INTOPT(ip_qos_interactive);
M_CP_INTOPT(ip_qos_bulk);
M_CP_INTOPT(use_kuserok);
@ -84,19 +84,19 @@ index d482e79..ad5869b 100644
M_CP_INTOPT(rekey_limit);
M_CP_INTOPT(rekey_interval);
@@ -2076,6 +2086,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
@@ -2143,6 +2153,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
+ dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
/* string arguments */
dump_cfg_string(sPidFile, o->pid_file);
diff --git a/servconf.h b/servconf.h
index 5117dfa..d63cb71 100644
index cf2a505..070a8ed 100644
--- a/servconf.h
+++ b/servconf.h
@@ -173,7 +173,8 @@ typedef struct {
@@ -175,7 +175,8 @@ typedef struct {
int num_permitted_opens;
@ -107,7 +107,7 @@ index 5117dfa..d63cb71 100644
char *revoked_keys_file;
char *trusted_user_ca_keys;
diff --git a/sshd_config b/sshd_config
index 43671f6..6ab00ed 100644
index 0d9454d..e731de1 100644
--- a/sshd_config
+++ b/sshd_config
@@ -94,6 +94,7 @@ GSSAPIAuthentication yes
@ -119,10 +119,10 @@ index 43671f6..6ab00ed 100644
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
diff --git a/sshd_config.5 b/sshd_config.5
index e0e5fff..aa9525d 100644
index eb4dd9e..ce1229b 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -505,6 +505,12 @@ on logout.
@@ -548,6 +548,12 @@ on logout.
The default is
.Dq yes .
Note that this option applies to protocol version 2 only.

12
openssh-6.6p1-ctr-cavstest.patch
View File

@ -1,5 +1,5 @@
diff --git a/Makefile.in b/Makefile.in
index 4ab6717..581b121 100644
index b225217..bbc3034 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -28,6 +28,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
@ -10,16 +10,16 @@ index 4ab6717..581b121 100644
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
@@ -66,7 +67,7 @@ EXEEXT=@EXEEXT@
MANFMT=@MANFMT@
INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
canohost.o channels.o cipher.o cipher-aes.o \
@@ -180,6 +181,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o
LIBOPENSSH_OBJS=\
ssherr.o \
@@ -190,6 +191,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o
ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o
$(LD) -o $@ ssh-keycat.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(SSHLIBS)
@ -29,7 +29,7 @@ index 4ab6717..581b121 100644
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
@@ -288,6 +292,7 @@ install-files:
@@ -310,6 +314,7 @@ install-files:
$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
fi
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)

36
openssh-6.6p1-entropy.patch
View File

@ -1,8 +1,8 @@
diff --git a/entropy.c b/entropy.c
index 2d483b3..b361a04 100644
index 1e9d52a..d24e724 100644
--- a/entropy.c
+++ b/entropy.c
@@ -234,6 +234,9 @@ seed_rng(void)
@@ -227,6 +227,9 @@ seed_rng(void)
memset(buf, '\0', sizeof(buf));
#endif /* OPENSSL_PRNG_ONLY */
@ -13,12 +13,12 @@ index 2d483b3..b361a04 100644
fatal("PRNG is not seeded");
}
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
index b912dbe..9206337 100644
index 843225d..041bbab 100644
--- a/openbsd-compat/Makefile.in
+++ b/openbsd-compat/Makefile.in
@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bcrypt_pbkdf.o bindresvport.o blowfish.o daemon.o di
COMPAT=arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
COMPAT=arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o kludge-fd_set.o
-PORTS=port-aix.o port-irix.o port-linux.o port-linux-sshd.o port-solaris.o port-tun.o port-uw.o
+PORTS=port-aix.o port-irix.o port-linux.o port-linux-sshd.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o
@ -27,7 +27,7 @@ index b912dbe..9206337 100644
$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
diff --git a/openbsd-compat/port-linux-prng.c b/openbsd-compat/port-linux-prng.c
new file mode 100644
index 0000000..92a617c
index 0000000..da84bf2
--- /dev/null
+++ b/openbsd-compat/port-linux-prng.c
@@ -0,0 +1,59 @@
@ -63,6 +63,7 @@ index 0000000..92a617c
+
+#include "log.h"
+#include "xmalloc.h"
+#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */
+#include "servconf.h"
+#include "port-linux.h"
+#include "key.h"
@ -72,10 +73,9 @@ index 0000000..92a617c
+void
+linux_seed(void)
+{
+ int len;
+ char *env = getenv("SSH_USE_STRONG_RNG");
+ char *random = "/dev/random";
+ size_t ienv, randlen = 14;
+ size_t len, ienv, randlen = 14;
+
+ if (!env || !strcmp(env, "0"))
+ random = "/dev/urandom";
@ -91,7 +91,7 @@ index 0000000..92a617c
+ }
+}
diff --git a/ssh-add.0 b/ssh-add.0
index ba43fee..0b2629a 100644
index f16165a..17d22cf 100644
--- a/ssh-add.0
+++ b/ssh-add.0
@@ -82,6 +82,16 @@ ENVIRONMENT
@ -112,10 +112,10 @@ index ba43fee..0b2629a 100644
~/.ssh/identity
Contains the protocol version 1 RSA authentication identity of
diff --git a/ssh-add.1 b/ssh-add.1
index 4812448..16305bf 100644
index 04d1840..db883a4 100644
--- a/ssh-add.1
+++ b/ssh-add.1
@@ -161,6 +161,20 @@ to make this work.)
@@ -170,6 +170,20 @@ to make this work.)
Identifies the path of a
.Ux Ns -domain
socket used to communicate with the agent.
@ -137,10 +137,10 @@ index 4812448..16305bf 100644
.Sh FILES
.Bl -tag -width Ds
diff --git a/ssh-agent.1 b/ssh-agent.1
index 281ecbd..1a9a635 100644
index d7e791b..7332f0d 100644
--- a/ssh-agent.1
+++ b/ssh-agent.1
@@ -201,6 +201,24 @@ sockets used to contain the connection to the authentication agent.
@@ -189,6 +189,24 @@ sockets used to contain the connection to the authentication agent.
These sockets should only be readable by the owner.
The sockets should get automatically removed when the agent exits.
.El
@ -166,10 +166,10 @@ index 281ecbd..1a9a635 100644
.Xr ssh 1 ,
.Xr ssh-add 1 ,
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index 12e00d4..1b51a4a 100644
index 276dacc..a09d9b1 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -832,6 +832,24 @@ Contains Diffie-Hellman groups used for DH-GEX.
@@ -841,6 +841,24 @@ Contains Diffie-Hellman groups used for DH-GEX.
The file format is described in
.Xr moduli 5 .
.El
@ -224,10 +224,10 @@ index 69d0829..02d79f8 100644
.Xr ssh 1 ,
.Xr ssh-keygen 1 ,
diff --git a/ssh.1 b/ssh.1
index 929904b..f65e42f 100644
index 4a476c2..410a04a 100644
--- a/ssh.1
+++ b/ssh.1
@@ -1309,6 +1309,23 @@ For more information, see the
@@ -1299,6 +1299,23 @@ For more information, see the
.Cm PermitUserEnvironment
option in
.Xr sshd_config 5 .
@ -252,10 +252,10 @@ index 929904b..f65e42f 100644
.Bl -tag -width Ds -compact
.It Pa ~/.rhosts
diff --git a/sshd.8 b/sshd.8
index c2c237f..058d37a 100644
index cb866b5..adcaaf9 100644
--- a/sshd.8
+++ b/sshd.8
@@ -951,6 +951,24 @@ concurrently for different ports, this contains the process ID of the one
@@ -945,6 +945,24 @@ concurrently for different ports, this contains the process ID of the one
started last).
The content of this file is not sensitive; it can be world-readable.
.El

415
openssh-6.6p1-fingerprint.patch
View File

@ -1,415 +0,0 @@
diff --git a/auth.c b/auth.c
index 9a36f1d..420a85b 100644
--- a/auth.c
+++ b/auth.c
@@ -685,9 +685,10 @@ auth_key_is_revoked(Key *key)
case 1:
revoked:
/* Key revoked */
- key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ key_fp = key_selected_fingerprint(key, SSH_FP_HEX);
error("WARNING: authentication attempt with a revoked "
- "%s key %s ", key_type(key), key_fp);
+ "%s key %s%s ", key_type(key),
+ key_fingerprint_prefix(), key_fp);
free(key_fp);
return 1;
}
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 488008f..eca0069 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -206,16 +206,18 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
if (host_status == HOST_OK) {
if (key_is_cert(key)) {
- fp = key_fingerprint(key->cert->signature_key,
- SSH_FP_MD5, SSH_FP_HEX);
+ fp = key_selected_fingerprint(key->cert->signature_key,
+ SSH_FP_HEX);
verbose("Accepted certificate ID \"%s\" signed by "
- "%s CA %s from %s@%s", key->cert->key_id,
- key_type(key->cert->signature_key), fp,
+ "%s CA %s%s from %s@%s", key->cert->key_id,
+ key_type(key->cert->signature_key),
+ key_fingerprint_prefix(), fp,
cuser, lookup);
} else {
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
- verbose("Accepted %s public key %s from %s@%s",
- key_type(key), fp, cuser, lookup);
+ fp = key_selected_fingerprint(key, SSH_FP_HEX);
+ verbose("Accepted %s public key %s%s from %s@%s",
+ key_type(key), key_fingerprint_prefix(),
+ fp, cuser, lookup);
}
free(fp);
}
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 0fd27bb..749b11a 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -365,10 +365,10 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
continue;
if (!key_is_cert_authority)
continue;
- fp = key_fingerprint(found, SSH_FP_MD5,
- SSH_FP_HEX);
- debug("matching CA found: file %s, line %lu, %s %s",
- file, linenum, key_type(found), fp);
+ fp = key_selected_fingerprint(found, SSH_FP_HEX);
+ debug("matching CA found: file %s, line %lu, %s %s%s",
+ file, linenum, key_type(found),
+ key_fingerprint_prefix(), fp);
/*
* If the user has specified a list of principals as
* a key option, then prefer that list to matching
@@ -406,9 +406,9 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
if (key_is_cert_authority)
continue;
found_key = 1;
- fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
- debug("matching key found: file %s, line %lu %s %s",
- file, linenum, key_type(found), fp);
+ fp = key_selected_fingerprint(found, SSH_FP_HEX);
+ verbose("Found matching %s key: %s%s",
+ key_type(found), key_fingerprint_prefix(), fp);
free(fp);
break;
}
@@ -431,13 +431,13 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
return 0;
- ca_fp = key_fingerprint(key->cert->signature_key,
- SSH_FP_MD5, SSH_FP_HEX);
+ ca_fp = key_selected_fingerprint(key->cert->signature_key, SSH_FP_HEX);
if (key_in_file(key->cert->signature_key,
options.trusted_user_ca_keys, 1) != 1) {
- debug2("%s: CA %s %s is not listed in %s", __func__,
- key_type(key->cert->signature_key), ca_fp,
+ debug2("%s: CA %s%s %s is not listed in %s", __func__,
+ key_type(key->cert->signature_key),
+ key_fingerprint_prefix(), ca_fp,
options.trusted_user_ca_keys);
goto out;
}
diff --git a/key.c b/key.c
index 168e1b7..eb98ea8 100644
--- a/key.c
+++ b/key.c
@@ -628,6 +628,34 @@ key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
return retval;
}
+enum fp_type
+key_fingerprint_selection(void)
+{
+ static enum fp_type rv;
+ static char rv_defined = 0;
+ char *env;
+
+ if (!rv_defined) {
+ env = getenv("SSH_FINGERPRINT_TYPE");
+ rv = (env && !strcmp (env, "sha")) ?
+ SSH_FP_SHA1 : SSH_FP_MD5;
+ rv_defined = 1;
+ }
+ return rv;
+}
+
+char *
+key_selected_fingerprint(Key *k, enum fp_rep dgst_rep)
+{
+ return key_fingerprint(k, key_fingerprint_selection(), dgst_rep);
+}
+
+char *
+key_fingerprint_prefix(void)
+{
+ return key_fingerprint_selection() == SSH_FP_SHA1 ? "sha1:" : "";
+}
+
/*
* Reads a multiple-precision integer in decimal from the buffer, and advances
* the pointer. The integer must already be initialized. This function is
diff --git a/key.h b/key.h
index d8ad13d..0e3eea5 100644
--- a/key.h
+++ b/key.h
@@ -104,6 +104,9 @@ int key_equal_public(const Key *, const Key *);
int key_equal(const Key *, const Key *);
char *key_fingerprint(const Key *, enum fp_type, enum fp_rep);
u_char *key_fingerprint_raw(const Key *, enum fp_type, u_int *);
+enum fp_type key_fingerprint_selection(void);
+char *key_selected_fingerprint(Key *, enum fp_rep);
+char *key_fingerprint_prefix(void);
const char *key_type(const Key *);
const char *key_cert_type(const Key *);
int key_write(const Key *, FILE *);
diff --git a/ssh-add.c b/ssh-add.c
index 3421452..691949f 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -330,10 +330,10 @@ list_identities(AuthenticationConnection *ac, int do_fp)
key = ssh_get_next_identity(ac, &comment, version)) {
had_identities = 1;
if (do_fp) {
- fp = key_fingerprint(key, SSH_FP_MD5,
- SSH_FP_HEX);
- printf("%d %s %s (%s)\n",
- key_size(key), fp, comment, key_type(key));
+ fp = key_selected_fingerprint(key, SSH_FP_HEX);
+ printf("%d %s%s %s (%s)\n",
+ key_size(key), key_fingerprint_prefix(),
+ fp, comment, key_type(key));
free(fp);
} else {
if (!key_write(key, stdout))
diff --git a/ssh-agent.c b/ssh-agent.c
index ba24612..117fdde 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -198,9 +198,9 @@ confirm_key(Identity *id)
char *p;
int ret = -1;
- p = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
- if (ask_permission("Allow use of key %s?\nKey fingerprint %s.",
- id->comment, p))
+ p = key_selected_fingerprint(id->key, SSH_FP_HEX);
+ if (ask_permission("Allow use of key %s?\nKey fingerprint %s%s.",
+ id->comment, key_fingerprint_prefix(), p))
ret = 0;
free(p);
diff --git a/ssh-keygen.c b/ssh-keygen.c
index 2a316bc..482dc1c 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -783,13 +783,14 @@ do_fingerprint(struct passwd *pw)
{
FILE *f;
Key *public;
- char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra;
+ char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra, *pfx;
int i, skip = 0, num = 0, invalid = 1;
enum fp_rep rep;
enum fp_type fptype;
struct stat st;
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : key_fingerprint_selection();
+ pfx = print_bubblebabble ? "" : key_fingerprint_prefix();
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
if (!have_identity)
@@ -801,8 +802,8 @@ do_fingerprint(struct passwd *pw)
public = key_load_public(identity_file, &comment);
if (public != NULL) {
fp = key_fingerprint(public, fptype, rep);
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
- printf("%u %s %s (%s)\n", key_size(public), fp, comment,
+ ra = key_selected_fingerprint(public, SSH_FP_RANDOMART);
+ printf("%u %s%s %s (%s)\n", key_size(public), pfx, fp, comment,
key_type(public));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
@@ -867,8 +868,8 @@ do_fingerprint(struct passwd *pw)
}
comment = *cp ? cp : comment;
fp = key_fingerprint(public, fptype, rep);
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
- printf("%u %s %s (%s)\n", key_size(public), fp,
+ ra = key_selected_fingerprint(public, SSH_FP_RANDOMART);
+ printf("%u %s%s %s (%s)\n", key_size(public), pfx, fp,
comment ? comment : "no comment", key_type(public));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
@@ -986,13 +987,15 @@ printhost(FILE *f, const char *name, Key *public, int ca, int hash)
if (print_fingerprint) {
enum fp_rep rep;
enum fp_type fptype;
- char *fp, *ra;
+ char *fp, *ra, *pfx;
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : key_fingerprint_selection();
+ pfx = print_bubblebabble ? "" : key_fingerprint_prefix();
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+
fp = key_fingerprint(public, fptype, rep);
- ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
- printf("%u %s %s (%s)\n", key_size(public), fp, name,
+ ra = key_selected_fingerprint(public, SSH_FP_RANDOMART);
+ printf("%u %s%s %s (%s)\n", key_size(public), pfx, fp, name,
key_type(public));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
@@ -1878,16 +1881,17 @@ do_show_cert(struct passwd *pw)
fatal("%s is not a certificate", identity_file);
v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
- key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
- ca_fp = key_fingerprint(key->cert->signature_key,
- SSH_FP_MD5, SSH_FP_HEX);
+ key_fp = key_selected_fingerprint(key, SSH_FP_HEX);
+ ca_fp = key_selected_fingerprint(key->cert->signature_key, SSH_FP_HEX);
printf("%s:\n", identity_file);
printf(" Type: %s %s certificate\n", key_ssh_name(key),
key_cert_type(key));
- printf(" Public key: %s %s\n", key_type(key), key_fp);
- printf(" Signing CA: %s %s\n",
- key_type(key->cert->signature_key), ca_fp);
+ printf(" Public key: %s %s%s\n", key_type(key),
+ key_fingerprint_prefix(), key_fp);
+ printf(" Signing CA: %s %s%s\n",
+ key_type(key->cert->signature_key),
+ key_fingerprint_prefix(), ca_fp);
printf(" Key ID: \"%s\"\n", key->cert->key_id);
if (!v00) {
printf(" Serial: %llu\n",
@@ -2686,13 +2690,12 @@ passphrase_again:
fclose(f);
if (!quiet) {
- char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);
- char *ra = key_fingerprint(public, SSH_FP_MD5,
- SSH_FP_RANDOMART);
+ char *fp = key_selected_fingerprint(public, SSH_FP_HEX);
+ char *ra = key_selected_fingerprint(public, SSH_FP_RANDOMART);
printf("Your public key has been saved in %s.\n",
identity_file);
printf("The key fingerprint is:\n");
- printf("%s %s\n", fp, comment);
+ printf("%s%s %s\n", key_fingerprint_prefix(), fp, comment);
printf("The key's randomart image is:\n");
printf("%s\n", ra);
free(ra);
diff --git a/sshconnect.c b/sshconnect.c
index 573d7a8..394cca8 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -914,10 +914,10 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
"key for IP address '%.128s' to the list "
"of known hosts.", type, ip);
} else if (options.visual_host_key) {
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
- ra = key_fingerprint(host_key, SSH_FP_MD5,
- SSH_FP_RANDOMART);
- logit("Host key fingerprint is %s\n%s\n", fp, ra);
+ fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
+ ra = key_selected_fingerprint(host_key, SSH_FP_RANDOMART);
+ logit("Host key fingerprint is %s%s\n%s\n",
+ key_fingerprint_prefix(), fp, ra);
free(ra);
free(fp);
}
@@ -955,9 +955,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
else
snprintf(msg1, sizeof(msg1), ".");
/* The default */
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
- ra = key_fingerprint(host_key, SSH_FP_MD5,
- SSH_FP_RANDOMART);
+ fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
+ ra = key_selected_fingerprint(host_key, SSH_FP_RANDOMART);
msg2[0] = '\0';
if (options.verify_host_key_dns) {
if (matching_host_key_dns)
@@ -972,10 +971,11 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
snprintf(msg, sizeof(msg),
"The authenticity of host '%.200s (%s)' can't be "
"established%s\n"
- "%s key fingerprint is %s.%s%s\n%s"
+ "%s key fingerprint is %s%s.%s%s\n%s"
"Are you sure you want to continue connecting "
"(yes/no)? ",
- host, ip, msg1, type, fp,
+ host, ip, msg1, type,
+ key_fingerprint_prefix(), fp,
options.visual_host_key ? "\n" : "",
options.visual_host_key ? ra : "",
msg2);
@@ -1220,8 +1220,9 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
int flags = 0;
char *fp;
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
- debug("Server host key: %s %s", key_type(host_key), fp);
+ fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
+ debug("Server host key: %s %s%s", key_type(host_key),
+ key_fingerprint_prefix(), fp);
free(fp);
/* XXX certs are not yet supported for DNS */
@@ -1327,14 +1328,15 @@ show_other_keys(struct hostkeys *hostkeys, Key *key)
continue;
if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
continue;
- fp = key_fingerprint(found->key, SSH_FP_MD5, SSH_FP_HEX);
- ra = key_fingerprint(found->key, SSH_FP_MD5, SSH_FP_RANDOMART);
+ fp = key_selected_fingerprint(found->key, SSH_FP_HEX);
+ ra = key_selected_fingerprint(found->key, SSH_FP_RANDOMART);
logit("WARNING: %s key found for host %s\n"
"in %s:%lu\n"
- "%s key fingerprint %s.",
+ "%s key fingerprint %s%s.",
key_type(found->key),
found->host, found->file, found->line,
- key_type(found->key), fp);
+ key_type(found->key),
+ key_fingerprint_prefix(), fp);
if (options.visual_host_key)
logit("%s", ra);
free(ra);
@@ -1349,7 +1351,7 @@ warn_changed_key(Key *host_key)
{
char *fp;
- fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
+ fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
@@ -1357,8 +1359,8 @@ warn_changed_key(Key *host_key)
error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
error("It is also possible that a host key has just been changed.");
- error("The fingerprint for the %s key sent by the remote host is\n%s.",
- key_type(host_key), fp);
+ error("The fingerprint for the %s key sent by the remote host is\n%s%s.",
+ key_type(host_key),key_fingerprint_prefix(), fp);
error("Please contact your system administrator.");
free(fp);
diff --git a/sshconnect2.c b/sshconnect2.c
index 7f4ff41..adbbfc7 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -577,8 +577,9 @@ input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
key->type, pktype);
goto done;
}
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
- debug2("input_userauth_pk_ok: fp %s", fp);
+ fp = key_selected_fingerprint(key, SSH_FP_HEX);
+ debug2("input_userauth_pk_ok: fp %s%s",
+ key_fingerprint_prefix(), fp);
free(fp);
/*
@@ -986,8 +987,9 @@ sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
int have_sig = 1;
char *fp;
- fp = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
- debug3("sign_and_send_pubkey: %s %s", key_type(id->key), fp);
+ fp = key_selected_fingerprint(id->key, SSH_FP_HEX);
+ debug3("sign_and_send_pubkey: %s %s%s", key_type(id->key),
+ key_fingerprint_prefix(), fp);
free(fp);
if (key_to_blob(id->key, &blob, &bloblen) == 0) {

25
openssh-6.6p1-force_krb.patch
View File

@ -1,5 +1,5 @@
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 42de994..60de320 100644
index 413b845..54dd383 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -32,7 +32,9 @@
@ -12,12 +12,7 @@ index 42de994..60de320 100644
#include "xmalloc.h"
#include "key.h"
@@ -40,10 +42,12 @@
#include "auth.h"
#include "log.h"
#include "servconf.h"
+#include "misc.h"
@@ -45,6 +47,7 @@
#include "buffer.h"
#include "ssh-gss.h"
@ -25,7 +20,7 @@ index 42de994..60de320 100644
extern ServerOptions options;
#ifdef HEIMDAL
@@ -55,6 +59,13 @@ extern ServerOptions options;
@@ -56,6 +59,13 @@ extern ServerOptions options;
# include <gssapi/gssapi_krb5.h>
#endif
@ -39,7 +34,7 @@ index 42de994..60de320 100644
static krb5_context krb_context = NULL;
/* Initialise the krb5 library, for the stuff that GSSAPI won't do */
@@ -87,6 +98,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
@@ -88,6 +98,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
krb5_principal princ;
int retval;
const char *errmsg;
@ -47,7 +42,7 @@ index 42de994..60de320 100644
if (ssh_gssapi_krb5_init() == 0)
return 0;
@@ -98,10 +110,22 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
@@ -99,10 +110,22 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
krb5_free_error_message(krb_context, errmsg);
return 0;
}
@ -71,7 +66,7 @@ index 42de994..60de320 100644
} else
retval = 0;
@@ -109,6 +133,135 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
@@ -110,6 +133,135 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
return retval;
}
@ -208,10 +203,10 @@ index 42de994..60de320 100644
/* This writes out any forwarded credentials from the structure populated
* during userauth. Called after we have setuid to the user */
diff --git a/session.c b/session.c
index b5dc144..ba4589b 100644
index 28659ec..9c94d8e 100644
--- a/session.c
+++ b/session.c
@@ -806,6 +806,29 @@ do_exec(Session *s, const char *command)
@@ -789,6 +789,29 @@ do_exec(Session *s, const char *command)
command = forced_command;
forced = "(key-option)";
}
@ -257,10 +252,10 @@ index 0374c88..509109a 100644
/* draft-ietf-secsh-gsskeyex-06 */
diff --git a/sshd.8 b/sshd.8
index 058d37a..5c4f15b 100644
index adcaaf9..824163b 100644
--- a/sshd.8
+++ b/sshd.8
@@ -327,6 +327,7 @@ Finally, the server and the client enter an authentication dialog.
@@ -324,6 +324,7 @@ Finally, the server and the client enter an authentication dialog.
The client tries to authenticate itself using
host-based authentication,
public key authentication,

253
openssh-6.6p1-gsskex.patch
View File

@ -1,8 +1,8 @@
diff --git a/Makefile.in b/Makefile.in
index 581b121..2ad26ff 100644
index bbc3034..c9891e0 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -77,6 +77,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
@@ -87,6 +87,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
@ -10,7 +10,7 @@ index 581b121..2ad26ff 100644
msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
ssh-pkcs11.o krl.o smult_curve25519_ref.o \
kexc25519.o kexc25519c.o poly1305.o chacha.o cipher-chachapoly.o \
@@ -96,7 +97,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
@@ -106,7 +107,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
auth2-none.o auth2-passwd.o auth2-pubkey.o \
monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
kexc25519s.o auth-krb5.o \
@ -20,10 +20,10 @@ index 581b121..2ad26ff 100644
sftp-server.o sftp-common.o \
roaming_common.o roaming_serv.o \
diff --git a/auth2-gss.c b/auth2-gss.c
index 4756dd7..ad65059 100644
index 4803e7e..222e3e0 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -52,6 +52,40 @@ static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
@@ -53,6 +53,40 @@ static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
static void input_gssapi_errtok(int, u_int32_t, void *);
@ -64,7 +64,7 @@ index 4756dd7..ad65059 100644
/*
* We only support those mechanisms that we know about (ie ones that we know
* how to check local user kuserok and the like)
@@ -235,7 +269,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
@@ -236,7 +270,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
packet_check_eom();
@ -74,7 +74,7 @@ index 4756dd7..ad65059 100644
authctxt->postponed = 0;
dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
@@ -277,7 +312,8 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
@@ -278,7 +313,8 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
gssbuf.length = buffer_len(&b);
if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
@ -84,7 +84,7 @@ index 4756dd7..ad65059 100644
else
logit("GSSAPI MIC check failed");
@@ -294,6 +330,12 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
@@ -295,6 +331,12 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
}
@ -98,10 +98,10 @@ index 4756dd7..ad65059 100644
"gssapi-with-mic",
userauth_gssapi,
diff --git a/auth2.c b/auth2.c
index 5f4f26f..0f52b68 100644
index d6fbc93..124d02b 100644
--- a/auth2.c
+++ b/auth2.c
@@ -69,6 +69,7 @@ extern Authmethod method_passwd;
@@ -70,6 +70,7 @@ extern Authmethod method_passwd;
extern Authmethod method_kbdint;
extern Authmethod method_hostbased;
#ifdef GSSAPI
@ -109,7 +109,7 @@ index 5f4f26f..0f52b68 100644
extern Authmethod method_gssapi;
#endif
@@ -76,6 +77,7 @@ Authmethod *authmethods[] = {
@@ -77,6 +78,7 @@ Authmethod *authmethods[] = {
&method_none,
&method_pubkey,
#ifdef GSSAPI
@ -118,7 +118,7 @@ index 5f4f26f..0f52b68 100644
#endif
&method_passwd,
diff --git a/clientloop.c b/clientloop.c
index 59ad3a2..9c60108 100644
index 397c965..20ce0b5 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -111,6 +111,10 @@
@ -132,7 +132,7 @@ index 59ad3a2..9c60108 100644
/* import options */
extern Options options;
@@ -1608,6 +1612,15 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
@@ -1596,6 +1600,15 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
/* Do channel operations unless rekeying in progress. */
if (!rekeying) {
channel_after_select(readset, writeset);
@ -149,7 +149,7 @@ index 59ad3a2..9c60108 100644
debug("need rekeying");
xxx_kex->done = 0;
diff --git a/configure.ac b/configure.ac
index 74e77db..9bde04e 100644
index 8dedb95..2c4adac 100644
--- a/configure.ac
+++ b/configure.ac
@@ -584,6 +584,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
@ -526,10 +526,10 @@ index b39281b..a3a2289 100644
+
#endif /* GSSAPI */
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 759fa10..42de994 100644
index 795992d..413b845 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -120,7 +120,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
@@ -121,7 +121,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
krb5_error_code problem;
krb5_principal princ;
OM_uint32 maj_status, min_status;
@ -538,7 +538,7 @@ index 759fa10..42de994 100644
const char *errmsg;
if (client->creds == NULL) {
@@ -180,11 +180,26 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
@@ -181,11 +181,26 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
return;
}
@ -569,7 +569,7 @@ index 759fa10..42de994 100644
#ifdef USE_PAM
if (options.use_pam)
@@ -193,9 +208,76 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
@@ -194,9 +209,76 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
krb5_cc_close(krb_context, ccache);
@ -646,7 +646,7 @@ index 759fa10..42de994 100644
ssh_gssapi_mech gssapi_kerberos_mech = {
"toWM5Slw5Ew8Mqkay+al2g==",
"Kerberos",
@@ -203,7 +285,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = {
@@ -204,7 +286,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = {
NULL,
&ssh_gssapi_krb5_userok,
NULL,
@ -657,7 +657,7 @@ index 759fa10..42de994 100644
#endif /* KRB5 */
diff --git a/gss-serv.c b/gss-serv.c
index e61b37b..14f540e 100644
index 5c59924..2289e8e 100644
--- a/gss-serv.c
+++ b/gss-serv.c
@@ -45,15 +45,20 @@
@ -684,7 +684,7 @@ index e61b37b..14f540e 100644
#ifdef KRB5
extern ssh_gssapi_mech gssapi_kerberos_mech;
@@ -100,25 +105,32 @@ ssh_gssapi_acquire_cred(Gssctxt *ctx)
char lname[MAXHOSTNAMELEN];
char lname[NI_MAXHOST];
gss_OID_set oidset;
- gss_create_empty_oid_set(&status, &oidset);
@ -693,11 +693,11 @@ index e61b37b..14f540e 100644
+ gss_create_empty_oid_set(&status, &oidset);
+ gss_add_oid_set_member(&status, ctx->oid, &oidset);
- if (gethostname(lname, MAXHOSTNAMELEN)) {
- if (gethostname(lname, sizeof(lname))) {
- gss_release_oid_set(&status, &oidset);
- return (-1);
- }
+ if (gethostname(lname, MAXHOSTNAMELEN)) {
+ if (gethostname(lname, sizeof(lname))) {
+ gss_release_oid_set(&status, &oidset);
+ return (-1);
+ }
@ -708,25 +708,25 @@ index e61b37b..14f540e 100644
+ }
+
+ if ((ctx->major = gss_acquire_cred(&ctx->minor,
+ ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds,
+ NULL, NULL)))
+ ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
+ ssh_gssapi_error(ctx);
- if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
gss_release_oid_set(&status, &oidset);
return (ctx->major);
+ } else {
+ ctx->name = GSS_C_NO_NAME;
+ ctx->creds = GSS_C_NO_CREDENTIAL;
}
- }
-
- if ((ctx->major = gss_acquire_cred(&ctx->minor,
- ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
- ssh_gssapi_error(ctx);
-
+ } else {
+ ctx->name = GSS_C_NO_NAME;
+ ctx->creds = GSS_C_NO_CREDENTIAL;
+ return GSS_S_COMPLETE;
+ }
- gss_release_oid_set(&status, &oidset);
- return (ctx->major);
+ return GSS_S_COMPLETE;
}
/* Privileged */
@ -796,8 +796,7 @@ index e61b37b..14f540e 100644
+
+ ctx->major = gss_compare_name(&ctx->minor, client->name,
+ new_name, &equal);
- gss_buffer_desc ename;
+
+ if (GSS_ERROR(ctx->major)) {
+ ssh_gssapi_error(ctx);
+ return (ctx->major);
@ -809,7 +808,8 @@ index e61b37b..14f540e 100644
+ }
+
+ debug("Marking rekeyed credentials for export");
+
- gss_buffer_desc ename;
+ gss_release_name(&ctx->minor, &client->name);
+ gss_release_cred(&ctx->minor, &client->creds);
+ client->name = new_name;
@ -991,10 +991,10 @@ index e61b37b..14f540e 100644
#endif
diff --git a/kex.c b/kex.c
index 74e2b86..bce2ab8 100644
index a173e70..4563920 100644
--- a/kex.c
+++ b/kex.c
@@ -51,6 +51,10 @@
@@ -53,6 +53,10 @@
#include "roaming.h"
#include "digest.h"
@ -1005,10 +1005,10 @@ index 74e2b86..bce2ab8 100644
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
# if defined(HAVE_EVP_SHA256)
# define evp_ssh_sha256 EVP_sha256
@@ -90,6 +94,11 @@ static const struct kexalg kexalgs[] = {
@@ -94,6 +98,11 @@ static const struct kexalg kexalgs[] = {
#ifdef HAVE_EVP_SHA256
{ KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
#endif
#endif /* HAVE_EVP_SHA256 */
+#ifdef GSSAPI
+ { KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
+ { KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
@ -1017,7 +1017,7 @@ index 74e2b86..bce2ab8 100644
{ NULL, -1, -1, -1},
};
@@ -119,6 +128,12 @@ kex_alg_by_name(const char *name)
@@ -123,6 +132,12 @@ kex_alg_by_name(const char *name)
for (k = kexalgs; k->name != NULL; k++) {
if (strcmp(k->name, name) == 0)
return k;
@ -1031,7 +1031,7 @@ index 74e2b86..bce2ab8 100644
return NULL;
}
diff --git a/kex.h b/kex.h
index c85680e..313bb51 100644
index 4c40ec8..1c76c08 100644
--- a/kex.h
+++ b/kex.h
@@ -76,6 +76,11 @@ enum kex_exchange {
@ -1412,10 +1412,10 @@ index 0000000..e90b567
+#endif /* GSSAPI */
diff --git a/kexgsss.c b/kexgsss.c
new file mode 100644
index 0000000..6d7518c
index 0000000..b880998
--- /dev/null
+++ b/kexgsss.c
@@ -0,0 +1,288 @@
@@ -0,0 +1,289 @@
+/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
+ *
@ -1460,6 +1460,7 @@ index 0000000..6d7518c
+#include "dh.h"
+#include "ssh-gss.h"
+#include "monitor_wrap.h"
+#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */
+#include "servconf.h"
+
+extern ServerOptions options;
@ -1704,35 +1705,11 @@ index 0000000..6d7518c
+ ssh_gssapi_rekey_creds();
+}
+#endif /* GSSAPI */
diff --git a/key.c b/key.c
index eb98ea8..900b9e3 100644
--- a/key.c
+++ b/key.c
@@ -1013,6 +1013,7 @@ static const struct keytype keytypes[] = {
KEY_DSA_CERT_V00, 0, 1 },
{ "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT",
KEY_ED25519_CERT, 0, 1 },
+ { "null", "null", KEY_NULL, 0, 0 },
{ NULL, NULL, -1, -1, 0 }
};
diff --git a/key.h b/key.h
index 0e3eea5..d51ed81 100644
--- a/key.h
+++ b/key.h
@@ -46,6 +46,7 @@ enum types {
KEY_ED25519_CERT,
KEY_RSA_CERT_V00,
KEY_DSA_CERT_V00,
+ KEY_NULL,
KEY_UNSPEC
};
enum fp_type {
diff --git a/monitor.c b/monitor.c
index 229fada..aa70945 100644
index d3f87e1..7ebc76e 100644
--- a/monitor.c
+++ b/monitor.c
@@ -178,6 +178,8 @@ int mm_answer_gss_setup_ctx(int, Buffer *);
@@ -181,6 +181,8 @@ int mm_answer_gss_setup_ctx(int, Buffer *);
int mm_answer_gss_accept_ctx(int, Buffer *);
int mm_answer_gss_userok(int, Buffer *);
int mm_answer_gss_checkmic(int, Buffer *);
@ -1741,7 +1718,7 @@ index 229fada..aa70945 100644
#endif
#ifdef SSH_AUDIT_EVENTS
@@ -253,11 +255,18 @@ struct mon_table mon_dispatch_proto20[] = {
@@ -261,11 +263,18 @@ struct mon_table mon_dispatch_proto20[] = {
{MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
{MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
{MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
@ -1757,10 +1734,10 @@ index 229fada..aa70945 100644
+ {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign},
+ {MONITOR_REQ_GSSUPCREDS, 0, mm_answer_gss_updatecreds},
+#endif
#ifdef WITH_OPENSSL
{MONITOR_REQ_MODULI, 0, mm_answer_moduli},
{MONITOR_REQ_SIGN, 0, mm_answer_sign},
{MONITOR_REQ_PTY, 0, mm_answer_pty},
@@ -366,6 +375,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
#endif
@@ -380,6 +389,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
/* Permit requests for moduli and signatures */
monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@ -1771,7 +1748,7 @@ index 229fada..aa70945 100644
} else {
mon_dispatch = mon_dispatch_proto15;
@@ -471,6 +484,10 @@ monitor_child_postauth(struct monitor *pmonitor)
@@ -488,6 +501,10 @@ monitor_child_postauth(struct monitor *pmonitor)
monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@ -1782,9 +1759,9 @@ index 229fada..aa70945 100644
} else {
mon_dispatch = mon_dispatch_postauth15;
monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -1866,6 +1883,13 @@ mm_get_kex(Buffer *m)
kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
@@ -1893,6 +1910,13 @@ mm_get_kex(Buffer *m)
kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
#endif
kex->kex[KEX_C25519_SHA256] = kexc25519_server;
+#ifdef GSSAPI
+ if (options.gss_keyex) {
@ -1796,7 +1773,7 @@ index 229fada..aa70945 100644
kex->server = 1;
kex->hostkey_type = buffer_get_int(m);
kex->kex_type = buffer_get_int(m);
@@ -2073,6 +2097,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m)
@@ -2100,6 +2124,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m)
OM_uint32 major;
u_int len;
@ -1806,7 +1783,7 @@ index 229fada..aa70945 100644
goid.elements = buffer_get_string(m, &len);
goid.length = len;
@@ -2100,6 +2127,9 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
@@ -2127,6 +2154,9 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
OM_uint32 flags = 0; /* GSI needs this */
u_int len;
@ -1816,7 +1793,7 @@ index 229fada..aa70945 100644
in.value = buffer_get_string(m, &len);
in.length = len;
major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
@@ -2117,6 +2147,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
@@ -2144,6 +2174,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@ -1824,7 +1801,7 @@ index 229fada..aa70945 100644
}
return (0);
}
@@ -2128,6 +2159,9 @@ mm_answer_gss_checkmic(int sock, Buffer *m)
@@ -2155,6 +2186,9 @@ mm_answer_gss_checkmic(int sock, Buffer *m)
OM_uint32 ret;
u_int len;
@ -1834,7 +1811,7 @@ index 229fada..aa70945 100644
gssbuf.value = buffer_get_string(m, &len);
gssbuf.length = len;
mic.value = buffer_get_string(m, &len);
@@ -2154,7 +2188,11 @@ mm_answer_gss_userok(int sock, Buffer *m)
@@ -2181,7 +2215,11 @@ mm_answer_gss_userok(int sock, Buffer *m)
{
int authenticated;
@ -1847,7 +1824,7 @@ index 229fada..aa70945 100644
buffer_clear(m);
buffer_put_int(m, authenticated);
@@ -2167,5 +2205,73 @@ mm_answer_gss_userok(int sock, Buffer *m)
@@ -2194,5 +2232,73 @@ mm_answer_gss_userok(int sock, Buffer *m)
/* Monitor loop will terminate if authenticated */
return (authenticated);
}
@ -1935,10 +1912,10 @@ index 20e2b4a..ff79fbb 100644
MONITOR_REQ_PAM_START = 100,
MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
diff --git a/monitor_wrap.c b/monitor_wrap.c
index d1b6d99..d1e1caa 100644
index 82f114c..7e991e6 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1290,7 +1290,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
@@ -1300,7 +1300,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
}
int
@ -1947,7 +1924,7 @@ index d1b6d99..d1e1caa 100644
{
Buffer m;
int authenticated = 0;
@@ -1307,5 +1307,50 @@ mm_ssh_gssapi_userok(char *user)
@@ -1317,5 +1317,50 @@ mm_ssh_gssapi_userok(char *user)
debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
return (authenticated);
}
@ -2015,10 +1992,10 @@ index 9d5e5ba..93929e0 100644
#ifdef USE_PAM
diff --git a/readconf.c b/readconf.c
index dc884c9..7613ff2 100644
index 3f5c58b..1c07766 100644
--- a/readconf.c
+++ b/readconf.c
@@ -141,6 +141,8 @@ typedef enum {
@@ -143,6 +143,8 @@ typedef enum {
oClearAllForwardings, oNoHostAuthenticationForLocalhost,
oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
oAddressFamily, oGssAuthentication, oGssDelegateCreds,
@ -2027,7 +2004,7 @@ index dc884c9..7613ff2 100644
oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
oSendEnv, oControlPath, oControlMaster, oControlPersist,
oHashKnownHosts,
@@ -183,10 +185,19 @@ static struct {
@@ -187,10 +189,19 @@ static struct {
{ "afstokenpassing", oUnsupported },
#if defined(GSSAPI)
{ "gssapiauthentication", oGssAuthentication },
@ -2047,7 +2024,7 @@ index dc884c9..7613ff2 100644
#endif
{ "fallbacktorsh", oDeprecated },
{ "usersh", oDeprecated },
@@ -841,10 +852,30 @@ parse_time:
@@ -868,10 +879,30 @@ parse_time:
intptr = &options->gss_authentication;
goto parse_flag;
@ -2078,7 +2055,7 @@ index dc884c9..7613ff2 100644
case oBatchMode:
intptr = &options->batch_mode;
goto parse_flag;
@@ -1497,7 +1528,12 @@ initialize_options(Options * options)
@@ -1553,7 +1584,12 @@ initialize_options(Options * options)
options->pubkey_authentication = -1;
options->challenge_response_authentication = -1;
options->gss_authentication = -1;
@ -2091,7 +2068,7 @@ index dc884c9..7613ff2 100644
options->password_authentication = -1;
options->kbd_interactive_authentication = -1;
options->kbd_interactive_devices = NULL;
@@ -1616,8 +1652,14 @@ fill_default_options(Options * options)
@@ -1677,8 +1713,14 @@ fill_default_options(Options * options)
options->challenge_response_authentication = 1;
if (options->gss_authentication == -1)
options->gss_authentication = 0;
@ -2107,10 +2084,10 @@ index dc884c9..7613ff2 100644
options->password_authentication = 1;
if (options->kbd_interactive_authentication == -1)
diff --git a/readconf.h b/readconf.h
index 75e3f8f..5cc97f0 100644
index a028306..1dbe509 100644
--- a/readconf.h
+++ b/readconf.h
@@ -54,7 +54,12 @@ typedef struct {
@@ -45,7 +45,12 @@ typedef struct {
int challenge_response_authentication;
/* Try S/Key or TIS, authentication. */
int gss_authentication; /* Try GSS authentication */
@ -2150,10 +2127,10 @@ index b093a91..4c8da00 100644
type_has_legacy() {
case $1 in
diff --git a/regress/kextype.sh b/regress/kextype.sh
index 8c2ac09..a2a87ca 100644
index 6f952f4..bcb609b 100644
--- a/regress/kextype.sh
+++ b/regress/kextype.sh
@@ -9,6 +9,9 @@ cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
@@ -14,6 +14,9 @@ echo "KexAlgorithms=$KEXOPT" >> $OBJ/sshd_proxy
tries="1 2 3 4"
for k in `${SSH} -Q kex`; do
@ -2164,10 +2141,10 @@ index 8c2ac09..a2a87ca 100644
for i in $tries; do
${SSH} -F $OBJ/ssh_proxy -o KexAlgorithms=$k x true
diff --git a/regress/rekey.sh b/regress/rekey.sh
index cf9401e..31fb0f7 100644
index fd452b0..1148197 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -30,6 +30,9 @@ increase_datafile_size 300
@@ -38,6 +38,9 @@ increase_datafile_size 300
opts=""
for i in `${SSH} -Q kex`; do
@ -2177,7 +2154,7 @@ index cf9401e..31fb0f7 100644
opts="$opts KexAlgorithms=$i"
done
for i in `${SSH} -Q cipher`; do
@@ -48,6 +51,9 @@ done
@@ -56,6 +59,9 @@ done
if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then
for c in `${SSH} -Q cipher-auth`; do
for kex in `${SSH} -Q kex`; do
@ -2185,13 +2162,13 @@ index cf9401e..31fb0f7 100644
+ continue
+ fi
verbose "client rekey $c $kex"
ssh_data_rekeying -oRekeyLimit=256k -oCiphers=$c -oKexAlgorithms=$kex
ssh_data_rekeying "KexAlgorithms=$kex" -oRekeyLimit=256k -oCiphers=$c
done
diff --git a/servconf.c b/servconf.c
index f763317..68fb9ef 100644
index c8a3f28..179c20d 100644
--- a/servconf.c
+++ b/servconf.c
@@ -108,7 +108,10 @@ initialize_server_options(ServerOptions *options)
@@ -110,7 +110,10 @@ initialize_server_options(ServerOptions *options)
options->kerberos_ticket_cleanup = -1;
options->kerberos_get_afs_token = -1;
options->gss_authentication=-1;
@ -2202,7 +2179,7 @@ index f763317..68fb9ef 100644
options->password_authentication = -1;
options->kbd_interactive_authentication = -1;
options->challenge_response_authentication = -1;
@@ -245,8 +248,14 @@ fill_default_server_options(ServerOptions *options)
@@ -253,8 +256,14 @@ fill_default_server_options(ServerOptions *options)
options->kerberos_get_afs_token = 0;
if (options->gss_authentication == -1)
options->gss_authentication = 0;
@ -2217,7 +2194,7 @@ index f763317..68fb9ef 100644
if (options->password_authentication == -1)
options->password_authentication = 1;
if (options->kbd_interactive_authentication == -1)
@@ -344,7 +353,8 @@ typedef enum {
@@ -359,7 +368,8 @@ typedef enum {
sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
sClientAliveCountMax, sAuthorizedKeysFile,
@ -2227,7 +2204,7 @@ index f763317..68fb9ef 100644
sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
sUsePrivilegeSeparation, sAllowAgentForwarding,
sHostCertificate,
@@ -411,10 +421,20 @@ static struct {
@@ -428,10 +438,20 @@ static struct {
#ifdef GSSAPI
{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@ -2248,7 +2225,7 @@ index f763317..68fb9ef 100644
{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
@@ -1091,10 +1111,22 @@ process_server_config_line(ServerOptions *options, char *line,
@@ -1113,10 +1133,22 @@ process_server_config_line(ServerOptions *options, char *line,
intptr = &options->gss_authentication;
goto parse_flag;
@ -2271,7 +2248,7 @@ index f763317..68fb9ef 100644
case sPasswordAuthentication:
intptr = &options->password_authentication;
goto parse_flag;
@@ -2005,6 +2037,9 @@ dump_config(ServerOptions *o)
@@ -2070,6 +2102,9 @@ dump_config(ServerOptions *o)
#ifdef GSSAPI
dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
@ -2282,10 +2259,10 @@ index f763317..68fb9ef 100644
dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
dump_cfg_fmtint(sKbdInteractiveAuthentication,
diff --git a/servconf.h b/servconf.h
index 4572066..37cfa9b 100644
index 21719e2..397698b 100644
--- a/servconf.h
+++ b/servconf.h
@@ -112,7 +112,10 @@ typedef struct {
@@ -113,7 +113,10 @@ typedef struct {
int kerberos_get_afs_token; /* If true, try to get AFS token if
* authenticated with Kerberos. */
int gss_authentication; /* If true, permit GSSAPI authentication */
@ -2398,7 +2375,7 @@ index a99d7f0..0374c88 100644
#endif /* _SSH_GSS_H */
diff --git a/ssh_config b/ssh_config
index 6d1abaf..b0d343b 100644
index 3f83c40..4a0fb82 100644
--- a/ssh_config
+++ b/ssh_config
@@ -26,6 +26,8 @@
@ -2411,10 +2388,10 @@ index 6d1abaf..b0d343b 100644
# CheckHostIP yes
# AddressFamily any
diff --git a/ssh_config.5 b/ssh_config.5
index b580392..e7accd6 100644
index f9ede7a..e6649ac 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -682,11 +682,43 @@ Specifies whether user authentication based on GSSAPI is allowed.
@@ -701,11 +701,43 @@ Specifies whether user authentication based on GSSAPI is allowed.
The default is
.Dq no .
Note that this option applies to protocol version 2 only.
@ -2460,11 +2437,11 @@ index b580392..e7accd6 100644
Indicates that
.Xr ssh 1
diff --git a/sshconnect2.c b/sshconnect2.c
index adbbfc7..cadf234 100644
index 4724b66..703f8e4 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -158,9 +158,34 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
{
@@ -159,9 +159,34 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
Kex *kex;
+#ifdef GSSAPI
@ -2498,9 +2475,9 @@ index adbbfc7..cadf234 100644
if (options.ciphers == (char *)-1) {
logit("No valid ciphers for protocol version 2 given, using defaults.");
options.ciphers = NULL;
@@ -196,6 +221,17 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
if (options.kex_algorithms != NULL)
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
@@ -199,6 +224,17 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
myproposal[PROPOSAL_KEX_ALGS]);
+#ifdef GSSAPI
+ /* If we've got GSSAPI algorithms, then we also support the
@ -2516,9 +2493,9 @@ index adbbfc7..cadf234 100644
if (options.rekey_limit || options.rekey_interval)
packet_set_rekey_limits((u_int32_t)options.rekey_limit,
(time_t)options.rekey_interval);
@@ -208,10 +244,30 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
@@ -213,10 +249,30 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
#endif
kex->kex[KEX_C25519_SHA256] = kexc25519_client;
+#ifdef GSSAPI
+ if (options.gss_keyex) {
@ -2547,7 +2524,7 @@ index adbbfc7..cadf234 100644
xxx_kex = kex;
dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
@@ -301,6 +357,7 @@ void input_gssapi_token(int type, u_int32_t, void *);
@@ -306,6 +362,7 @@ void input_gssapi_token(int type, u_int32_t, void *);
void input_gssapi_hash(int type, u_int32_t, void *);
void input_gssapi_error(int, u_int32_t, void *);
void input_gssapi_errtok(int, u_int32_t, void *);
@ -2555,7 +2532,7 @@ index adbbfc7..cadf234 100644
#endif
void userauth(Authctxt *, char *);
@@ -316,6 +373,11 @@ static char *authmethods_get(void);
@@ -321,6 +378,11 @@ static char *authmethods_get(void);
Authmethod authmethods[] = {
#ifdef GSSAPI
@ -2567,7 +2544,7 @@ index adbbfc7..cadf234 100644
{"gssapi-with-mic",
userauth_gssapi,
NULL,
@@ -613,19 +675,31 @@ userauth_gssapi(Authctxt *authctxt)
@@ -617,19 +679,31 @@ userauth_gssapi(Authctxt *authctxt)
static u_int mech = 0;
OM_uint32 min;
int ok = 0;
@ -2601,7 +2578,7 @@ index adbbfc7..cadf234 100644
ok = 1; /* Mechanism works */
} else {
mech++;
@@ -722,8 +796,8 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
@@ -726,8 +800,8 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
Gssctxt *gssctxt;
@ -2612,7 +2589,7 @@ index adbbfc7..cadf234 100644
if (authctxt == NULL)
fatal("input_gssapi_response: no authentication context");
@@ -832,6 +906,48 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
@@ -836,6 +910,48 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
free(msg);
free(lang);
}
@ -2662,21 +2639,10 @@ index adbbfc7..cadf234 100644
int
diff --git a/sshd.c b/sshd.c
index 24ab272..e4e406e 100644
index f7b8aba..2871fe9 100644
--- a/sshd.c
+++ b/sshd.c
@@ -122,6 +122,10 @@
#include "ssh-sandbox.h"
#include "version.h"
+#ifdef USE_SECURITY_SESSION_API
+#include <Security/AuthSession.h>
+#endif
+
#ifdef LIBWRAP
#include <tcpd.h>
#include <syslog.h>
@@ -1744,10 +1748,13 @@ main(int ac, char **av)
@@ -1761,10 +1761,13 @@ main(int ac, char **av)
logit("Disabling protocol version 1. Could not load host key");
options.protocol &= ~SSH_PROTO_1;
}
@ -2690,7 +2656,7 @@ index 24ab272..e4e406e 100644
if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
logit("sshd: no hostkeys available -- exiting.");
exit(1);
@@ -2488,6 +2495,48 @@ do_ssh2_kex(void)
@@ -2501,6 +2504,49 @@ do_ssh2_kex(void)
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
list_hostkey_types());
@ -2735,13 +2701,14 @@ index 24ab272..e4e406e 100644
+ fatal("No supported key exchange algorithms");
+ }
+#endif
+
+
/* start key exchange */
kex = kex_setup(myproposal);
kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
@@ -2496,6 +2545,13 @@ do_ssh2_kex(void)
kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
#ifdef WITH_OPENSSL
@@ -2511,6 +2557,13 @@ do_ssh2_kex(void)
kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
#endif
kex->kex[KEX_C25519_SHA256] = kexc25519_server;
+#ifdef GSSAPI
+ if (options.gss_keyex) {
@ -2754,7 +2721,7 @@ index 24ab272..e4e406e 100644
kex->client_version_string=client_version_string;
kex->server_version_string=server_version_string;
diff --git a/sshd_config b/sshd_config
index c1b7c03..adfd7b1 100644
index 7061f75..f4796fc 100644
--- a/sshd_config
+++ b/sshd_config
@@ -91,6 +91,8 @@ ChallengeResponseAuthentication no
@ -2767,10 +2734,10 @@ index c1b7c03..adfd7b1 100644
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
diff --git a/sshd_config.5 b/sshd_config.5
index 95b5f8c..1fb002d 100644
index cccb310..8ad79d9 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -493,12 +493,40 @@ Specifies whether user authentication based on GSSAPI is allowed.
@@ -536,12 +536,40 @@ Specifies whether user authentication based on GSSAPI is allowed.
The default is
.Dq no .
Note that this option applies to protocol version 2 only.

34
openssh-6.6p1-keycat.patch
View File

@ -17,7 +17,7 @@ index 0000000..630ec62
+
+
diff --git a/Makefile.in b/Makefile.in
index 411eadb..4ab6717 100644
index f02aa1e..b225217 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -27,6 +27,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
@ -28,16 +28,16 @@ index 411eadb..4ab6717 100644
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
@@ -64,7 +65,7 @@ EXEEXT=@EXEEXT@
@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
MANFMT=@MANFMT@
INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
canohost.o channels.o cipher.o cipher-aes.o \
@@ -176,6 +177,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11
LIBOPENSSH_OBJS=\
ssherr.o \
@@ -186,6 +187,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11
ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
@ -47,7 +47,7 @@ index 411eadb..4ab6717 100644
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
@@ -283,6 +287,7 @@ install-files:
@@ -305,6 +309,7 @@ install-files:
$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
fi
@ -56,10 +56,10 @@ index 411eadb..4ab6717 100644
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index c0ae0d4..cb0f931 100644
index 12f5afd..269e642 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -600,6 +600,14 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
@@ -602,6 +602,14 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
_exit(1);
}
@ -75,10 +75,10 @@ index c0ae0d4..cb0f931 100644
options.authorized_keys_command, user_pw->pw_name, NULL);
diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
index d04f4ed..0077dd7 100644
index 265bd3a..8f32464 100644
--- a/openbsd-compat/port-linux-sshd.c
+++ b/openbsd-compat/port-linux-sshd.c
@@ -53,6 +53,20 @@ extern Authctxt *the_authctxt;
@@ -54,6 +54,20 @@ extern Authctxt *the_authctxt;
extern int inetd_flag;
extern int rexeced_flag;
@ -99,7 +99,7 @@ index d04f4ed..0077dd7 100644
/* Send audit message */
static int
sshd_selinux_send_audit_message(int success, security_context_t default_context,
@@ -307,7 +321,7 @@ sshd_selinux_getctxbyname(char *pwname,
@@ -308,7 +322,7 @@ sshd_selinux_getctxbyname(char *pwname,
/* Setup environment variables for pam_selinux */
static int
@ -108,7 +108,7 @@ index d04f4ed..0077dd7 100644
{
const char *reqlvl;
char *role;
@@ -318,16 +332,16 @@ sshd_selinux_setup_pam_variables(void)
@@ -319,16 +333,16 @@ sshd_selinux_setup_pam_variables(void)
ssh_selinux_get_role_level(&role, &reqlvl);
@ -128,7 +128,7 @@ index d04f4ed..0077dd7 100644
if (role != NULL)
free(role);
@@ -335,6 +349,24 @@ sshd_selinux_setup_pam_variables(void)
@@ -336,6 +350,24 @@ sshd_selinux_setup_pam_variables(void)
return rv;
}
@ -153,7 +153,7 @@ index d04f4ed..0077dd7 100644
/* Set the execution context to the default for the specified user */
void
sshd_selinux_setup_exec_context(char *pwname)
@@ -343,7 +375,7 @@ sshd_selinux_setup_exec_context(char *pwname)
@@ -344,7 +376,7 @@ sshd_selinux_setup_exec_context(char *pwname)
int r = 0;
security_context_t default_ctx = NULL;
@ -162,7 +162,7 @@ index d04f4ed..0077dd7 100644
return;
if (options.use_pam) {
@@ -414,7 +446,7 @@ sshd_selinux_copy_context(void)
@@ -415,7 +447,7 @@ sshd_selinux_copy_context(void)
{
security_context_t *ctx;
@ -187,10 +187,10 @@ index b18893c..cb51f99 100644
#ifdef LINUX_OOM_ADJUST
diff --git a/platform.c b/platform.c
index 0d39ab2..0dae387 100644
index 84c47fa..6d876cb 100644
--- a/platform.c
+++ b/platform.c
@@ -102,7 +102,7 @@ platform_setusercontext(struct passwd *pw)
@@ -103,7 +103,7 @@ platform_setusercontext(struct passwd *pw)
{
#ifdef WITH_SELINUX
/* Cache selinux status for later use */

13
openssh-6.6p1-keyperm.patch
View File

@ -1,15 +1,16 @@
diff -up openssh-6.6p1/authfile.c.keyperm openssh-6.6p1/authfile.c
--- openssh-6.6p1/authfile.c.keyperm 2014-02-04 01:20:15.000000000 +0100
+++ openssh-6.6p1/authfile.c 2014-05-05 15:20:43.075246776 +0200
@@ -54,6 +54,7 @@
diff --git a/authfile.c b/authfile.c
index e93d867..4fc5b3d 100644
--- a/authfile.c
+++ b/authfile.c
@@ -32,6 +32,7 @@
#include <errno.h>
#include <fcntl.h>
+#include <grp.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>
@@ -979,6 +980,13 @@ key_perm_ok(int fd, const char *filename
@@ -207,6 +208,13 @@ sshkey_perm_ok(int fd, const char *filename)
#ifdef HAVE_CYGWIN
if (check_ntsec(filename))
#endif

50
openssh-6.6p1-kuserok.patch
View File

@ -1,8 +1,8 @@
diff --git a/auth-krb5.c b/auth-krb5.c
index 6c62bdf..11c8562 100644
index 0089b18..8480261 100644
--- a/auth-krb5.c
+++ b/auth-krb5.c
@@ -54,6 +54,21 @@
@@ -55,6 +55,21 @@
extern ServerOptions options;
@ -24,7 +24,7 @@ index 6c62bdf..11c8562 100644
static int
krb5_init(void *context)
{
@@ -157,8 +172,9 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
@@ -158,8 +173,9 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
if (problem)
goto out;
@ -37,7 +37,7 @@ index 6c62bdf..11c8562 100644
goto out;
}
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 60de320..0a4930e 100644
index 54dd383..961c564 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -67,6 +67,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_principal, const char *, const char *,
@ -175,27 +175,27 @@ index 60de320..0a4930e 100644
if ((fp = fopen(file, "r")) == NULL) {
int saved_errno = errno;
diff --git a/servconf.c b/servconf.c
index 68fb9ef..904c869 100644
index 179c20d..d17ed04 100644
--- a/servconf.c
+++ b/servconf.c
@@ -157,6 +157,7 @@ initialize_server_options(ServerOptions *options)
options->ip_qos_interactive = -1;
@@ -163,6 +163,7 @@ initialize_server_options(ServerOptions *options)
options->ip_qos_bulk = -1;
options->version_addendum = NULL;
options->fingerprint_hash = -1;
+ options->use_kuserok = -1;
}
void
@@ -312,6 +313,8 @@ fill_default_server_options(ServerOptions *options)
options->version_addendum = xstrdup("");
if (options->show_patchlevel == -1)
options->show_patchlevel = 0;
@@ -328,6 +329,8 @@ fill_default_server_options(ServerOptions *options)
options->fwd_opts.streamlocal_bind_unlink = 0;
if (options->fingerprint_hash == -1)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
+ if (options->use_kuserok == -1)
+ options->use_kuserok = 1;
/* Turn privilege separation on by default */
if (use_privsep == -1)
@@ -338,7 +341,7 @@ typedef enum {
use_privsep = PRIVSEP_NOSANDBOX;
@@ -353,7 +356,7 @@ typedef enum {
sPermitRootLogin, sLogFacility, sLogLevel,
sRhostsRSAAuthentication, sRSAAuthentication,
sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
@ -204,7 +204,7 @@ index 68fb9ef..904c869 100644
sKerberosTgtPassing, sChallengeResponseAuthentication,
sPasswordAuthentication, sKbdInteractiveAuthentication,
sListenAddress, sAddressFamily,
@@ -410,11 +413,13 @@ static struct {
@@ -427,11 +430,13 @@ static struct {
#else
{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
#endif
@ -218,7 +218,7 @@ index 68fb9ef..904c869 100644
#endif
{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
@@ -1526,6 +1531,10 @@ process_server_config_line(ServerOptions *options, char *line,
@@ -1557,6 +1562,10 @@ process_server_config_line(ServerOptions *options, char *line,
*activep = value;
break;
@ -229,7 +229,7 @@ index 68fb9ef..904c869 100644
case sPermitOpen:
arg = strdelim(&cp);
if (!arg || *arg == '\0')
@@ -1811,6 +1820,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
@@ -1872,6 +1881,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
M_CP_INTOPT(max_authtries);
M_CP_INTOPT(ip_qos_interactive);
M_CP_INTOPT(ip_qos_bulk);
@ -237,19 +237,19 @@ index 68fb9ef..904c869 100644
M_CP_INTOPT(rekey_limit);
M_CP_INTOPT(rekey_interval);
@@ -2062,6 +2072,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sUseDNS, o->use_dns);
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
@@ -2130,6 +2140,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
+ dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
/* string arguments */
dump_cfg_string(sPidFile, o->pid_file);
diff --git a/servconf.h b/servconf.h
index 37cfa9b..5117dfa 100644
index 397698b..cf2a505 100644
--- a/servconf.h
+++ b/servconf.h
@@ -173,6 +173,7 @@ typedef struct {
@@ -175,6 +175,7 @@ typedef struct {
int num_permitted_opens;
@ -258,7 +258,7 @@ index 37cfa9b..5117dfa 100644
char *revoked_keys_file;
char *trusted_user_ca_keys;
diff --git a/sshd_config b/sshd_config
index adfd7b1..e772ed5 100644
index f4796fc..0d9454d 100644
--- a/sshd_config
+++ b/sshd_config
@@ -87,6 +87,7 @@ ChallengeResponseAuthentication no
@ -270,10 +270,10 @@ index adfd7b1..e772ed5 100644
# GSSAPI options
GSSAPIAuthentication yes
diff --git a/sshd_config.5 b/sshd_config.5
index 1fb002d..e0e5fff 100644
index 8ad79d9..eb4dd9e 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -697,6 +697,10 @@ Specifies whether to automatically destroy the user's ticket cache
@@ -740,6 +740,10 @@ Specifies whether to automatically destroy the user's ticket cache
file on logout.
The default is
.Dq yes .
@ -284,7 +284,7 @@ index 1fb002d..e0e5fff 100644
.It Cm KexAlgorithms
Specifies the available KEX (Key Exchange) algorithms.
Multiple algorithms must be comma-separated.
@@ -862,6 +866,7 @@ Available keywords are
@@ -961,6 +965,7 @@ Available keywords are
.Cm HostbasedUsesNameFromPacketOnly ,
.Cm KbdInteractiveAuthentication ,
.Cm KerberosAuthentication ,

75
openssh-6.6p1-role-mls.patch
View File

@ -25,7 +25,7 @@ index a1a2b52..b109a5a 100644
char ** fetch_pam_child_environment(void);
void free_pam_environment(char **);
diff --git a/auth.h b/auth.h
index 124e597..4605588 100644
index d081c94..847cffd 100644
--- a/auth.h
+++ b/auth.h
@@ -59,6 +59,9 @@ struct Authctxt {
@ -39,10 +39,10 @@ index 124e597..4605588 100644
char *info; /* Extra info for next auth_log */
#ifdef BSD_AUTH
diff --git a/auth1.c b/auth1.c
index 0f870b3..df040bb 100644
index 5038828..f0a98d2 100644
--- a/auth1.c
+++ b/auth1.c
@@ -381,6 +381,9 @@ do_authentication(Authctxt *authctxt)
@@ -382,6 +382,9 @@ do_authentication(Authctxt *authctxt)
{
u_int ulen;
char *user, *style = NULL;
@ -52,7 +52,7 @@ index 0f870b3..df040bb 100644
/* Get the name of the user that we wish to log in as. */
packet_read_expect(SSH_CMSG_USER);
@@ -389,11 +392,24 @@ do_authentication(Authctxt *authctxt)
@@ -390,11 +393,24 @@ do_authentication(Authctxt *authctxt)
user = packet_get_cstring(&ulen);
packet_check_eom();
@ -78,10 +78,10 @@ index 0f870b3..df040bb 100644
/* Verify that the user is a valid user. */
if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
diff --git a/auth2-gss.c b/auth2-gss.c
index c28a705..4756dd7 100644
index 447f896..4803e7e 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -251,6 +251,7 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
@@ -252,6 +252,7 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
Authctxt *authctxt = ctxt;
Gssctxt *gssctxt;
int authenticated = 0;
@ -89,7 +89,7 @@ index c28a705..4756dd7 100644
Buffer b;
gss_buffer_desc mic, gssbuf;
u_int len;
@@ -263,7 +264,13 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
@@ -264,7 +265,13 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
mic.value = packet_get_string(&len);
mic.length = len;
@ -104,7 +104,7 @@ index c28a705..4756dd7 100644
"gssapi-with-mic");
gssbuf.value = buffer_ptr(&b);
@@ -275,6 +282,8 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
@@ -276,6 +283,8 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
logit("GSSAPI MIC check failed");
buffer_free(&b);
@ -114,10 +114,10 @@ index c28a705..4756dd7 100644
authctxt->postponed = 0;
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index eca0069..95d678e 100644
index b7ae353..41f1a3f 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -112,7 +112,15 @@ userauth_hostbased(Authctxt *authctxt)
@@ -113,7 +113,15 @@ userauth_hostbased(Authctxt *authctxt)
buffer_put_string(&b, session_id2, session_id2_len);
/* reconstruct packet */
buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
@ -135,7 +135,7 @@ index eca0069..95d678e 100644
buffer_put_cstring(&b, "hostbased");
buffer_put_string(&b, pkalg, alen);
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 749b11a..c0ae0d4 100644
index 3f4f789..12f5afd 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -133,9 +133,11 @@ userauth_pubkey(Authctxt *authctxt)
@ -153,10 +153,10 @@ index 749b11a..c0ae0d4 100644
free(userstyle);
buffer_put_cstring(&b,
diff --git a/auth2.c b/auth2.c
index a5490c0..5f4f26f 100644
index d9b440a..d6fbc93 100644
--- a/auth2.c
+++ b/auth2.c
@@ -215,6 +215,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
@@ -216,6 +216,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
Authctxt *authctxt = ctxt;
Authmethod *m = NULL;
char *user, *service, *method, *style = NULL;
@ -166,7 +166,7 @@ index a5490c0..5f4f26f 100644
int authenticated = 0;
if (authctxt == NULL)
@@ -226,6 +229,11 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
@@ -227,6 +230,11 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
debug("userauth-request for user %s service %s method %s", user, service, method);
debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
@ -178,7 +178,7 @@ index a5490c0..5f4f26f 100644
if ((style = strchr(user, ':')) != NULL)
*style++ = 0;
@@ -251,8 +259,15 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
@@ -252,8 +260,15 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
use_privsep ? " [net]" : "");
authctxt->service = xstrdup(service);
authctxt->style = style ? xstrdup(style) : NULL;
@ -196,10 +196,10 @@ index a5490c0..5f4f26f 100644
if (auth2_setup_methods_lists(authctxt) != 0)
packet_disconnect("no authentication methods enabled");
diff --git a/misc.c b/misc.c
index e4c8c32..f31cd91 100644
index 94b05b0..651c21b 100644
--- a/misc.c
+++ b/misc.c
@@ -430,6 +430,7 @@ char *
@@ -431,6 +431,7 @@ char *
colon(char *cp)
{
int flag = 0;
@ -207,7 +207,7 @@ index e4c8c32..f31cd91 100644
if (*cp == ':') /* Leading colon is part of file name. */
return NULL;
@@ -445,6 +446,13 @@ colon(char *cp)
@@ -446,6 +447,13 @@ colon(char *cp)
return (cp);
if (*cp == '/')
return NULL;
@ -222,10 +222,10 @@ index e4c8c32..f31cd91 100644
return NULL;
}
diff --git a/monitor.c b/monitor.c
index 531c4f9..229fada 100644
index dbe29f1..d3f87e1 100644
--- a/monitor.c
+++ b/monitor.c
@@ -145,6 +145,9 @@ int mm_answer_sign(int, Buffer *);
@@ -148,6 +148,9 @@ int mm_answer_sign(int, Buffer *);
int mm_answer_pwnamallow(int, Buffer *);
int mm_answer_auth2_read_banner(int, Buffer *);
int mm_answer_authserv(int, Buffer *);
@ -235,7 +235,7 @@ index 531c4f9..229fada 100644
int mm_answer_authpassword(int, Buffer *);
int mm_answer_bsdauthquery(int, Buffer *);
int mm_answer_bsdauthrespond(int, Buffer *);
@@ -219,6 +222,9 @@ struct mon_table mon_dispatch_proto20[] = {
@@ -227,6 +230,9 @@ struct mon_table mon_dispatch_proto20[] = {
{MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
{MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@ -245,7 +245,7 @@ index 531c4f9..229fada 100644
{MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
{MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
#ifdef USE_PAM
@@ -805,6 +811,9 @@ mm_answer_pwnamallow(int sock, Buffer *m)
@@ -824,6 +830,9 @@ mm_answer_pwnamallow(int sock, Buffer *m)
else {
/* Allow service/style information on the auth context */
monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@ -255,7 +255,7 @@ index 531c4f9..229fada 100644
monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
}
#ifdef USE_PAM
@@ -846,6 +855,25 @@ mm_answer_authserv(int sock, Buffer *m)
@@ -865,6 +874,25 @@ mm_answer_authserv(int sock, Buffer *m)
return (0);
}
@ -281,7 +281,7 @@ index 531c4f9..229fada 100644
int
mm_answer_authpassword(int sock, Buffer *m)
{
@@ -1220,7 +1248,7 @@ static int
@@ -1241,7 +1269,7 @@ static int
monitor_valid_userblob(u_char *data, u_int datalen)
{
Buffer b;
@ -290,7 +290,7 @@ index 531c4f9..229fada 100644
u_int len;
int fail = 0;
@@ -1246,6 +1274,8 @@ monitor_valid_userblob(u_char *data, u_int datalen)
@@ -1267,6 +1295,8 @@ monitor_valid_userblob(u_char *data, u_int datalen)
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
fail++;
p = buffer_get_cstring(&b, NULL);
@ -299,7 +299,7 @@ index 531c4f9..229fada 100644
xasprintf(&userstyle, "%s%s%s", authctxt->user,
authctxt->style ? ":" : "",
authctxt->style ? authctxt->style : "");
@@ -1281,7 +1311,7 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
@@ -1302,7 +1332,7 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
char *chost)
{
Buffer b;
@ -308,7 +308,7 @@ index 531c4f9..229fada 100644
u_int len;
int fail = 0;
@@ -1298,6 +1328,8 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
@@ -1319,6 +1349,8 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
fail++;
p = buffer_get_cstring(&b, NULL);
@ -333,10 +333,10 @@ index 5bc41b5..20e2b4a 100644
MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
diff --git a/monitor_wrap.c b/monitor_wrap.c
index 1a47e41..d1b6d99 100644
index 45dc169..82f114c 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -336,6 +336,25 @@ mm_inform_authserv(char *service, char *style)
@@ -342,6 +342,25 @@ mm_inform_authserv(char *service, char *style)
buffer_free(&m);
}
@ -377,12 +377,12 @@ index 18c2501..9d5e5ba 100644
char *mm_auth2_read_banner(void);
int mm_auth_password(struct Authctxt *, char *);
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
index 6ecfb93..b912dbe 100644
index ab1a3e3..843225d 100644
--- a/openbsd-compat/Makefile.in
+++ b/openbsd-compat/Makefile.in
@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bcrypt_pbkdf.o bindresvport.o blowfish.o daemon.o di
COMPAT=arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
COMPAT=arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o kludge-fd_set.o
-PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
+PORTS=port-aix.o port-irix.o port-linux.o port-linux-sshd.o port-solaris.o port-tun.o port-uw.o
@ -391,10 +391,10 @@ index 6ecfb93..b912dbe 100644
$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
new file mode 100644
index 0000000..c18524e
index 0000000..6310717
--- /dev/null
+++ b/openbsd-compat/port-linux-sshd.c
@@ -0,0 +1,414 @@
@@ -0,0 +1,415 @@
+/*
+ * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
+ * Copyright (c) 2014 Petr Lautrbach <plautrba@redhat.com>
@ -426,6 +426,7 @@ index 0000000..c18524e
+
+#include "log.h"
+#include "xmalloc.h"
+#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */
+#include "servconf.h"
+#include "port-linux.h"
+#include "key.h"
@ -868,10 +869,10 @@ index e3d1004..8ef6cc4 100644
#ifdef LINUX_OOM_ADJUST
diff --git a/platform.c b/platform.c
index 30fc609..0d39ab2 100644
index ee313da..84c47fa 100644
--- a/platform.c
+++ b/platform.c
@@ -183,7 +183,7 @@ platform_setusercontext_post_groups(struct passwd *pw)
@@ -184,7 +184,7 @@ platform_setusercontext_post_groups(struct passwd *pw)
}
#endif /* HAVE_SETPCRED */
#ifdef WITH_SELINUX
@ -881,10 +882,10 @@ index 30fc609..0d39ab2 100644
}
diff --git a/sshd.c b/sshd.c
index 7523de9..07f9926 100644
index 481d001..41b317b 100644
--- a/sshd.c
+++ b/sshd.c
@@ -2138,6 +2138,9 @@ main(int ac, char **av)
@@ -2144,6 +2144,9 @@ main(int ac, char **av)
restore_uid();
}
#endif

450
openssh-6.6p1-audit.patch → openssh-6.7p1-audit.patch
View File

File diff suppressed because it is too large Load Diff

1285
openssh-6.7p1-fingerprint.patch
View File

File diff suppressed because it is too large Load Diff

340
openssh-6.6p1-fips.patch → openssh-6.7p1-fips.patch
View File

@ -1,8 +1,8 @@
diff --git a/Makefile.in b/Makefile.in
index 3bb7f00..294bef5 100644
index 9311e16..1eb2b45 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -154,25 +154,25 @@ libssh.a: $(LIBSSH_OBJS)
@@ -164,25 +164,25 @@ libssh.a: $(LIBSSH_OBJS)
$(RANLIB) $@
ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
@ -34,7 +34,7 @@ index 3bb7f00..294bef5 100644
ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
@@ -187,7 +187,7 @@ ctr-cavstest$(EXEEXT): $(LIBCOMPAT) libssh.a ctr-cavstest.o
@@ -197,7 +197,7 @@ ctr-cavstest$(EXEEXT): $(LIBCOMPAT) libssh.a ctr-cavstest.o
$(LD) -o $@ ctr-cavstest.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
@ -43,77 +43,6 @@ index 3bb7f00..294bef5 100644
sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
diff --git a/auth-rsa.c b/auth-rsa.c
index f225b0b..8bafcd6 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -244,7 +244,7 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file,
"actual %d vs. announced %d.",
file, linenum, BN_num_bits(key->rsa->n), bits);
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ fp = key_selected_fingerprint(key, SSH_FP_HEX);
debug("matching key found: file %s, line %lu %s %s",
file, linenum, key_type(key), fp);
free(fp);
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 6d1c872..3808ec8 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -214,8 +214,7 @@ pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...)
}
if (key_is_cert(key)) {
- fp = key_fingerprint(key->cert->signature_key,
- SSH_FP_MD5, SSH_FP_HEX);
+ fp = key_selected_fingerprint(key->cert->signature_key, SSH_FP_HEX);
auth_info(authctxt, "%s ID %s (serial %llu) CA %s %s%s%s",
key_type(key), key->cert->key_id,
(unsigned long long)key->cert->serial,
@@ -223,7 +222,7 @@ pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...)
extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
free(fp);
} else {
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ fp = key_selected_fingerprint(key, SSH_FP_HEX);
auth_info(authctxt, "%s %s%s%s", key_type(key), fp,
extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
free(fp);
diff --git a/authfile.c b/authfile.c
index ec4f4ff..2b3d650 100644
--- a/authfile.c
+++ b/authfile.c
@@ -46,6 +46,7 @@
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/pem.h>
+#include <openssl/fips.h>
/* compatibility with old or broken OpenSSL versions */
#include "openbsd-compat/openssl-compat.h"
@@ -1068,7 +1069,7 @@ Key *
key_parse_private(Buffer *buffer, const char *filename,
const char *passphrase, char **commentp)
{
- Key *pub, *prv;
+ Key *pub, *prv = NULL;
/* it's a SSH v1 key if the public key part is readable */
pub = key_parse_public_rsa1(buffer, commentp);
@@ -1080,9 +1081,10 @@ key_parse_private(Buffer *buffer, const char *filename,
*commentp = xstrdup(filename);
} else {
key_free(pub);
- /* key_parse_public_rsa1() has already loaded the comment */
- prv = key_parse_private_type(buffer, KEY_RSA1, passphrase,
- NULL);
+ if (! FIPS_mode())
+ /* key_parse_public_rsa1() has already loaded the comment */
+ prv = key_parse_private_type(buffer, KEY_RSA1, passphrase,
+ NULL);
}
return prv;
}
diff --git a/cipher-ctr.c b/cipher-ctr.c
index 73e9c7c..40ee395 100644
--- a/cipher-ctr.c
@ -129,7 +58,7 @@ index 73e9c7c..40ee395 100644
return (&aes_ctr);
}
diff --git a/cipher.c b/cipher.c
index 226e56d..b19443c 100644
index 9cc7cf8..5ebfa84 100644
--- a/cipher.c
+++ b/cipher.c
@@ -39,6 +39,8 @@
@ -141,11 +70,11 @@ index 226e56d..b19443c 100644
#include <string.h>
#include <stdarg.h>
#include <stdio.h>
@@ -90,6 +92,25 @@ static const struct Cipher ciphers[] = {
@@ -99,6 +101,26 @@ static const struct sshcipher ciphers[] = {
{ NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
};
+static const struct Cipher fips_ciphers[] = {
+static const struct sshcipher fips_ciphers[] = {
+ { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+ { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
+ { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
@ -164,38 +93,39 @@ index 226e56d..b19443c 100644
+#endif
+ { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
+};
+
/*--*/
/* Returns a list of supported ciphers separated by the specified char. */
@@ -100,7 +121,7 @@ cipher_alg_list(char sep, int auth_only)
/* Returns a comma-separated list of supported ciphers. */
@@ -109,7 +131,7 @@ cipher_alg_list(char sep, int auth_only)
size_t nlen, rlen = 0;
const Cipher *c;
const struct sshcipher *c;
- for (c = ciphers; c->name != NULL; c++) {
+ for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++) {
if (c->number != SSH_CIPHER_SSH2)
continue;
if (auth_only && c->auth_len == 0)
@@ -180,7 +201,7 @@ const Cipher *
@@ -193,7 +215,7 @@ const struct sshcipher *
cipher_by_name(const char *name)
{
const Cipher *c;
const struct sshcipher *c;
- for (c = ciphers; c->name != NULL; c++)
+ for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
if (strcmp(c->name, name) == 0)
return c;
return NULL;
@@ -190,7 +211,7 @@ const Cipher *
@@ -203,7 +225,7 @@ const struct sshcipher *
cipher_by_number(int id)
{
const Cipher *c;
const struct sshcipher *c;
- for (c = ciphers; c->name != NULL; c++)
+ for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
if (c->number == id)
return c;
return NULL;
@@ -232,7 +253,7 @@ cipher_number(const char *name)
const Cipher *c;
@@ -244,7 +266,7 @@ cipher_number(const char *name)
const struct sshcipher *c;
if (name == NULL)
return -1;
- for (c = ciphers; c->name != NULL; c++)
@ -216,10 +146,10 @@ index 48f7b68..9ff39f4 100644
/*
diff --git a/entropy.c b/entropy.c
index b361a04..5616643 100644
index d24e724..06b0095 100644
--- a/entropy.c
+++ b/entropy.c
@@ -222,6 +222,9 @@ seed_rng(void)
@@ -215,6 +215,9 @@ seed_rng(void)
fatal("OpenSSL version mismatch. Built against %lx, you "
"have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
@ -230,18 +160,18 @@ index b361a04..5616643 100644
if (RAND_status() == 1) {
debug3("RNG is ready, skipping seeding");
diff --git a/kex.c b/kex.c
index bc3e53e..ede7b67 100644
index e0cf3de..e11198f 100644
--- a/kex.c
+++ b/kex.c
@@ -34,6 +34,7 @@
#include <string.h>
@@ -35,6 +35,7 @@
#ifdef WITH_OPENSSL
#include <openssl/crypto.h>
+#include <openssl/fips.h>
#endif
#include "xmalloc.h"
#include "ssh2.h"
@@ -103,6 +104,25 @@ static const struct kexalg kexalgs[] = {
@@ -107,6 +108,25 @@ static const struct kexalg kexalgs[] = {
{ NULL, -1, -1, -1},
};
@ -267,7 +197,7 @@ index bc3e53e..ede7b67 100644
char *
kex_alg_list(char sep)
{
@@ -126,7 +146,7 @@ kex_alg_by_name(const char *name)
@@ -130,7 +150,7 @@ kex_alg_by_name(const char *name)
{
const struct kexalg *k;
@ -276,7 +206,7 @@ index bc3e53e..ede7b67 100644
if (strcmp(k->name, name) == 0)
return k;
#ifdef GSSAPI
@@ -151,7 +171,10 @@ kex_names_valid(const char *names)
@@ -155,7 +175,10 @@ kex_names_valid(const char *names)
for ((p = strsep(&cp, ",")); p && *p != '\0';
(p = strsep(&cp, ","))) {
if (kex_alg_by_name(p) == NULL) {
@ -313,7 +243,7 @@ index 2700b72..0820894 100644
}
#else /* OPENSSL_HAS_ECC */
diff --git a/kexgexc.c b/kexgexc.c
index 355b7ba..427e11f 100644
index 0a91bdd..b75930b 100644
--- a/kexgexc.c
+++ b/kexgexc.c
@@ -26,6 +26,8 @@
@ -358,50 +288,8 @@ index 770ad28..9d4fc6d 100644
omax = max = DH_GRP_MAX;
break;
default:
diff --git a/key.c b/key.c
index 62f3edb..a2050f6 100644
--- a/key.c
+++ b/key.c
@@ -42,6 +42,7 @@
#include "crypto_api.h"
#include <openssl/evp.h>
+#include <openssl/fips.h>
#include <openbsd-compat/openssl-compat.h>
#include <stdarg.h>
@@ -636,9 +637,13 @@ key_fingerprint_selection(void)
char *env;
if (!rv_defined) {
- env = getenv("SSH_FINGERPRINT_TYPE");
- rv = (env && !strcmp (env, "sha")) ?
- SSH_FP_SHA1 : SSH_FP_MD5;
+ if (FIPS_mode())
+ rv = SSH_FP_SHA1;
+ else {
+ env = getenv("SSH_FINGERPRINT_TYPE");
+ rv = (env && !strcmp (env, "sha")) ?
+ SSH_FP_SHA1 : SSH_FP_MD5;
+ }
rv_defined = 1;
}
return rv;
@@ -1168,8 +1173,11 @@ rsa_generate_private_key(u_int bits)
fatal("%s: BN_new failed", __func__);
if (!BN_set_word(f4, RSA_F4))
fatal("%s: BN_new failed", __func__);
- if (!RSA_generate_key_ex(private, bits, f4, NULL))
+ if (!RSA_generate_key_ex(private, bits, f4, NULL)) {
+ if (FIPS_mode())
+ logit("%s: the key length might be unsupported by FIPS mode approved key generation method", __func__);
fatal("%s: key generation failed.", __func__);
+ }
BN_free(f4);
return private;
}
diff --git a/mac.c b/mac.c
index 9388af4..cd7b034 100644
index fd07bf2..fedfbb2 100644
--- a/mac.c
+++ b/mac.c
@@ -27,6 +27,8 @@
@ -466,26 +354,18 @@ index 9388af4..cd7b034 100644
continue;
if (mac != NULL) {
diff --git a/myproposal.h b/myproposal.h
index 3a0f5ae..4f35a44 100644
index b35b2b8..a608d27 100644
--- a/myproposal.h
+++ b/myproposal.h
@@ -88,6 +88,12 @@
"diffie-hellman-group14-sha1," \
"diffie-hellman-group1-sha1"
@@ -140,6 +140,28 @@
"hmac-sha1-96," \
"hmac-md5-96"
+#define KEX_DEFAULT_KEX_FIPS \
+ KEX_ECDH_METHODS \
+ KEX_SHA256_METHODS \
+ "diffie-hellman-group-exchange-sha1," \
+ "diffie-hellman-group14-sha1"
+
#define KEX_DEFAULT_PK_ALG \
HOSTKEY_ECDSA_CERT_METHODS \
"ssh-ed25519-cert-v01@openssh.com," \
@@ -133,6 +139,22 @@
#define KEX_DEFAULT_COMP "none,zlib@openssh.com,zlib"
#define KEX_DEFAULT_LANG ""
+#define KEX_FIPS_ENCRYPT \
+ "aes128-ctr,aes192-ctr,aes256-ctr," \
+ "aes128-cbc,3des-cbc," \
@ -502,59 +382,24 @@ index 3a0f5ae..4f35a44 100644
+#define KEX_FIPS_MAC \
+ "hmac-sha1"
+#endif
+
#else
static char *myproposal[PROPOSAL_MAX] = {
KEX_DEFAULT_KEX,
diff --git a/ssh-keygen.c b/ssh-keygen.c
index 66198e6..ccf22c8 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -195,6 +195,12 @@ type_bits_valid(int type, u_int32_t *bitsp)
fprintf(stderr, "key bits exceeds maximum %d\n", maxbits);
exit(1);
}
+ if (FIPS_mode()) {
+ if (type == KEY_DSA)
+ fatal("DSA keys are not allowed in FIPS mode");
+ if (type == KEY_ED25519)
+ fatal("ED25519 keys are not allowed in FIPS mode");
+ }
if (type == KEY_DSA && *bitsp != 1024)
fatal("DSA keys must be 1024 bits");
else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 768)
@@ -746,7 +752,7 @@ do_download(struct passwd *pw)
enum fp_type fptype;
char *fp, *ra;
- fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : key_fingerprint_selection();
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
pkcs11_init(0);
@@ -756,8 +762,7 @@ do_download(struct passwd *pw)
for (i = 0; i < nkeys; i++) {
if (print_fingerprint) {
fp = key_fingerprint(keys[i], fptype, rep);
- ra = key_fingerprint(keys[i], SSH_FP_MD5,
- SSH_FP_RANDOMART);
+ ra = key_selected_fingerprint(keys[i], SSH_FP_RANDOMART);
printf("%u %s %s (PKCS11 key)\n", key_size(keys[i]),
fp, key_type(keys[i]));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
#define KEX_SERVER_KEX \
diff --git a/ssh.c b/ssh.c
index 1e6cb90..ea9193f 100644
index 26e9681..a0a7c29 100644
--- a/ssh.c
+++ b/ssh.c
@@ -73,6 +73,8 @@
@@ -75,6 +75,8 @@
#include <openssl/evp.h>
#include <openssl/err.h>
#endif
+#include <openssl/fips.h>
+#include <fipscheck.h>
#include "openbsd-compat/openssl-compat.h"
#include "openbsd-compat/sys-queue.h"
@@ -427,6 +429,13 @@ main(int ac, char **av)
@@ -433,6 +435,13 @@ main(int ac, char **av)
sanitise_stdfd();
__progname = ssh_get_progname(av[0]);
@ -568,7 +413,7 @@ index 1e6cb90..ea9193f 100644
#ifndef HAVE_SETPROCTITLE
/* Prepare for later setproctitle emulation */
@@ -504,6 +513,9 @@ main(int ac, char **av)
@@ -510,6 +519,9 @@ main(int ac, char **av)
"ACD:E:F:I:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) {
switch (opt) {
case '1':
@ -578,15 +423,15 @@ index 1e6cb90..ea9193f 100644
options.protocol = SSH_PROTO_1;
break;
case '2':
@@ -828,7 +840,6 @@ main(int ac, char **av)
@@ -841,7 +853,6 @@ main(int ac, char **av)
host_arg = xstrdup(host);
#ifdef WITH_OPENSSL
- OpenSSL_add_all_algorithms();
ERR_load_crypto_strings();
#endif
/* Initialize the command to execute on remote host. */
@@ -973,6 +984,10 @@ main(int ac, char **av)
@@ -997,6 +1008,10 @@ main(int ac, char **av)
seed_rng();
@ -597,7 +442,7 @@ index 1e6cb90..ea9193f 100644
if (options.user == NULL)
options.user = xstrdup(pw->pw_name);
@@ -1020,6 +1035,12 @@ main(int ac, char **av)
@@ -1069,6 +1084,12 @@ main(int ac, char **av)
timeout_ms = options.connection_timeout * 1000;
@ -611,10 +456,10 @@ index 1e6cb90..ea9193f 100644
if (ssh_connect(host, addrs, &hostaddr, options.port,
options.address_family, options.connection_attempts,
diff --git a/sshconnect2.c b/sshconnect2.c
index b00658b..6a1562c 100644
index efe6158..5631f39 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -44,6 +44,8 @@
@@ -46,6 +46,8 @@
#include <vis.h>
#endif
@ -623,24 +468,13 @@ index b00658b..6a1562c 100644
#include "openbsd-compat/sys-queue.h"
#include "xmalloc.h"
@@ -168,20 +170,25 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
@@ -171,20 +173,25 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
#ifdef GSSAPI
if (options.gss_keyex) {
- /* Add the GSSAPI mechanisms currently supported on this
- * client to the key exchange algorithm proposal */
- orig = myproposal[PROPOSAL_KEX_ALGS];
-
- if (options.gss_trust_dns)
- gss_host = (char *)get_canonical_hostname(1);
- else
- gss_host = host;
-
- gss = ssh_gssapi_client_mechanisms(gss_host, options.gss_client_identity);
- if (gss) {
- debug("Offering GSSAPI proposal: %s", gss);
- xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
- "%s,%s", gss, orig);
+ if (FIPS_mode()) {
+ logit("Disabling GSSAPIKeyExchange. Not usable in FIPS mode");
+ options.gss_keyex = 0;
@ -648,12 +482,21 @@ index b00658b..6a1562c 100644
+ /* Add the GSSAPI mechanisms currently supported on this
+ * client to the key exchange algorithm proposal */
+ orig = myproposal[PROPOSAL_KEX_ALGS];
+
- if (options.gss_trust_dns)
- gss_host = (char *)get_canonical_hostname(1);
- else
- gss_host = host;
+ if (options.gss_trust_dns)
+ gss_host = (char *)get_canonical_hostname(1);
+ else
+ gss_host = host;
+
- gss = ssh_gssapi_client_mechanisms(gss_host, options.gss_client_identity);
- if (gss) {
- debug("Offering GSSAPI proposal: %s", gss);
- xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
- "%s,%s", gss, orig);
+ gss = ssh_gssapi_client_mechanisms(gss_host, options.gss_client_identity);
+ if (gss) {
+ debug("Offering GSSAPI proposal: %s", gss);
@ -663,7 +506,7 @@ index b00658b..6a1562c 100644
}
}
#endif
@@ -193,6 +200,10 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
@@ -196,6 +203,10 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
if (options.ciphers != NULL) {
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
@ -674,7 +517,7 @@ index b00658b..6a1562c 100644
}
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
@@ -208,7 +219,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
@@ -211,7 +222,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
if (options.macs != NULL) {
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
@ -686,7 +529,7 @@ index b00658b..6a1562c 100644
if (options.hostkeyalgorithms != NULL)
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
compat_pkalg_proposal(options.hostkeyalgorithms);
@@ -220,9 +235,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
@@ -223,9 +238,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
}
if (options.kex_algorithms != NULL)
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
@ -700,19 +543,27 @@ index b00658b..6a1562c 100644
/* If we've got GSSAPI algorithms, then we also support the
* 'null' hostkey, as a last resort */
diff --git a/sshd.c b/sshd.c
index b561ec8..e977de3 100644
index db23ce2..3ce59f0 100644
--- a/sshd.c
+++ b/sshd.c
@@ -75,6 +75,8 @@
@@ -66,6 +66,7 @@
#include <grp.h>
#include <pwd.h>
#include <signal.h>
+#include <syslog.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
@@ -76,6 +77,8 @@
#include <openssl/dh.h>
#include <openssl/bn.h>
#include <openssl/rand.h>
+#include <openssl/fips.h>
+#include <fipscheck.h>
#include "openbsd-compat/openssl-compat.h"
#endif
#ifdef HAVE_SECUREWARE
@@ -1468,6 +1470,18 @@ main(int ac, char **av)
@@ -1479,6 +1482,18 @@ main(int ac, char **av)
#endif
__progname = ssh_get_progname(av[0]);
@ -731,16 +582,16 @@ index b561ec8..e977de3 100644
/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
saved_argc = ac;
rexec_argc = ac;
@@ -1619,8 +1633,6 @@ main(int ac, char **av)
@@ -1630,7 +1645,7 @@ main(int ac, char **av)
else
closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
- OpenSSL_add_all_algorithms();
-
/* If requested, redirect the logs to the specified logfile. */
if (logfile != NULL) {
log_redirect_stderr_to(logfile);
@@ -1798,6 +1810,10 @@ main(int ac, char **av)
-#ifdef WITH_OPENSSL
+#if 0 /* FIPS */
OpenSSL_add_all_algorithms();
#endif
@@ -1816,6 +1831,10 @@ main(int ac, char **av)
debug("private host key: #%d type %d %s", i, keytype,
key_type(key ? key : pubkey));
}
@ -751,7 +602,7 @@ index b561ec8..e977de3 100644
if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
logit("Disabling protocol version 1. Could not load host key");
options.protocol &= ~SSH_PROTO_1;
@@ -1961,6 +1977,10 @@ main(int ac, char **av)
@@ -1982,6 +2001,10 @@ main(int ac, char **av)
/* Reinitialize the log (because of the fork above). */
log_init(__progname, options.log_level, options.log_facility, log_stderr);
@ -762,7 +613,7 @@ index b561ec8..e977de3 100644
/* Chdir to the root directory so that the current disk can be
unmounted if desired. */
if (chdir("/") == -1)
@@ -2530,6 +2550,9 @@ do_ssh2_kex(void)
@@ -2541,6 +2564,9 @@ do_ssh2_kex(void)
if (options.ciphers != NULL) {
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
@ -772,7 +623,7 @@ index b561ec8..e977de3 100644
}
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
@@ -2539,6 +2562,9 @@ do_ssh2_kex(void)
@@ -2550,6 +2576,9 @@ do_ssh2_kex(void)
if (options.macs != NULL) {
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
@ -782,7 +633,7 @@ index b561ec8..e977de3 100644
}
if (options.compression == COMP_NONE) {
myproposal[PROPOSAL_COMP_ALGS_CTOS] =
@@ -2549,6 +2575,8 @@ do_ssh2_kex(void)
@@ -2560,6 +2589,8 @@ do_ssh2_kex(void)
}
if (options.kex_algorithms != NULL)
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
@ -791,7 +642,7 @@ index b561ec8..e977de3 100644
myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
myproposal[PROPOSAL_KEX_ALGS]);
@@ -2575,10 +2603,14 @@ do_ssh2_kex(void)
@@ -2586,10 +2617,14 @@ do_ssh2_kex(void)
if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0)
orig = NULL;
@ -810,3 +661,24 @@ index b561ec8..e977de3 100644
if (gss && orig)
xasprintf(&newstr, "%s,%s", gss, orig);
diff --git a/sshkey.c b/sshkey.c
index f078e11..5e3d97f 100644
--- a/sshkey.c
+++ b/sshkey.c
@@ -34,6 +34,7 @@
#include <openssl/evp.h>
#include <openssl/err.h>
#include <openssl/pem.h>
+#include <openssl/fips.h>
#include "crypto_api.h"
@@ -1523,6 +1524,8 @@ rsa_generate_private_key(u_int bits, RSA **rsap)
}
if (!BN_set_word(f4, RSA_F4) ||
!RSA_generate_key_ex(private, bits, f4, NULL)) {
+ if (FIPS_mode())
+ logit("%s: the key length might be unsupported by FIPS mode approved key generation method", __func__);
ret = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
}

30
openssh-6.6p1-ldap.patch → openssh-6.7p1-ldap.patch
View File

@ -113,7 +113,7 @@ index 0000000..dd5f5cc
+ Jan F. Chadima <jchadima@redhat.com>
+
diff --git a/Makefile.in b/Makefile.in
index 28a8ec4..411eadb 100644
index 06be3d5..f02aa1e 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -25,6 +25,8 @@ SSH_PROGRAM=@bindir@/ssh
@ -125,7 +125,7 @@ index 28a8ec4..411eadb 100644
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
@@ -60,8 +62,9 @@ XAUTH_PATH=@XAUTH_PATH@
@@ -61,8 +63,9 @@ XAUTH_PATH=@XAUTH_PATH@
LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
EXEEXT=@EXEEXT@
MANFMT=@MANFMT@
@ -134,9 +134,9 @@ index 28a8ec4..411eadb 100644
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
canohost.o channels.o cipher.o cipher-aes.o \
@@ -98,8 +101,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
LIBOPENSSH_OBJS=\
ssherr.o \
@@ -108,8 +111,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
sandbox-seccomp-filter.o sandbox-capsicum.o
@ -147,7 +147,7 @@ index 28a8ec4..411eadb 100644
MANTYPE = @MANTYPE@
CONFIGFILES=sshd_config.out ssh_config.out moduli.out
@@ -170,6 +173,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o roaming_dummy.o readco
@@ -180,6 +183,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o roaming_dummy.o readco
ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
@ -157,7 +157,7 @@ index 28a8ec4..411eadb 100644
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
@@ -273,6 +279,10 @@ install-files:
@@ -295,6 +301,10 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@ -168,7 +168,7 @@ index 28a8ec4..411eadb 100644
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
@@ -289,6 +299,10 @@ install-files:
@@ -311,6 +321,10 @@ install-files:
$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@ -179,7 +179,7 @@ index 28a8ec4..411eadb 100644
-rm -f $(DESTDIR)$(bindir)/slogin
ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
@@ -318,6 +332,13 @@ install-sysconf:
@@ -340,6 +354,13 @@ install-sysconf:
else \
echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
fi
@ -193,7 +193,7 @@ index 28a8ec4..411eadb 100644
host-key: ssh-keygen$(EXEEXT)
@if [ -z "$(DESTDIR)" ] ; then \
@@ -381,6 +402,8 @@ uninstall:
@@ -403,6 +424,8 @@ uninstall:
-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@ -202,19 +202,19 @@ index 28a8ec4..411eadb 100644
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
@@ -392,6 +415,7 @@ uninstall:
@@ -414,6 +437,7 @@ uninstall:
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
+ -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c
regress-prep:
diff --git a/configure.ac b/configure.ac
index 7c6ce08..722a19e 100644
index 67c4486..6553074 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1625,6 +1625,106 @@ if test "x$use_pie" != "xno"; then
@@ -1569,6 +1569,106 @@ if test "x$use_pie" != "xno"; then
fi
fi
@ -1159,7 +1159,7 @@ index 0000000..665dca2
+
diff --git a/ldapconf.c b/ldapconf.c
new file mode 100644
index 0000000..525060a
index 0000000..b49cae6
--- /dev/null
+++ b/ldapconf.c
@@ -0,0 +1,722 @@

42
openssh.spec
View File

@ -63,10 +63,10 @@
%endif
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
%define openssh_ver 6.6.1p1
%define openssh_rel 11.1
%define openssh_ver 6.7p1
%define openssh_rel 1
%define pam_ssh_agent_ver 0.9.3
%define pam_ssh_agent_rel 3
%define pam_ssh_agent_rel 4
Summary: An open source implementation of SSH protocol versions 1 and 2
Name: openssh
@ -74,8 +74,7 @@ Version: %{openssh_ver}
Release: %{openssh_rel}%{?dist}%{?rescue_rel}
URL: http://www.openssh.com/portable.html
#URL1: http://pamsshagentauth.sourceforge.net
# Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-6.6p1.tar.gz
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
#Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
Source2: sshd.pam
Source3: sshd.init
@ -103,10 +102,9 @@ Patch102: openssh-5.8p1-getaddrinfo.patch
Patch103: openssh-5.8p1-packet.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
Patch200: openssh-6.6p1-audit.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1171248
# record pfs= field in CRYPTO_SESSION audit event
Patch201: openssh-6.6.1p1-audit-pfs.patch
Patch200: openssh-6.7p1-audit.patch
# --- pam_ssh-agent ---
# make it build reusing the openssh sources
@ -117,13 +115,15 @@ Patch301: pam_ssh_agent_auth-0.9.2-seteuid.patch
Patch302: pam_ssh_agent_auth-0.9.2-visibility.patch
# don't use xfree (#1024965)
Patch303: pam_ssh_agent_auth-0.9.3-no-xfree.patch
# use SSH_DIGEST_* for fingerprint hashes
Patch304: pam_ssh_agent_auth-0.9.3-fingerprint-hash.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
Patch400: openssh-6.6p1-role-mls.patch
#https://bugzilla.redhat.com/show_bug.cgi?id=781634
Patch404: openssh-6.6p1-privsep-selinux.patch
#?-- unwanted child :(
Patch501: openssh-6.6p1-ldap.patch
Patch501: openssh-6.7p1-ldap.patch
#?
Patch502: openssh-6.6p1-keycat.patch
@ -143,15 +143,11 @@ Patch608: openssh-6.1p1-askpass-ld.patch
Patch609: openssh-5.5p1-x11.patch
#?
Patch700: openssh-6.6p1-fips.patch
#?
# drop? Patch701: openssh-5.6p1-exit-deadlock.patch
Patch700: openssh-6.7p1-fips.patch
#?
Patch702: openssh-5.1p1-askpass-progress.patch
#?
Patch703: openssh-4.3p2-askpass-grab-info.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=205842
# drop? Patch704: openssh-5.9p1-edns.patch
#?
Patch705: openssh-5.1p1-scp-manpage.patch
#?
@ -361,7 +357,7 @@ remote ssh-agent instance.
The module is most useful for su and sudo service stacks.
%prep
%setup -q -a 4 -n openssh-6.6p1
%setup -q -a 4
#Do not enable by default
%if 0
%patch0 -p1 -b .wIm
@ -377,6 +373,7 @@ pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
%patch301 -p1 -b .psaa-seteuid
%patch302 -p1 -b .psaa-visibility
%patch303 -p1 -b .psaa-xfree
%patch304 -p2 -b .psaa-fingerprint
# Remove duplicate headers
rm -f $(cat %{SOURCE5})
popd
@ -399,13 +396,8 @@ popd
%patch607 -p1 -b .sigpipe
%patch608 -p1 -b .askpass-ld
%patch609 -p1 -b .x11
#
# drop? %patch701 -p1 -b .exit-deadlock
%patch702 -p1 -b .progress
%patch703 -p1 -b .grab-info
# investigate - https://bugzilla.redhat.com/show_bug.cgi?id=205842
# probably not needed anymore %patch704 -p1 -b .edns
# drop it %patch705 -p1 -b .manpage
%patch706 -p1 -b .localdomain
%patch707 -p1 -b .redhat
%patch708 -p1 -b .entropy
@ -422,15 +414,10 @@ popd
%patch902 -p1 -b .ccache_name
%patch905 -p1 -b .legacy-ssh-copy-id
%patch906 -p1 -b .fromto-remote
%patch907 -p1 -b .CLOCK_BOOTTIME
%patch908 -p1 -b .CVE-2014-2653
%patch909 -p1 -b .6.6.1
%patch910 -p1 -b .NI_MAXHOST
%patch911 -p1 -b .set_remote_ipaddr
%patch912 -p1 -b .utf8-banner
%patch913 -p1 -b .partial-success
%patch914 -p1 -b .servconf
%patch915 -p1 -b .SIGXFSZ
%patch916 -p1 -b .contexts
%patch917 -p1 -b .cisco-dh
%patch918 -p1 -b .log-in-chroot
@ -439,10 +426,10 @@ popd
%patch802 -p1 -b .GSSAPIEnablek5users
%patch200 -p1 -b .audit
%patch201 -p1 -b .audit-fps
%patch700 -p1 -b .fips
%patch100 -p1 -b .coverity
# FIXME rebase 6.7p1
# %patch100 -p1 -b .coverity
%if 0
# Nothing here yet
@ -751,6 +738,9 @@ getent passwd sshd >/dev/null || \
%endif
%changelog
* Tue Jan 20 2015 Petr Lautrbach <plautrba@redhat.com> 6.7p1-1 + 0.9.3-4
- new upstream release openssh-6.7p1
* Thu Jan 15 2015 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-11.1 + 0.9.3-3
- error message if scp when directory doesn't exist (#1142223)
- parsing configuration file values (#1130733)

64
pam_ssh_agent_auth-0.9.3-fingerprint-hash.patch Normal file
View File

@ -0,0 +1,64 @@
diff --git a/pam_ssh_agent_auth-0.9.3/key.c b/pam_ssh_agent_auth-0.9.3/key.c
index 9555e7e..c17aae6 100644
--- a/pam_ssh_agent_auth-0.9.3/key.c
+++ b/pam_ssh_agent_auth-0.9.3/key.c
@@ -55,6 +55,7 @@
#include "uuencode.h"
#include "buffer.h"
#include "log.h"
+#include "digest.h"
Key *
key_new(int type)
@@ -181,7 +182,7 @@ key_equal(const Key *a, const Key *b)
}
u_char*
-key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
+key_fingerprint_raw(const Key *k, int dgst_type,
u_int *dgst_raw_length)
{
const EVP_MD *md = NULL;
@@ -194,10 +195,10 @@ key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
*dgst_raw_length = 0;
switch (dgst_type) {
- case SSH_FP_MD5:
+ case SSH_DIGEST_MD5:
md = EVP_md5();
break;
- case SSH_FP_SHA1:
+ case SSH_DIGEST_SHA1:
md = EVP_sha1();
break;
default:
@@ -302,7 +303,7 @@ key_fingerprint_bubblebabble(u_char *dgst_raw, u_int dgst_raw_len)
}
char *
-key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
+key_fingerprint(const Key *k, int dgst_type, enum fp_rep dgst_rep)
{
char *retval = NULL;
u_char *dgst_raw;
diff --git a/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c b/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c
index dddcba9..8ba6d87 100644
--- a/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c
+++ b/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c
@@ -43,6 +43,7 @@
#include "buffer.h"
#include "log.h"
#include "compat.h"
+#include "digest.h"
#include "key.h"
#include "pathnames.h"
#include "misc.h"
@@ -118,7 +119,7 @@ pam_user_key_allowed2(struct passwd *pw, Key *key, char *file)
found_key = 1;
logit("matching key found: file %s, line %lu",
file, linenum);
- fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
+ fp = key_fingerprint(found, SSH_DIGEST_MD5, SSH_FP_HEX);
logit("Found matching %s key: %s",
key_type(found), fp);
free(fp);

2
sources
View File

@ -1,2 +1,2 @@
9872ca1983e566ff5a89c240529e223d pam_ssh_agent_auth-0.9.3.tar.bz2
3e9800e6bca1fbac0eea4d41baa7f239 openssh-6.6p1.tar.gz
3246aa79317b1d23cae783a3bf8275d6 openssh-6.7p1.tar.gz