rpms/openssh
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Delete unneeded debug messages from fips-compl-dh patch

Browse Source 
Related: rhbz#2091694

Signed-off-by: Norbert Pocs <npocs@redhat.com>
This commit is contained in:
Norbert Pocs 2023-05-25 09:16:00 +02:00
parent 1490ffd3e0
commit 48718a1a72
1 changed files with 9 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
openssh-8.7p1-evp-fips-compl-dh.patch
View File

@ -1,6 +1,6 @@
diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-8.7p1/dh.c openssh-8.7p1-patched/dh.c diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-8.7p1/dh.c openssh-8.7p1-patched/dh.c
--- openssh-8.7p1/dh.c 2023-05-16 15:38:53.461326047 +0200 --- openssh-8.7p1/dh.c 2023-05-25 09:01:23.295627077 +0200
+++ openssh-8.7p1-patched/dh.c 2023-05-16 15:37:14.785260359 +0200 +++ openssh-8.7p1-patched/dh.c 2023-05-25 09:00:56.519332820 +0200
@@ -37,6 +37,9 @@ @@ -37,6 +37,9 @@
#include <openssl/bn.h> #include <openssl/bn.h>
#include <openssl/dh.h> #include <openssl/dh.h>
@ -126,8 +126,8 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
DH * DH *
diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-8.7p1/kex.c openssh-8.7p1-patched/kex.c diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-8.7p1/kex.c openssh-8.7p1-patched/kex.c
--- openssh-8.7p1/kex.c 2023-05-16 15:38:53.465326090 +0200 --- openssh-8.7p1/kex.c 2023-05-25 09:01:23.299627122 +0200
+++ openssh-8.7p1-patched/kex.c 2023-05-16 15:37:14.785260359 +0200 +++ openssh-8.7p1-patched/kex.c 2023-05-25 09:00:56.519332820 +0200
@@ -1603,3 +1603,47 @@ @@ -1603,3 +1603,47 @@
return r; return r;
} }
@ -177,8 +177,8 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
+} +}
+#endif /* WITH_OPENSSL */ +#endif /* WITH_OPENSSL */
diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-8.7p1/kexdh.c openssh-8.7p1-patched/kexdh.c diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-8.7p1/kexdh.c openssh-8.7p1-patched/kexdh.c
--- openssh-8.7p1/kexdh.c 2023-05-16 15:38:53.403325420 +0200 --- openssh-8.7p1/kexdh.c 2023-05-25 09:01:23.237626425 +0200
+++ openssh-8.7p1-patched/kexdh.c 2023-05-16 15:37:34.097468928 +0200 +++ openssh-8.7p1-patched/kexdh.c 2023-05-25 09:03:21.817957988 +0200
@@ -35,6 +35,10 @@ @@ -35,6 +35,10 @@
#include "openbsd-compat/openssl-compat.h" #include "openbsd-compat/openssl-compat.h"
@ -204,7 +204,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
#ifdef DEBUG_KEXDH #ifdef DEBUG_KEXDH
fprintf(stderr, "dh_pub= "); fprintf(stderr, "dh_pub= ");
@@ -100,24 +107,64 @@ @@ -100,24 +107,59 @@
r = SSH_ERR_MESSAGE_INCOMPLETE; r = SSH_ERR_MESSAGE_INCOMPLETE;
goto out; goto out;
} }
@ -222,7 +222,6 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
+ /* import peer key + /* import peer key
+ * the parameters should be the same as with pkey + * the parameters should be the same as with pkey
+ */ + */
+ debug_f("import peer key to evp");
+ r = kex_create_evp_dh(&dh_pkey, p, q, g, dh_pub, NULL); + r = kex_create_evp_dh(&dh_pkey, p, q, g, dh_pub, NULL);
+ if (r != 0) { + if (r != 0) {
+ error_f("Could not import peer key for dh"); + error_f("Could not import peer key for dh");
@ -230,13 +229,11 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
+ goto out; + goto out;
+ } + }
+ +
+ debug_f("creating EVP_PKEY_CTX");
+ if ((ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL)) == NULL) { + if ((ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL)) == NULL) {
+ error_f("Could not init EVP_PKEY_CTX for dh"); + error_f("Could not init EVP_PKEY_CTX for dh");
+ r = SSH_ERR_ALLOC_FAIL; + r = SSH_ERR_ALLOC_FAIL;
+ goto out; + goto out;
+ } + }
+ debug_f("Deriving - init context");
+ if (EVP_PKEY_derive_init(ctx) != 1 || + if (EVP_PKEY_derive_init(ctx) != 1 ||
+ EVP_PKEY_derive_set_peer(ctx, dh_pkey) != 1 || + EVP_PKEY_derive_set_peer(ctx, dh_pkey) != 1 ||
+ EVP_PKEY_derive(ctx, NULL, &klen) != 1) { + EVP_PKEY_derive(ctx, NULL, &klen) != 1) {
@ -244,7 +241,6 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
+ r = SSH_ERR_LIBCRYPTO_ERROR; + r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out; + goto out;
+ } + }
+ debug_f("Deriving - buffer size is %d", (int)klen);
if ((kbuf = malloc(klen)) == NULL || if ((kbuf = malloc(klen)) == NULL ||
(shared_secret = BN_new()) == NULL) { (shared_secret = BN_new()) == NULL) {
r = SSH_ERR_ALLOC_FAIL; r = SSH_ERR_ALLOC_FAIL;
@ -252,7 +248,6 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
} }
- if ((kout = DH_compute_key(kbuf, dh_pub, kex->dh)) < 0 || - if ((kout = DH_compute_key(kbuf, dh_pub, kex->dh)) < 0 ||
- BN_bin2bn(kbuf, kout, shared_secret) == NULL) { - BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
+ debug_f("Deriving - using real buffer");
+ if (EVP_PKEY_derive(ctx, kbuf, &klen) != 1 || + if (EVP_PKEY_derive(ctx, kbuf, &klen) != 1 ||
+ BN_bin2bn(kbuf, klen, shared_secret) == NULL) { + BN_bin2bn(kbuf, klen, shared_secret) == NULL) {
+ error_f("Could not derive key"); + error_f("Could not derive key");
@ -274,8 +269,8 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
} }
diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-8.7p1/kex.h openssh-8.7p1-patched/kex.h diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-8.7p1/kex.h openssh-8.7p1-patched/kex.h
--- openssh-8.7p1/kex.h 2023-05-16 15:38:53.465326090 +0200 --- openssh-8.7p1/kex.h 2023-05-25 09:01:23.299627122 +0200
+++ openssh-8.7p1-patched/kex.h 2023-05-16 15:37:14.786260370 +0200 +++ openssh-8.7p1-patched/kex.h 2023-05-25 09:00:56.519332820 +0200
@@ -33,6 +33,9 @@ @@ -33,6 +33,9 @@
# include <openssl/bn.h> # include <openssl/bn.h>
# include <openssl/dh.h> # include <openssl/dh.h>