- don't report duplicate syslog messages, use correct local time (#189158)
- don't allow spnego as gssapi mechanism (from upstream) - fixed memleaks found by Coverity (from upstream) - allow ip options except source routing (#202856) (patch by HP)
This commit is contained in:
Tomáš Mráz
parent
c12d6ba86c
commit
ac4818c499
59
openssh-4.3p2-allow-ip-opts.patch
Normal file
59
openssh-4.3p2-allow-ip-opts.patch
Normal file
@ -0,0 +1,59 @@
|
||||
From: Paul Moore <paul.moore@hp.com>
|
||||
Subject: OpenSSH: fix option handling on incoming connections
|
||||
|
||||
OpenSSH rejects incoming connections if any IP options are present when the
|
||||
comments state that they are only concerned with source routing options. This
|
||||
connection rejection causes problems with CIPSO which uses IP options to tag
|
||||
packets with security attributes.
|
||||
|
||||
This patch modifies the check_ip_options() function to only fail if loose or
|
||||
strict source routing options are present, all other options are allowed.
|
||||
|
||||
Signed-off-by: Paul Moore <paul.moore@hp.com>
|
||||
|
||||
---
|
||||
canohost.c | 23 +++++++++++++++++------
|
||||
1 file changed, 17 insertions(+), 6 deletions(-)
|
||||
|
||||
Index: openssh-4.3p2/canohost.c
|
||||
===================================================================
|
||||
--- openssh-4.3p2.orig/canohost.c
|
||||
+++ openssh-4.3p2/canohost.c
|
||||
@@ -146,6 +146,7 @@ check_ip_options(int sock, char *ipaddr)
|
||||
u_int i;
|
||||
int ipproto;
|
||||
struct protoent *ip;
|
||||
+ u_int opt_iter;
|
||||
|
||||
if ((ip = getprotobyname("ip")) != NULL)
|
||||
ipproto = ip->p_proto;
|
||||
@@ -154,13 +155,23 @@ check_ip_options(int sock, char *ipaddr)
|
||||
option_size = sizeof(options);
|
||||
if (getsockopt(sock, ipproto, IP_OPTIONS, options,
|
||||
&option_size) >= 0 && option_size != 0) {
|
||||
- text[0] = '\0';
|
||||
- for (i = 0; i < option_size; i++)
|
||||
- snprintf(text + i*3, sizeof(text) - i*3,
|
||||
- " %2.2x", options[i]);
|
||||
- fatal("Connection from %.100s with IP options:%.800s",
|
||||
- ipaddr, text);
|
||||
+ opt_iter = 0;
|
||||
+ do {
|
||||
+ /* Fail, fatally, if we detect either loose or strict
|
||||
+ * source routing options. */
|
||||
+ if (options[opt_iter] == 131 ||
|
||||
+ options[opt_iter] == 137)
|
||||
+ goto fail;
|
||||
+ opt_iter += options[opt_iter + 1] + 2;
|
||||
+ } while (opt_iter < option_size);
|
||||
}
|
||||
+ return;
|
||||
+
|
||||
+fail:
|
||||
+ text[0] = '\0';
|
||||
+ for (i = 0; i < option_size; i++)
|
||||
+ snprintf(text + i*3, sizeof(text) - i*3, " %2.2x", options[i]);
|
||||
+ fatal("Connection from %.100s with IP options:%.800s", ipaddr, text);
|
||||
#endif /* IP_OPTIONS */
|
||||
}
|
||||
|
||||
25
openssh.spec
25
openssh.spec
@ -61,7 +61,7 @@
|
||||
Summary: The OpenSSH implementation of SSH protocol versions 1 and 2
|
||||
Name: openssh
|
||||
Version: 4.3p2
|
||||
Release: 8%{?rescue_rel}
|
||||
Release: 9%{?rescue_rel}
|
||||
URL: http://www.openssh.com/portable.html
|
||||
#Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||
#Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.sig
|
||||
@ -91,6 +91,11 @@ Patch36: openssh-4.3p2-buffer-len.patch
|
||||
Patch37: openssh-4.3p2-configure-typo.patch
|
||||
Patch38: openssh-4.3p2-askpass-grab-info.patch
|
||||
Patch39: openssh-4.3p2-no-v6only.patch
|
||||
Patch40: openssh-4.3p2-coverity-memleaks.patch
|
||||
Patch41: openssh-4.3p2-gssapi-no-spnego.patch
|
||||
Patch42: openssh-4.3p2-no-dup-logs.patch
|
||||
Patch43: openssh-4.3p2-localtime.patch
|
||||
Patch44: openssh-4.3p2-allow-ip-opts.patch
|
||||
License: BSD
|
||||
Group: Applications/Internet
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot
|
||||
@ -219,6 +224,11 @@ an X11 passphrase dialog for OpenSSH.
|
||||
%patch37 -p1 -b .typo
|
||||
%patch38 -p1 -b .grab-info
|
||||
%patch39 -p1 -b .no-v6only
|
||||
%patch40 -p1 -b .memleaks
|
||||
%patch41 -p1 -b .no-spnego
|
||||
%patch42 -p1 -b .no-dups
|
||||
%patch43 -p1 -b .localtime
|
||||
%patch44 -p1 -b .ip-opts
|
||||
|
||||
autoreconf
|
||||
|
||||
@ -228,7 +238,7 @@ CFLAGS="$RPM_OPT_FLAGS"; export CFLAGS
|
||||
CFLAGS="$CFLAGS -Os"
|
||||
%endif
|
||||
%if %{pie}
|
||||
%ifarch s390 s390x
|
||||
%ifarch s390 s390x sparc sparc64
|
||||
CFLAGS="$CFLAGS -fPIE"
|
||||
%else
|
||||
CFLAGS="$CFLAGS -fpie"
|
||||
@ -311,9 +321,10 @@ popd
|
||||
rm -rf $RPM_BUILD_ROOT
|
||||
mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh
|
||||
mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh
|
||||
mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd
|
||||
mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd/etc
|
||||
make install DESTDIR=$RPM_BUILD_ROOT
|
||||
|
||||
touch $RPM_BUILD_ROOT%{_var}/empty/sshd/etc/localtime
|
||||
install -d $RPM_BUILD_ROOT/etc/pam.d/
|
||||
install -d $RPM_BUILD_ROOT/etc/rc.d/init.d
|
||||
install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh
|
||||
@ -440,6 +451,8 @@ fi
|
||||
%files server
|
||||
%defattr(-,root,root)
|
||||
%dir %attr(0711,root,root) %{_var}/empty/sshd
|
||||
%dir %attr(0755,root,root) %{_var}/empty/sshd/etc
|
||||
%ghost %verify(not md5 size mtime) %{_var}/empty/sshd/etc/localtime
|
||||
%attr(0755,root,root) %{_sbindir}/sshd
|
||||
%attr(0755,root,root) %{_libexecdir}/openssh/sftp-server
|
||||
%attr(0644,root,root) %{_mandir}/man5/sshd_config.5*
|
||||
@ -460,6 +473,12 @@ fi
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Wed Aug 23 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
|
||||
- don't report duplicate syslog messages, use correct local time (#189158)
|
||||
- don't allow spnego as gssapi mechanism (from upstream)
|
||||
- fixed memleaks found by Coverity (from upstream)
|
||||
- allow ip options except source routing (#202856) (patch by HP)
|
||||
|
||||
* Tue Aug 8 2006 Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
|
||||
- drop the pam-session patch from the previous build (#201341)
|
||||
- don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user