Initialize for openssh
This commit is contained in:
commit
96bbab7210
67 changed files with 20378 additions and 0 deletions
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
openssh-8.4p1.tar.gz
|
||||
1
.openssh.metadata
Normal file
1
.openssh.metadata
Normal file
|
|
@ -0,0 +1 @@
|
|||
af9929cd39b695c1ebde9f37e237287516150d69bdd4e96d01d51f7ba329fdd4 openssh-8.4p1.tar.gz
|
||||
64
README.FIPS
Normal file
64
README.FIPS
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
Notes on FIPS mode and OpenSSH
|
||||
|
||||
---
|
||||
|
||||
SUSE OpenSSH comes with FIPS 140-2 support, and certain versions have been
|
||||
certified as FIPS compliant by NIST. Apart from other things, this standard
|
||||
puts restrictions on cryptographic algorithms that may be used.
|
||||
|
||||
Important notice: FIPS is not only a matter of functionality. If you want to
|
||||
claim having a FIPS certified service, you *must* use the certified binaries.
|
||||
Even binaries built from the same sources in the same environment and running
|
||||
on a certified system, yet from a package lacking the certification, are
|
||||
formally not considered to be fulfilling the requirements.
|
||||
|
||||
The certified binaries (ssh, sshd, sftp-server) perform mandatory selfcheck at
|
||||
startup and proceed only when the checks succeed (non-certified binaries may
|
||||
skip the check). These checks require the cryptographic hashes contained in the
|
||||
openssh-fips subpackage.
|
||||
|
||||
The FIPS mode for OpenSSH is enabled in two ways - either:
|
||||
|
||||
1) /proc/sys/crypto/fips_enabled contains a single character '1' - this is a
|
||||
system-wide setting controlled bu the fips kernel parameter; or
|
||||
|
||||
2) the environment variable SSH_FORCE_FIPS - if set (to any value), the
|
||||
binaries behave as if they were running on a system in FIPS mode.
|
||||
|
||||
Since FIPS 140-2 only allows use of certain cryptographic algorithms, both the
|
||||
client and server will fail if they are requested to use non-approved
|
||||
algorithms while in FIPS mode. This means that working configurations for FIPS
|
||||
mode form a proper subset of all working (generic) configurations. Some
|
||||
configurations may even prevent the binaries from starting at all.
|
||||
|
||||
This however should be viewed in the context of FIPS being a security policy
|
||||
tool - it is not of much use to run the same system both in FIPS mode and
|
||||
outside of it, since that would defeat the main purpose of FIPS having
|
||||
guaranteeing standardised minimum restrictions on cryptographic algorithms
|
||||
(and thus on the overall security of the system).
|
||||
|
||||
Unless you specify what cryptographic algorithms you wish to use, both the
|
||||
client and server should work out of the box in FIPS mode.
|
||||
|
||||
For sshd, you can use the `-t` option to check whether the configuration file
|
||||
is working. Setting the above mentioned environment variable allows testing of
|
||||
behaviour in FIPS mode (checksum files for both OpenSSH and OpenSSL must be
|
||||
installed).
|
||||
|
||||
In addition to cryptographic algorithms restrictions, sshd performs periodic
|
||||
PRNG re-seeding. The seed is read from entropy source either /dev/urandom or
|
||||
/dev/random. By default, the former is used, unless the environment variable
|
||||
SSH_USE_STRONG_RNG is set to a non-zero value or the binary is running in FIPS
|
||||
mode. This has two important implications:
|
||||
|
||||
1) the selected entropy source must be available, i.e. when running in a
|
||||
changeroot the device files need to be present there.
|
||||
|
||||
2) /dev/random is a blocking interface - unless enough randomness is available,
|
||||
the process stops until the entropy pool is replenished. Thus on systems where
|
||||
a long running processes are expected, one should make sure there is always
|
||||
enough entropy for sshd. Sporadically this may also cause sshd to aborted,
|
||||
since some versions of OpenSSL (the underlying cryptographic engine) don't
|
||||
handle gracefully being interrupted while trying to read entropy from the
|
||||
system source.
|
||||
|
||||
22
README.SUSE
Normal file
22
README.SUSE
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
There are following changes in default settings of ssh client and server:
|
||||
|
||||
* Accepting and sending of locale environment variables in protocol 2 is
|
||||
enabled.
|
||||
|
||||
* PAM authentication is enabled and mostly even required, do not turn it off.
|
||||
|
||||
* root authentiation with password is enabled by default (PermitRootLogin yes).
|
||||
NOTE: this has security implications and is only done in order to not change
|
||||
behaviour of the server in an update. We strongly suggest setting this option
|
||||
either "prohibit-password" or even better to "no" (which disables direct
|
||||
remote root login entirely).
|
||||
|
||||
* DSA authentication is enabled by default for maximum compatibility.
|
||||
NOTE: do not use DSA authentication since it is being phased out for a reason
|
||||
- the size of DSA keys is limited by the standard to 1024 bits which cannot
|
||||
be considered safe any more.
|
||||
|
||||
* Accepting all RFC4419 specified DH group parameters. See KexDHMin in
|
||||
ssh_config and sshd_config manual pages.
|
||||
|
||||
For more information on differences in SUSE OpenSSH package see README.FIPS
|
||||
18
README.kerberos
Normal file
18
README.kerberos
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
This version of the Kerbros/GSSAPI support avoids DNS lookups
|
||||
for Kerberos-related names. These DNS lookups were problematic
|
||||
for dialup users because they would lead to excessive delays
|
||||
if DNS was not reachable.
|
||||
|
||||
If you do use Kerberos, please make sure you edit the server and
|
||||
client configuration files as follows:
|
||||
|
||||
/etc/ssh/sshd_config:
|
||||
|
||||
GSSAPIAuthentication yes
|
||||
GSSAPICleanupCredentials yes
|
||||
|
||||
/etc/ssh/ssh_config:
|
||||
Host *
|
||||
... lots of other options ...
|
||||
GSSAPIAuthentication yes
|
||||
GSSAPIDelegateCredentials yes
|
||||
184
cavs_driver-ssh.pl
Normal file
184
cavs_driver-ssh.pl
Normal file
|
|
@ -0,0 +1,184 @@
|
|||
#!/usr/bin/perl
|
||||
#
|
||||
# CAVS test driver for OpenSSH
|
||||
#
|
||||
# Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
|
||||
#
|
||||
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
# of this software and associated documentation files (the "Software"), to deal
|
||||
# in the Software without restriction, including without limitation the rights
|
||||
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
# copies of the Software, and to permit persons to whom the Software is
|
||||
# furnished to do so, subject to the following conditions:
|
||||
#
|
||||
# The above copyright notice and this permission notice shall be included in
|
||||
# all copies or substantial portions of the Software.
|
||||
#
|
||||
# NO WARRANTY
|
||||
#
|
||||
# BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
# FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
# OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
# PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
# OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
# TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
# PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
# REPAIR OR CORRECTION.
|
||||
#
|
||||
# IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
# WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
# REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
# INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
# OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
# TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
# YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
# PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
# POSSIBILITY OF SUCH DAMAGES.
|
||||
#
|
||||
use strict;
|
||||
use warnings;
|
||||
use IPC::Open2;
|
||||
|
||||
# Executing a program by feeding STDIN and retrieving
|
||||
# STDOUT
|
||||
# $1: data string to be piped to the app on STDIN
|
||||
# rest: program and args
|
||||
# returns: STDOUT of program as string
|
||||
sub pipe_through_program($@) {
|
||||
my $in = shift;
|
||||
my @args = @_;
|
||||
|
||||
my ($CO, $CI);
|
||||
my $pid = open2($CO, $CI, @args);
|
||||
|
||||
my $out = "";
|
||||
my $len = length($in);
|
||||
my $first = 1;
|
||||
while (1) {
|
||||
my $rin = "";
|
||||
my $win = "";
|
||||
# Output of prog is FD that we read
|
||||
vec($rin,fileno($CO),1) = 1;
|
||||
# Input of prog is FD that we write
|
||||
# check for $first is needed because we can have NULL input
|
||||
# that is to be written to the app
|
||||
if ( $len > 0 || $first) {
|
||||
(vec($win,fileno($CI),1) = 1);
|
||||
$first=0;
|
||||
}
|
||||
# Let us wait for 100ms
|
||||
my $nfound = select(my $rout=$rin, my $wout=$win, undef, 0.1);
|
||||
if ( $wout ) {
|
||||
my $written = syswrite($CI, $in, $len);
|
||||
die "broken pipe" if !defined $written;
|
||||
$len -= $written;
|
||||
substr($in, 0, $written) = "";
|
||||
if ($len <= 0) {
|
||||
close $CI or die "broken pipe: $!";
|
||||
}
|
||||
}
|
||||
if ( $rout ) {
|
||||
my $tmp_out = "";
|
||||
my $bytes_read = sysread($CO, $tmp_out, 4096);
|
||||
$out .= $tmp_out;
|
||||
last if ($bytes_read == 0);
|
||||
}
|
||||
}
|
||||
close $CO or die "broken pipe: $!";
|
||||
waitpid $pid, 0;
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
# Parser of CAVS test vector file
|
||||
# $1: Test vector file
|
||||
# $2: Output file for test results
|
||||
# return: nothing
|
||||
sub parse($$) {
|
||||
my $infile = shift;
|
||||
my $outfile = shift;
|
||||
|
||||
my $out = "";
|
||||
|
||||
my $K = "";
|
||||
my $H = "";
|
||||
my $session_id = "";
|
||||
my $ivlen = 0;
|
||||
my $eklen = "";
|
||||
my $iklen = "";
|
||||
|
||||
open(IN, "<$infile");
|
||||
while(<IN>) {
|
||||
|
||||
my $line = $_;
|
||||
chomp($line);
|
||||
$line =~ s/\r//;
|
||||
|
||||
if ($line =~ /\[SHA-1\]/) {
|
||||
$iklen = 20;
|
||||
} elsif ($line =~ /\[SHA-256\]/) {
|
||||
$iklen = 32;
|
||||
} elsif ($line =~ /\[SHA-384\]/) {
|
||||
$iklen = 48;
|
||||
} elsif ($line =~ /\[SHA-512\]/) {
|
||||
$iklen = 64;
|
||||
} elsif ($line =~ /^\[IV length\s*=\s*(.*)\]/) {
|
||||
$ivlen = $1;
|
||||
$ivlen = $ivlen / 8;
|
||||
} elsif ($line =~ /^\[encryption key length\s*=\s*(.*)\]/) {
|
||||
$eklen = $1;
|
||||
$eklen = $eklen / 8;
|
||||
} elsif ($line =~ /^K\s*=\s*(.*)/) {
|
||||
$K = $1;
|
||||
$K = substr($K, 8);
|
||||
$K = "00" . $K;
|
||||
} elsif ($line =~ /^H\s*=\s*(.*)/) {
|
||||
$H = $1;
|
||||
} elsif ($line =~ /^session_id\s*=\s*(.*)/) {
|
||||
$session_id = $1;
|
||||
}
|
||||
$out .= $line . "\n";
|
||||
|
||||
if ($K ne "" && $H ne "" && $session_id ne "" &&
|
||||
$ivlen ne "" && $eklen ne "" && $iklen > 0) {
|
||||
$out .= pipe_through_program("", "@LIBEXECDIR@/ssh/cavstest-kdf -H $H -K $K -s $session_id -i $ivlen -e $eklen -m $iklen");
|
||||
|
||||
$K = "";
|
||||
$H = "";
|
||||
$session_id = "";
|
||||
}
|
||||
}
|
||||
close IN;
|
||||
$out =~ s/\n/\r\n/g; # make it a dos file
|
||||
open(OUT, ">$outfile") or die "Cannot create output file $outfile: $?";
|
||||
print OUT $out;
|
||||
close OUT;
|
||||
}
|
||||
|
||||
############################################################
|
||||
#
|
||||
# let us pretend to be C :-)
|
||||
sub main() {
|
||||
|
||||
my $infile=$ARGV[0];
|
||||
die "Error: Test vector file $infile not found" if (! -f $infile);
|
||||
|
||||
my $outfile = $infile;
|
||||
# let us add .rsp regardless whether we could strip .req
|
||||
$outfile =~ s/\.req$//;
|
||||
$outfile .= ".rsp";
|
||||
if (-f $outfile) {
|
||||
die "Output file $outfile could not be removed: $?"
|
||||
unless unlink($outfile);
|
||||
}
|
||||
print STDERR "Performing tests from source file $infile with results stored in destination file $outfile\n";
|
||||
|
||||
# Do the job
|
||||
parse($infile, $outfile);
|
||||
}
|
||||
|
||||
###########################################
|
||||
# Call it
|
||||
main();
|
||||
1;
|
||||
132
openssh-6.6.1p1-selinux-contexts.patch
Normal file
132
openssh-6.6.1p1-selinux-contexts.patch
Normal file
|
|
@ -0,0 +1,132 @@
|
|||
Index: openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux-sshd.c
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
@@ -33,6 +33,7 @@
|
||||
#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */
|
||||
#include "servconf.h"
|
||||
#include "port-linux.h"
|
||||
+#include "misc.h"
|
||||
#include "sshkey.h"
|
||||
#include "hostfile.h"
|
||||
#include "auth.h"
|
||||
@@ -455,7 +456,7 @@ sshd_selinux_setup_exec_context(char *pw
|
||||
void
|
||||
sshd_selinux_copy_context(void)
|
||||
{
|
||||
- security_context_t *ctx;
|
||||
+ char *ctx;
|
||||
|
||||
if (!sshd_selinux_enabled())
|
||||
return;
|
||||
@@ -474,6 +475,72 @@ sshd_selinux_copy_context(void)
|
||||
}
|
||||
}
|
||||
|
||||
+void
|
||||
+sshd_selinux_change_privsep_preauth_context(void)
|
||||
+{
|
||||
+ int len;
|
||||
+ char line[1024], *preauth_context = NULL, *cp, *arg;
|
||||
+ const char *contexts_path;
|
||||
+ FILE *contexts_file;
|
||||
+ struct stat sb;
|
||||
+
|
||||
+ contexts_path = selinux_openssh_contexts_path();
|
||||
+ if (contexts_path == NULL) {
|
||||
+ debug3("%s: Failed to get the path to SELinux context", __func__);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ if ((contexts_file = fopen(contexts_path, "r")) == NULL) {
|
||||
+ debug("%s: Failed to open SELinux context file", __func__);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ if (fstat(fileno(contexts_file), &sb) != 0 ||
|
||||
+ sb.st_uid != 0 || (sb.st_mode & 022) != 0) {
|
||||
+ logit("%s: SELinux context file needs to be owned by root"
|
||||
+ " and not writable by anyone else", __func__);
|
||||
+ fclose(contexts_file);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ while (fgets(line, sizeof(line), contexts_file)) {
|
||||
+ /* Strip trailing whitespace */
|
||||
+ for (len = strlen(line) - 1; len > 0; len--) {
|
||||
+ if (strchr(" \t\r\n", line[len]) == NULL)
|
||||
+ break;
|
||||
+ line[len] = '\0';
|
||||
+ }
|
||||
+
|
||||
+ if (line[0] == '\0')
|
||||
+ continue;
|
||||
+
|
||||
+ cp = line;
|
||||
+ arg = strdelim(&cp);
|
||||
+ if (arg && *arg == '\0')
|
||||
+ arg = strdelim(&cp);
|
||||
+
|
||||
+ if (arg && strcmp(arg, "privsep_preauth") == 0) {
|
||||
+ arg = strdelim(&cp);
|
||||
+ if (!arg || *arg == '\0') {
|
||||
+ debug("%s: privsep_preauth is empty", __func__);
|
||||
+ fclose(contexts_file);
|
||||
+ return;
|
||||
+ }
|
||||
+ preauth_context = xstrdup(arg);
|
||||
+ }
|
||||
+ }
|
||||
+ fclose(contexts_file);
|
||||
+
|
||||
+ if (preauth_context == NULL) {
|
||||
+ debug("%s: Unable to find 'privsep_preauth' option in"
|
||||
+ " SELinux context file", __func__);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ ssh_selinux_change_context(preauth_context);
|
||||
+ free(preauth_context);
|
||||
+}
|
||||
+
|
||||
#endif
|
||||
#endif
|
||||
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux.c
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux.c
|
||||
@@ -185,7 +185,7 @@ ssh_selinux_change_context(const char *n
|
||||
strlcpy(newctx + len, newname, newlen - len);
|
||||
if ((cx = index(cx + 1, ':')))
|
||||
strlcat(newctx, cx, newlen);
|
||||
- debug3("%s: setting context from '%s' to '%s'", __func__,
|
||||
+ debug("%s: setting context from '%s' to '%s'", __func__,
|
||||
oldctx, newctx);
|
||||
if (setcon(newctx) < 0)
|
||||
switchlog("%s: setcon %s from %s failed with %s", __func__,
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux.h
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
@@ -27,6 +27,7 @@ int sshd_selinux_enabled(void);
|
||||
void sshd_selinux_copy_context(void);
|
||||
void sshd_selinux_setup_exec_context(char *);
|
||||
int sshd_selinux_setup_env_variables(void);
|
||||
+void sshd_selinux_change_privsep_preauth_context(void);
|
||||
#endif
|
||||
|
||||
#ifdef LINUX_OOM_ADJUST
|
||||
Index: openssh-8.4p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd.c
|
||||
+++ openssh-8.4p1/sshd.c
|
||||
@@ -540,7 +540,7 @@ privsep_preauth_child(struct ssh *ssh)
|
||||
demote_sensitive_data(ssh);
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
- ssh_selinux_change_context("sshd_net_t");
|
||||
+ sshd_selinux_change_privsep_preauth_context();
|
||||
#endif
|
||||
|
||||
/* Demote the child */
|
||||
492
openssh-6.6p1-keycat.patch
Normal file
492
openssh-6.6p1-keycat.patch
Normal file
|
|
@ -0,0 +1,492 @@
|
|||
Index: openssh-8.4p1/auth.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth.c
|
||||
+++ openssh-8.4p1/auth.c
|
||||
@@ -877,6 +877,14 @@ subprocess(const char *tag, struct passw
|
||||
_exit(1);
|
||||
}
|
||||
|
||||
+#ifdef WITH_SELINUX
|
||||
+ if (sshd_selinux_setup_env_variables() < 0) {
|
||||
+ error ("failed to copy environment: %s",
|
||||
+ strerror(errno));
|
||||
+ _exit(127);
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
execve(av[0], av, child_env);
|
||||
error("%s exec \"%s\": %s", tag, command, strerror(errno));
|
||||
_exit(127);
|
||||
Index: openssh-8.4p1/HOWTO.ssh-keycat
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ openssh-8.4p1/HOWTO.ssh-keycat
|
||||
@@ -0,0 +1,12 @@
|
||||
+The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
|
||||
+of an user in any environment. This includes environments with
|
||||
+polyinstantiation of home directories and SELinux MLS policy enabled.
|
||||
+
|
||||
+To use ssh-keycat, set these options in /etc/ssh/sshd_config file:
|
||||
+ AuthorizedKeysCommand /usr/libexec/openssh/ssh-keycat
|
||||
+ AuthorizedKeysCommandUser root
|
||||
+
|
||||
+Do not forget to enable public key authentication:
|
||||
+ PubkeyAuthentication yes
|
||||
+
|
||||
+
|
||||
Index: openssh-8.4p1/Makefile.in
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/Makefile.in
|
||||
+++ openssh-8.4p1/Makefile.in
|
||||
@@ -23,6 +23,7 @@ SSH_PROGRAM=@bindir@/ssh
|
||||
ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
|
||||
SFTP_SERVER=$(libexecdir)/sftp-server
|
||||
SSH_KEYSIGN=$(libexecdir)/ssh-keysign
|
||||
+SSH_KEYCAT=$(libexecdir)/ssh-keycat
|
||||
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
|
||||
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
|
||||
SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
|
||||
@@ -54,6 +55,7 @@ LIBS=@LIBS@
|
||||
K5LIBS=@K5LIBS@
|
||||
GSSLIBS=@GSSLIBS@
|
||||
SSHDLIBS=@SSHDLIBS@
|
||||
+KEYCATLIBS=@KEYCATLIBS@
|
||||
LIBEDIT=@LIBEDIT@
|
||||
LIBFIDO2=@LIBFIDO2@
|
||||
AR=@AR@
|
||||
@@ -70,7 +72,7 @@ MKDIR_P=@MKDIR_P@
|
||||
|
||||
.SUFFIXES: .lo
|
||||
|
||||
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
|
||||
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT)
|
||||
|
||||
TARGETS += cavstest-ctr$(EXEEXT) cavstest-kdf$(EXEEXT)
|
||||
|
||||
@@ -243,6 +245,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
|
||||
ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
|
||||
$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
|
||||
|
||||
+ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
|
||||
+ $(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
|
||||
+
|
||||
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
|
||||
$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
|
||||
|
||||
@@ -422,6 +427,7 @@ install-files:
|
||||
$(INSTALL) -m 0755 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
|
||||
fi
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
|
||||
+ $(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT)
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux.h
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
@@ -23,8 +23,10 @@ void ssh_selinux_setup_pty(char *, const
|
||||
void ssh_selinux_change_context(const char *);
|
||||
void ssh_selinux_setfscreatecon(const char *);
|
||||
|
||||
+int sshd_selinux_enabled(void);
|
||||
void sshd_selinux_copy_context(void);
|
||||
void sshd_selinux_setup_exec_context(char *);
|
||||
+int sshd_selinux_setup_env_variables(void);
|
||||
#endif
|
||||
|
||||
#ifdef LINUX_OOM_ADJUST
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux-sshd.c
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
@@ -53,6 +53,20 @@ extern Authctxt *the_authctxt;
|
||||
extern int inetd_flag;
|
||||
extern int rexeced_flag;
|
||||
|
||||
+/* Wrapper around is_selinux_enabled() to log its return value once only */
|
||||
+int
|
||||
+sshd_selinux_enabled(void)
|
||||
+{
|
||||
+ static int enabled = -1;
|
||||
+
|
||||
+ if (enabled == -1) {
|
||||
+ enabled = (is_selinux_enabled() == 1);
|
||||
+ debug("SELinux support %s", enabled ? "enabled" : "disabled");
|
||||
+ }
|
||||
+
|
||||
+ return (enabled);
|
||||
+}
|
||||
+
|
||||
/* Send audit message */
|
||||
static int
|
||||
sshd_selinux_send_audit_message(int success, security_context_t default_context,
|
||||
@@ -318,7 +332,7 @@ sshd_selinux_getctxbyname(char *pwname,
|
||||
|
||||
/* Setup environment variables for pam_selinux */
|
||||
static int
|
||||
-sshd_selinux_setup_pam_variables(void)
|
||||
+sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
|
||||
{
|
||||
const char *reqlvl;
|
||||
char *role;
|
||||
@@ -329,16 +343,16 @@ sshd_selinux_setup_pam_variables(void)
|
||||
|
||||
ssh_selinux_get_role_level(&role, &reqlvl);
|
||||
|
||||
- rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : "");
|
||||
+ rv = set_it("SELINUX_ROLE_REQUESTED", role ? role : "");
|
||||
|
||||
if (inetd_flag && !rexeced_flag) {
|
||||
use_current = "1";
|
||||
} else {
|
||||
use_current = "";
|
||||
- rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
|
||||
+ rv = rv || set_it("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
|
||||
}
|
||||
|
||||
- rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current);
|
||||
+ rv = rv || set_it("SELINUX_USE_CURRENT_RANGE", use_current);
|
||||
|
||||
if (role != NULL)
|
||||
free(role);
|
||||
@@ -346,6 +360,24 @@ sshd_selinux_setup_pam_variables(void)
|
||||
return rv;
|
||||
}
|
||||
|
||||
+static int
|
||||
+sshd_selinux_setup_pam_variables(void)
|
||||
+{
|
||||
+ return sshd_selinux_setup_variables(do_pam_putenv);
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+do_setenv(char *name, const char *value)
|
||||
+{
|
||||
+ return setenv(name, value, 1);
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+sshd_selinux_setup_env_variables(void)
|
||||
+{
|
||||
+ return sshd_selinux_setup_variables(do_setenv);
|
||||
+}
|
||||
+
|
||||
/* Set the execution context to the default for the specified user */
|
||||
void
|
||||
sshd_selinux_setup_exec_context(char *pwname)
|
||||
@@ -354,7 +386,7 @@ sshd_selinux_setup_exec_context(char *pw
|
||||
int r = 0;
|
||||
security_context_t default_ctx = NULL;
|
||||
|
||||
- if (!ssh_selinux_enabled())
|
||||
+ if (!sshd_selinux_enabled())
|
||||
return;
|
||||
|
||||
if (options.use_pam) {
|
||||
@@ -425,7 +457,7 @@ sshd_selinux_copy_context(void)
|
||||
{
|
||||
security_context_t *ctx;
|
||||
|
||||
- if (!ssh_selinux_enabled())
|
||||
+ if (!sshd_selinux_enabled())
|
||||
return;
|
||||
|
||||
if (getexeccon((security_context_t *)&ctx) != 0) {
|
||||
Index: openssh-8.4p1/platform.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/platform.c
|
||||
+++ openssh-8.4p1/platform.c
|
||||
@@ -99,7 +99,7 @@ platform_setusercontext(struct passwd *p
|
||||
{
|
||||
#ifdef WITH_SELINUX
|
||||
/* Cache selinux status for later use */
|
||||
- (void)ssh_selinux_enabled();
|
||||
+ (void)sshd_selinux_enabled();
|
||||
#endif
|
||||
|
||||
#ifdef USE_SOLARIS_PROJECTS
|
||||
Index: openssh-8.4p1/ssh-keycat.c
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ openssh-8.4p1/ssh-keycat.c
|
||||
@@ -0,0 +1,241 @@
|
||||
+/*
|
||||
+ * Redistribution and use in source and binary forms, with or without
|
||||
+ * modification, are permitted provided that the following conditions
|
||||
+ * are met:
|
||||
+ * 1. Redistributions of source code must retain the above copyright
|
||||
+ * notice, and the entire permission notice in its entirety,
|
||||
+ * including the disclaimer of warranties.
|
||||
+ * 2. Redistributions in binary form must reproduce the above copyright
|
||||
+ * notice, this list of conditions and the following disclaimer in the
|
||||
+ * documentation and/or other materials provided with the distribution.
|
||||
+ * 3. The name of the author may not be used to endorse or promote
|
||||
+ * products derived from this software without specific prior
|
||||
+ * written permission.
|
||||
+ *
|
||||
+ * ALTERNATIVELY, this product may be distributed under the terms of
|
||||
+ * the GNU Public License, in which case the provisions of the GPL are
|
||||
+ * required INSTEAD OF the above restrictions. (This clause is
|
||||
+ * necessary due to a potential bad interaction between the GPL and
|
||||
+ * the restrictions contained in a BSD-style copyright.)
|
||||
+ *
|
||||
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
|
||||
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
|
||||
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
+ */
|
||||
+
|
||||
+/*
|
||||
+ * Copyright (c) 2011 Red Hat, Inc.
|
||||
+ * Written by Tomas Mraz <tmraz@redhat.com>
|
||||
+*/
|
||||
+
|
||||
+#define _GNU_SOURCE
|
||||
+
|
||||
+#include "config.h"
|
||||
+#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
+#include <string.h>
|
||||
+#include <sys/types.h>
|
||||
+#include <sys/stat.h>
|
||||
+#include <pwd.h>
|
||||
+#include <fcntl.h>
|
||||
+#include <unistd.h>
|
||||
+#ifdef HAVE_STDINT_H
|
||||
+#include <stdint.h>
|
||||
+#endif
|
||||
+
|
||||
+#include <security/pam_appl.h>
|
||||
+
|
||||
+#include "uidswap.h"
|
||||
+#include "misc.h"
|
||||
+
|
||||
+#define ERR_USAGE 1
|
||||
+#define ERR_PAM_START 2
|
||||
+#define ERR_OPEN_SESSION 3
|
||||
+#define ERR_CLOSE_SESSION 4
|
||||
+#define ERR_PAM_END 5
|
||||
+#define ERR_GETPWNAM 6
|
||||
+#define ERR_MEMORY 7
|
||||
+#define ERR_OPEN 8
|
||||
+#define ERR_FILE_MODE 9
|
||||
+#define ERR_FDOPEN 10
|
||||
+#define ERR_STAT 11
|
||||
+#define ERR_WRITE 12
|
||||
+#define ERR_PAM_PUTENV 13
|
||||
+#define BUFLEN 4096
|
||||
+
|
||||
+/* Just ignore the messages in the conversation function */
|
||||
+static int
|
||||
+dummy_conv(int num_msg, const struct pam_message **msgm,
|
||||
+ struct pam_response **response, void *appdata_ptr)
|
||||
+{
|
||||
+ struct pam_response *rsp;
|
||||
+
|
||||
+ (void)msgm;
|
||||
+ (void)appdata_ptr;
|
||||
+
|
||||
+ if (num_msg <= 0)
|
||||
+ return PAM_CONV_ERR;
|
||||
+
|
||||
+ /* Just allocate the array as empty responses */
|
||||
+ rsp = calloc (num_msg, sizeof (struct pam_response));
|
||||
+ if (rsp == NULL)
|
||||
+ return PAM_CONV_ERR;
|
||||
+
|
||||
+ *response = rsp;
|
||||
+ return PAM_SUCCESS;
|
||||
+}
|
||||
+
|
||||
+static struct pam_conv conv = {
|
||||
+ dummy_conv,
|
||||
+ NULL
|
||||
+};
|
||||
+
|
||||
+char *
|
||||
+make_auth_keys_name(const struct passwd *pwd)
|
||||
+{
|
||||
+ char *fname;
|
||||
+
|
||||
+ if (asprintf(&fname, "%s/.ssh/authorized_keys", pwd->pw_dir) < 0)
|
||||
+ return NULL;
|
||||
+
|
||||
+ return fname;
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+dump_keys(const char *user)
|
||||
+{
|
||||
+ struct passwd *pwd;
|
||||
+ int fd = -1;
|
||||
+ FILE *f = NULL;
|
||||
+ char *fname = NULL;
|
||||
+ int rv = 0;
|
||||
+ char buf[BUFLEN];
|
||||
+ size_t len;
|
||||
+ struct stat st;
|
||||
+
|
||||
+ if ((pwd = getpwnam(user)) == NULL) {
|
||||
+ return ERR_GETPWNAM;
|
||||
+ }
|
||||
+
|
||||
+ if ((fname = make_auth_keys_name(pwd)) == NULL) {
|
||||
+ return ERR_MEMORY;
|
||||
+ }
|
||||
+
|
||||
+ temporarily_use_uid(pwd);
|
||||
+
|
||||
+ if ((fd = open(fname, O_RDONLY|O_NONBLOCK|O_NOFOLLOW, 0)) < 0) {
|
||||
+ rv = ERR_OPEN;
|
||||
+ goto fail;
|
||||
+ }
|
||||
+
|
||||
+ if (fstat(fd, &st) < 0) {
|
||||
+ rv = ERR_STAT;
|
||||
+ goto fail;
|
||||
+ }
|
||||
+
|
||||
+ if (!S_ISREG(st.st_mode) ||
|
||||
+ (st.st_uid != pwd->pw_uid && st.st_uid != 0)) {
|
||||
+ rv = ERR_FILE_MODE;
|
||||
+ goto fail;
|
||||
+ }
|
||||
+
|
||||
+ unset_nonblock(fd);
|
||||
+
|
||||
+ if ((f = fdopen(fd, "r")) == NULL) {
|
||||
+ rv = ERR_FDOPEN;
|
||||
+ goto fail;
|
||||
+ }
|
||||
+
|
||||
+ fd = -1;
|
||||
+
|
||||
+ while ((len = fread(buf, 1, sizeof(buf), f)) > 0) {
|
||||
+ rv = fwrite(buf, 1, len, stdout) != len ? ERR_WRITE : 0;
|
||||
+ }
|
||||
+
|
||||
+fail:
|
||||
+ if (fd != -1)
|
||||
+ close(fd);
|
||||
+ if (f != NULL)
|
||||
+ fclose(f);
|
||||
+ free(fname);
|
||||
+ restore_uid();
|
||||
+ return rv;
|
||||
+}
|
||||
+
|
||||
+static const char *env_names[] = { "SELINUX_ROLE_REQUESTED",
|
||||
+ "SELINUX_LEVEL_REQUESTED",
|
||||
+ "SELINUX_USE_CURRENT_RANGE"
|
||||
+};
|
||||
+
|
||||
+extern char **environ;
|
||||
+
|
||||
+int
|
||||
+set_pam_environment(pam_handle_t *pamh)
|
||||
+{
|
||||
+ int i;
|
||||
+ size_t j;
|
||||
+
|
||||
+ for (j = 0; j < sizeof(env_names)/sizeof(env_names[0]); ++j) {
|
||||
+ int len = strlen(env_names[j]);
|
||||
+
|
||||
+ for (i = 0; environ[i] != NULL; ++i) {
|
||||
+ if (strncmp(env_names[j], environ[i], len) == 0 &&
|
||||
+ environ[i][len] == '=') {
|
||||
+ if (pam_putenv(pamh, environ[i]) != PAM_SUCCESS)
|
||||
+ return ERR_PAM_PUTENV;
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+main(int argc, char *argv[])
|
||||
+{
|
||||
+ pam_handle_t *pamh = NULL;
|
||||
+ int retval;
|
||||
+ int ev = 0;
|
||||
+
|
||||
+ if (argc != 2) {
|
||||
+ fprintf(stderr, "Usage: %s <user-name>\n", argv[0]);
|
||||
+ return ERR_USAGE;
|
||||
+ }
|
||||
+
|
||||
+ retval = pam_start("ssh-keycat", argv[1], &conv, &pamh);
|
||||
+ if (retval != PAM_SUCCESS) {
|
||||
+ return ERR_PAM_START;
|
||||
+ }
|
||||
+
|
||||
+ ev = set_pam_environment(pamh);
|
||||
+ if (ev != 0)
|
||||
+ goto finish;
|
||||
+
|
||||
+ retval = pam_open_session(pamh, PAM_SILENT);
|
||||
+ if (retval != PAM_SUCCESS) {
|
||||
+ ev = ERR_OPEN_SESSION;
|
||||
+ goto finish;
|
||||
+ }
|
||||
+
|
||||
+ ev = dump_keys(argv[1]);
|
||||
+
|
||||
+ retval = pam_close_session(pamh, PAM_SILENT);
|
||||
+ if (retval != PAM_SUCCESS) {
|
||||
+ ev = ERR_CLOSE_SESSION;
|
||||
+ }
|
||||
+
|
||||
+finish:
|
||||
+ retval = pam_end (pamh,retval);
|
||||
+ if (retval != PAM_SUCCESS) {
|
||||
+ ev = ERR_PAM_END;
|
||||
+ }
|
||||
+ return ev;
|
||||
+}
|
||||
Index: openssh-8.4p1/configure.ac
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/configure.ac
|
||||
+++ openssh-8.4p1/configure.ac
|
||||
@@ -3512,6 +3512,7 @@ AC_ARG_WITH([pam],
|
||||
PAM_MSG="yes"
|
||||
|
||||
SSHDLIBS="$SSHDLIBS -lpam"
|
||||
+ KEYCATLIBS="$KEYCATLIBS -lpam"
|
||||
AC_DEFINE([USE_PAM], [1],
|
||||
[Define if you want to enable PAM support])
|
||||
|
||||
@@ -3522,6 +3523,7 @@ AC_ARG_WITH([pam],
|
||||
;;
|
||||
*)
|
||||
SSHDLIBS="$SSHDLIBS -ldl"
|
||||
+ KEYCATLIBS="$KEYCATLIBS -ldl"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
@@ -4700,6 +4702,7 @@ AC_ARG_WITH([selinux],
|
||||
fi ]
|
||||
)
|
||||
AC_SUBST([SSHDLIBS])
|
||||
+AC_SUBST([KEYCATLIBS])
|
||||
|
||||
# Check whether user wants Kerberos 5 support
|
||||
KRB5_MSG="no"
|
||||
@@ -5699,6 +5702,9 @@ echo " Libraries: ${LIBS}"
|
||||
if test ! -z "${SSHDLIBS}"; then
|
||||
echo " +for sshd: ${SSHDLIBS}"
|
||||
fi
|
||||
+if test ! -z "${KEYCATLIBS}"; then
|
||||
+echo " +for ssh-keycat: ${KEYCATLIBS}"
|
||||
+fi
|
||||
|
||||
echo ""
|
||||
|
||||
125
openssh-6.6p1-privsep-selinux.patch
Normal file
125
openssh-6.6p1-privsep-selinux.patch
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
Index: openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux.h
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
@@ -23,6 +23,7 @@ void ssh_selinux_setup_pty(char *, const
|
||||
void ssh_selinux_change_context(const char *);
|
||||
void ssh_selinux_setfscreatecon(const char *);
|
||||
|
||||
+void sshd_selinux_copy_context(void);
|
||||
void sshd_selinux_setup_exec_context(char *);
|
||||
#endif
|
||||
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux-sshd.c
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
@@ -420,6 +420,28 @@ sshd_selinux_setup_exec_context(char *pw
|
||||
debug3("%s: done", __func__);
|
||||
}
|
||||
|
||||
+void
|
||||
+sshd_selinux_copy_context(void)
|
||||
+{
|
||||
+ security_context_t *ctx;
|
||||
+
|
||||
+ if (!ssh_selinux_enabled())
|
||||
+ return;
|
||||
+
|
||||
+ if (getexeccon((security_context_t *)&ctx) != 0) {
|
||||
+ logit("%s: getexeccon failed with %s", __func__, strerror(errno));
|
||||
+ return;
|
||||
+ }
|
||||
+ if (ctx != NULL) {
|
||||
+ /* unset exec context before we will lose this capabililty */
|
||||
+ if (setexeccon(NULL) != 0)
|
||||
+ fatal("%s: setexeccon failed with %s", __func__, strerror(errno));
|
||||
+ if (setcon(ctx) != 0)
|
||||
+ fatal("%s: setcon failed with %s", __func__, strerror(errno));
|
||||
+ freecon(ctx);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
#endif
|
||||
#endif
|
||||
|
||||
Index: openssh-8.4p1/session.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/session.c
|
||||
+++ openssh-8.4p1/session.c
|
||||
@@ -1412,7 +1412,7 @@ do_setusercontext(struct passwd *pw)
|
||||
|
||||
platform_setusercontext(pw);
|
||||
|
||||
- if (platform_privileged_uidswap()) {
|
||||
+ if (platform_privileged_uidswap() && (!is_child || !use_privsep)) {
|
||||
#ifdef HAVE_LOGIN_CAP
|
||||
if (setusercontext(lc, pw, pw->pw_uid,
|
||||
(LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) {
|
||||
@@ -1444,6 +1444,9 @@ do_setusercontext(struct passwd *pw)
|
||||
(unsigned long long)pw->pw_uid);
|
||||
chroot_path = percent_expand(tmp, "h", pw->pw_dir,
|
||||
"u", pw->pw_name, "U", uidstr, (char *)NULL);
|
||||
+#ifdef WITH_SELINUX
|
||||
+ sshd_selinux_copy_context();
|
||||
+#endif
|
||||
safely_chroot(chroot_path, pw->pw_uid);
|
||||
free(tmp);
|
||||
free(chroot_path);
|
||||
@@ -1479,6 +1482,11 @@ do_setusercontext(struct passwd *pw)
|
||||
/* Permanently switch to the desired uid. */
|
||||
permanently_set_uid(pw);
|
||||
#endif
|
||||
+
|
||||
+#ifdef WITH_SELINUX
|
||||
+ if (in_chroot == 0)
|
||||
+ sshd_selinux_copy_context();
|
||||
+#endif
|
||||
} else if (options.chroot_directory != NULL &&
|
||||
strcasecmp(options.chroot_directory, "none") != 0) {
|
||||
fatal("server lacks privileges to chroot to ChrootDirectory");
|
||||
@@ -1496,9 +1504,6 @@ do_pwchange(Session *s)
|
||||
if (s->ttyfd != -1) {
|
||||
fprintf(stderr,
|
||||
"You must change your password now and login again!\n");
|
||||
-#ifdef WITH_SELINUX
|
||||
- setexeccon(NULL);
|
||||
-#endif
|
||||
#ifdef PASSWD_NEEDS_USERNAME
|
||||
execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
|
||||
(char *)NULL);
|
||||
@@ -1732,9 +1737,6 @@ do_child(struct ssh *ssh, Session *s, co
|
||||
argv[i] = NULL;
|
||||
optind = optreset = 1;
|
||||
__progname = argv[0];
|
||||
-#ifdef WITH_SELINUX
|
||||
- ssh_selinux_change_context("sftpd_t");
|
||||
-#endif
|
||||
exit(sftp_server_main(i, argv, s->pw));
|
||||
}
|
||||
|
||||
Index: openssh-8.4p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd.c
|
||||
+++ openssh-8.4p1/sshd.c
|
||||
@@ -539,6 +539,10 @@ privsep_preauth_child(struct ssh *ssh)
|
||||
/* Demote the private keys to public keys. */
|
||||
demote_sensitive_data(ssh);
|
||||
|
||||
+#ifdef WITH_SELINUX
|
||||
+ ssh_selinux_change_context("sshd_net_t");
|
||||
+#endif
|
||||
+
|
||||
/* Demote the child */
|
||||
if (privsep_chroot) {
|
||||
/* Change our root directory */
|
||||
@@ -634,6 +638,9 @@ privsep_postauth(struct ssh *ssh, Authct
|
||||
|
||||
#ifdef DISABLE_FD_PASSING
|
||||
if (1) {
|
||||
+#elif defined(WITH_SELINUX)
|
||||
+ if (0) {
|
||||
+ /* even root user can be confined by SELinux */
|
||||
#else
|
||||
if (authctxt->pw->pw_uid == 0) {
|
||||
#endif
|
||||
206
openssh-7.6p1-audit_race_condition.patch
Normal file
206
openssh-7.6p1-audit_race_condition.patch
Normal file
|
|
@ -0,0 +1,206 @@
|
|||
diff --git a/monitor_wrap.c b/monitor_wrap.c
|
||||
index 6d900a8..bfc8e8e 100644
|
||||
--- a/monitor_wrap.c
|
||||
+++ b/monitor_wrap.c
|
||||
@@ -1187,4 +1187,51 @@ mm_audit_destroy_sensitive_data(struct ssh *ssh, const char *fp, pid_t pid, uid_
|
||||
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, m);
|
||||
sshbuf_free(m);
|
||||
}
|
||||
+
|
||||
+int mm_forward_audit_messages(int fdin)
|
||||
+{
|
||||
+ u_char buf[4];
|
||||
+ u_int blen, msg_len;
|
||||
+ struct sshbuf *m;
|
||||
+ int ret = 0;
|
||||
+
|
||||
+ debug3("%s: entering", __func__);
|
||||
+ m = sshbuf_new();
|
||||
+ do {
|
||||
+ int r;
|
||||
+
|
||||
+ blen = atomicio(read, fdin, buf, sizeof(buf));
|
||||
+ if (blen == 0) /* closed pipe */
|
||||
+ break;
|
||||
+ if (blen != sizeof(buf)) {
|
||||
+ error("%s: Failed to read the buffer from child", __func__);
|
||||
+ ret = -1;
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
+ msg_len = get_u32(buf);
|
||||
+ if (msg_len > 256 * 1024)
|
||||
+ fatal("%s: read: bad msg_len %d", __func__, msg_len);
|
||||
+ sshbuf_reset(m);
|
||||
+ if ((r = sshbuf_reserve(m, msg_len, NULL)) != 0)
|
||||
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
|
||||
+ if (atomicio(read, fdin, sshbuf_mutable_ptr(m), msg_len) != msg_len) {
|
||||
+ error("%s: Failed to read the the buffer conent from the child", __func__);
|
||||
+ ret = -1;
|
||||
+ break;
|
||||
+ }
|
||||
+ if (atomicio(vwrite, pmonitor->m_recvfd, buf, blen) != blen ||
|
||||
+ atomicio(vwrite, pmonitor->m_recvfd, sshbuf_mutable_ptr(m), msg_len) != msg_len) {
|
||||
+ error("%s: Failed to write the messag to the monitor", __func__);
|
||||
+ ret = -1;
|
||||
+ break;
|
||||
+ }
|
||||
+ } while (1);
|
||||
+ sshbuf_free(m);
|
||||
+ return ret;
|
||||
+}
|
||||
+void mm_set_monitor_pipe(int fd)
|
||||
+{
|
||||
+ pmonitor->m_recvfd = fd;
|
||||
+}
|
||||
#endif /* SSH_AUDIT_EVENTS */
|
||||
diff --git a/monitor_wrap.h b/monitor_wrap.h
|
||||
index 1ebc51d..b3882f3 100644
|
||||
--- a/monitor_wrap.h
|
||||
+++ b/monitor_wrap.h
|
||||
@@ -91,6 +91,8 @@ void mm_audit_unsupported_body(struct ssh *, int);
|
||||
void mm_audit_kex_body(struct ssh *, int, char *, char *, char *, char *, pid_t, uid_t);
|
||||
void mm_audit_session_key_free_body(struct ssh *, int, pid_t, uid_t);
|
||||
void mm_audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);
|
||||
+int mm_forward_audit_messages(int);
|
||||
+void mm_set_monitor_pipe(int);
|
||||
#endif
|
||||
|
||||
struct Session;
|
||||
diff --git a/packet.c b/packet.c
|
||||
index dfd1f85..30e31f9 100644
|
||||
--- a/packet.c
|
||||
+++ b/packet.c
|
||||
@@ -599,7 +599,7 @@ ssh_packet_rdomain_in(struct ssh *ssh)
|
||||
/* Closes the connection and clears and frees internal data structures. */
|
||||
|
||||
static void
|
||||
-ssh_packet_close_internal(struct ssh *ssh, int do_close)
|
||||
+ssh_packet_close_internal(struct ssh *ssh, int do_close, int do_audit)
|
||||
{
|
||||
struct session_state *state = ssh->state;
|
||||
u_int mode;
|
||||
@@ -651,7 +651,7 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
|
||||
#endif /* WITH_ZLIB */
|
||||
cipher_free(state->send_context);
|
||||
cipher_free(state->receive_context);
|
||||
- if (had_keys && state->server_side) {
|
||||
+ if (do_audit && had_keys && state->server_side) {
|
||||
/* Assuming this is called only from privsep child */
|
||||
audit_session_key_free(ssh, MODE_MAX);
|
||||
}
|
||||
@@ -677,13 +677,19 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
|
||||
void
|
||||
ssh_packet_close(struct ssh *ssh)
|
||||
{
|
||||
- ssh_packet_close_internal(ssh, 1);
|
||||
+ ssh_packet_close_internal(ssh, 1, 1);
|
||||
}
|
||||
|
||||
void
|
||||
ssh_packet_clear_keys(struct ssh *ssh)
|
||||
{
|
||||
- ssh_packet_close_internal(ssh, 0);
|
||||
+ ssh_packet_close_internal(ssh, 0, 1);
|
||||
+}
|
||||
+
|
||||
+void
|
||||
+ssh_packet_clear_keys_noaudit(struct ssh *ssh)
|
||||
+{
|
||||
+ ssh_packet_close_internal(ssh, 0, 0);
|
||||
}
|
||||
|
||||
/* Sets remote side protocol flags. */
|
||||
diff --git a/packet.h b/packet.h
|
||||
index 239b391..341e33c 100644
|
||||
--- a/packet.h
|
||||
+++ b/packet.h
|
||||
@@ -102,6 +102,7 @@ int ssh_packet_get_connection_out(struct ssh *);
|
||||
void ssh_packet_close(struct ssh *);
|
||||
void ssh_packet_set_input_hook(struct ssh *, ssh_packet_hook_fn *, void *);
|
||||
void ssh_packet_clear_keys(struct ssh *);
|
||||
+void ssh_packet_clear_keys_noaudit(struct ssh *);
|
||||
void ssh_clear_newkeys(struct ssh *, int);
|
||||
|
||||
int ssh_packet_is_rekeying(struct ssh *);
|
||||
diff --git a/session.c b/session.c
|
||||
index 3162089..a130703 100644
|
||||
--- a/session.c
|
||||
+++ b/session.c
|
||||
@@ -158,6 +158,10 @@ static Session *sessions = NULL;
|
||||
login_cap_t *lc;
|
||||
#endif
|
||||
|
||||
+#ifdef SSH_AUDIT_EVENTS
|
||||
+int paudit[2];
|
||||
+#endif
|
||||
+
|
||||
static int is_child = 0;
|
||||
static int in_chroot = 0;
|
||||
|
||||
@@ -732,6 +736,8 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
|
||||
}
|
||||
if (s->command != NULL && s->ptyfd == -1)
|
||||
s->command_handle = PRIVSEP(audit_run_command(ssh, s->command));
|
||||
+ if (pipe(paudit) < 0)
|
||||
+ fatal("pipe: %s", strerror(errno));
|
||||
#endif
|
||||
if (s->ttyfd != -1)
|
||||
ret = do_exec_pty(ssh, s, command);
|
||||
@@ -747,6 +753,20 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
|
||||
*/
|
||||
sshbuf_reset(loginmsg);
|
||||
|
||||
+#ifdef SSH_AUDIT_EVENTS
|
||||
+ close(paudit[1]);
|
||||
+ if (use_privsep && ret == 0) {
|
||||
+ /*
|
||||
+ * Read the audit messages from forked child and send them
|
||||
+ * back to monitor. We don't want to communicate directly,
|
||||
+ * because the messages might get mixed up.
|
||||
+ * Continue after the pipe gets closed (all messages sent).
|
||||
+ */
|
||||
+ ret = mm_forward_audit_messages(paudit[0]);
|
||||
+ }
|
||||
+ close(paudit[0]);
|
||||
+#endif /* SSH_AUDIT_EVENTS */
|
||||
+
|
||||
return ret;
|
||||
}
|
||||
|
||||
@@ -1551,15 +1571,31 @@ do_child(struct ssh *ssh, Session *s, const char *command)
|
||||
int env_size;
|
||||
int r = 0;
|
||||
|
||||
+#ifdef SSH_AUDIT_EVENTS
|
||||
+ int pparent = paudit[1];
|
||||
+ close(paudit[0]);
|
||||
+ /* Hack the monitor pipe to avoid race condition with parent */
|
||||
+ if (use_privsep)
|
||||
+ mm_set_monitor_pipe(pparent);
|
||||
+#endif
|
||||
+
|
||||
sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
|
||||
|
||||
/* remove hostkey from the child's memory */
|
||||
- destroy_sensitive_data(ssh, 1);
|
||||
- ssh_packet_clear_keys(ssh);
|
||||
- /* Don't audit this - both us and the parent would be talking to the
|
||||
- monitor over a single socket, with no synchronization. */
|
||||
+ destroy_sensitive_data(ssh, use_privsep);
|
||||
+ ssh_packet_clear_keys_noaudit(ssh);
|
||||
+ /*
|
||||
+ * We can audit this, because we hacked the pipe to direct the
|
||||
+ * messages over postauth child. But this message requires an answer
|
||||
+ * which we can't do using a one-way pipe.
|
||||
+ */
|
||||
packet_destroy_all(ssh, 0, 1);
|
||||
|
||||
+#ifdef SSH_AUDIT_EVENTS
|
||||
+ /* Notify parent that we are done */
|
||||
+ close(pparent);
|
||||
+#endif
|
||||
+
|
||||
/* Force a password change */
|
||||
if (s->authctxt->force_pwchange) {
|
||||
do_setusercontext(pw);
|
||||
278
openssh-7.6p1-cleanup-selinux.patch
Normal file
278
openssh-7.6p1-cleanup-selinux.patch
Normal file
|
|
@ -0,0 +1,278 @@
|
|||
Index: openssh-8.4p1/auth2-pubkey.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth2-pubkey.c
|
||||
+++ openssh-8.4p1/auth2-pubkey.c
|
||||
@@ -74,6 +74,9 @@
|
||||
extern ServerOptions options;
|
||||
extern u_char *session_id2;
|
||||
extern u_int session_id2_len;
|
||||
+extern int inetd_flag;
|
||||
+extern int rexeced_flag;
|
||||
+extern Authctxt *the_authctxt;
|
||||
|
||||
static char *
|
||||
format_key(const struct sshkey *key)
|
||||
@@ -564,7 +567,8 @@ match_principals_command(struct ssh *ssh
|
||||
|
||||
if ((pid = subprocess("AuthorizedPrincipalsCommand", runas_pw, command,
|
||||
ac, av, &f,
|
||||
- SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD)) == 0)
|
||||
+ SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
|
||||
+ (inetd_flag && !rexeced_flag), the_authctxt)) == 0)
|
||||
goto out;
|
||||
|
||||
uid_swapped = 1;
|
||||
@@ -1002,7 +1006,8 @@ user_key_command_allowed2(struct ssh *ss
|
||||
|
||||
if ((pid = subprocess("AuthorizedKeysCommand", runas_pw, command,
|
||||
ac, av, &f,
|
||||
- SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD)) == 0)
|
||||
+ SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
|
||||
+ (inetd_flag && !rexeced_flag), the_authctxt)) == 0)
|
||||
goto out;
|
||||
|
||||
uid_swapped = 1;
|
||||
Index: openssh-8.4p1/auth.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth.c
|
||||
+++ openssh-8.4p1/auth.c
|
||||
@@ -755,7 +755,8 @@ auth_get_canonical_hostname(struct ssh *
|
||||
*/
|
||||
pid_t
|
||||
subprocess(const char *tag, struct passwd *pw, const char *command,
|
||||
- int ac, char **av, FILE **child, u_int flags)
|
||||
+ int ac, char **av, FILE **child, u_int flags, int inetd,
|
||||
+ void *the_authctxt)
|
||||
{
|
||||
FILE *f = NULL;
|
||||
struct stat st;
|
||||
@@ -878,7 +879,7 @@ subprocess(const char *tag, struct passw
|
||||
}
|
||||
|
||||
#ifdef WITH_SELINUX
|
||||
- if (sshd_selinux_setup_env_variables() < 0) {
|
||||
+ if (sshd_selinux_setup_env_variables(inetd, the_authctxt) < 0) {
|
||||
error ("failed to copy environment: %s",
|
||||
strerror(errno));
|
||||
_exit(127);
|
||||
Index: openssh-8.4p1/auth.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth.h
|
||||
+++ openssh-8.4p1/auth.h
|
||||
@@ -236,7 +236,7 @@ struct passwd *fakepw(void);
|
||||
#define SSH_SUBPROCESS_STDOUT_CAPTURE (1<<1) /* Redirect stdout */
|
||||
#define SSH_SUBPROCESS_STDERR_DISCARD (1<<2) /* Discard stderr */
|
||||
pid_t subprocess(const char *, struct passwd *,
|
||||
- const char *, int, char **, FILE **, u_int flags);
|
||||
+ const char *, int, char **, FILE **, u_int flags, int, void *);
|
||||
|
||||
int sys_auth_passwd(struct ssh *, const char *);
|
||||
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux.h
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
@@ -25,8 +25,8 @@ void ssh_selinux_setfscreatecon(const ch
|
||||
|
||||
int sshd_selinux_enabled(void);
|
||||
void sshd_selinux_copy_context(void);
|
||||
-void sshd_selinux_setup_exec_context(char *);
|
||||
-int sshd_selinux_setup_env_variables(void);
|
||||
+void sshd_selinux_setup_exec_context(char *, int, int(char *, const char *), void *, int);
|
||||
+int sshd_selinux_setup_env_variables(int inetd, void *);
|
||||
void sshd_selinux_change_privsep_preauth_context(void);
|
||||
#endif
|
||||
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux-sshd.c
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
@@ -49,11 +49,6 @@
|
||||
#include <unistd.h>
|
||||
#endif
|
||||
|
||||
-extern ServerOptions options;
|
||||
-extern Authctxt *the_authctxt;
|
||||
-extern int inetd_flag;
|
||||
-extern int rexeced_flag;
|
||||
-
|
||||
/* Wrapper around is_selinux_enabled() to log its return value once only */
|
||||
int
|
||||
sshd_selinux_enabled(void)
|
||||
@@ -223,7 +218,8 @@ get_user_context(const char *sename, con
|
||||
}
|
||||
|
||||
static void
|
||||
-ssh_selinux_get_role_level(char **role, const char **level)
|
||||
+ssh_selinux_get_role_level(char **role, const char **level,
|
||||
+ Authctxt *the_authctxt)
|
||||
{
|
||||
*role = NULL;
|
||||
*level = NULL;
|
||||
@@ -241,8 +237,8 @@ ssh_selinux_get_role_level(char **role,
|
||||
|
||||
/* Return the default security context for the given username */
|
||||
static int
|
||||
-sshd_selinux_getctxbyname(char *pwname,
|
||||
- security_context_t *default_sc, security_context_t *user_sc)
|
||||
+sshd_selinux_getctxbyname(char *pwname, security_context_t *default_sc,
|
||||
+ security_context_t *user_sc, int inetd, Authctxt *the_authctxt)
|
||||
{
|
||||
char *sename, *lvl;
|
||||
char *role;
|
||||
@@ -250,7 +246,7 @@ sshd_selinux_getctxbyname(char *pwname,
|
||||
int r = 0;
|
||||
context_t con = NULL;
|
||||
|
||||
- ssh_selinux_get_role_level(&role, &reqlvl);
|
||||
+ ssh_selinux_get_role_level(&role, &reqlvl, the_authctxt);
|
||||
|
||||
#ifdef HAVE_GETSEUSERBYNAME
|
||||
if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
|
||||
@@ -272,7 +268,7 @@ sshd_selinux_getctxbyname(char *pwname,
|
||||
|
||||
if (r == 0) {
|
||||
/* If launched from xinetd, we must use current level */
|
||||
- if (inetd_flag && !rexeced_flag) {
|
||||
+ if (inetd) {
|
||||
security_context_t sshdsc=NULL;
|
||||
|
||||
if (getcon_raw(&sshdsc) < 0)
|
||||
@@ -333,7 +329,8 @@ sshd_selinux_getctxbyname(char *pwname,
|
||||
|
||||
/* Setup environment variables for pam_selinux */
|
||||
static int
|
||||
-sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
|
||||
+sshd_selinux_setup_variables(int(*set_it)(char *, const char *), int inetd,
|
||||
+ Authctxt *the_authctxt)
|
||||
{
|
||||
const char *reqlvl;
|
||||
char *role;
|
||||
@@ -342,11 +339,11 @@ sshd_selinux_setup_variables(int(*set_it
|
||||
|
||||
debug3("%s: setting execution context", __func__);
|
||||
|
||||
- ssh_selinux_get_role_level(&role, &reqlvl);
|
||||
+ ssh_selinux_get_role_level(&role, &reqlvl, the_authctxt);
|
||||
|
||||
rv = set_it("SELINUX_ROLE_REQUESTED", role ? role : "");
|
||||
|
||||
- if (inetd_flag && !rexeced_flag) {
|
||||
+ if (inetd) {
|
||||
use_current = "1";
|
||||
} else {
|
||||
use_current = "";
|
||||
@@ -362,9 +359,10 @@ sshd_selinux_setup_variables(int(*set_it
|
||||
}
|
||||
|
||||
static int
|
||||
-sshd_selinux_setup_pam_variables(void)
|
||||
+sshd_selinux_setup_pam_variables(int inetd,
|
||||
+ int(pam_setenv)(char *, const char *), Authctxt *the_authctxt)
|
||||
{
|
||||
- return sshd_selinux_setup_variables(do_pam_putenv);
|
||||
+ return sshd_selinux_setup_variables(pam_setenv, inetd, the_authctxt);
|
||||
}
|
||||
|
||||
static int
|
||||
@@ -374,25 +372,28 @@ do_setenv(char *name, const char *value)
|
||||
}
|
||||
|
||||
int
|
||||
-sshd_selinux_setup_env_variables(void)
|
||||
+sshd_selinux_setup_env_variables(int inetd, void *the_authctxt)
|
||||
{
|
||||
- return sshd_selinux_setup_variables(do_setenv);
|
||||
+ Authctxt *authctxt = (Authctxt *) the_authctxt;
|
||||
+ return sshd_selinux_setup_variables(do_setenv, inetd, authctxt);
|
||||
}
|
||||
|
||||
/* Set the execution context to the default for the specified user */
|
||||
void
|
||||
-sshd_selinux_setup_exec_context(char *pwname)
|
||||
+sshd_selinux_setup_exec_context(char *pwname, int inetd,
|
||||
+ int(pam_setenv)(char *, const char *), void *the_authctxt, int use_pam)
|
||||
{
|
||||
security_context_t user_ctx = NULL;
|
||||
int r = 0;
|
||||
security_context_t default_ctx = NULL;
|
||||
+ Authctxt *authctxt = (Authctxt *) the_authctxt;
|
||||
|
||||
if (!sshd_selinux_enabled())
|
||||
return;
|
||||
|
||||
- if (options.use_pam) {
|
||||
+ if (use_pam) {
|
||||
/* do not compute context, just setup environment for pam_selinux */
|
||||
- if (sshd_selinux_setup_pam_variables()) {
|
||||
+ if (sshd_selinux_setup_pam_variables(inetd, pam_setenv, authctxt)) {
|
||||
switch (security_getenforce()) {
|
||||
case -1:
|
||||
fatal("%s: security_getenforce() failed", __func__);
|
||||
@@ -410,7 +411,7 @@ sshd_selinux_setup_exec_context(char *pw
|
||||
|
||||
debug3("%s: setting execution context", __func__);
|
||||
|
||||
- r = sshd_selinux_getctxbyname(pwname, &default_ctx, &user_ctx);
|
||||
+ r = sshd_selinux_getctxbyname(pwname, &default_ctx, &user_ctx, inetd, authctxt);
|
||||
if (r >= 0) {
|
||||
r = setexeccon(user_ctx);
|
||||
if (r < 0) {
|
||||
Index: openssh-8.4p1/platform.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/platform.c
|
||||
+++ openssh-8.4p1/platform.c
|
||||
@@ -33,6 +33,9 @@
|
||||
|
||||
extern int use_privsep;
|
||||
extern ServerOptions options;
|
||||
+extern int inetd_flag;
|
||||
+extern int rexeced_flag;
|
||||
+extern Authctxt *the_authctxt;
|
||||
|
||||
void
|
||||
platform_pre_listen(void)
|
||||
@@ -184,7 +187,9 @@ platform_setusercontext_post_groups(stru
|
||||
}
|
||||
#endif /* HAVE_SETPCRED */
|
||||
#ifdef WITH_SELINUX
|
||||
- sshd_selinux_setup_exec_context(pw->pw_name);
|
||||
+ sshd_selinux_setup_exec_context(pw->pw_name,
|
||||
+ (inetd_flag && !rexeced_flag), do_pam_putenv, the_authctxt,
|
||||
+ options.use_pam);
|
||||
#endif
|
||||
}
|
||||
|
||||
Index: openssh-8.4p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd.c
|
||||
+++ openssh-8.4p1/sshd.c
|
||||
@@ -162,7 +162,7 @@ int debug_flag = 0;
|
||||
static int test_flag = 0;
|
||||
|
||||
/* Flag indicating that the daemon is being started from inetd. */
|
||||
-static int inetd_flag = 0;
|
||||
+int inetd_flag = 0;
|
||||
|
||||
/* Flag indicating that sshd should not detach and become a daemon. */
|
||||
static int no_daemon_flag = 0;
|
||||
@@ -175,7 +175,7 @@ static char **saved_argv;
|
||||
static int saved_argc;
|
||||
|
||||
/* re-exec */
|
||||
-static int rexeced_flag = 0;
|
||||
+int rexeced_flag = 0;
|
||||
static int rexec_flag = 1;
|
||||
static int rexec_argc = 0;
|
||||
static char **rexec_argv;
|
||||
@@ -2381,7 +2381,9 @@ main(int ac, char **av)
|
||||
}
|
||||
#endif
|
||||
#ifdef WITH_SELINUX
|
||||
- sshd_selinux_setup_exec_context(authctxt->pw->pw_name);
|
||||
+ sshd_selinux_setup_exec_context(authctxt->pw->pw_name,
|
||||
+ (inetd_flag && !rexeced_flag), do_pam_putenv, the_authctxt,
|
||||
+ options.use_pam);
|
||||
#endif
|
||||
#ifdef USE_PAM
|
||||
if (options.use_pam) {
|
||||
54
openssh-7.7p1-IPv6_X_forwarding.patch
Normal file
54
openssh-7.7p1-IPv6_X_forwarding.patch
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# HG changeset patch
|
||||
# Parent 8df645ca39d64de025d8838c5713812e72308c92
|
||||
Correctly parse DISPLAY variable for cases where it contains an IPv6 address
|
||||
(which should - but not always is - in (square) brackets).
|
||||
|
||||
bnc#847710 - https://bugzilla.novell.com/show_bug.cgi?id=847710
|
||||
|
||||
diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
|
||||
--- openssh-7.7p1/channels.c
|
||||
+++ openssh-7.7p1/channels.c
|
||||
@@ -4590,33 +4590,42 @@ x11_connect_display(struct ssh *ssh)
|
||||
return -1;
|
||||
|
||||
/* OK, we now have a connection to the display. */
|
||||
return sock;
|
||||
}
|
||||
/*
|
||||
* Connect to an inet socket. The DISPLAY value is supposedly
|
||||
* hostname:d[.s], where hostname may also be numeric IP address.
|
||||
+ * Note that IPv6 numeric addresses contain colons (e.g. ::1:0)
|
||||
*/
|
||||
strlcpy(buf, display, sizeof(buf));
|
||||
- cp = strchr(buf, ':');
|
||||
+ cp = strrchr(buf, ':');
|
||||
if (!cp) {
|
||||
error("Could not find ':' in DISPLAY: %.100s", display);
|
||||
return -1;
|
||||
}
|
||||
*cp = 0;
|
||||
/*
|
||||
* buf now contains the host name. But first we parse the
|
||||
* display number.
|
||||
*/
|
||||
if (sscanf(cp + 1, "%u", &display_number) != 1) {
|
||||
error("Could not parse display number from DISPLAY: %.100s",
|
||||
display);
|
||||
return -1;
|
||||
}
|
||||
+
|
||||
+ /* Remove brackets surrounding IPv6 addresses if there are any. */
|
||||
+ if (buf[0] == '[' && (cp = strchr(buf, ']'))) {
|
||||
+ *cp = 0;
|
||||
+ cp = buf + 1;
|
||||
+ } else {
|
||||
+ cp = buf;
|
||||
+ }
|
||||
|
||||
/* Look up the host address */
|
||||
memset(&hints, 0, sizeof(hints));
|
||||
hints.ai_family = ssh->chanctxt->IPv4or6;
|
||||
hints.ai_socktype = SOCK_STREAM;
|
||||
snprintf(strport, sizeof strport, "%u", 6000 + display_number);
|
||||
if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
|
||||
error("%.100s: unknown host. (%s)", buf,
|
||||
47
openssh-7.7p1-X11_trusted_forwarding.patch
Normal file
47
openssh-7.7p1-X11_trusted_forwarding.patch
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
# HG changeset patch
|
||||
# Parent d25c96855fd67e997e25ec1198d953af33eb289c
|
||||
# enable trusted X11 forwarding by default in both sshd and sshsystem-wide
|
||||
# configuration
|
||||
# bnc#50836 (was suse #35836)
|
||||
Enable Trusted X11 forwarding by default, since the security benefits of
|
||||
having it disabled are negligible these days with XI2 being widely used.
|
||||
|
||||
Index: openssh-7.8p1/ssh_config
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/ssh_config
|
||||
+++ openssh-7.8p1/ssh_config
|
||||
@@ -17,9 +17,20 @@
|
||||
# list of available options, their meanings and defaults, please see the
|
||||
# ssh_config(5) man page.
|
||||
|
||||
-# Host *
|
||||
+Host *
|
||||
# ForwardAgent no
|
||||
# ForwardX11 no
|
||||
+
|
||||
+# If you do not trust your remote host (or its administrator), you
|
||||
+# should not forward X11 connections to your local X11-display for
|
||||
+# security reasons: Someone stealing the authentification data on the
|
||||
+# remote side (the "spoofed" X-server by the remote sshd) can read your
|
||||
+# keystrokes as you type, just like any other X11 client could do.
|
||||
+# Set this to "no" here for global effect or in your own ~/.ssh/config
|
||||
+# file if you want to have the remote X11 authentification data to
|
||||
+# expire after twenty minutes after remote login.
|
||||
+ ForwardX11Trusted yes
|
||||
+
|
||||
# PasswordAuthentication yes
|
||||
# HostbasedAuthentication no
|
||||
# GSSAPIAuthentication no
|
||||
Index: openssh-7.8p1/sshd_config
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/sshd_config
|
||||
+++ openssh-7.8p1/sshd_config
|
||||
@@ -84,7 +84,7 @@ AuthorizedKeysFile .ssh/authorized_keys
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
-#X11Forwarding no
|
||||
+X11Forwarding yes
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
23
openssh-7.7p1-X_forward_with_disabled_ipv6.patch
Normal file
23
openssh-7.7p1-X_forward_with_disabled_ipv6.patch
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# HG changeset patch
|
||||
# Parent 44592f09f090e74432f608084069d30d808fda69
|
||||
Do not throw away already open sockets for X11 forwarding if another socket
|
||||
family is not available for bind()
|
||||
|
||||
diff --git a/channels.c b/channels.c
|
||||
index f51b7e3..95af47e 100644
|
||||
--- a/channels.c
|
||||
+++ b/channels.c
|
||||
@@ -4637,6 +4637,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
|
||||
debug2("%s: bind port %d: %.100s", __func__,
|
||||
port, strerror(errno));
|
||||
close(sock);
|
||||
+ /* do not remove successfully opened sockets if
|
||||
+ * the request failed because the protocol
|
||||
+ * IPv4/6 is not available (e.g. IPv6 may be
|
||||
+ * disabled while being supported)
|
||||
+ */
|
||||
+ if (EADDRNOTAVAIL == errno)
|
||||
+ continue;
|
||||
for (n = 0; n < num_socks; n++)
|
||||
close(socks[n]);
|
||||
num_socks = 0;
|
||||
59
openssh-7.7p1-allow_root_password_login.patch
Normal file
59
openssh-7.7p1-allow_root_password_login.patch
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
# HG changeset patch
|
||||
# Parent af43d436bc7fe818dd976c923ad99b89051eb299
|
||||
Allow root login with password by default. While less secure than upstream
|
||||
default of forbidding access to the root account with a password, we are
|
||||
temporarily introducing this change to keep the default used in older OpenSSH
|
||||
versions shipped with SLE.
|
||||
|
||||
Index: openssh-8.4p1/servconf.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/servconf.c
|
||||
+++ openssh-8.4p1/servconf.c
|
||||
@@ -329,7 +329,7 @@ fill_default_server_options(ServerOption
|
||||
if (options->login_grace_time == -1)
|
||||
options->login_grace_time = 120;
|
||||
if (options->permit_root_login == PERMIT_NOT_SET)
|
||||
- options->permit_root_login = PERMIT_NO_PASSWD;
|
||||
+ options->permit_root_login = PERMIT_YES;
|
||||
if (options->ignore_rhosts == -1)
|
||||
options->ignore_rhosts = 1;
|
||||
if (options->ignore_user_known_hosts == -1)
|
||||
Index: openssh-8.4p1/sshd_config
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd_config
|
||||
+++ openssh-8.4p1/sshd_config
|
||||
@@ -29,7 +29,7 @@
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
-#PermitRootLogin prohibit-password
|
||||
+PermitRootLogin yes
|
||||
#StrictModes yes
|
||||
#MaxAuthTries 6
|
||||
#MaxSessions 10
|
||||
Index: openssh-8.4p1/sshd_config.0
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd_config.0
|
||||
+++ openssh-8.4p1/sshd_config.0
|
||||
@@ -778,7 +778,7 @@ DESCRIPTION
|
||||
PermitRootLogin
|
||||
Specifies whether root can log in using ssh(1). The argument
|
||||
must be yes, prohibit-password, forced-commands-only, or no. The
|
||||
- default is prohibit-password.
|
||||
+ default is yes.
|
||||
|
||||
If this option is set to prohibit-password (or its deprecated
|
||||
alias, without-password), password and keyboard-interactive
|
||||
Index: openssh-8.4p1/sshd_config.5
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd_config.5
|
||||
+++ openssh-8.4p1/sshd_config.5
|
||||
@@ -1331,7 +1331,7 @@ The argument must be
|
||||
or
|
||||
.Cm no .
|
||||
The default is
|
||||
-.Cm prohibit-password .
|
||||
+.Cm yes .
|
||||
.Pp
|
||||
If this option is set to
|
||||
.Cm prohibit-password
|
||||
304
openssh-7.7p1-cavstest-ctr.patch
Normal file
304
openssh-7.7p1-cavstest-ctr.patch
Normal file
|
|
@ -0,0 +1,304 @@
|
|||
# HG changeset patch
|
||||
# Parent cc1022edba2c5eeb0facba08468f65afc2466b63
|
||||
CAVS test for OpenSSH's own CTR encryption mode implementation
|
||||
|
||||
Index: openssh-8.4p1/Makefile.in
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/Makefile.in
|
||||
+++ openssh-8.4p1/Makefile.in
|
||||
@@ -25,6 +25,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
|
||||
SSH_KEYSIGN=$(libexecdir)/ssh-keysign
|
||||
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
|
||||
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
|
||||
+CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
|
||||
PRIVSEP_PATH=@PRIVSEP_PATH@
|
||||
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
|
||||
STRIP_OPT=@STRIP_OPT@
|
||||
@@ -68,6 +69,8 @@ MKDIR_P=@MKDIR_P@
|
||||
|
||||
TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
|
||||
|
||||
+TARGETS += cavstest-ctr$(EXEEXT)
|
||||
+
|
||||
XMSS_OBJS=\
|
||||
ssh-xmss.o \
|
||||
sshkey-xmss.o \
|
||||
@@ -242,6 +245,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss
|
||||
sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
|
||||
$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
|
||||
|
||||
+# FIPS tests
|
||||
+cavstest-ctr$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o cavstest-ctr.o
|
||||
+ $(LD) -o $@ cavstest-ctr.o ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
|
||||
+
|
||||
# test driver for the loginrec code - not built by default
|
||||
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
|
||||
$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
|
||||
@@ -400,6 +407,7 @@ install-files:
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
|
||||
+ $(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT)
|
||||
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
|
||||
$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
|
||||
$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
|
||||
Index: openssh-8.4p1/cavstest-ctr.c
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ openssh-8.4p1/cavstest-ctr.c
|
||||
@@ -0,0 +1,214 @@
|
||||
+/*
|
||||
+ *
|
||||
+ * invocation (all of the following are equal):
|
||||
+ * ./ctr-cavstest --algo aes128-ctr --key 987212980144b6a632e864031f52dacc --mode encrypt --data a6deca405eef2e8e4609abf3c3ccf4a6
|
||||
+ * ./ctr-cavstest --algo aes128-ctr --key 987212980144b6a632e864031f52dacc --mode encrypt --data a6deca405eef2e8e4609abf3c3ccf4a6 --iv 00000000000000000000000000000000
|
||||
+ * echo -n a6deca405eef2e8e4609abf3c3ccf4a6 | ./ctr-cavstest --algo aes128-ctr --key 987212980144b6a632e864031f52dacc --mode encrypt
|
||||
+ */
|
||||
+
|
||||
+#include "includes.h"
|
||||
+
|
||||
+#include <sys/types.h>
|
||||
+#include <sys/param.h>
|
||||
+#include <stdarg.h>
|
||||
+#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
+#include <string.h>
|
||||
+#include <ctype.h>
|
||||
+
|
||||
+#include "xmalloc.h"
|
||||
+#include "log.h"
|
||||
+#include "cipher.h"
|
||||
+
|
||||
+/* compatibility with old or broken OpenSSL versions */
|
||||
+#include "openbsd-compat/openssl-compat.h"
|
||||
+
|
||||
+void
|
||||
+usage(void)
|
||||
+{
|
||||
+ fprintf(stderr, "Usage: ctr-cavstest --algo <ssh-crypto-algorithm>\n"
|
||||
+ " --key <hexadecimal-key> --mode <encrypt|decrypt>\n"
|
||||
+ " [--iv <hexadecimal-iv>] --data <hexadecimal-data>\n\n"
|
||||
+ "Hexadecimal output is printed to stdout.\n"
|
||||
+ "Hexadecimal input data can be alternatively read from stdin.\n");
|
||||
+ exit(1);
|
||||
+}
|
||||
+
|
||||
+void *
|
||||
+fromhex(char *hex, size_t * len)
|
||||
+{
|
||||
+ unsigned char *bin;
|
||||
+ char *p;
|
||||
+ size_t n = 0;
|
||||
+ int shift = 4;
|
||||
+ unsigned char out = 0;
|
||||
+ unsigned char *optr;
|
||||
+
|
||||
+ bin = xmalloc(strlen(hex) / 2);
|
||||
+ optr = bin;
|
||||
+
|
||||
+ for (p = hex; *p != '\0'; ++p) {
|
||||
+ unsigned char c;
|
||||
+
|
||||
+ c = *p;
|
||||
+ if (isspace(c))
|
||||
+ continue;
|
||||
+
|
||||
+ if (c >= '0' && c <= '9') {
|
||||
+ c = c - '0';
|
||||
+ } else if (c >= 'A' && c <= 'F') {
|
||||
+ c = c - 'A' + 10;
|
||||
+ } else if (c >= 'a' && c <= 'f') {
|
||||
+ c = c - 'a' + 10;
|
||||
+ } else {
|
||||
+ /* truncate on nonhex cipher */
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
+ out |= c << shift;
|
||||
+ shift = (shift + 4) % 8;
|
||||
+
|
||||
+ if (shift) {
|
||||
+ *(optr++) = out;
|
||||
+ out = 0;
|
||||
+ ++n;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ *len = n;
|
||||
+ return bin;
|
||||
+}
|
||||
+
|
||||
+#define READ_CHUNK 4096
|
||||
+#define MAX_READ_SIZE 1024*1024*100
|
||||
+char *
|
||||
+read_stdin(void)
|
||||
+{
|
||||
+ char *buf;
|
||||
+ size_t n, total = 0;
|
||||
+
|
||||
+ buf = xmalloc(READ_CHUNK);
|
||||
+
|
||||
+ do {
|
||||
+ n = fread(buf + total, 1, READ_CHUNK, stdin);
|
||||
+ if (n < READ_CHUNK) /* terminate on short read */
|
||||
+ break;
|
||||
+
|
||||
+ total += n;
|
||||
+ buf = xreallocarray(buf, total + READ_CHUNK, 1);
|
||||
+ } while (total < MAX_READ_SIZE);
|
||||
+ return buf;
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+main(int argc, char *argv[])
|
||||
+{
|
||||
+
|
||||
+ struct sshcipher *c;
|
||||
+ struct sshcipher_ctx cc;
|
||||
+ struct sshcipher_ctx *ccp;
|
||||
+ char *algo = "aes128-ctr";
|
||||
+ char *hexkey = NULL;
|
||||
+ char *hexiv = "00000000000000000000000000000000";
|
||||
+ char *hexdata = NULL;
|
||||
+ char *p;
|
||||
+ int i;
|
||||
+ int encrypt = 1;
|
||||
+ void *key;
|
||||
+ size_t keylen;
|
||||
+ void *iv;
|
||||
+ size_t ivlen;
|
||||
+ void *data;
|
||||
+ size_t datalen;
|
||||
+ void *outdata;
|
||||
+
|
||||
+ for (i = 1; i < argc; ++i) {
|
||||
+ if (strcmp(argv[i], "--algo") == 0) {
|
||||
+ algo = argv[++i];
|
||||
+ } else if (strcmp(argv[i], "--key") == 0) {
|
||||
+ hexkey = argv[++i];
|
||||
+ } else if (strcmp(argv[i], "--mode") == 0) {
|
||||
+ ++i;
|
||||
+ if (argv[i] == NULL) {
|
||||
+ usage();
|
||||
+ }
|
||||
+ if (strncmp(argv[i], "enc", 3) == 0) {
|
||||
+ encrypt = 1;
|
||||
+ } else if (strncmp(argv[i], "dec", 3) == 0) {
|
||||
+ encrypt = 0;
|
||||
+ } else {
|
||||
+ usage();
|
||||
+ }
|
||||
+ } else if (strcmp(argv[i], "--iv") == 0) {
|
||||
+ hexiv = argv[++i];
|
||||
+ } else if (strcmp(argv[i], "--data") == 0) {
|
||||
+ hexdata = argv[++i];
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if (hexkey == NULL || algo == NULL) {
|
||||
+ usage();
|
||||
+ }
|
||||
+
|
||||
+ OpenSSL_add_all_algorithms();
|
||||
+
|
||||
+ c = cipher_by_name(algo);
|
||||
+ if (c == NULL) {
|
||||
+ fprintf(stderr, "Error: unknown algorithm\n");
|
||||
+ return 2;
|
||||
+ }
|
||||
+
|
||||
+ if (hexdata == NULL) {
|
||||
+ hexdata = read_stdin();
|
||||
+ } else {
|
||||
+ hexdata = xstrdup(hexdata);
|
||||
+ }
|
||||
+
|
||||
+ key = fromhex(hexkey, &keylen);
|
||||
+
|
||||
+ if (keylen != 16 && keylen != 24 && keylen == 32) {
|
||||
+ fprintf(stderr, "Error: unsupported key length\n");
|
||||
+ return 2;
|
||||
+ }
|
||||
+
|
||||
+ iv = fromhex(hexiv, &ivlen);
|
||||
+
|
||||
+ if (ivlen != 16) {
|
||||
+ fprintf(stderr, "Error: unsupported iv length\n");
|
||||
+ return 2;
|
||||
+ }
|
||||
+
|
||||
+ data = fromhex(hexdata, &datalen);
|
||||
+
|
||||
+ if (data == NULL || datalen == 0) {
|
||||
+ fprintf(stderr, "Error: no data to encrypt/decrypt\n");
|
||||
+ return 2;
|
||||
+ }
|
||||
+
|
||||
+ ccp = &cc;
|
||||
+ cipher_init(&ccp, c, key, keylen, iv, ivlen, encrypt);
|
||||
+
|
||||
+ free(key);
|
||||
+ free(iv);
|
||||
+
|
||||
+ outdata = malloc(datalen);
|
||||
+ if (outdata == NULL) {
|
||||
+ fprintf(stderr, "Error: memory allocation failure\n");
|
||||
+ return 2;
|
||||
+ }
|
||||
+
|
||||
+ cipher_crypt(&cc, 0, outdata, data, datalen, 0, 0);
|
||||
+
|
||||
+ free(data);
|
||||
+
|
||||
+ cipher_free(&cc);
|
||||
+
|
||||
+ for (p = outdata; datalen > 0; ++p, --datalen) {
|
||||
+ printf("%02X", (unsigned char) *p);
|
||||
+ }
|
||||
+
|
||||
+ free(outdata);
|
||||
+
|
||||
+ printf("\n");
|
||||
+ return 0;
|
||||
+}
|
||||
Index: openssh-8.4p1/cipher.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/cipher.c
|
||||
+++ openssh-8.4p1/cipher.c
|
||||
@@ -58,15 +58,6 @@
|
||||
#define EVP_CIPHER_CTX void
|
||||
#endif
|
||||
|
||||
-struct sshcipher_ctx {
|
||||
- int plaintext;
|
||||
- int encrypt;
|
||||
- EVP_CIPHER_CTX *evp;
|
||||
- struct chachapoly_ctx *cp_ctx;
|
||||
- struct aesctr_ctx ac_ctx; /* XXX union with evp? */
|
||||
- const struct sshcipher *cipher;
|
||||
-};
|
||||
-
|
||||
struct sshcipher {
|
||||
char *name;
|
||||
u_int block_size;
|
||||
Index: openssh-8.4p1/cipher.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/cipher.h
|
||||
+++ openssh-8.4p1/cipher.h
|
||||
@@ -48,7 +48,15 @@
|
||||
#define CIPHER_DECRYPT 0
|
||||
|
||||
struct sshcipher;
|
||||
-struct sshcipher_ctx;
|
||||
+struct sshcipher_ctx {
|
||||
+ int plaintext;
|
||||
+ int encrypt;
|
||||
+ EVP_CIPHER_CTX *evp;
|
||||
+ struct chachapoly_ctx *cp_ctx; /* XXX union with evp? */
|
||||
+ struct aesctr_ctx ac_ctx; /* XXX union with evp? */
|
||||
+ const struct sshcipher *cipher;
|
||||
+};
|
||||
+
|
||||
|
||||
const struct sshcipher *cipher_by_name(const char *);
|
||||
const char *cipher_warning_message(const struct sshcipher_ctx *);
|
||||
450
openssh-7.7p1-cavstest-kdf.patch
Normal file
450
openssh-7.7p1-cavstest-kdf.patch
Normal file
|
|
@ -0,0 +1,450 @@
|
|||
# HG changeset patch
|
||||
# Parent 1e1d5a2ab8bddfc800f570755f9ea1addcc878c1
|
||||
CAVS test for KDF implementation in OpenSSH
|
||||
|
||||
Index: openssh-8.4p1/Makefile.in
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/Makefile.in
|
||||
+++ openssh-8.4p1/Makefile.in
|
||||
@@ -26,6 +26,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
|
||||
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
|
||||
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
|
||||
CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
|
||||
+CAVSTEST_KDF=$(libexecdir)/cavstest-kdf
|
||||
PRIVSEP_PATH=@PRIVSEP_PATH@
|
||||
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
|
||||
STRIP_OPT=@STRIP_OPT@
|
||||
@@ -69,7 +70,7 @@ MKDIR_P=@MKDIR_P@
|
||||
|
||||
TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
|
||||
|
||||
-TARGETS += cavstest-ctr$(EXEEXT)
|
||||
+TARGETS += cavstest-ctr$(EXEEXT) cavstest-kdf$(EXEEXT)
|
||||
|
||||
XMSS_OBJS=\
|
||||
ssh-xmss.o \
|
||||
@@ -249,6 +250,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S
|
||||
cavstest-ctr$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o cavstest-ctr.o
|
||||
$(LD) -o $@ cavstest-ctr.o ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
|
||||
|
||||
+cavstest-kdf$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o cavstest-kdf.o
|
||||
+ $(LD) -o $@ cavstest-kdf.o ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
|
||||
+
|
||||
# test driver for the loginrec code - not built by default
|
||||
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
|
||||
$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
|
||||
@@ -408,6 +412,7 @@ install-files:
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
|
||||
$(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT)
|
||||
+ $(INSTALL) -m 0755 $(STRIP_OPT) cavstest-kdf$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-kdf$(EXEEXT)
|
||||
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
|
||||
$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
|
||||
$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
|
||||
Index: openssh-8.4p1/cavstest-kdf.c
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ openssh-8.4p1/cavstest-kdf.c
|
||||
@@ -0,0 +1,402 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
|
||||
+ *
|
||||
+ * Redistribution and use in source and binary forms, with or without
|
||||
+ * modification, are permitted provided that the following conditions
|
||||
+ * are met:
|
||||
+ * 1. Redistributions of source code must retain the above copyright
|
||||
+ * notice, and the entire permission notice in its entirety,
|
||||
+ * including the disclaimer of warranties.
|
||||
+ * 2. Redistributions in binary form must reproduce the above copyright
|
||||
+ * notice, this list of conditions and the following disclaimer in the
|
||||
+ * documentation and/or other materials provided with the distribution.
|
||||
+ * 3. The name of the author may not be used to endorse or promote
|
||||
+ * products derived from this software without specific prior
|
||||
+ * written permission.
|
||||
+ *
|
||||
+ * ALTERNATIVELY, this product may be distributed under the terms of
|
||||
+ * the GNU General Public License, in which case the provisions of the GPL2
|
||||
+ * are required INSTEAD OF the above restrictions. (This clause is
|
||||
+ * necessary due to a potential bad interaction between the GPL and
|
||||
+ * the restrictions contained in a BSD-style copyright.)
|
||||
+ *
|
||||
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
|
||||
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
|
||||
+ * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
|
||||
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
||||
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
||||
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
|
||||
+ * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
|
||||
+ * DAMAGE.
|
||||
+ */
|
||||
+
|
||||
+#include "includes.h"
|
||||
+
|
||||
+#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
+#include <errno.h>
|
||||
+#include <sys/types.h>
|
||||
+#include <string.h>
|
||||
+
|
||||
+#include <openssl/bn.h>
|
||||
+
|
||||
+#include "xmalloc.h"
|
||||
+#include "ssherr.h"
|
||||
+#include "sshbuf.h"
|
||||
+#include "sshkey.h"
|
||||
+#include "cipher.h"
|
||||
+#include "kex.h"
|
||||
+#include "packet.h"
|
||||
+
|
||||
+static int bin_char(unsigned char hex)
|
||||
+{
|
||||
+ if (48 <= hex && 57 >= hex)
|
||||
+ return (hex - 48);
|
||||
+ if (65 <= hex && 70 >= hex)
|
||||
+ return (hex - 55);
|
||||
+ if (97 <= hex && 102 >= hex)
|
||||
+ return (hex - 87);
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * Convert hex representation into binary string
|
||||
+ * @hex input buffer with hex representation
|
||||
+ * @hexlen length of hex
|
||||
+ * @bin output buffer with binary data
|
||||
+ * @binlen length of already allocated bin buffer (should be at least
|
||||
+ * half of hexlen -- if not, only a fraction of hexlen is converted)
|
||||
+ */
|
||||
+static void hex2bin(const char *hex, size_t hexlen,
|
||||
+ unsigned char *bin, size_t binlen)
|
||||
+{
|
||||
+ size_t i = 0;
|
||||
+ size_t chars = (binlen > (hexlen / 2)) ? (hexlen / 2) : binlen;
|
||||
+
|
||||
+ for (i = 0; i < chars; i++) {
|
||||
+ bin[i] = bin_char(hex[(i*2)]) << 4;
|
||||
+ bin[i] |= bin_char(hex[((i*2)+1)]);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * Allocate sufficient space for binary representation of hex
|
||||
+ * and convert hex into bin
|
||||
+ *
|
||||
+ * Caller must free bin
|
||||
+ * @hex input buffer with hex representation
|
||||
+ * @hexlen length of hex
|
||||
+ * @bin return value holding the pointer to the newly allocated buffer
|
||||
+ * @binlen return value holding the allocated size of bin
|
||||
+ *
|
||||
+ * return: 0 on success, !0 otherwise
|
||||
+ */
|
||||
+static int hex2bin_alloc(const char *hex, size_t hexlen,
|
||||
+ unsigned char **bin, size_t *binlen)
|
||||
+{
|
||||
+ unsigned char *out = NULL;
|
||||
+ size_t outlen = 0;
|
||||
+
|
||||
+ if (!hexlen)
|
||||
+ return -EINVAL;
|
||||
+
|
||||
+ outlen = (hexlen + 1) / 2;
|
||||
+
|
||||
+ out = calloc(1, outlen);
|
||||
+ if (!out)
|
||||
+ return -errno;
|
||||
+
|
||||
+ hex2bin(hex, hexlen, out, outlen);
|
||||
+ *bin = out;
|
||||
+ *binlen = outlen;
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static char hex_char_map_l[] = { '0', '1', '2', '3', '4', '5', '6', '7',
|
||||
+ '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' };
|
||||
+static char hex_char_map_u[] = { '0', '1', '2', '3', '4', '5', '6', '7',
|
||||
+ '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' };
|
||||
+static char hex_char(unsigned int bin, int u)
|
||||
+{
|
||||
+ if (bin < sizeof(hex_char_map_l))
|
||||
+ return (u) ? hex_char_map_u[bin] : hex_char_map_l[bin];
|
||||
+ return 'X';
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * Convert binary string into hex representation
|
||||
+ * @bin input buffer with binary data
|
||||
+ * @binlen length of bin
|
||||
+ * @hex output buffer to store hex data
|
||||
+ * @hexlen length of already allocated hex buffer (should be at least
|
||||
+ * twice binlen -- if not, only a fraction of binlen is converted)
|
||||
+ * @u case of hex characters (0=>lower case, 1=>upper case)
|
||||
+ */
|
||||
+static void bin2hex(const unsigned char *bin, size_t binlen,
|
||||
+ char *hex, size_t hexlen, int u)
|
||||
+{
|
||||
+ size_t i = 0;
|
||||
+ size_t chars = (binlen > (hexlen / 2)) ? (hexlen / 2) : binlen;
|
||||
+
|
||||
+ for (i = 0; i < chars; i++) {
|
||||
+ hex[(i*2)] = hex_char((bin[i] >> 4), u);
|
||||
+ hex[((i*2)+1)] = hex_char((bin[i] & 0x0f), u);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+struct kdf_cavs {
|
||||
+ unsigned char *K;
|
||||
+ size_t Klen;
|
||||
+ unsigned char *H;
|
||||
+ size_t Hlen;
|
||||
+ unsigned char *session_id;
|
||||
+ size_t session_id_len;
|
||||
+
|
||||
+ unsigned int iv_len;
|
||||
+ unsigned int ek_len;
|
||||
+ unsigned int ik_len;
|
||||
+};
|
||||
+
|
||||
+#ifdef WITH_OPENSSL
|
||||
+static int
|
||||
+kex_derive_keys_bn(struct ssh *ssh, u_char *hash, u_int hashlen,
|
||||
+ const BIGNUM *secret)
|
||||
+{
|
||||
+ struct sshbuf *shared_secret;
|
||||
+ int r;
|
||||
+
|
||||
+ if ((shared_secret = sshbuf_new()) == NULL)
|
||||
+ return SSH_ERR_ALLOC_FAIL;
|
||||
+ if ((r = sshbuf_put_bignum2(shared_secret, secret)) == 0)
|
||||
+ r = kex_derive_keys(ssh, hash, hashlen, shared_secret);
|
||||
+ sshbuf_free(shared_secret);
|
||||
+ return r;
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
+static int sshkdf_cavs(struct kdf_cavs *test)
|
||||
+{
|
||||
+ int ret = 0;
|
||||
+ struct kex kex;
|
||||
+ BIGNUM *Kbn = NULL;
|
||||
+ int mode = 0;
|
||||
+ struct newkeys *keys_client;
|
||||
+ struct newkeys *keys_server;
|
||||
+ struct ssh *ssh = NULL;
|
||||
+
|
||||
+#define HEXOUTLEN 500
|
||||
+ char hex[HEXOUTLEN];
|
||||
+
|
||||
+ memset(&kex, 0, sizeof(struct kex));
|
||||
+
|
||||
+ Kbn = BN_new();
|
||||
+ BN_bin2bn(test->K, test->Klen, Kbn);
|
||||
+ if (!Kbn) {
|
||||
+ printf("cannot convert K into BIGNUM\n");
|
||||
+ ret = 1;
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ kex.session_id = test->session_id;
|
||||
+ kex.session_id_len = test->session_id_len;
|
||||
+
|
||||
+ /* setup kex */
|
||||
+
|
||||
+ /* select the right hash based on struct ssh_digest digests */
|
||||
+ switch (test->ik_len) {
|
||||
+ case 20:
|
||||
+ kex.hash_alg = 2;
|
||||
+ break;
|
||||
+ case 32:
|
||||
+ kex.hash_alg = 3;
|
||||
+ break;
|
||||
+ case 48:
|
||||
+ kex.hash_alg = 4;
|
||||
+ break;
|
||||
+ case 64:
|
||||
+ kex.hash_alg = 5;
|
||||
+ break;
|
||||
+ default:
|
||||
+ printf("Wrong hash type %u\n", test->ik_len);
|
||||
+ ret = 1;
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ /* implement choose_enc */
|
||||
+ for (mode = 0; mode < 2; mode++) {
|
||||
+ kex.newkeys[mode] = calloc(1, sizeof(struct newkeys));
|
||||
+ if (!kex.newkeys[mode]) {
|
||||
+ printf("allocation of newkeys failed\n");
|
||||
+ ret = 1;
|
||||
+ goto out;
|
||||
+ }
|
||||
+ kex.newkeys[mode]->enc.iv_len = test->iv_len;
|
||||
+ kex.newkeys[mode]->enc.key_len = test->ek_len;
|
||||
+ kex.newkeys[mode]->enc.block_size = (test->iv_len == 64) ? 8 : 16;
|
||||
+ kex.newkeys[mode]->mac.key_len = test->ik_len;
|
||||
+ }
|
||||
+
|
||||
+ /* implement kex_choose_conf */
|
||||
+ kex.we_need = kex.newkeys[0]->enc.key_len;
|
||||
+ if (kex.we_need < kex.newkeys[0]->enc.block_size)
|
||||
+ kex.we_need = kex.newkeys[0]->enc.block_size;
|
||||
+ if (kex.we_need < kex.newkeys[0]->enc.iv_len)
|
||||
+ kex.we_need = kex.newkeys[0]->enc.iv_len;
|
||||
+ if (kex.we_need < kex.newkeys[0]->mac.key_len)
|
||||
+ kex.we_need = kex.newkeys[0]->mac.key_len;
|
||||
+
|
||||
+ /* MODE_OUT (1) -> server to client
|
||||
+ * MODE_IN (0) -> client to server */
|
||||
+ kex.server = 1;
|
||||
+
|
||||
+ /* do it */
|
||||
+ if ((ssh = ssh_packet_set_connection(NULL, -1, -1)) == NULL){
|
||||
+ printf("Allocation error\n");
|
||||
+ goto out;
|
||||
+ }
|
||||
+ ssh->kex = &kex;
|
||||
+ kex_derive_keys_bn(ssh, test->H, test->Hlen, Kbn);
|
||||
+
|
||||
+ keys_client = kex.newkeys[0];
|
||||
+ keys_server = kex.newkeys[1];
|
||||
+
|
||||
+ /* get data */
|
||||
+ memset(hex, 0, HEXOUTLEN);
|
||||
+ bin2hex(keys_client->enc.iv, (size_t)keys_client->enc.iv_len,
|
||||
+ hex, HEXOUTLEN, 0);
|
||||
+ printf("Initial IV (client to server) = %s\n", hex);
|
||||
+
|
||||
+ memset(hex, 0, HEXOUTLEN);
|
||||
+ bin2hex(keys_server->enc.iv, (size_t)keys_server->enc.iv_len,
|
||||
+ hex, HEXOUTLEN, 0);
|
||||
+ printf("Initial IV (server to client) = %s\n", hex);
|
||||
+
|
||||
+ memset(hex, 0, HEXOUTLEN);
|
||||
+ bin2hex(keys_client->enc.key, (size_t)keys_client->enc.key_len,
|
||||
+ hex, HEXOUTLEN, 0);
|
||||
+ printf("Encryption key (client to server) = %s\n", hex);
|
||||
+
|
||||
+ memset(hex, 0, HEXOUTLEN);
|
||||
+ bin2hex(keys_server->enc.key, (size_t)keys_server->enc.key_len,
|
||||
+ hex, HEXOUTLEN, 0);
|
||||
+ printf("Encryption key (server to client) = %s\n", hex);
|
||||
+
|
||||
+ memset(hex, 0, HEXOUTLEN);
|
||||
+ bin2hex(keys_client->mac.key, (size_t)keys_client->mac.key_len,
|
||||
+ hex, HEXOUTLEN, 0);
|
||||
+ printf("Integrity key (client to server) = %s\n", hex);
|
||||
+
|
||||
+ memset(hex, 0, HEXOUTLEN);
|
||||
+ bin2hex(keys_server->mac.key, (size_t)keys_server->mac.key_len,
|
||||
+ hex, HEXOUTLEN, 0);
|
||||
+ printf("Integrity key (server to client) = %s\n", hex);
|
||||
+
|
||||
+out:
|
||||
+ if (Kbn)
|
||||
+ BN_free(Kbn);
|
||||
+ if (ssh)
|
||||
+ ssh_packet_close(ssh);
|
||||
+ if (kex.newkeys[0])
|
||||
+ free(kex.newkeys[0]);
|
||||
+ if (kex.newkeys[1])
|
||||
+ free(kex.newkeys[1]);
|
||||
+ return ret;
|
||||
+}
|
||||
+
|
||||
+static void usage(void)
|
||||
+{
|
||||
+ fprintf(stderr, "\nOpenSSH KDF CAVS Test\n\n");
|
||||
+ fprintf(stderr, "Usage:\n");
|
||||
+ fprintf(stderr, "\t-K\tShared secret string\n");
|
||||
+ fprintf(stderr, "\t-H\tHash string\n");
|
||||
+ fprintf(stderr, "\t-s\tSession ID string\n");
|
||||
+ fprintf(stderr, "\t-i\tIV length to be generated\n");
|
||||
+ fprintf(stderr, "\t-e\tEncryption key length to be generated\n");
|
||||
+ fprintf(stderr, "\t-m\tMAC key length to be generated\n");
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * Test command example:
|
||||
+ * ./ssh-cavs -K 0055d50f2d163cc07cd8a93cc7c3430c30ce786b572c01ad29fec7597000cf8618d664e2ec3dcbc8bb7a1a7eb7ef67f61cdaf291625da879186ac0a5cb27af571b59612d6a6e0627344d846271959fda61c78354aa498773d59762f8ca2d0215ec590d8633de921f920d41e47b3de6ab9a3d0869e1c826d0e4adebf8e3fb646a15dea20a410b44e969f4b791ed6a67f13f1b74234004d5fa5e87eff7abc32d49bbdf44d7b0107e8f10609233b7e2b7eff74a4daf25641de7553975dac6ac1e5117df6f6dbaa1c263d23a6c3e5a3d7d49ae8a828c1e333ac3f85fbbf57b5c1a45be45e43a7be1a4707eac779b8285522d1f531fe23f890fd38a004339932b93eda4 -H d3ab91a850febb417a25d892ec48ed5952c7a5de -s d3ab91a850febb417a25d892ec48ed5952c7a5de -i 8 -e 24 -m 20
|
||||
+ *
|
||||
+ * Expected result for example:
|
||||
+ * Initial IV (client to server) = 4bb320d1679dfd3a
|
||||
+ * Encryption key (client to server) = 13048cc600b9d3cf9095aa6cf8e2ff9cf1c54ca0520c89ed
|
||||
+ * Integrity key (client to server) = ecef63a092b0dcc585bdc757e01b2740af57d640
|
||||
+ * Initial IV (server to client) = 43dea6fdf263a308
|
||||
+ * Encryption key (server to client) = 1e483c5134e901aa11fc4e0a524e7ec7b75556148a222bb0
|
||||
+ * Integrity key (server to client) = 7424b05f3c44a72b4ebd281fb71f9cbe7b64d479
|
||||
+ */
|
||||
+int main(int argc, char *argv[])
|
||||
+{
|
||||
+ struct kdf_cavs test;
|
||||
+ int ret = 1;
|
||||
+ int opt = 0;
|
||||
+
|
||||
+ memset(&test, 0, sizeof(struct kdf_cavs));
|
||||
+ while((opt = getopt(argc, argv, "K:H:s:i:e:m:")) != -1)
|
||||
+ {
|
||||
+ size_t len = 0;
|
||||
+ switch(opt)
|
||||
+ {
|
||||
+ /*
|
||||
+ * CAVS K is MPINT
|
||||
+ * we want a hex (i.e. the caller must ensure the
|
||||
+ * following transformations already happened):
|
||||
+ * 1. cut off first four bytes
|
||||
+ * 2. if most significant bit of value is
|
||||
+ * 1, prepend 0 byte
|
||||
+ */
|
||||
+ case 'K':
|
||||
+ len = strlen(optarg);
|
||||
+ ret = hex2bin_alloc(optarg, len,
|
||||
+ &test.K, &test.Klen);
|
||||
+ if (ret)
|
||||
+ goto out;
|
||||
+ break;
|
||||
+ case 'H':
|
||||
+ len = strlen(optarg);
|
||||
+ ret = hex2bin_alloc(optarg, len,
|
||||
+ &test.H, &test.Hlen);
|
||||
+ if (ret)
|
||||
+ goto out;
|
||||
+ break;
|
||||
+ case 's':
|
||||
+ len = strlen(optarg);
|
||||
+ ret = hex2bin_alloc(optarg, len,
|
||||
+ &test.session_id,
|
||||
+ &test.session_id_len);
|
||||
+ if (ret)
|
||||
+ goto out;
|
||||
+ break;
|
||||
+ case 'i':
|
||||
+ test.iv_len = strtoul(optarg, NULL, 10);
|
||||
+ break;
|
||||
+ case 'e':
|
||||
+ test.ek_len = strtoul(optarg, NULL, 10);
|
||||
+ break;
|
||||
+ case 'm':
|
||||
+ test.ik_len = strtoul(optarg, NULL, 10);
|
||||
+ break;
|
||||
+ default:
|
||||
+ usage();
|
||||
+ goto out;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ ret = sshkdf_cavs(&test);
|
||||
+
|
||||
+out:
|
||||
+ if (test.session_id)
|
||||
+ free(test.session_id);
|
||||
+ if (test.K)
|
||||
+ free(test.K);
|
||||
+ if (test.H)
|
||||
+ free(test.H);
|
||||
+ return ret;
|
||||
+
|
||||
+}
|
||||
48
openssh-7.7p1-disable_openssl_abi_check.patch
Normal file
48
openssh-7.7p1-disable_openssl_abi_check.patch
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# HG changeset patch
|
||||
# Parent b13da8c3e99081cb92ab226d2c512241a82cd0d5
|
||||
disable run-time check for OpenSSL ABI by version number as that is not a
|
||||
reliable indicator of ABI changes and doesn't make much sense in a
|
||||
distribution package
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 42ffd95..20a1884 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -4878,6 +4878,19 @@ AC_ARG_WITH([bsd-auth],
|
||||
]
|
||||
)
|
||||
|
||||
+# Whether we are using distribution (Open)SSL, so no runtime checks are necessary
|
||||
+DISTRO_SSL=no
|
||||
+AC_ARG_WITH([distro-ssl],
|
||||
+ [ --with-distro-ssl Disable runtime OpenSSL version checks (good for distributions)],
|
||||
+ [
|
||||
+ if test "x$withval" != "xno" ; then
|
||||
+ AC_DEFINE([DISTRO_SSL], [1],
|
||||
+ [Define if you are using distribution SSL library and don;t expect its API/ABI to change])
|
||||
+ DISTRO_SSL=yes
|
||||
+ fi
|
||||
+ ]
|
||||
+)
|
||||
+
|
||||
# Where to place sshd.pid
|
||||
piddir=/var/run
|
||||
# make sure the directory exists
|
||||
diff --git a/entropy.c b/entropy.c
|
||||
index f8b9f42..4957b23 100644
|
||||
--- a/entropy.c
|
||||
+++ b/entropy.c
|
||||
@@ -223,11 +223,13 @@ seed_rng(void)
|
||||
/* Initialise libcrypto */
|
||||
ssh_libcrypto_init();
|
||||
|
||||
+#ifndef DISTRO_SSL
|
||||
if (!ssh_compatible_openssl(OPENSSL_VERSION_NUMBER,
|
||||
OpenSSL_version_num()))
|
||||
fatal("OpenSSL version mismatch. Built against %lx, you "
|
||||
"have %lx", (u_long)OPENSSL_VERSION_NUMBER,
|
||||
OpenSSL_version_num());
|
||||
+#endif
|
||||
|
||||
#ifndef OPENSSL_PRNG_ONLY
|
||||
if (RAND_status() == 1)
|
||||
27
openssh-7.7p1-eal3.patch
Normal file
27
openssh-7.7p1-eal3.patch
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# HG changeset patch
|
||||
# Parent 8fd4e445c3a5c823568661a4f71b064cbcb217a9
|
||||
fix paths and references in sshd man pages
|
||||
|
||||
diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in
|
||||
--- openssh-7.7p1/Makefile.in
|
||||
+++ openssh-7.7p1/Makefile.in
|
||||
@@ -127,17 +127,18 @@ MANTYPE = @MANTYPE@
|
||||
CONFIGFILES=sshd_config.out ssh_config.out moduli.out
|
||||
CONFIGFILES_IN=sshd_config ssh_config moduli
|
||||
|
||||
PATHSUBS = \
|
||||
-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
|
||||
-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
|
||||
-e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \
|
||||
-e 's|/usr/libexec|$(libexecdir)|g' \
|
||||
- -e 's|/etc/shosts.equiv|$(sysconfdir)/shosts.equiv|g' \
|
||||
+ -e 's|login\.conf|login.defs|g' \
|
||||
+ -e 's|/etc/shosts.equiv|$(sysconfdir)/ssh/shosts.equiv|g' \
|
||||
-e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \
|
||||
-e 's|/etc/ssh/ssh_host_ecdsa_key|$(sysconfdir)/ssh_host_ecdsa_key|g' \
|
||||
-e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \
|
||||
-e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \
|
||||
-e 's|/etc/ssh/ssh_host_ed25519_key|$(sysconfdir)/ssh_host_ed25519_key|g' \
|
||||
-e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \
|
||||
-e 's|/etc/moduli|$(sysconfdir)/moduli|g' \
|
||||
-e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \
|
||||
28
openssh-7.7p1-enable_PAM_by_default.patch
Normal file
28
openssh-7.7p1-enable_PAM_by_default.patch
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# HG changeset patch
|
||||
# Parent 5c1e122e31b601de64d81085294216af33f31aed
|
||||
# force PAM in defaullt install (this was removed from upstream in 3.8p1)
|
||||
# bnc#46749
|
||||
# --used to be called '-pam-fix2'
|
||||
|
||||
diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
|
||||
--- openssh-7.7p1/sshd_config
|
||||
+++ openssh-7.7p1/sshd_config
|
||||
@@ -74,17 +74,17 @@ AuthorizedKeysFile .ssh/authorized_keys
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
-#UsePAM no
|
||||
+UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
X11Forwarding yes
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
840
openssh-7.7p1-fips.patch
Normal file
840
openssh-7.7p1-fips.patch
Normal file
|
|
@ -0,0 +1,840 @@
|
|||
# HG changeset patch
|
||||
# Parent 92d953171b34f6fba18d24085eeeaa24b1d2d5b5
|
||||
FIPS 140-2 compliance. Perform selftests on start and use only FIPS approved
|
||||
algorithms.
|
||||
|
||||
Index: openssh-8.4p1/Makefile.in
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/Makefile.in
|
||||
+++ openssh-8.4p1/Makefile.in
|
||||
@@ -112,6 +112,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
|
||||
|
||||
SKOBJS= ssh-sk-client.o
|
||||
|
||||
+LIBSSH_OBJS += fips.o
|
||||
+
|
||||
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
|
||||
sshconnect.o sshconnect2.o mux.o $(SKOBJS)
|
||||
|
||||
Index: openssh-8.4p1/cipher-ctr.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/cipher-ctr.c
|
||||
+++ openssh-8.4p1/cipher-ctr.c
|
||||
@@ -27,6 +27,8 @@
|
||||
#include "xmalloc.h"
|
||||
#include "log.h"
|
||||
|
||||
+#include "fips.h"
|
||||
+
|
||||
/* compatibility with old or broken OpenSSL versions */
|
||||
#include "openbsd-compat/openssl-compat.h"
|
||||
|
||||
@@ -139,6 +141,8 @@ evp_aes_128_ctr(void)
|
||||
#ifndef SSH_OLD_EVP
|
||||
aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
|
||||
EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
|
||||
+ if (fips_mode())
|
||||
+ aes_ctr.flags |= EVP_CIPH_FLAG_FIPS;
|
||||
#endif
|
||||
return (&aes_ctr);
|
||||
}
|
||||
Index: openssh-8.4p1/cipher.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/cipher.c
|
||||
+++ openssh-8.4p1/cipher.c
|
||||
@@ -51,6 +51,9 @@
|
||||
|
||||
#include "openbsd-compat/openssl-compat.h"
|
||||
|
||||
+#include "fips.h"
|
||||
+#include "log.h"
|
||||
+
|
||||
#ifndef WITH_OPENSSL
|
||||
#define EVP_CIPHER_CTX void
|
||||
#endif
|
||||
@@ -83,7 +86,7 @@ struct sshcipher {
|
||||
#endif
|
||||
};
|
||||
|
||||
-static const struct sshcipher ciphers[] = {
|
||||
+static const struct sshcipher ciphers_all[] = {
|
||||
#ifdef WITH_OPENSSL
|
||||
#ifndef OPENSSL_NO_DES
|
||||
{ "3des-cbc", 8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc },
|
||||
@@ -114,8 +117,52 @@ static const struct sshcipher ciphers[]
|
||||
{ NULL, 0, 0, 0, 0, 0, NULL }
|
||||
};
|
||||
|
||||
+static const struct sshcipher ciphers_fips140_2[] = {
|
||||
+#ifdef WITH_OPENSSL
|
||||
+ { "aes128-cbc", 16, 16, 0, 0, CFLAG_CBC, EVP_aes_128_cbc },
|
||||
+ { "aes192-cbc", 16, 24, 0, 0, CFLAG_CBC, EVP_aes_192_cbc },
|
||||
+ { "aes256-cbc", 16, 32, 0, 0, CFLAG_CBC, EVP_aes_256_cbc },
|
||||
+ { "rijndael-cbc@lysator.liu.se",
|
||||
+ 16, 32, 0, 0, CFLAG_CBC, EVP_aes_256_cbc },
|
||||
+ { "aes128-ctr", 16, 16, 0, 0, 0, EVP_aes_128_ctr },
|
||||
+ { "aes192-ctr", 16, 24, 0, 0, 0, EVP_aes_192_ctr },
|
||||
+ { "aes256-ctr", 16, 32, 0, 0, 0, EVP_aes_256_ctr },
|
||||
+# ifdef OPENSSL_HAVE_EVPGCM
|
||||
+ { "aes128-gcm@openssh.com",
|
||||
+ 16, 16, 12, 16, 0, EVP_aes_128_gcm },
|
||||
+ { "aes256-gcm@openssh.com",
|
||||
+ 16, 32, 12, 16, 0, EVP_aes_256_gcm },
|
||||
+# endif /* OPENSSL_HAVE_EVPGCM */
|
||||
+#else
|
||||
+ { "aes128-ctr", 16, 16, 0, 0, CFLAG_AESCTR, NULL },
|
||||
+ { "aes192-ctr", 16, 24, 0, 0, CFLAG_AESCTR, NULL },
|
||||
+ { "aes256-ctr", 16, 32, 0, 0, CFLAG_AESCTR, NULL },
|
||||
+#endif
|
||||
+ { "none", 8, 0, 0, 0, CFLAG_NONE, NULL },
|
||||
+
|
||||
+ { NULL, 0, 0, 0, 0, 0, NULL }
|
||||
+};
|
||||
+
|
||||
/*--*/
|
||||
|
||||
+/* Returns array of ciphers available depending on selected FIPS mode */
|
||||
+static const struct sshcipher *
|
||||
+fips_select_ciphers(void)
|
||||
+{
|
||||
+ int fips = fips_mode();
|
||||
+ switch (fips) {
|
||||
+ case 0:
|
||||
+ return ciphers_all;
|
||||
+ case 1:
|
||||
+ return ciphers_fips140_2;
|
||||
+ default:
|
||||
+ /* should not be reached */
|
||||
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
|
||||
+ fips, __FILE__, __LINE__);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
/* Returns a comma-separated list of supported ciphers. */
|
||||
char *
|
||||
cipher_alg_list(char sep, int auth_only)
|
||||
@@ -124,7 +171,7 @@ cipher_alg_list(char sep, int auth_only)
|
||||
size_t nlen, rlen = 0;
|
||||
const struct sshcipher *c;
|
||||
|
||||
- for (c = ciphers; c->name != NULL; c++) {
|
||||
+ for (c = fips_select_ciphers(); c->name != NULL; c++) {
|
||||
if ((c->flags & CFLAG_INTERNAL) != 0)
|
||||
continue;
|
||||
if (auth_only && c->auth_len == 0)
|
||||
@@ -207,7 +254,7 @@ const struct sshcipher *
|
||||
cipher_by_name(const char *name)
|
||||
{
|
||||
const struct sshcipher *c;
|
||||
- for (c = ciphers; c->name != NULL; c++)
|
||||
+ for (c = fips_select_ciphers(); c->name != NULL; c++)
|
||||
if (strcmp(c->name, name) == 0)
|
||||
return c;
|
||||
return NULL;
|
||||
Index: openssh-8.4p1/fips.c
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ openssh-8.4p1/fips.c
|
||||
@@ -0,0 +1,212 @@
|
||||
+/*
|
||||
+ * Copyright (c) 2012 Petr Cerny. All rights reserved.
|
||||
+ *
|
||||
+ * Redistribution and use in source and binary forms, with or without
|
||||
+ * modification, are permitted provided that the following conditions
|
||||
+ * are met:
|
||||
+ * 1. Redistributions of source code must retain the above copyright
|
||||
+ * notice, this list of conditions and the following disclaimer.
|
||||
+ * 2. Redistributions in binary form must reproduce the above copyright
|
||||
+ * notice, this list of conditions and the following disclaimer in the
|
||||
+ * documentation and/or other materials provided with the distribution.
|
||||
+ *
|
||||
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
+ */
|
||||
+
|
||||
+#include "includes.h"
|
||||
+
|
||||
+#include "fips.h"
|
||||
+
|
||||
+#include "cipher.h"
|
||||
+#include "dh.h"
|
||||
+#include "digest.h"
|
||||
+#include "kex.h"
|
||||
+#include "sshkey.h"
|
||||
+#include "mac.h"
|
||||
+#include "log.h"
|
||||
+#include "xmalloc.h"
|
||||
+
|
||||
+#include <string.h>
|
||||
+#include <openssl/crypto.h>
|
||||
+
|
||||
+static int fips_state = -1;
|
||||
+
|
||||
+static int
|
||||
+fips_check_required_env(void)
|
||||
+{
|
||||
+ int fips_required = 0;
|
||||
+ char *env = getenv(SSH_FORCE_FIPS_ENV);
|
||||
+
|
||||
+ if (env) {
|
||||
+ errno = 0;
|
||||
+ fips_required = strtol(env, NULL, 10);
|
||||
+ if (errno) {
|
||||
+ debug("bogus value in the %s environment variable, ignoring\n"
|
||||
+ , SSH_FORCE_FIPS_ENV);
|
||||
+ fips_required = 0;
|
||||
+ } else
|
||||
+ fips_required = 1;
|
||||
+ }
|
||||
+ return fips_required;
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+fips_mode(void)
|
||||
+{
|
||||
+ if (-1 == fips_state) {
|
||||
+ fips_state = FIPS_mode();
|
||||
+ if (fips_state)
|
||||
+ debug("FIPS mode initialized");
|
||||
+ else {
|
||||
+ if (fips_check_required_env()) {
|
||||
+ debug("FIPS mode requested through the environment variable '%s'"
|
||||
+ , SSH_FORCE_FIPS_ENV);
|
||||
+ if (!FIPS_mode_set(1))
|
||||
+ fatal("Unable to enter FIPS mode as requested through the environment variable '%s'"
|
||||
+ , SSH_FORCE_FIPS_ENV);
|
||||
+ fips_state = 1;
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+ return fips_state;
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+fips_correct_dgst(int digest)
|
||||
+{
|
||||
+ int fips;
|
||||
+ int rv = -1;
|
||||
+
|
||||
+ fips = fips_mode();
|
||||
+ switch (fips) {
|
||||
+ case 0:
|
||||
+ rv = digest;
|
||||
+ break;
|
||||
+ case 1:
|
||||
+ switch (digest) {
|
||||
+ case SSH_DIGEST_MD5:
|
||||
+ case SSH_DIGEST_SHA1:
|
||||
+ debug("MD5/RIPEMD160 digests not allowed in FIPS 140-2 mode"
|
||||
+ "using SHA-256 instead.");
|
||||
+ rv = SSH_DIGEST_SHA256;
|
||||
+ break;
|
||||
+ default:
|
||||
+ rv = digest;
|
||||
+ break;
|
||||
+ }
|
||||
+ break;
|
||||
+ default:
|
||||
+ /* should not be reached */
|
||||
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
|
||||
+ fips, __FILE__, __LINE__);
|
||||
+ }
|
||||
+
|
||||
+ return rv;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * filter out FIPS disallowed algorithms
|
||||
+ * *crypto MUST be free()-able - it is assigned newly allocated memory and
|
||||
+ * the previous one is freed
|
||||
+ *
|
||||
+ * returns zero if all algorithms were rejected, non-zero otherwise
|
||||
+ */
|
||||
+int
|
||||
+fips_filter_crypto(char **crypto, fips_filters filter)
|
||||
+{
|
||||
+ char *token, *tmp, *tmp_sav, *new;
|
||||
+ int plus = 0;
|
||||
+ int valid;
|
||||
+ int comma = 0;
|
||||
+ int empty = 1;
|
||||
+ size_t len;
|
||||
+
|
||||
+ tmp = tmp_sav = xstrdup(*crypto);
|
||||
+
|
||||
+ len = strlen(tmp) + 1;
|
||||
+ new = xcalloc(1, len);
|
||||
+
|
||||
+ if ('+' == *tmp) {
|
||||
+ plus = 1;
|
||||
+ tmp++;
|
||||
+ }
|
||||
+
|
||||
+ while ((token = strsep(&tmp, ",")) != NULL) {
|
||||
+ switch(filter) {
|
||||
+ case FIPS_FILTER_CIPHERS:
|
||||
+ valid = ciphers_valid(token);
|
||||
+ if (!valid)
|
||||
+ debug("Cipher '%s' is not allowed in FIPS mode",
|
||||
+ token);
|
||||
+ break;
|
||||
+ case FIPS_FILTER_MACS:
|
||||
+ valid = mac_valid(token);
|
||||
+ if (!valid)
|
||||
+ debug("MAC '%s' is not allowed in FIPS mode",
|
||||
+ token);
|
||||
+ break;
|
||||
+ case FIPS_FILTER_KEX_ALGS:
|
||||
+ valid = kex_names_valid(token);
|
||||
+ if (!valid)
|
||||
+ debug("KEX '%s' is not allowed in FIPS mode",
|
||||
+ token);
|
||||
+ break;
|
||||
+ default:
|
||||
+ /* should not be reached */
|
||||
+ fatal("Fatal error: incorrect FIPS filter '%i' requested at %s:%u",
|
||||
+ filter, __FILE__, __LINE__);
|
||||
+ }
|
||||
+
|
||||
+ if (valid) {
|
||||
+ empty = 0;
|
||||
+ if (plus) {
|
||||
+ strlcat(new, "+", len);
|
||||
+ plus = 0;
|
||||
+ }
|
||||
+ if (comma)
|
||||
+ strlcat(new, ",", len);
|
||||
+ else
|
||||
+ comma = 1;
|
||||
+ strlcat(new, token, len);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* free tmp and re-allocate shorter buffer for result if necessary */
|
||||
+ free(tmp_sav);
|
||||
+ free(*crypto);
|
||||
+ *crypto = new;
|
||||
+
|
||||
+ return (!empty);
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+fips_dgst_min(void)
|
||||
+{
|
||||
+ int fips;
|
||||
+ int dgst;
|
||||
+
|
||||
+ fips = fips_mode();
|
||||
+ switch (fips) {
|
||||
+ case 0:
|
||||
+ dgst = SSH_DIGEST_MD5;
|
||||
+ break;
|
||||
+ case 1:
|
||||
+ dgst = SSH_DIGEST_SHA256;
|
||||
+ break;
|
||||
+ default:
|
||||
+ /* should not be reached */
|
||||
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
|
||||
+ fips, __FILE__, __LINE__);
|
||||
+ }
|
||||
+ return dgst;
|
||||
+}
|
||||
+
|
||||
Index: openssh-8.4p1/fips.h
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ openssh-8.4p1/fips.h
|
||||
@@ -0,0 +1,44 @@
|
||||
+/*
|
||||
+ * Copyright (c) 2012 Petr Cerny. All rights reserved.
|
||||
+ *
|
||||
+ * Redistribution and use in source and binary forms, with or without
|
||||
+ * modification, are permitted provided that the following conditions
|
||||
+ * are met:
|
||||
+ * 1. Redistributions of source code must retain the above copyright
|
||||
+ * notice, this list of conditions and the following disclaimer.
|
||||
+ * 2. Redistributions in binary form must reproduce the above copyright
|
||||
+ * notice, this list of conditions and the following disclaimer in the
|
||||
+ * documentation and/or other materials provided with the distribution.
|
||||
+ *
|
||||
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
+ */
|
||||
+#ifndef FIPS_H
|
||||
+#define FIPS_H
|
||||
+
|
||||
+#include "sshkey.h"
|
||||
+
|
||||
+#define SSH_FORCE_FIPS_ENV "SSH_FORCE_FIPS"
|
||||
+
|
||||
+typedef enum {
|
||||
+ FIPS_FILTER_CIPHERS,
|
||||
+ FIPS_FILTER_MACS,
|
||||
+ FIPS_FILTER_KEX_ALGS
|
||||
+} fips_filters;
|
||||
+
|
||||
+int fips_mode(void);
|
||||
+int fips_correct_dgst(int);
|
||||
+int fips_dgst_min(void);
|
||||
+enum fp_type fips_correct_fp_type(enum fp_type);
|
||||
+int fips_filter_crypto(char **, fips_filters);
|
||||
+
|
||||
+#endif
|
||||
+
|
||||
Index: openssh-8.4p1/hmac.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/hmac.c
|
||||
+++ openssh-8.4p1/hmac.c
|
||||
@@ -145,7 +145,7 @@ hmac_test(void *key, size_t klen, void *
|
||||
size_t i;
|
||||
u_char digest[16];
|
||||
|
||||
- if ((ctx = ssh_hmac_start(SSH_DIGEST_MD5)) == NULL)
|
||||
+ if ((ctx = ssh_hmac_start(fips_correct_dgst(SSH_DIGEST_MD5))) == NULL)
|
||||
printf("ssh_hmac_start failed");
|
||||
if (ssh_hmac_init(ctx, key, klen) < 0 ||
|
||||
ssh_hmac_update(ctx, m, mlen) < 0 ||
|
||||
Index: openssh-8.4p1/kex.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/kex.c
|
||||
+++ openssh-8.4p1/kex.c
|
||||
@@ -62,6 +62,8 @@
|
||||
#include "sshbuf.h"
|
||||
#include "digest.h"
|
||||
|
||||
+#include "fips.h"
|
||||
+
|
||||
/* prototype */
|
||||
static int kex_choose_conf(struct ssh *);
|
||||
static int kex_input_newkeys(int, u_int32_t, struct ssh *);
|
||||
@@ -85,7 +87,7 @@ struct kexalg {
|
||||
int ec_nid;
|
||||
int hash_alg;
|
||||
};
|
||||
-static const struct kexalg kexalgs[] = {
|
||||
+static const struct kexalg kexalgs_all[] = {
|
||||
#ifdef WITH_OPENSSL
|
||||
{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
|
||||
{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
|
||||
@@ -116,6 +118,47 @@ static const struct kexalg kexalgs[] = {
|
||||
{ NULL, 0, -1, -1},
|
||||
};
|
||||
|
||||
+static const struct kexalg kexalgs_fips140_2[] = {
|
||||
+#ifdef WITH_OPENSSL
|
||||
+ { KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
|
||||
+ { KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
|
||||
+ { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
|
||||
+ { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512 },
|
||||
+ { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
|
||||
+#ifdef HAVE_EVP_SHA256
|
||||
+ { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
|
||||
+#endif /* HAVE_EVP_SHA256 */
|
||||
+#ifdef OPENSSL_HAS_ECC
|
||||
+ { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,
|
||||
+ NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
|
||||
+ { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1,
|
||||
+ SSH_DIGEST_SHA384 },
|
||||
+# ifdef OPENSSL_HAS_NISTP521
|
||||
+ { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
|
||||
+ SSH_DIGEST_SHA512 },
|
||||
+# endif /* OPENSSL_HAS_NISTP521 */
|
||||
+#endif /* OPENSSL_HAS_ECC */
|
||||
+#endif /* WITH_OPENSSL */
|
||||
+ { NULL, -1, -1, -1},
|
||||
+};
|
||||
+
|
||||
+/* Returns array of macs available depending on selected FIPS mode */
|
||||
+static const struct kexalg *
|
||||
+fips_select_kexalgs(void)
|
||||
+{
|
||||
+ int fips = fips_mode();
|
||||
+ switch (fips) {
|
||||
+ case 0:
|
||||
+ return kexalgs_all;
|
||||
+ case 1:
|
||||
+ return kexalgs_fips140_2;
|
||||
+ default:
|
||||
+ /* should not be reached */
|
||||
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
|
||||
+ fips, __FILE__, __LINE__);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
char *
|
||||
kex_alg_list(char sep)
|
||||
{
|
||||
@@ -123,7 +166,7 @@ kex_alg_list(char sep)
|
||||
size_t nlen, rlen = 0;
|
||||
const struct kexalg *k;
|
||||
|
||||
- for (k = kexalgs; k->name != NULL; k++) {
|
||||
+ for (k = fips_select_kexalgs(); k->name != NULL; k++) {
|
||||
if (ret != NULL)
|
||||
ret[rlen++] = sep;
|
||||
nlen = strlen(k->name);
|
||||
@@ -143,7 +186,7 @@ kex_alg_by_name(const char *name)
|
||||
{
|
||||
const struct kexalg *k;
|
||||
|
||||
- for (k = kexalgs; k->name != NULL; k++) {
|
||||
+ for (k = fips_select_kexalgs(); k->name != NULL; k++) {
|
||||
if (strcmp(k->name, name) == 0)
|
||||
return k;
|
||||
}
|
||||
@@ -163,7 +206,10 @@ kex_names_valid(const char *names)
|
||||
for ((p = strsep(&cp, ",")); p && *p != '\0';
|
||||
(p = strsep(&cp, ","))) {
|
||||
if (kex_alg_by_name(p) == NULL) {
|
||||
+ /* do not complain here - MACs and ciphers checks
|
||||
+ * are silent here
|
||||
error("Unsupported KEX algorithm \"%.100s\"", p);
|
||||
+ */
|
||||
free(s);
|
||||
return 0;
|
||||
}
|
||||
Index: openssh-8.4p1/mac.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/mac.c
|
||||
+++ openssh-8.4p1/mac.c
|
||||
@@ -41,6 +41,9 @@
|
||||
|
||||
#include "openbsd-compat/openssl-compat.h"
|
||||
|
||||
+#include "fips.h"
|
||||
+#include "log.h"
|
||||
+
|
||||
#define SSH_DIGEST 1 /* SSH_DIGEST_XXX */
|
||||
#define SSH_UMAC 2 /* UMAC (not integrated with OpenSSL) */
|
||||
#define SSH_UMAC128 3
|
||||
@@ -55,7 +58,7 @@ struct macalg {
|
||||
int etm; /* Encrypt-then-MAC */
|
||||
};
|
||||
|
||||
-static const struct macalg macs[] = {
|
||||
+static const struct macalg macs_all[] = {
|
||||
/* Encrypt-and-MAC (encrypt-and-authenticate) variants */
|
||||
{ "hmac-sha1", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },
|
||||
{ "hmac-sha1-96", SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 0 },
|
||||
@@ -79,6 +82,41 @@ static const struct macalg macs[] = {
|
||||
{ NULL, 0, 0, 0, 0, 0, 0 }
|
||||
};
|
||||
|
||||
+static const struct macalg macs_fips140_2[] = {
|
||||
+ /* Encrypt-and-MAC (encrypt-and-authenticate) variants */
|
||||
+ { "hmac-sha1", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },
|
||||
+#ifdef HAVE_EVP_SHA256
|
||||
+ { "hmac-sha2-256", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 0 },
|
||||
+ { "hmac-sha2-512", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 0 },
|
||||
+#endif
|
||||
+
|
||||
+ /* Encrypt-then-MAC variants */
|
||||
+ { "hmac-sha1-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 1 },
|
||||
+#ifdef HAVE_EVP_SHA256
|
||||
+ { "hmac-sha2-256-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 1 },
|
||||
+ { "hmac-sha2-512-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 1 },
|
||||
+#endif
|
||||
+
|
||||
+ { NULL, 0, 0, 0, 0, 0, 0 }
|
||||
+};
|
||||
+
|
||||
+/* Returns array of macs available depending on selected FIPS mode */
|
||||
+static const struct macalg *
|
||||
+fips_select_macs(void)
|
||||
+{
|
||||
+ int fips = fips_mode();
|
||||
+ switch (fips) {
|
||||
+ case 0:
|
||||
+ return macs_all;
|
||||
+ case 1:
|
||||
+ return macs_fips140_2;
|
||||
+ default:
|
||||
+ /* should not be reached */
|
||||
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
|
||||
+ fips, __FILE__, __LINE__);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
/* Returns a list of supported MACs separated by the specified char. */
|
||||
char *
|
||||
mac_alg_list(char sep)
|
||||
@@ -87,7 +125,7 @@ mac_alg_list(char sep)
|
||||
size_t nlen, rlen = 0;
|
||||
const struct macalg *m;
|
||||
|
||||
- for (m = macs; m->name != NULL; m++) {
|
||||
+ for (m = fips_select_macs(); m->name != NULL; m++) {
|
||||
if (ret != NULL)
|
||||
ret[rlen++] = sep;
|
||||
nlen = strlen(m->name);
|
||||
@@ -126,7 +164,7 @@ mac_setup(struct sshmac *mac, char *name
|
||||
{
|
||||
const struct macalg *m;
|
||||
|
||||
- for (m = macs; m->name != NULL; m++) {
|
||||
+ for (m = fips_select_macs(); m->name != NULL; m++) {
|
||||
if (strcmp(name, m->name) != 0)
|
||||
continue;
|
||||
if (mac != NULL)
|
||||
Index: openssh-8.4p1/readconf.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/readconf.c
|
||||
+++ openssh-8.4p1/readconf.c
|
||||
@@ -68,6 +68,8 @@
|
||||
#include "myproposal.h"
|
||||
#include "digest.h"
|
||||
|
||||
+#include "fips.h"
|
||||
+
|
||||
/* Format of the configuration file:
|
||||
|
||||
# Configuration data is parsed as follows:
|
||||
@@ -1949,6 +1951,23 @@ option_clear_or_none(const char *o)
|
||||
return o == NULL || strcasecmp(o, "none") == 0;
|
||||
}
|
||||
|
||||
+/* remove algorithms not approved for use in FIPS mode, when running in FIPS
|
||||
+ * mode
|
||||
+ */
|
||||
+void
|
||||
+filter_fips_algorithms(Options *o)
|
||||
+{
|
||||
+ if (fips_mode()) {
|
||||
+ if (!fips_filter_crypto(&o->ciphers, FIPS_FILTER_CIPHERS))
|
||||
+ fatal("None of selected ciphers can be used in FIPS mode");
|
||||
+ if (!fips_filter_crypto(&o->macs, FIPS_FILTER_MACS))
|
||||
+ fatal("None of selected MAC algorithms can be used in FIPS mode");
|
||||
+ if (!fips_filter_crypto(&o->kex_algorithms, FIPS_FILTER_KEX_ALGS))
|
||||
+ fatal("None of selected KEX algorithms can be used in FIPS mode");
|
||||
+ }
|
||||
+ return;
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* Initializes options to special values that indicate that they have not yet
|
||||
* been set. Read_config_file will only set options with this value. Options
|
||||
@@ -2240,6 +2259,9 @@ fill_default_options(Options * options)
|
||||
options->canonicalize_hostname = SSH_CANONICALISE_NO;
|
||||
if (options->fingerprint_hash == -1)
|
||||
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
|
||||
+ options->fingerprint_hash =
|
||||
+ fips_correct_dgst(options->fingerprint_hash);
|
||||
+
|
||||
#ifdef ENABLE_SK_INTERNAL
|
||||
if (options->sk_provider == NULL)
|
||||
options->sk_provider = xstrdup("internal");
|
||||
@@ -2273,6 +2295,7 @@ fill_default_options(Options * options)
|
||||
ASSEMBLE(pubkey_key_types, def_key, all_key);
|
||||
ASSEMBLE(ca_sign_algorithms, def_sig, all_sig);
|
||||
#undef ASSEMBLE
|
||||
+
|
||||
free(all_cipher);
|
||||
free(all_mac);
|
||||
free(all_kex);
|
||||
@@ -2284,6 +2307,8 @@ fill_default_options(Options * options)
|
||||
kex_default_pk_alg_filtered = def_key; /* save for later use */
|
||||
free(def_sig);
|
||||
|
||||
+ filter_fips_algorithms(options);
|
||||
+
|
||||
#define CLEAR_ON_NONE(v) \
|
||||
do { \
|
||||
if (option_clear_or_none(v)) { \
|
||||
Index: openssh-8.4p1/readconf.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/readconf.h
|
||||
+++ openssh-8.4p1/readconf.h
|
||||
@@ -200,6 +200,7 @@ typedef struct {
|
||||
#define SSH_STRICT_HOSTKEY_YES 2
|
||||
#define SSH_STRICT_HOSTKEY_ASK 3
|
||||
|
||||
+void filter_fips_algorithms(Options *o);
|
||||
const char *kex_default_pk_alg(void);
|
||||
char *ssh_connection_hash(const char *thishost, const char *host,
|
||||
const char *portstr, const char *user);
|
||||
Index: openssh-8.4p1/servconf.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/servconf.c
|
||||
+++ openssh-8.4p1/servconf.c
|
||||
@@ -70,6 +70,7 @@
|
||||
#include "auth.h"
|
||||
#include "myproposal.h"
|
||||
#include "digest.h"
|
||||
+#include "fips.h"
|
||||
|
||||
static void add_listen_addr(ServerOptions *, const char *,
|
||||
const char *, int);
|
||||
@@ -201,6 +202,23 @@ option_clear_or_none(const char *o)
|
||||
return o == NULL || strcasecmp(o, "none") == 0;
|
||||
}
|
||||
|
||||
+/* remove algorithms not approved for use in FIPS mode, when running in FIPS
|
||||
+ * mode
|
||||
+ */
|
||||
+static void
|
||||
+filter_fips_algorithms_s(ServerOptions *o)
|
||||
+{
|
||||
+ if (fips_mode()) {
|
||||
+ if (!fips_filter_crypto(&o->ciphers, FIPS_FILTER_CIPHERS))
|
||||
+ fatal("None of selected ciphers can be used in FIPS mode");
|
||||
+ if (!fips_filter_crypto(&o->macs, FIPS_FILTER_MACS))
|
||||
+ fatal("None of selected MAC algorithms can be used in FIPS mode");
|
||||
+ if (!fips_filter_crypto(&o->kex_algorithms, FIPS_FILTER_KEX_ALGS))
|
||||
+ fatal("None of selected KEX algorithms can be used in FIPS mode");
|
||||
+ }
|
||||
+ return;
|
||||
+}
|
||||
+
|
||||
static void
|
||||
assemble_algorithms(ServerOptions *o)
|
||||
{
|
||||
@@ -242,6 +260,8 @@ assemble_algorithms(ServerOptions *o)
|
||||
free(def_kex);
|
||||
free(def_key);
|
||||
free(def_sig);
|
||||
+
|
||||
+ filter_fips_algorithms_s(o);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -454,6 +474,8 @@ fill_default_server_options(ServerOption
|
||||
options->fwd_opts.streamlocal_bind_unlink = 0;
|
||||
if (options->fingerprint_hash == -1)
|
||||
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
|
||||
+ options->fingerprint_hash =
|
||||
+ fips_correct_dgst(options->fingerprint_hash);
|
||||
if (options->disable_forwarding == -1)
|
||||
options->disable_forwarding = 0;
|
||||
if (options->expose_userauth_info == -1)
|
||||
Index: openssh-8.4p1/ssh-keygen.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/ssh-keygen.c
|
||||
+++ openssh-8.4p1/ssh-keygen.c
|
||||
@@ -66,6 +66,8 @@
|
||||
#include "ssh-sk.h"
|
||||
#include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */
|
||||
|
||||
+#include "fips.h"
|
||||
+
|
||||
#ifdef WITH_OPENSSL
|
||||
# define DEFAULT_KEY_TYPE_NAME "rsa"
|
||||
#else
|
||||
@@ -1036,11 +1038,13 @@ do_fingerprint(struct passwd *pw)
|
||||
static void
|
||||
do_gen_all_hostkeys(struct passwd *pw)
|
||||
{
|
||||
- struct {
|
||||
+ struct Key_types {
|
||||
char *key_type;
|
||||
char *key_type_display;
|
||||
char *path;
|
||||
- } key_types[] = {
|
||||
+ };
|
||||
+
|
||||
+ struct Key_types key_types_all[] = {
|
||||
#ifdef WITH_OPENSSL
|
||||
{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
|
||||
{ "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
|
||||
@@ -1055,6 +1059,17 @@ do_gen_all_hostkeys(struct passwd *pw)
|
||||
{ NULL, NULL, NULL }
|
||||
};
|
||||
|
||||
+ struct Key_types key_types_fips140_2[] = {
|
||||
+#ifdef WITH_OPENSSL
|
||||
+ { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
|
||||
+#ifdef OPENSSL_HAS_ECC
|
||||
+ { "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE },
|
||||
+#endif /* OPENSSL_HAS_ECC */
|
||||
+#endif /* WITH_OPENSSL */
|
||||
+ { NULL, NULL, NULL }
|
||||
+ };
|
||||
+
|
||||
+ struct Key_types *key_types;
|
||||
u_int32_t bits = 0;
|
||||
int first = 0;
|
||||
struct stat st;
|
||||
@@ -1062,6 +1077,12 @@ do_gen_all_hostkeys(struct passwd *pw)
|
||||
char comment[1024], *prv_tmp, *pub_tmp, *prv_file, *pub_file;
|
||||
int i, type, fd, r;
|
||||
|
||||
+ if (fips_mode()) {
|
||||
+ key_types = key_types_fips140_2;
|
||||
+ } else {
|
||||
+ key_types = key_types_all;
|
||||
+ }
|
||||
+
|
||||
for (i = 0; key_types[i].key_type; i++) {
|
||||
public = private = NULL;
|
||||
prv_tmp = pub_tmp = prv_file = pub_file = NULL;
|
||||
@@ -3586,6 +3607,15 @@ main(int argc, char **argv)
|
||||
key_type_name = DEFAULT_KEY_TYPE_NAME;
|
||||
|
||||
type = sshkey_type_from_name(key_type_name);
|
||||
+
|
||||
+ /* protocol v1 is not allowed in FIPS mode, DSA is not acceptable because
|
||||
+ * it has to be 1024 bit due to RFC 4253 using SHA-1 which implies 1024 bit
|
||||
+ * keys due to FIPS-186 specification for DSS */
|
||||
+ if (fips_mode() &&
|
||||
+ (type == KEY_DSA || type == KEY_ED25519 ||
|
||||
+ type == KEY_DSA_CERT || type == KEY_ED25519_CERT))
|
||||
+ fatal("Key type %s not alowed in FIPS mode", key_type_name);
|
||||
+
|
||||
type_bits_valid(type, key_type_name, &bits);
|
||||
|
||||
if (!quiet)
|
||||
Index: openssh-8.4p1/ssh_config.5
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/ssh_config.5
|
||||
+++ openssh-8.4p1/ssh_config.5
|
||||
@@ -682,6 +682,8 @@ Valid options are:
|
||||
and
|
||||
.Cm sha256
|
||||
(the default).
|
||||
+.Pp
|
||||
+In the FIPS mode the minimum of SHA-1 is enforced (which means sha256).
|
||||
.It Cm ForwardAgent
|
||||
Specifies whether the connection to the authentication agent (if any)
|
||||
will be forwarded to the remote machine.
|
||||
Index: openssh-8.4p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd.c
|
||||
+++ openssh-8.4p1/sshd.c
|
||||
@@ -124,6 +124,8 @@
|
||||
#include "ssherr.h"
|
||||
#include "sk-api.h"
|
||||
|
||||
+#include "fips.h"
|
||||
+
|
||||
/* Re-exec fds */
|
||||
#define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1)
|
||||
#define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2)
|
||||
Index: openssh-8.4p1/sshd_config.5
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd_config.5
|
||||
+++ openssh-8.4p1/sshd_config.5
|
||||
@@ -594,6 +594,8 @@ and
|
||||
.Cm sha256 .
|
||||
The default is
|
||||
.Cm sha256 .
|
||||
+.Pp
|
||||
+In the FIPS mode the minimum of SHA-1 is enforced (which means sha256).
|
||||
.It Cm ForceCommand
|
||||
Forces the execution of the command specified by
|
||||
.Cm ForceCommand ,
|
||||
474
openssh-7.7p1-fips_checks.patch
Normal file
474
openssh-7.7p1-fips_checks.patch
Normal file
|
|
@ -0,0 +1,474 @@
|
|||
# HG changeset patch
|
||||
# Parent e9b69da9a0f8dca923f8fc2836b38fe6590c791a
|
||||
#
|
||||
# Simple implementation of FIPS 140-2 selfchecks. Use OpenSSL to generate and
|
||||
# verify checksums of binaries. Any hash iused in OpenSSH can be used (MD5 would
|
||||
# obviously be a poor choice, since OpenSSL would barf and abort immediately in
|
||||
# FIPS mode). SHA-2 seems to be a reasonable choice.
|
||||
#
|
||||
# The logic of the checks is as follows: decide whether FIPS mode is mandated
|
||||
# (either by checking /proc/sys/crypto/fips_enabled or environment variable
|
||||
# SSH_FORCE_FIPS. In FIPS mode, checksums are required to match (inability to
|
||||
# retrieve pre-calculated hash is a fatal error). In non-FIPS mode the checks
|
||||
# still must be performed, unless the hashes are not installed. Thus if the hash
|
||||
# file is not found (or the hash matches), proceed in non-FIPS mode and abort
|
||||
# otherwise.
|
||||
|
||||
Index: openssh-8.4p1/fips-check.c
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ openssh-8.4p1/fips-check.c
|
||||
@@ -0,0 +1,34 @@
|
||||
+#include "includes.h"
|
||||
+#include <fcntl.h>
|
||||
+#include <limits.h>
|
||||
+#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
+#include <string.h>
|
||||
+#include <sys/stat.h>
|
||||
+#include <sys/types.h>
|
||||
+#include <unistd.h>
|
||||
+
|
||||
+#include "digest.h"
|
||||
+#include "fips.h"
|
||||
+
|
||||
+#include <openssl/err.h>
|
||||
+
|
||||
+#define PROC_NAME_LEN 64
|
||||
+
|
||||
+static const char *argv0;
|
||||
+
|
||||
+void
|
||||
+print_help_exit(int ev)
|
||||
+{
|
||||
+ fprintf(stderr, "%s <-c|-w> <file> <checksum_file>\n", argv0);
|
||||
+ fprintf(stderr, " -c verify hash of 'file' against hash in 'checksum_file'\n");
|
||||
+ fprintf(stderr, " -w write hash of 'file' into 'checksum_file'\n");
|
||||
+ exit(ev);
|
||||
+}
|
||||
+
|
||||
+int
|
||||
+main(int argc, char **argv)
|
||||
+{
|
||||
+ fips_ssh_init();
|
||||
+ return 0;
|
||||
+}
|
||||
Index: openssh-8.4p1/fips.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/fips.c
|
||||
+++ openssh-8.4p1/fips.c
|
||||
@@ -35,30 +35,296 @@
|
||||
#include "log.h"
|
||||
#include "xmalloc.h"
|
||||
|
||||
+#include <errno.h>
|
||||
+#include <fcntl.h>
|
||||
#include <string.h>
|
||||
+#include <string.h>
|
||||
+#include <sys/stat.h>
|
||||
+#include <sys/types.h>
|
||||
+#include <unistd.h>
|
||||
#include <openssl/crypto.h>
|
||||
+#include <openssl/err.h>
|
||||
+#include <openssl/hmac.h>
|
||||
|
||||
static int fips_state = -1;
|
||||
|
||||
+/* calculates HMAC of contents of a file given by filename using the hash
|
||||
+ * algorithm specified by FIPS_HMAC_EVP in fips.h and placing the result into
|
||||
+ * newly allacated memory - remember to free it when not needed anymore */
|
||||
static int
|
||||
-fips_check_required_env(void)
|
||||
+hmac_file(const char *filename, u_char **hmac_out)
|
||||
+{
|
||||
+ int check = -1;
|
||||
+ int fd;
|
||||
+ struct stat fs;
|
||||
+ void *hmap;
|
||||
+ unsigned char *hmac;
|
||||
+ unsigned char *hmac_rv = NULL;
|
||||
+
|
||||
+ hmac = xmalloc(FIPS_HMAC_LEN);
|
||||
+
|
||||
+ fd = open(filename, O_RDONLY);
|
||||
+ if (-1 == fd)
|
||||
+ goto bail_out;
|
||||
+
|
||||
+ if (-1 == fstat(fd, &fs)) {
|
||||
+ close(fd);
|
||||
+ goto bail_out;
|
||||
+ }
|
||||
+
|
||||
+ hmap = mmap(NULL, fs.st_size, PROT_READ, MAP_SHARED, fd, 0);
|
||||
+
|
||||
+ if ((void *)(-1) != hmap) {
|
||||
+ hmac_rv = HMAC(FIPS_HMAC_EVP(), FIPS_HMAC_KEY
|
||||
+ , strlen(FIPS_HMAC_KEY), hmap, fs.st_size, hmac, NULL);
|
||||
+ check = CHECK_OK;
|
||||
+ munmap(hmap, fs.st_size);
|
||||
+ }
|
||||
+ close(fd);
|
||||
+
|
||||
+bail_out:
|
||||
+ if (hmac_rv) {
|
||||
+ check = CHECK_OK;
|
||||
+ *hmac_out = hmac;
|
||||
+ } else {
|
||||
+ check = CHECK_FAIL;
|
||||
+ *hmac_out = NULL;
|
||||
+ free(hmac);
|
||||
+ }
|
||||
+ return check;
|
||||
+}
|
||||
+
|
||||
+/* find pathname of binary of process with PID pid. exe is buffer expected to
|
||||
+ * be capable of holding at least max_pathlen characters
|
||||
+ */
|
||||
+static int
|
||||
+get_executable_path(pid_t pid, char *exe, int max_pathlen)
|
||||
+{
|
||||
+ char exe_sl[PROC_EXE_PATH_LEN];
|
||||
+ int n;
|
||||
+ int rv = -1;
|
||||
+
|
||||
+ n = snprintf(exe_sl, sizeof(exe_sl), "/proc/%u/exe", pid);
|
||||
+ if ((n <= 10) || (n >= max_pathlen)) {
|
||||
+ fatal("error compiling filename of link to executable");
|
||||
+ }
|
||||
+
|
||||
+ exe[0] = 0;
|
||||
+ n = readlink(exe_sl, exe, max_pathlen);
|
||||
+ /* the file doesn't need to exist - procfs might not be mounted in
|
||||
+ * chroot */
|
||||
+ if (n == -1) {
|
||||
+ rv = CHECK_MISSING;
|
||||
+ } else {
|
||||
+ if (n < max_pathlen) {
|
||||
+ exe[n] = 0;
|
||||
+ rv = CHECK_OK;
|
||||
+ } else {
|
||||
+ rv = CHECK_FAIL;
|
||||
+ }
|
||||
+ }
|
||||
+ return rv;
|
||||
+}
|
||||
+
|
||||
+/* Read HMAC from file chk, allocating enough memory to hold the HMAC and
|
||||
+ * return it in *hmac.
|
||||
+ * Remember to free() it when it's not needed anymore.
|
||||
+ */
|
||||
+static int
|
||||
+read_hmac(const char *chk, u_char **hmac)
|
||||
+{
|
||||
+ int check = -1;
|
||||
+ int fdh, n;
|
||||
+ u_char *hmac_in;
|
||||
+
|
||||
+ *hmac = NULL;
|
||||
+
|
||||
+ fdh = open(chk, O_RDONLY);
|
||||
+ if (-1 == fdh) {
|
||||
+ switch (errno) {
|
||||
+ case ENOENT:
|
||||
+ check = CHECK_MISSING;
|
||||
+ debug("fips: checksum file %s is missing\n", chk);
|
||||
+ break;
|
||||
+ default:
|
||||
+ check = CHECK_FAIL;
|
||||
+ debug("fips: ckecksum file %s not accessible\n", chk);
|
||||
+ break;
|
||||
+
|
||||
+ }
|
||||
+ goto bail_out;
|
||||
+ }
|
||||
+
|
||||
+ hmac_in = xmalloc(FIPS_HMAC_LEN);
|
||||
+
|
||||
+ n = read(fdh, (void *)hmac_in, FIPS_HMAC_LEN);
|
||||
+ if (FIPS_HMAC_LEN != n) {
|
||||
+ debug("fips: unable to read whole checksum from checksum file\n");
|
||||
+ free (hmac_in);
|
||||
+ check = CHECK_FAIL;
|
||||
+ } else {
|
||||
+ check = CHECK_OK;
|
||||
+ *hmac = hmac_in;
|
||||
+ }
|
||||
+ close(fdh);
|
||||
+bail_out:
|
||||
+ return check;
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+fips_hmac_self(void)
|
||||
+{
|
||||
+ int check = -1;
|
||||
+ u_char *hmac = NULL, *hmac_chk = NULL;
|
||||
+ char *exe, *chk;
|
||||
+
|
||||
+ exe = xmalloc(PATH_MAX);
|
||||
+ chk = xmalloc(PATH_MAX);
|
||||
+
|
||||
+ /* we will need to add the suffix and the null terminator */
|
||||
+ check = get_executable_path(getpid(), exe
|
||||
+ , PATH_MAX - strlen(CHECKSUM_SUFFIX) - 1);
|
||||
+ if (CHECK_OK != check)
|
||||
+ goto cleanup;
|
||||
+
|
||||
+ strncpy(chk, exe, PATH_MAX);
|
||||
+ strlcat(chk, CHECKSUM_SUFFIX, PATH_MAX);
|
||||
+
|
||||
+ check = read_hmac(chk, &hmac_chk);
|
||||
+ if (CHECK_OK != check)
|
||||
+ goto cleanup;
|
||||
+
|
||||
+ check = hmac_file(exe, &hmac);
|
||||
+ if (CHECK_OK != check)
|
||||
+ goto cleanup;
|
||||
+
|
||||
+ check = memcmp(hmac, hmac_chk, FIPS_HMAC_LEN);
|
||||
+ if (0 == check) {
|
||||
+ check = CHECK_OK;
|
||||
+ debug("fips: checksum matches\n");
|
||||
+ } else {
|
||||
+ check = CHECK_FAIL;
|
||||
+ debug("fips: checksum mismatch!\n");
|
||||
+ }
|
||||
+
|
||||
+cleanup:
|
||||
+ free(hmac);
|
||||
+ free(hmac_chk);
|
||||
+ free(chk);
|
||||
+ free(exe);
|
||||
+
|
||||
+ return check;
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+fips_check_required_proc(void)
|
||||
{
|
||||
int fips_required = 0;
|
||||
- char *env = getenv(SSH_FORCE_FIPS_ENV);
|
||||
+ int fips_fd;
|
||||
+ char fips_sys = 0;
|
||||
|
||||
- if (env) {
|
||||
- errno = 0;
|
||||
- fips_required = strtol(env, NULL, 10);
|
||||
- if (errno) {
|
||||
- debug("bogus value in the %s environment variable, ignoring\n"
|
||||
- , SSH_FORCE_FIPS_ENV);
|
||||
- fips_required = 0;
|
||||
- } else
|
||||
- fips_required = 1;
|
||||
+ struct stat dummy;
|
||||
+ if (-1 == stat(FIPS_PROC_PATH, &dummy)) {
|
||||
+ switch (errno) {
|
||||
+ case ENOENT:
|
||||
+ case ENOTDIR:
|
||||
+ break;
|
||||
+ default:
|
||||
+ fatal("Check for system-wide FIPS mode is required and %s cannot"
|
||||
+ " be accessed for reason other than non-existence - aborting"
|
||||
+ , FIPS_PROC_PATH);
|
||||
+ break;
|
||||
+ }
|
||||
+ } else {
|
||||
+ if (-1 == (fips_fd = open(FIPS_PROC_PATH, O_RDONLY)))
|
||||
+ fatal("Check for system-wide FIPS mode is required and %s cannot"
|
||||
+ " be opened for reading - aborting"
|
||||
+ , FIPS_PROC_PATH);
|
||||
+ if (1 > read(fips_fd, &fips_sys, 1))
|
||||
+ fatal("Check for system-wide FIPS mode is required and %s doesn't"
|
||||
+ " return at least one character - aborting"
|
||||
+ , FIPS_PROC_PATH);
|
||||
+ close(fips_fd);
|
||||
+ switch (fips_sys) {
|
||||
+ case '0':
|
||||
+ case '1':
|
||||
+ fips_required = fips_sys - '0';
|
||||
+ break;
|
||||
+ default:
|
||||
+ fatal("Bogus character %c found in %s - aborting"
|
||||
+ , fips_sys, FIPS_PROC_PATH);
|
||||
+ }
|
||||
}
|
||||
return fips_required;
|
||||
}
|
||||
|
||||
+static int
|
||||
+fips_check_required_env(void)
|
||||
+{
|
||||
+ return (NULL != getenv(SSH_FORCE_FIPS_ENV));
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+fips_required(void)
|
||||
+{
|
||||
+ int fips_requests = 0;
|
||||
+ fips_requests += fips_check_required_proc();
|
||||
+ fips_requests += fips_check_required_env();
|
||||
+ return fips_requests;
|
||||
+}
|
||||
+
|
||||
+/* check whether FIPS mode is required and perform selfchecksum/selftest */
|
||||
+void
|
||||
+fips_ssh_init(void)
|
||||
+{
|
||||
+ int checksum;
|
||||
+
|
||||
+ checksum = fips_hmac_self();
|
||||
+
|
||||
+ if (fips_required()) {
|
||||
+ switch (checksum) {
|
||||
+ case CHECK_OK:
|
||||
+ debug("fips: mandatory checksum ok");
|
||||
+ break;
|
||||
+ case CHECK_FAIL:
|
||||
+ fatal("fips: mandatory checksum failed - aborting");
|
||||
+ break;
|
||||
+ case CHECK_MISSING:
|
||||
+ fatal("fips: mandatory checksum data missing - aborting");
|
||||
+ break;
|
||||
+ default:
|
||||
+ fatal("Fatal error: internal error at %s:%u"
|
||||
+ , __FILE__, __LINE__);
|
||||
+ break;
|
||||
+ }
|
||||
+ fips_state = FIPS_mode_set(1);
|
||||
+ if (1 != fips_state) {
|
||||
+ ERR_load_crypto_strings();
|
||||
+ u_long err = ERR_get_error();
|
||||
+ error("fips: OpenSSL error %lx: %s"
|
||||
+ , err, ERR_error_string(err, NULL));
|
||||
+ fatal("fips: unable to set OpenSSL into FIPS mode - aborting");
|
||||
+ }
|
||||
+ } else {
|
||||
+ switch (checksum) {
|
||||
+ case CHECK_OK:
|
||||
+ debug("fips: checksum ok");
|
||||
+ break;
|
||||
+ case CHECK_FAIL:
|
||||
+ fatal("fips: checksum failed - aborting");
|
||||
+ break;
|
||||
+ case CHECK_MISSING:
|
||||
+ debug("fips: checksum data missing, but not required - continuing non-FIPS");
|
||||
+ break;
|
||||
+ default:
|
||||
+ fatal("Fatal error: internal error at %s:%u",
|
||||
+ __FILE__, __LINE__);
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+ return;
|
||||
+}
|
||||
+
|
||||
int
|
||||
fips_mode(void)
|
||||
{
|
||||
Index: openssh-8.4p1/fips.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/fips.h
|
||||
+++ openssh-8.4p1/fips.h
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
- * Copyright (c) 2012 Petr Cerny. All rights reserved.
|
||||
+ * Copyright (c) 2012-2014 Petr Cerny. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
@@ -27,6 +27,15 @@
|
||||
#include "sshkey.h"
|
||||
|
||||
#define SSH_FORCE_FIPS_ENV "SSH_FORCE_FIPS"
|
||||
+#define FIPS_PROC_PATH "/proc/sys/crypto/fips_enabled"
|
||||
+
|
||||
+#define PROC_EXE_PATH_LEN 64
|
||||
+#define CHECKSUM_SUFFIX ".hmac"
|
||||
+#define FIPS_HMAC_KEY "HMAC_KEY:OpenSSH-FIPS@SLE"
|
||||
+#define FIPS_HMAC_EVP EVP_sha256
|
||||
+#define FIPS_HMAC_LEN 32
|
||||
+
|
||||
+void fips_ssh_init(void);
|
||||
|
||||
typedef enum {
|
||||
FIPS_FILTER_CIPHERS,
|
||||
@@ -34,6 +43,12 @@ typedef enum {
|
||||
FIPS_FILTER_KEX_ALGS
|
||||
} fips_filters;
|
||||
|
||||
+typedef enum {
|
||||
+ CHECK_OK = 0,
|
||||
+ CHECK_FAIL,
|
||||
+ CHECK_MISSING
|
||||
+} fips_checksum_status;
|
||||
+
|
||||
int fips_mode(void);
|
||||
int fips_correct_dgst(int);
|
||||
int fips_dgst_min(void);
|
||||
@@ -41,4 +56,3 @@ enum fp_type fips_correct_fp_type(enum
|
||||
int fips_filter_crypto(char **, fips_filters);
|
||||
|
||||
#endif
|
||||
-
|
||||
Index: openssh-8.4p1/sftp-server.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sftp-server.c
|
||||
+++ openssh-8.4p1/sftp-server.c
|
||||
@@ -53,6 +53,8 @@
|
||||
|
||||
char *sftp_realpath(const char *, char *); /* sftp-realpath.c */
|
||||
|
||||
+#include "fips.h"
|
||||
+
|
||||
/* Our verbosity */
|
||||
static LogLevel log_level = SYSLOG_LEVEL_ERROR;
|
||||
|
||||
@@ -1577,6 +1579,9 @@ sftp_server_main(int argc, char **argv,
|
||||
extern char *optarg;
|
||||
extern char *__progname;
|
||||
|
||||
+ /* initialize fips */
|
||||
+ fips_ssh_init();
|
||||
+
|
||||
__progname = ssh_get_progname(argv[0]);
|
||||
log_init(__progname, log_level, log_facility, log_stderr);
|
||||
|
||||
Index: openssh-8.4p1/ssh.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/ssh.c
|
||||
+++ openssh-8.4p1/ssh.c
|
||||
@@ -113,6 +113,8 @@
|
||||
#include "ssh-pkcs11.h"
|
||||
#endif
|
||||
|
||||
+#include "fips.h"
|
||||
+
|
||||
extern char *__progname;
|
||||
|
||||
/* Saves a copy of argv for setproctitle emulation */
|
||||
@@ -658,6 +660,10 @@ main(int ac, char **av)
|
||||
size_t n, len;
|
||||
u_int j;
|
||||
|
||||
+ /* initialize fips - can go before ssh_malloc_init(), since that is a
|
||||
+ * OpenBSD-only thing (as of OpenSSH 7.6p1) */
|
||||
+ fips_ssh_init();
|
||||
+
|
||||
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
|
||||
sanitise_stdfd();
|
||||
|
||||
Index: openssh-8.4p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd.c
|
||||
+++ openssh-8.4p1/sshd.c
|
||||
@@ -1545,6 +1545,10 @@ main(int ac, char **av)
|
||||
Authctxt *authctxt;
|
||||
struct connection_info *connection_info = NULL;
|
||||
|
||||
+ /* initialize fips - can go before ssh_malloc_init(), since that is a
|
||||
+ * OpenBSD-only thing (as of OpenSSH 7.6p1) */
|
||||
+ fips_ssh_init();
|
||||
+
|
||||
#ifdef HAVE_SECUREWARE
|
||||
(void)set_auth_parameters(ac, av);
|
||||
#endif
|
||||
29
openssh-7.7p1-host_ident.patch
Normal file
29
openssh-7.7p1-host_ident.patch
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# HG changeset patch
|
||||
# Parent 0f731d0b541b8a919d24ac91098f560a49712822
|
||||
Suggest command line for removal of offending keys from known_hosts file
|
||||
|
||||
diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c
|
||||
--- openssh-7.7p1/sshconnect.c
|
||||
+++ openssh-7.7p1/sshconnect.c
|
||||
@@ -1147,16 +1147,21 @@ check_host_key(char *hostname, struct so
|
||||
}
|
||||
/* The host key has changed. */
|
||||
warn_changed_key(host_key);
|
||||
error("Add correct host key in %.100s to get rid of this message.",
|
||||
user_hostfiles[0]);
|
||||
error("Offending %s key in %s:%lu",
|
||||
sshkey_type(host_found->key),
|
||||
host_found->file, host_found->line);
|
||||
+ error("You can use following command to remove the offending key:");
|
||||
+ if (host_found->file)
|
||||
+ error("ssh-keygen -R %s -f %s", host, host_found->file);
|
||||
+ else
|
||||
+ error("ssh-keygen -R %s", host);
|
||||
|
||||
/*
|
||||
* If strict host key checking is in use, the user will have
|
||||
* to edit the key manually and we can only abort.
|
||||
*/
|
||||
if (options.strict_host_key_checking !=
|
||||
SSH_STRICT_HOSTKEY_OFF) {
|
||||
error("%s host key for %.200s has changed and you have "
|
||||
83
openssh-7.7p1-hostname_changes_when_forwarding_X.patch
Normal file
83
openssh-7.7p1-hostname_changes_when_forwarding_X.patch
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
# HG changeset patch
|
||||
# Parent 5e19a205fa03584bb0d829ecbba7495ce1899b65
|
||||
# -- uset do be called '-xauthlocalhostname'
|
||||
handle hostname changes when forwarding X
|
||||
|
||||
Index: openssh-8.4p1/session.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/session.c
|
||||
+++ openssh-8.4p1/session.c
|
||||
@@ -985,7 +985,7 @@ copy_environment(char **source, char ***
|
||||
#endif
|
||||
|
||||
static char **
|
||||
-do_setup_env(struct ssh *ssh, Session *s, const char *shell)
|
||||
+do_setup_env(struct ssh *ssh, Session *s, const char *shell, int *env_size)
|
||||
{
|
||||
char buf[256];
|
||||
size_t n;
|
||||
@@ -1195,6 +1195,8 @@ do_setup_env(struct ssh *ssh, Session *s
|
||||
for (i = 0; env[i]; i++)
|
||||
fprintf(stderr, " %.200s\n", env[i]);
|
||||
}
|
||||
+
|
||||
+ *env_size = envsize;
|
||||
return env;
|
||||
}
|
||||
|
||||
@@ -1203,7 +1205,7 @@ do_setup_env(struct ssh *ssh, Session *s
|
||||
* first in this order).
|
||||
*/
|
||||
static void
|
||||
-do_rc_files(struct ssh *ssh, Session *s, const char *shell)
|
||||
+do_rc_files(struct ssh *ssh, Session *s, const char *shell, char **env, int *env_size)
|
||||
{
|
||||
FILE *f = NULL;
|
||||
char *cmd = NULL, *user_rc = NULL;
|
||||
@@ -1260,12 +1262,20 @@ do_rc_files(struct ssh *ssh, Session *s,
|
||||
fatal("%s: xasprintf: %s", __func__, strerror(errno));
|
||||
f = popen(cmd, "w");
|
||||
if (f) {
|
||||
+ char hostname[MAXHOSTNAMELEN];
|
||||
+
|
||||
fprintf(f, "remove %s\n",
|
||||
s->auth_display);
|
||||
fprintf(f, "add %s %s %s\n",
|
||||
s->auth_display, s->auth_proto,
|
||||
s->auth_data);
|
||||
pclose(f);
|
||||
+ if (gethostname(hostname,sizeof(hostname)) >= 0)
|
||||
+ child_set_env(&env,env_size,"XAUTHLOCALHOSTNAME",
|
||||
+ hostname);
|
||||
+ else
|
||||
+ debug("Cannot set up XAUTHLOCALHOSTNAME %s\n",
|
||||
+ strerror(errno));
|
||||
} else {
|
||||
fprintf(stderr, "Could not run %s\n",
|
||||
cmd);
|
||||
@@ -1526,6 +1536,7 @@ do_child(struct ssh *ssh, Session *s, co
|
||||
char **env, *argv[ARGV_MAX], remote_id[512];
|
||||
const char *shell, *shell0;
|
||||
struct passwd *pw = s->pw;
|
||||
+ int env_size;
|
||||
int r = 0;
|
||||
|
||||
sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
|
||||
@@ -1582,7 +1593,7 @@ do_child(struct ssh *ssh, Session *s, co
|
||||
* Make sure $SHELL points to the shell from the password file,
|
||||
* even if shell is overridden from login.conf
|
||||
*/
|
||||
- env = do_setup_env(ssh, s, shell);
|
||||
+ env = do_setup_env(ssh, s, shell, &env_size);
|
||||
|
||||
#ifdef HAVE_LOGIN_CAP
|
||||
shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
|
||||
@@ -1646,7 +1657,7 @@ do_child(struct ssh *ssh, Session *s, co
|
||||
|
||||
closefrom(STDERR_FILENO + 1);
|
||||
|
||||
- do_rc_files(ssh, s, shell);
|
||||
+ do_rc_files(ssh, s, shell, env, &env_size);
|
||||
|
||||
/* restore SIGPIPE for child */
|
||||
ssh_signal(SIGPIPE, SIG_DFL);
|
||||
2726
openssh-7.7p1-ldap.patch
Normal file
2726
openssh-7.7p1-ldap.patch
Normal file
File diff suppressed because it is too large
Load diff
17
openssh-7.7p1-no_fork-no_pid_file.patch
Normal file
17
openssh-7.7p1-no_fork-no_pid_file.patch
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
# HG changeset patch
|
||||
# Parent bad0c8b3b8d72abb6960ed85b57ee42352371738
|
||||
Do not write a PID file when not daemonizing (e.g. when running from systemd)
|
||||
|
||||
diff --git a/sshd.c b/sshd.c
|
||||
index f3ccc3a..eadc1b3 100644
|
||||
--- a/sshd.c
|
||||
+++ b/sshd.c
|
||||
@@ -2076,7 +2076,7 @@ main(int ac, char **av)
|
||||
* Write out the pid file after the sigterm handler
|
||||
* is setup and the listen sockets are bound
|
||||
*/
|
||||
- if (options.pid_file != NULL && !debug_flag) {
|
||||
+ if (!no_daemon_flag && options.pid_file != NULL && !debug_flag) {
|
||||
FILE *f = fopen(options.pid_file, "w");
|
||||
|
||||
if (f == NULL) {
|
||||
134
openssh-7.7p1-pam_check_locks.patch
Normal file
134
openssh-7.7p1-pam_check_locks.patch
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
# HG changeset patch
|
||||
# Parent 089f4fba0112d410a1bfa74398941f076681d446
|
||||
new option UsePAMCheckLocks to enforce checking for locked accounts while
|
||||
UsePAM is used
|
||||
|
||||
bnc#708678, FATE#312033
|
||||
|
||||
Index: openssh-8.4p1/auth.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth.c
|
||||
+++ openssh-8.4p1/auth.c
|
||||
@@ -113,7 +113,7 @@ allowed_user(struct ssh *ssh, struct pas
|
||||
return 0;
|
||||
|
||||
#ifdef USE_SHADOW
|
||||
- if (!options.use_pam)
|
||||
+ if (!options.use_pam || options.use_pam_check_locks)
|
||||
spw = getspnam(pw->pw_name);
|
||||
#ifdef HAS_SHADOW_EXPIRE
|
||||
if (!options.use_pam && spw != NULL && auth_shadow_acctexpired(spw))
|
||||
@@ -133,7 +133,7 @@ allowed_user(struct ssh *ssh, struct pas
|
||||
#endif
|
||||
|
||||
/* check for locked account */
|
||||
- if (!options.use_pam && passwd && *passwd) {
|
||||
+ if ((!options.use_pam || options.use_pam_check_locks) && passwd && *passwd) {
|
||||
int locked = 0;
|
||||
|
||||
#ifdef LOCKED_PASSWD_STRING
|
||||
Index: openssh-8.4p1/servconf.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/servconf.c
|
||||
+++ openssh-8.4p1/servconf.c
|
||||
@@ -92,6 +92,7 @@ initialize_server_options(ServerOptions
|
||||
|
||||
/* Portable-specific options */
|
||||
options->use_pam = -1;
|
||||
+ options->use_pam_check_locks = -1;
|
||||
|
||||
/* Standard Options */
|
||||
options->num_ports = 0;
|
||||
@@ -300,6 +301,8 @@ fill_default_server_options(ServerOption
|
||||
/* Portable-specific options */
|
||||
if (options->use_pam == -1)
|
||||
options->use_pam = 0;
|
||||
+ if (options->use_pam_check_locks == -1)
|
||||
+ options->use_pam_check_locks = 0;
|
||||
|
||||
/* Standard Options */
|
||||
if (options->num_host_key_files == 0) {
|
||||
@@ -501,7 +504,7 @@ fill_default_server_options(ServerOption
|
||||
typedef enum {
|
||||
sBadOption, /* == unknown option */
|
||||
/* Portable-specific options */
|
||||
- sUsePAM,
|
||||
+ sUsePAM, sUsePAMChecklocks,
|
||||
/* Standard Options */
|
||||
sPort, sHostKeyFile, sLoginGraceTime,
|
||||
sPermitRootLogin, sLogFacility, sLogLevel,
|
||||
@@ -553,8 +556,10 @@ static struct {
|
||||
/* Portable-specific options */
|
||||
#ifdef USE_PAM
|
||||
{ "usepam", sUsePAM, SSHCFG_GLOBAL },
|
||||
+ { "usepamchecklocks", sUsePAMChecklocks, SSHCFG_GLOBAL },
|
||||
#else
|
||||
{ "usepam", sUnsupported, SSHCFG_GLOBAL },
|
||||
+ { "usepamchecklocks", sUnsupported, SSHCFG_GLOBAL },
|
||||
#endif
|
||||
{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
|
||||
/* Standard Options */
|
||||
@@ -1318,6 +1323,9 @@ process_server_config_line_depth(ServerO
|
||||
case sUsePAM:
|
||||
intptr = &options->use_pam;
|
||||
goto parse_flag;
|
||||
+ case sUsePAMChecklocks:
|
||||
+ intptr = &options->use_pam_check_locks;
|
||||
+ goto parse_flag;
|
||||
|
||||
/* Standard Options */
|
||||
case sBadOption:
|
||||
Index: openssh-8.4p1/servconf.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/servconf.h
|
||||
+++ openssh-8.4p1/servconf.h
|
||||
@@ -195,6 +195,7 @@ typedef struct {
|
||||
char *adm_forced_command;
|
||||
|
||||
int use_pam; /* Enable auth via PAM */
|
||||
+ int use_pam_check_locks; /* internally check for locked accounts even when using PAM */
|
||||
|
||||
int permit_tun;
|
||||
|
||||
Index: openssh-8.4p1/sshd_config.0
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd_config.0
|
||||
+++ openssh-8.4p1/sshd_config.0
|
||||
@@ -1032,6 +1032,14 @@ DESCRIPTION
|
||||
If UsePAM is enabled, you will not be able to run sshd(8) as a
|
||||
non-root user. The default is no.
|
||||
|
||||
+ UsePAMCheckLocks
|
||||
+ When set to ``yes'', the checks whether the account has been
|
||||
+ locked with `passwd -l' are performed even when PAM authentication
|
||||
+ is enabled via UsePAM. This is to ensure that it is not possible
|
||||
+ to log in with e.g. a public key (in such a case PAM is used only
|
||||
+ to set up the session and some PAM modules will not check whether
|
||||
+ the account is locked in this scenario). The default is ``no''.
|
||||
+
|
||||
VersionAddendum
|
||||
Optionally specifies additional text to append to the SSH
|
||||
protocol banner sent by the server upon connection. The default
|
||||
Index: openssh-8.4p1/sshd_config.5
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd_config.5
|
||||
+++ openssh-8.4p1/sshd_config.5
|
||||
@@ -1718,6 +1718,18 @@ is enabled, you will not be able to run
|
||||
as a non-root user.
|
||||
The default is
|
||||
.Cm no .
|
||||
+.It Cm UsePAMCheckLocks
|
||||
+When set to
|
||||
+.Dq yes
|
||||
+, the checks whether the account has been locked with
|
||||
+.Pa passwd -l
|
||||
+are performed even when PAM authentication is enabled via
|
||||
+.Cm UsePAM .
|
||||
+This is to ensure that it is not possible to log in with e.g. a
|
||||
+public key (in such a case PAM is used only to set up the session and some PAM
|
||||
+modules will not check whether the account is locked in this scenario). The
|
||||
+default is
|
||||
+.Dq no .
|
||||
.It Cm VersionAddendum
|
||||
Optionally specifies additional text to append to the SSH protocol banner
|
||||
sent by the server upon connection.
|
||||
49
openssh-7.7p1-pts_names_formatting.patch
Normal file
49
openssh-7.7p1-pts_names_formatting.patch
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
# HG changeset patch
|
||||
# Parent 7cd948c83939479d1ba88a3161991cb561306f3f
|
||||
# use same lines naming as utempter (prevents problems with using different
|
||||
# formats in ?tmp? files)
|
||||
# --used to be called '-pts'
|
||||
|
||||
diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
|
||||
--- openssh-7.7p1/loginrec.c
|
||||
+++ openssh-7.7p1/loginrec.c
|
||||
@@ -541,17 +541,17 @@ getlast_entry(struct logininfo *li)
|
||||
/*
|
||||
* 'line' string utility functions
|
||||
*
|
||||
* These functions process the 'line' string into one of three forms:
|
||||
*
|
||||
* 1. The full filename (including '/dev')
|
||||
* 2. The stripped name (excluding '/dev')
|
||||
* 3. The abbreviated name (e.g. /dev/ttyp00 -> yp00
|
||||
- * /dev/pts/1 -> ts/1 )
|
||||
+ * /dev/pts/1 -> /1 )
|
||||
*
|
||||
* Form 3 is used on some systems to identify a .tmp.? entry when
|
||||
* attempting to remove it. Typically both addition and removal is
|
||||
* performed by one application - say, sshd - so as long as the choice
|
||||
* uniquely identifies a terminal it's ok.
|
||||
*/
|
||||
|
||||
|
||||
@@ -602,16 +602,20 @@ line_abbrevname(char *dst, const char *s
|
||||
/* Always skip prefix if present */
|
||||
if (strncmp(src, "/dev/", 5) == 0)
|
||||
src += 5;
|
||||
|
||||
#ifdef WITH_ABBREV_NO_TTY
|
||||
if (strncmp(src, "tty", 3) == 0)
|
||||
src += 3;
|
||||
#endif
|
||||
+ if (strncmp(src, "pts/", 4) == 0) {
|
||||
+ src += 3;
|
||||
+ if (strlen(src) > 4) src++;
|
||||
+ }
|
||||
|
||||
len = strlen(src);
|
||||
|
||||
if (len > 0) {
|
||||
if (((int)len - dstsize) > 0)
|
||||
src += ((int)len - dstsize);
|
||||
|
||||
/* note: _don't_ change this to strlcpy */
|
||||
55
openssh-7.7p1-remove_xauth_cookies_on_exit.patch
Normal file
55
openssh-7.7p1-remove_xauth_cookies_on_exit.patch
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
# HG changeset patch
|
||||
# Parent a60c0d88667efe0a64c030168950b69476af1622
|
||||
# --used to be called '-xauth'
|
||||
try to remove xauth cookies on logout
|
||||
|
||||
bnc#98815
|
||||
|
||||
diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c
|
||||
--- openssh-7.7p1/session.c
|
||||
+++ openssh-7.7p1/session.c
|
||||
@@ -2302,16 +2302,44 @@ session_close(struct ssh *ssh, Session *
|
||||
u_int i;
|
||||
|
||||
verbose("Close session: user %s from %.200s port %d id %d",
|
||||
s->pw->pw_name,
|
||||
ssh_remote_ipaddr(ssh),
|
||||
ssh_remote_port(ssh),
|
||||
s->self);
|
||||
|
||||
+ if ((s->display != NULL) && (s->auth_proto != NULL) &&
|
||||
+ (s->auth_data != NULL) && (options.xauth_location != NULL)) {
|
||||
+ pid_t pid;
|
||||
+ FILE *f;
|
||||
+ char cmd[1024];
|
||||
+ struct passwd * pw = s->pw;
|
||||
+
|
||||
+ if (!(pid = fork())) {
|
||||
+ permanently_set_uid(pw);
|
||||
+
|
||||
+ /* Remove authority data from .Xauthority if appropriate. */
|
||||
+ debug("Running %.500s remove %.100s\n",
|
||||
+ options.xauth_location, s->auth_display);
|
||||
+
|
||||
+ snprintf(cmd, sizeof cmd, "unset XAUTHORITY && HOME=\"%.200s\" %s -q -",
|
||||
+ s->pw->pw_dir, options.xauth_location);
|
||||
+ f = popen(cmd, "w");
|
||||
+ if (f) {
|
||||
+ fprintf(f, "remove %s\n", s->auth_display);
|
||||
+ pclose(f);
|
||||
+ } else
|
||||
+ error("Could not run %s\n", cmd);
|
||||
+ exit(0);
|
||||
+ } else if (pid > 0) {
|
||||
+ waitpid(pid, NULL, 0);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
if (s->ttyfd != -1)
|
||||
session_pty_cleanup(s);
|
||||
free(s->term);
|
||||
free(s->display);
|
||||
free(s->x11_chanids);
|
||||
free(s->auth_display);
|
||||
free(s->auth_data);
|
||||
free(s->auth_proto);
|
||||
41
openssh-7.7p1-seccomp_ipc_flock.patch
Normal file
41
openssh-7.7p1-seccomp_ipc_flock.patch
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
# HG changeset patch
|
||||
# Parent 9d38b7292619a6d5faf554b1a88888fdfa535de7
|
||||
Patch from IBM enabling the use of OpenCryptoki, submitted upstreams:
|
||||
|
||||
From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
|
||||
To: openssh-unix-dev@mindrot.org
|
||||
Subject: [PATCH 1/3] Allow flock and ipc syscall for s390 architecture
|
||||
Date: Tue, 9 May 2017 14:27:13 -0300
|
||||
|
||||
In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
|
||||
and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
|
||||
implementation) which calls the libraries that will communicate with the
|
||||
crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
|
||||
this is only need on s390 architecture.
|
||||
|
||||
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
|
||||
|
||||
Index: openssh-7.9p1/sandbox-seccomp-filter.c
|
||||
===================================================================
|
||||
--- openssh-7.9p1.orig/sandbox-seccomp-filter.c
|
||||
+++ openssh-7.9p1/sandbox-seccomp-filter.c
|
||||
@@ -175,6 +175,9 @@ static const struct sock_filter preauth_
|
||||
#ifdef __NR_geteuid32
|
||||
SC_ALLOW(__NR_geteuid32),
|
||||
#endif
|
||||
+#if defined(__NR_flock) && defined(__s390__)
|
||||
+ SC_ALLOW(__NR_flock),
|
||||
+#endif
|
||||
#ifdef __NR_getpgid
|
||||
SC_ALLOW(__NR_getpgid),
|
||||
#endif
|
||||
@@ -193,6 +196,9 @@ static const struct sock_filter preauth_
|
||||
#ifdef __NR_getuid32
|
||||
SC_ALLOW(__NR_getuid32),
|
||||
#endif
|
||||
+#if defined(__NR_ipc) && defined(__s390__)
|
||||
+ SC_ALLOW(__NR_ipc),
|
||||
+#endif
|
||||
#ifdef __NR_madvise
|
||||
SC_ALLOW(__NR_madvise),
|
||||
#endif
|
||||
30
openssh-7.7p1-seccomp_stat.patch
Normal file
30
openssh-7.7p1-seccomp_stat.patch
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
# HG changeset patch
|
||||
# Parent 5034ae16f6a5c9c7151d931dc1cce2a541fe010e
|
||||
Allow the stat() syscall for OpenSSL re-seed patch
|
||||
(which causes OpenSSL use stat() on some file)
|
||||
|
||||
bnc#912436
|
||||
|
||||
diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-seccomp-filter.c
|
||||
--- openssh-7.7p1/sandbox-seccomp-filter.c
|
||||
+++ openssh-7.7p1/sandbox-seccomp-filter.c
|
||||
@@ -224,16 +224,19 @@ static const struct sock_filter preauth_
|
||||
SC_ALLOW(__NR_select),
|
||||
#endif
|
||||
#ifdef __NR_shutdown
|
||||
SC_ALLOW(__NR_shutdown),
|
||||
#endif
|
||||
#ifdef __NR_sigprocmask
|
||||
SC_ALLOW(__NR_sigprocmask),
|
||||
#endif
|
||||
+#ifdef __NR_stat
|
||||
+ SC_ALLOW(__NR_stat),
|
||||
+#endif
|
||||
#ifdef __NR_time
|
||||
SC_ALLOW(__NR_time),
|
||||
#endif
|
||||
#ifdef __NR_write
|
||||
SC_ALLOW(__NR_write),
|
||||
#endif
|
||||
#ifdef __NR_socketcall
|
||||
SC_ALLOW_ARG(__NR_socketcall, 0, SYS_SHUTDOWN),
|
||||
53
openssh-7.7p1-send_locale.patch
Normal file
53
openssh-7.7p1-send_locale.patch
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# HG changeset patch
|
||||
# Parent db426aecefd1f4f8a7f9b9b6e8936cd8dd2f17fa
|
||||
send locales in default configuration
|
||||
bnc#65747
|
||||
|
||||
diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config
|
||||
--- openssh-7.7p1/ssh_config
|
||||
+++ openssh-7.7p1/ssh_config
|
||||
@@ -26,16 +26,21 @@ Host *
|
||||
# security reasons: Someone stealing the authentification data on the
|
||||
# remote side (the "spoofed" X-server by the remote sshd) can read your
|
||||
# keystrokes as you type, just like any other X11 client could do.
|
||||
# Set this to "no" here for global effect or in your own ~/.ssh/config
|
||||
# file if you want to have the remote X11 authentification data to
|
||||
# expire after twenty minutes after remote login.
|
||||
ForwardX11Trusted yes
|
||||
|
||||
+# This enables sending locale enviroment variables LC_* LANG, see ssh_config(5).
|
||||
+ SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
||||
+ SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
||||
+ SendEnv LC_IDENTIFICATION LC_ALL
|
||||
+
|
||||
# PasswordAuthentication yes
|
||||
# HostbasedAuthentication no
|
||||
# GSSAPIAuthentication no
|
||||
# GSSAPIDelegateCredentials no
|
||||
# BatchMode no
|
||||
# CheckHostIP yes
|
||||
# AddressFamily any
|
||||
# ConnectTimeout 0
|
||||
diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
|
||||
--- openssh-7.7p1/sshd_config
|
||||
+++ openssh-7.7p1/sshd_config
|
||||
@@ -104,14 +104,19 @@ X11Forwarding yes
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/libexec/sftp-server
|
||||
|
||||
+# This enables accepting locale enviroment variables LC_* LANG, see sshd_config(5).
|
||||
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
||||
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
||||
+AcceptEnv LC_IDENTIFICATION LC_ALL
|
||||
+
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
125
openssh-7.7p1-sftp_force_permissions.patch
Normal file
125
openssh-7.7p1-sftp_force_permissions.patch
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
Index: openssh-8.4p1/sftp-server.8
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sftp-server.8
|
||||
+++ openssh-8.4p1/sftp-server.8
|
||||
@@ -38,6 +38,7 @@
|
||||
.Op Fl P Ar denied_requests
|
||||
.Op Fl p Ar allowed_requests
|
||||
.Op Fl u Ar umask
|
||||
+.Op Fl m Ar force_file_dir_perms
|
||||
.Ek
|
||||
.Nm
|
||||
.Fl Q Ar protocol_feature
|
||||
@@ -138,6 +139,10 @@ Sets an explicit
|
||||
.Xr umask 2
|
||||
to be applied to newly-created files and directories, instead of the
|
||||
user's default mask.
|
||||
+.It Fl m Ar force_file_dir_perms
|
||||
+Sets explicit permissions to be applied to newly-created files and directories
|
||||
+instead of the default or client requested mode. Numeric values include:
|
||||
+777, 755, 750, 666, 644, 640, etc. Option -u is ineffective if -m is set.
|
||||
.El
|
||||
.Pp
|
||||
On some systems,
|
||||
Index: openssh-8.4p1/sftp-server.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sftp-server.c
|
||||
+++ openssh-8.4p1/sftp-server.c
|
||||
@@ -69,6 +69,10 @@ struct sshbuf *oqueue;
|
||||
/* Version of client */
|
||||
static u_int version;
|
||||
|
||||
+/* Force file and directory permissions */
|
||||
+int permforce = 0;
|
||||
+long permforcemode;
|
||||
+
|
||||
/* SSH2_FXP_INIT received */
|
||||
static int init_done;
|
||||
|
||||
@@ -687,6 +691,7 @@ process_open(u_int32_t id)
|
||||
Attrib a;
|
||||
char *name;
|
||||
int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
|
||||
+ mode_t old_umask = 0;
|
||||
|
||||
if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
|
||||
(r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
|
||||
@@ -696,6 +701,10 @@ process_open(u_int32_t id)
|
||||
debug3("request %u: open flags %d", id, pflags);
|
||||
flags = flags_from_portable(pflags);
|
||||
mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
|
||||
+ if (permforce == 1) { /* Force perm if -m is set */
|
||||
+ mode = permforcemode;
|
||||
+ old_umask = umask(0); /* so umask does not interfere */
|
||||
+ }
|
||||
logit("open \"%s\" flags %s mode 0%o",
|
||||
name, string_from_portable(pflags), mode);
|
||||
if (readonly &&
|
||||
@@ -717,6 +726,8 @@ process_open(u_int32_t id)
|
||||
}
|
||||
}
|
||||
}
|
||||
+ if (permforce == 1)
|
||||
+ (void) umask(old_umask); /* restore umask to something sane */
|
||||
if (status != SSH2_FX_OK)
|
||||
send_status(id, status);
|
||||
free(name);
|
||||
@@ -1131,6 +1142,7 @@ process_mkdir(u_int32_t id)
|
||||
Attrib a;
|
||||
char *name;
|
||||
int r, mode, status = SSH2_FX_FAILURE;
|
||||
+ mode_t old_umask = 0;
|
||||
|
||||
if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
|
||||
(r = decode_attrib(iqueue, &a)) != 0)
|
||||
@@ -1138,9 +1150,16 @@ process_mkdir(u_int32_t id)
|
||||
|
||||
mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
|
||||
a.perm & 07777 : 0777;
|
||||
+ if (permforce == 1) { /* Force perm if -m is set */
|
||||
+ mode = permforcemode;
|
||||
+ old_umask = umask(0); /* so umask does not interfere */
|
||||
+ }
|
||||
+
|
||||
debug3("request %u: mkdir", id);
|
||||
logit("mkdir name \"%s\" mode 0%o", name, mode);
|
||||
r = mkdir(name, mode);
|
||||
+ if (permforce == 1)
|
||||
+ (void) umask(old_umask); /* restore umask to something sane */
|
||||
status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
|
||||
send_status(id, status);
|
||||
free(name);
|
||||
@@ -1560,7 +1579,7 @@ sftp_server_usage(void)
|
||||
fprintf(stderr,
|
||||
"usage: %s [-ehR] [-d start_directory] [-f log_facility] "
|
||||
"[-l log_level]\n\t[-P denied_requests] "
|
||||
- "[-p allowed_requests] [-u umask]\n"
|
||||
+ "[-p allowed_requests] [-u umask] [-m force_file_dir_perms]\n"
|
||||
" %s -Q protocol_feature\n",
|
||||
__progname, __progname);
|
||||
exit(1);
|
||||
@@ -1588,7 +1607,7 @@ sftp_server_main(int argc, char **argv,
|
||||
pw = pwcopy(user_pw);
|
||||
|
||||
while (!skipargs && (ch = getopt(argc, argv,
|
||||
- "d:f:l:P:p:Q:u:cehR")) != -1) {
|
||||
+ "d:f:l:P:p:Q:u:m:cehR")) != -1) {
|
||||
switch (ch) {
|
||||
case 'Q':
|
||||
if (strcasecmp(optarg, "requests") != 0) {
|
||||
@@ -1650,6 +1669,15 @@ sftp_server_main(int argc, char **argv,
|
||||
fatal("Invalid umask \"%s\"", optarg);
|
||||
(void)umask((mode_t)mask);
|
||||
break;
|
||||
+ case 'm':
|
||||
+ /* Force permissions on file and directory received via sftp */
|
||||
+ permforce = 1;
|
||||
+ permforcemode = strtol(optarg, &cp, 8);
|
||||
+ if (permforcemode < 0 || permforcemode > 0777 ||
|
||||
+ *cp != '\0' || (permforcemode == 0 &&
|
||||
+ errno != 0))
|
||||
+ fatal("Invalid file mode \"%s\"", optarg);
|
||||
+ break;
|
||||
case 'h':
|
||||
default:
|
||||
sftp_server_usage();
|
||||
60
openssh-7.7p1-sftp_print_diagnostic_messages.patch
Normal file
60
openssh-7.7p1-sftp_print_diagnostic_messages.patch
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
# HG changeset patch
|
||||
# Parent 60bdbe6dd8d6bc011883472363d56e1d97f68835
|
||||
Put back sftp client diagnostic messages in batch mode
|
||||
|
||||
Index: openssh-8.4p1/sftp.1
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sftp.1
|
||||
+++ openssh-8.4p1/sftp.1
|
||||
@@ -287,6 +287,9 @@ Specifies the port to connect to on the
|
||||
.It Fl p
|
||||
Preserves modification times, access times, and modes from the
|
||||
original files transferred.
|
||||
+.It Fl Q
|
||||
+Not-so-quiet batch mode: forces printing of diagnostic messages
|
||||
+in batch mode.
|
||||
.It Fl q
|
||||
Quiet mode: disables the progress meter as well as warning and
|
||||
diagnostic messages from
|
||||
Index: openssh-8.4p1/sftp.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sftp.c
|
||||
+++ openssh-8.4p1/sftp.c
|
||||
@@ -85,6 +85,9 @@ static volatile pid_t sshpid = -1;
|
||||
/* Suppress diagnositic messages */
|
||||
int quiet = 0;
|
||||
|
||||
+/* Force diagnositic messages in batch mode */
|
||||
+int loud = 0;
|
||||
+
|
||||
/* This is set to 0 if the progressmeter is not desired. */
|
||||
int showprogress = 1;
|
||||
|
||||
@@ -2408,7 +2411,7 @@ main(int argc, char **argv)
|
||||
infile = stdin;
|
||||
|
||||
while ((ch = getopt(argc, argv,
|
||||
- "1246AafhNpqrvCc:D:i:l:o:s:S:b:B:F:J:P:R:")) != -1) {
|
||||
+ "1246AafhNpQqrvCc:D:i:l:o:s:S:b:B:F:J:P:R:")) != -1) {
|
||||
switch (ch) {
|
||||
/* Passed through to ssh(1) */
|
||||
case 'A':
|
||||
@@ -2426,6 +2429,9 @@ main(int argc, char **argv)
|
||||
addargs(&args, "-%c", ch);
|
||||
addargs(&args, "%s", optarg);
|
||||
break;
|
||||
+ case 'Q':
|
||||
+ loud = 1;
|
||||
+ break;
|
||||
case 'q':
|
||||
ll = SYSLOG_LEVEL_ERROR;
|
||||
quiet = 1;
|
||||
@@ -2510,6 +2516,8 @@ main(int argc, char **argv)
|
||||
usage();
|
||||
}
|
||||
}
|
||||
+ if (batchmode && loud)
|
||||
+ quiet = 0;
|
||||
|
||||
/* Do this last because we want the user to be able to override it */
|
||||
addargs(&args, "-oForwardAgent no");
|
||||
86
openssh-7.7p1-systemd-notify.patch
Normal file
86
openssh-7.7p1-systemd-notify.patch
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
# HG changeset patch
|
||||
# Parent d296e85dc414b8cd1b4b55ad03d8216feb26531a
|
||||
Send signals to systemd to prevent various race conditions
|
||||
bsc#1048367
|
||||
|
||||
Index: openssh-7.8p1/configure.ac
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/configure.ac
|
||||
+++ openssh-7.8p1/configure.ac
|
||||
@@ -4378,6 +4378,30 @@ AC_ARG_WITH([kerberos5],
|
||||
AC_SUBST([GSSLIBS])
|
||||
AC_SUBST([K5LIBS])
|
||||
|
||||
+# Check whether user wants systemd support
|
||||
+SYSTEMD_MSG="no"
|
||||
+AC_ARG_WITH(systemd,
|
||||
+ [ --with-systemd Enable systemd support],
|
||||
+ [ if test "x$withval" != "xno" ; then
|
||||
+ AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
|
||||
+ if test "$PKGCONFIG" != "no"; then
|
||||
+ AC_MSG_CHECKING([for libsystemd])
|
||||
+ if $PKGCONFIG --exists libsystemd; then
|
||||
+ SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd`
|
||||
+ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
|
||||
+ CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS"
|
||||
+ SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS"
|
||||
+ AC_MSG_RESULT([yes])
|
||||
+ AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.])
|
||||
+ SYSTEMD_MSG="yes"
|
||||
+ else
|
||||
+ AC_MSG_RESULT([no])
|
||||
+ fi
|
||||
+ fi
|
||||
+ fi ]
|
||||
+)
|
||||
+
|
||||
+
|
||||
# Looking for programs, paths and files
|
||||
|
||||
PRIVSEP_PATH=/var/empty
|
||||
@@ -5183,6 +5207,7 @@ echo " libldns support
|
||||
echo " Solaris process contract support: $SPC_MSG"
|
||||
echo " Solaris project support: $SP_MSG"
|
||||
echo " Solaris privilege support: $SPP_MSG"
|
||||
+echo " systemd support: $SYSTEMD_MSG"
|
||||
echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
|
||||
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
|
||||
echo " BSD Auth support: $BSD_AUTH_MSG"
|
||||
Index: openssh-7.8p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/sshd.c
|
||||
+++ openssh-7.8p1/sshd.c
|
||||
@@ -87,6 +87,10 @@
|
||||
#include <prot.h>
|
||||
#endif
|
||||
|
||||
+#ifdef HAVE_SYSTEMD
|
||||
+#include <systemd/sd-daemon.h>
|
||||
+#endif
|
||||
+
|
||||
#include "xmalloc.h"
|
||||
#include "ssh.h"
|
||||
#include "ssh2.h"
|
||||
@@ -308,6 +312,10 @@ sighup_handler(int sig)
|
||||
static void
|
||||
sighup_restart(void)
|
||||
{
|
||||
+#ifdef HAVE_SYSTEMD
|
||||
+ /* Signal systemd that we are reloading */
|
||||
+ sd_notify(0, "RELOADING=1");
|
||||
+#endif
|
||||
logit("Received SIGHUP; restarting.");
|
||||
if (options.pid_file != NULL)
|
||||
unlink(options.pid_file);
|
||||
@@ -1995,6 +2003,11 @@ main(int ac, char **av)
|
||||
}
|
||||
}
|
||||
|
||||
+#ifdef HAVE_SYSTEMD
|
||||
+ /* Signal systemd that we are ready to accept connections */
|
||||
+ sd_notify(0, "READY=1");
|
||||
+#endif
|
||||
+
|
||||
/* Accept a connection and return in a forked child */
|
||||
server_accept_loop(&sock_in, &sock_out,
|
||||
&newsock, config_s);
|
||||
889
openssh-7.8p1-role-mls.patch
Normal file
889
openssh-7.8p1-role-mls.patch
Normal file
|
|
@ -0,0 +1,889 @@
|
|||
Index: openssh-8.4p1/auth2.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth2.c
|
||||
+++ openssh-8.4p1/auth2.c
|
||||
@@ -266,6 +266,9 @@ input_userauth_request(int type, u_int32
|
||||
Authctxt *authctxt = ssh->authctxt;
|
||||
Authmethod *m = NULL;
|
||||
char *user = NULL, *service = NULL, *method = NULL, *style = NULL;
|
||||
+#ifdef WITH_SELINUX
|
||||
+ char *role = NULL;
|
||||
+#endif
|
||||
int r, authenticated = 0;
|
||||
double tstart = monotime_double();
|
||||
|
||||
@@ -279,6 +282,11 @@ input_userauth_request(int type, u_int32
|
||||
debug("userauth-request for user %s service %s method %s", user, service, method);
|
||||
debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
|
||||
|
||||
+#ifdef WITH_SELINUX
|
||||
+ if ((role = strchr(user, '/')) != NULL)
|
||||
+ *role++ = 0;
|
||||
+#endif
|
||||
+
|
||||
if ((style = strchr(user, ':')) != NULL)
|
||||
*style++ = 0;
|
||||
|
||||
@@ -304,8 +312,15 @@ input_userauth_request(int type, u_int32
|
||||
use_privsep ? " [net]" : "");
|
||||
authctxt->service = xstrdup(service);
|
||||
authctxt->style = style ? xstrdup(style) : NULL;
|
||||
- if (use_privsep)
|
||||
+#ifdef WITH_SELINUX
|
||||
+ authctxt->role = role ? xstrdup(role) : NULL;
|
||||
+#endif
|
||||
+ if (use_privsep) {
|
||||
mm_inform_authserv(service, style);
|
||||
+#ifdef WITH_SELINUX
|
||||
+ mm_inform_authrole(role);
|
||||
+#endif
|
||||
+ }
|
||||
userauth_banner(ssh);
|
||||
if (auth2_setup_methods_lists(authctxt) != 0)
|
||||
ssh_packet_disconnect(ssh,
|
||||
Index: openssh-8.4p1/auth2-gss.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth2-gss.c
|
||||
+++ openssh-8.4p1/auth2-gss.c
|
||||
@@ -324,6 +324,7 @@ input_gssapi_mic(int type, u_int32_t ple
|
||||
Authctxt *authctxt = ssh->authctxt;
|
||||
Gssctxt *gssctxt;
|
||||
int r, authenticated = 0;
|
||||
+ char *micuser;
|
||||
struct sshbuf *b;
|
||||
gss_buffer_desc mic, gssbuf;
|
||||
const char *displayname;
|
||||
@@ -341,7 +342,13 @@ input_gssapi_mic(int type, u_int32_t ple
|
||||
fatal("%s: sshbuf_new failed", __func__);
|
||||
mic.value = p;
|
||||
mic.length = len;
|
||||
- ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,
|
||||
+#ifdef WITH_SELINUX
|
||||
+ if (authctxt->role && authctxt->role[0] != 0)
|
||||
+ xasprintf(&micuser, "%s/%s", authctxt->user, authctxt->role);
|
||||
+ else
|
||||
+#endif
|
||||
+ micuser = authctxt->user;
|
||||
+ ssh_gssapi_buildmic(b, micuser, authctxt->service,
|
||||
"gssapi-with-mic");
|
||||
|
||||
if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
|
||||
@@ -355,6 +362,8 @@ input_gssapi_mic(int type, u_int32_t ple
|
||||
logit("GSSAPI MIC check failed");
|
||||
|
||||
sshbuf_free(b);
|
||||
+ if (micuser != authctxt->user)
|
||||
+ free(micuser);
|
||||
free(mic.value);
|
||||
|
||||
if ((!use_privsep || mm_is_monitor()) &&
|
||||
Index: openssh-8.4p1/auth2-hostbased.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth2-hostbased.c
|
||||
+++ openssh-8.4p1/auth2-hostbased.c
|
||||
@@ -131,7 +131,16 @@ userauth_hostbased(struct ssh *ssh)
|
||||
/* reconstruct packet */
|
||||
if ((r = sshbuf_put_string(b, session_id2, session_id2_len)) != 0 ||
|
||||
(r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
|
||||
+#ifdef WITH_SELINUX
|
||||
+ (authctxt->role
|
||||
+ ? ( (r = sshbuf_put_u32(b, strlen(authctxt->user)+strlen(authctxt->role)+1)) != 0 ||
|
||||
+ (r = sshbuf_put(b, authctxt->user, strlen(authctxt->user))) != 0 ||
|
||||
+ (r = sshbuf_put_u8(b, '/') != 0) ||
|
||||
+ (r = sshbuf_put(b, authctxt->role, strlen(authctxt->role))) != 0)
|
||||
+ : (r = sshbuf_put_cstring(b, authctxt->user)) != 0) ||
|
||||
+#else
|
||||
(r = sshbuf_put_cstring(b, authctxt->user)) != 0 ||
|
||||
+#endif
|
||||
(r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
|
||||
(r = sshbuf_put_cstring(b, "hostbased")) != 0 ||
|
||||
(r = sshbuf_put_string(b, pkalg, alen)) != 0 ||
|
||||
Index: openssh-8.4p1/auth2-pubkey.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth2-pubkey.c
|
||||
+++ openssh-8.4p1/auth2-pubkey.c
|
||||
@@ -194,9 +194,16 @@ userauth_pubkey(struct ssh *ssh)
|
||||
goto done;
|
||||
}
|
||||
/* reconstruct packet */
|
||||
- xasprintf(&userstyle, "%s%s%s", authctxt->user,
|
||||
+ xasprintf(&userstyle, "%s%s%s%s%s", authctxt->user,
|
||||
authctxt->style ? ":" : "",
|
||||
- authctxt->style ? authctxt->style : "");
|
||||
+ authctxt->style ? authctxt->style : "",
|
||||
+#ifdef WITH_SELINUX
|
||||
+ authctxt->role ? "/" : "",
|
||||
+ authctxt->role ? authctxt->role : ""
|
||||
+#else
|
||||
+ "", ""
|
||||
+#endif
|
||||
+ );
|
||||
if ((r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
|
||||
(r = sshbuf_put_cstring(b, userstyle)) != 0 ||
|
||||
(r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
|
||||
Index: openssh-8.4p1/auth.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth.h
|
||||
+++ openssh-8.4p1/auth.h
|
||||
@@ -63,6 +63,9 @@ struct Authctxt {
|
||||
char *service;
|
||||
struct passwd *pw; /* set if 'valid' */
|
||||
char *style;
|
||||
+#ifdef WITH_SELINUX
|
||||
+ char *role;
|
||||
+#endif
|
||||
|
||||
/* Method lists for multiple authentication */
|
||||
char **auth_methods; /* modified from server config */
|
||||
Index: openssh-8.4p1/auth-pam.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth-pam.c
|
||||
+++ openssh-8.4p1/auth-pam.c
|
||||
@@ -1222,7 +1222,7 @@ is_pam_session_open(void)
|
||||
* during the ssh authentication process.
|
||||
*/
|
||||
int
|
||||
-do_pam_putenv(char *name, char *value)
|
||||
+do_pam_putenv(char *name, const char *value)
|
||||
{
|
||||
int ret = 1;
|
||||
char *compound;
|
||||
Index: openssh-8.4p1/auth-pam.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/auth-pam.h
|
||||
+++ openssh-8.4p1/auth-pam.h
|
||||
@@ -33,7 +33,7 @@ u_int do_pam_account(void);
|
||||
void do_pam_session(struct ssh *);
|
||||
void do_pam_setcred(int );
|
||||
void do_pam_chauthtok(void);
|
||||
-int do_pam_putenv(char *, char *);
|
||||
+int do_pam_putenv(char *, const char *);
|
||||
char ** fetch_pam_environment(void);
|
||||
char ** fetch_pam_child_environment(void);
|
||||
void free_pam_environment(char **);
|
||||
Index: openssh-8.4p1/misc.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/misc.c
|
||||
+++ openssh-8.4p1/misc.c
|
||||
@@ -670,6 +670,7 @@ char *
|
||||
colon(char *cp)
|
||||
{
|
||||
int flag = 0;
|
||||
+ int start = 1;
|
||||
|
||||
if (*cp == ':') /* Leading colon is part of file name. */
|
||||
return NULL;
|
||||
@@ -685,6 +686,13 @@ colon(char *cp)
|
||||
return (cp);
|
||||
if (*cp == '/')
|
||||
return NULL;
|
||||
+ if (start) {
|
||||
+ /* Slash on beginning or after dots only denotes file name. */
|
||||
+ if (*cp == '/')
|
||||
+ return (0);
|
||||
+ if (*cp != '.')
|
||||
+ start = 0;
|
||||
+ }
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
Index: openssh-8.4p1/monitor.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/monitor.c
|
||||
+++ openssh-8.4p1/monitor.c
|
||||
@@ -121,6 +121,9 @@ int mm_answer_sign(struct ssh *, int, st
|
||||
int mm_answer_pwnamallow(struct ssh *, int, struct sshbuf *);
|
||||
int mm_answer_auth2_read_banner(struct ssh *, int, struct sshbuf *);
|
||||
int mm_answer_authserv(struct ssh *, int, struct sshbuf *);
|
||||
+#ifdef WITH_SELINUX
|
||||
+int mm_answer_authrole(struct ssh *, int, struct sshbuf *);
|
||||
+#endif
|
||||
int mm_answer_authpassword(struct ssh *, int, struct sshbuf *);
|
||||
int mm_answer_bsdauthquery(struct ssh *, int, struct sshbuf *);
|
||||
int mm_answer_bsdauthrespond(struct ssh *, int, struct sshbuf *);
|
||||
@@ -206,6 +209,9 @@ struct mon_table mon_dispatch_proto20[]
|
||||
{MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
|
||||
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
|
||||
{MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
|
||||
+#ifdef WITH_SELINUX
|
||||
+ {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole},
|
||||
+#endif
|
||||
{MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
|
||||
{MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
|
||||
#ifdef USE_PAM
|
||||
@@ -837,6 +843,9 @@ mm_answer_pwnamallow(struct ssh *ssh, in
|
||||
|
||||
/* Allow service/style information on the auth context */
|
||||
monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
|
||||
+#ifdef WITH_SELINUX
|
||||
+ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1);
|
||||
+#endif
|
||||
monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
|
||||
|
||||
#ifdef USE_PAM
|
||||
@@ -912,6 +921,26 @@ key_base_type_match(const char *method,
|
||||
return found;
|
||||
}
|
||||
|
||||
+#ifdef WITH_SELINUX
|
||||
+int
|
||||
+mm_answer_authrole(struct ssh *ssh, int sock, struct sshbuf *m)
|
||||
+{
|
||||
+ int r;
|
||||
+ monitor_permit_authentications(1);
|
||||
+
|
||||
+ if ((r = sshbuf_get_cstring(m, &authctxt->role, NULL)) != 0)
|
||||
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
|
||||
+ debug3("%s: role=%s", __func__, authctxt->role);
|
||||
+
|
||||
+ if (strlen(authctxt->role) == 0) {
|
||||
+ free(authctxt->role);
|
||||
+ authctxt->role = NULL;
|
||||
+ }
|
||||
+
|
||||
+ return (0);
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
int
|
||||
mm_answer_authpassword(struct ssh *ssh, int sock, struct sshbuf *m)
|
||||
{
|
||||
@@ -1285,7 +1314,7 @@ monitor_valid_userblob(const u_char *dat
|
||||
{
|
||||
struct sshbuf *b;
|
||||
const u_char *p;
|
||||
- char *userstyle, *cp;
|
||||
+ char *userstyle, *s, *cp;
|
||||
size_t len;
|
||||
u_char type;
|
||||
int r, fail = 0;
|
||||
@@ -1316,6 +1345,8 @@ monitor_valid_userblob(const u_char *dat
|
||||
fail++;
|
||||
if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
|
||||
fatal("%s: buffer error: %s", __func__, ssh_err(r));
|
||||
+ if ((s = strchr(cp, '/')) != NULL)
|
||||
+ *s = '\0';
|
||||
xasprintf(&userstyle, "%s%s%s", authctxt->user,
|
||||
authctxt->style ? ":" : "",
|
||||
authctxt->style ? authctxt->style : "");
|
||||
@@ -1351,7 +1382,7 @@ monitor_valid_hostbasedblob(const u_char
|
||||
{
|
||||
struct sshbuf *b;
|
||||
const u_char *p;
|
||||
- char *cp, *userstyle;
|
||||
+ char *cp, *s, *userstyle;
|
||||
size_t len;
|
||||
int r, fail = 0;
|
||||
u_char type;
|
||||
@@ -1372,6 +1403,8 @@ monitor_valid_hostbasedblob(const u_char
|
||||
fail++;
|
||||
if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
|
||||
fatal("%s: buffer error: %s", __func__, ssh_err(r));
|
||||
+ if ((s = strchr(p, '/')) != NULL)
|
||||
+ *s = '\0';
|
||||
xasprintf(&userstyle, "%s%s%s", authctxt->user,
|
||||
authctxt->style ? ":" : "",
|
||||
authctxt->style ? authctxt->style : "");
|
||||
Index: openssh-8.4p1/monitor.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/monitor.h
|
||||
+++ openssh-8.4p1/monitor.h
|
||||
@@ -55,6 +55,10 @@ enum monitor_reqtype {
|
||||
MONITOR_REQ_GSSCHECKMIC = 48, MONITOR_ANS_GSSCHECKMIC = 49,
|
||||
MONITOR_REQ_TERM = 50,
|
||||
|
||||
+#ifdef WITH_SELINUX
|
||||
+ MONITOR_REQ_AUTHROLE = 80,
|
||||
+#endif
|
||||
+
|
||||
MONITOR_REQ_PAM_START = 100,
|
||||
MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
|
||||
MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
|
||||
Index: openssh-8.4p1/monitor_wrap.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/monitor_wrap.c
|
||||
+++ openssh-8.4p1/monitor_wrap.c
|
||||
@@ -385,6 +385,27 @@ mm_inform_authserv(char *service, char *
|
||||
sshbuf_free(m);
|
||||
}
|
||||
|
||||
+/* Inform the privileged process about role */
|
||||
+
|
||||
+#ifdef WITH_SELINUX
|
||||
+void
|
||||
+mm_inform_authrole(char *role)
|
||||
+{
|
||||
+ int r;
|
||||
+ struct sshbuf *m;
|
||||
+
|
||||
+ debug3("%s entering", __func__);
|
||||
+
|
||||
+ if ((m = sshbuf_new()) == NULL)
|
||||
+ fatal("%s: sshbuf_new failed", __func__);
|
||||
+ if ((r = sshbuf_put_cstring(m, role ? role : "")) != 0)
|
||||
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
|
||||
+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, m);
|
||||
+
|
||||
+ sshbuf_free(m);
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
/* Do the password authentication */
|
||||
int
|
||||
mm_auth_password(struct ssh *ssh, char *password)
|
||||
Index: openssh-8.4p1/monitor_wrap.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/monitor_wrap.h
|
||||
+++ openssh-8.4p1/monitor_wrap.h
|
||||
@@ -49,6 +49,9 @@ int mm_sshkey_sign(struct ssh *, struct
|
||||
const u_char *, size_t, const char *, const char *,
|
||||
const char *, u_int compat);
|
||||
void mm_inform_authserv(char *, char *);
|
||||
+#ifdef WITH_SELINUX
|
||||
+void mm_inform_authrole(char *);
|
||||
+#endif
|
||||
struct passwd *mm_getpwnamallow(struct ssh *, const char *);
|
||||
char *mm_auth2_read_banner(void);
|
||||
int mm_auth_password(struct ssh *, char *);
|
||||
Index: openssh-8.4p1/openbsd-compat/Makefile.in
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/Makefile.in
|
||||
+++ openssh-8.4p1/openbsd-compat/Makefile.in
|
||||
@@ -96,7 +96,8 @@ PORTS= port-aix.o \
|
||||
port-linux.o \
|
||||
port-solaris.o \
|
||||
port-net.o \
|
||||
- port-uw.o
|
||||
+ port-uw.o \
|
||||
+ port-linux-sshd.o
|
||||
|
||||
.c.o:
|
||||
$(CC) $(CFLAGS_NOPIE) $(PICFLAG) $(CPPFLAGS) -c $<
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux.c
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux.c
|
||||
@@ -101,37 +101,6 @@ ssh_selinux_getctxbyname(char *pwname)
|
||||
return sc;
|
||||
}
|
||||
|
||||
-/* Set the execution context to the default for the specified user */
|
||||
-void
|
||||
-ssh_selinux_setup_exec_context(char *pwname)
|
||||
-{
|
||||
- security_context_t user_ctx = NULL;
|
||||
-
|
||||
- if (!ssh_selinux_enabled())
|
||||
- return;
|
||||
-
|
||||
- debug3("%s: setting execution context", __func__);
|
||||
-
|
||||
- user_ctx = ssh_selinux_getctxbyname(pwname);
|
||||
- if (setexeccon(user_ctx) != 0) {
|
||||
- switch (security_getenforce()) {
|
||||
- case -1:
|
||||
- fatal("%s: security_getenforce() failed", __func__);
|
||||
- case 0:
|
||||
- error("%s: Failed to set SELinux execution "
|
||||
- "context for %s", __func__, pwname);
|
||||
- break;
|
||||
- default:
|
||||
- fatal("%s: Failed to set SELinux execution context "
|
||||
- "for %s (in enforcing mode)", __func__, pwname);
|
||||
- }
|
||||
- }
|
||||
- if (user_ctx != NULL)
|
||||
- freecon(user_ctx);
|
||||
-
|
||||
- debug3("%s: done", __func__);
|
||||
-}
|
||||
-
|
||||
/* Set the TTY context for the specified user */
|
||||
void
|
||||
ssh_selinux_setup_pty(char *pwname, const char *tty)
|
||||
@@ -146,7 +115,11 @@ ssh_selinux_setup_pty(char *pwname, cons
|
||||
|
||||
debug3("%s: setting TTY context on %s", __func__, tty);
|
||||
|
||||
- user_ctx = ssh_selinux_getctxbyname(pwname);
|
||||
+ if (getexeccon(&user_ctx) != 0) {
|
||||
+ error("%s: getexeccon: %s", __func__, strerror(errno));
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
|
||||
/* XXX: should these calls fatal() upon failure in enforcing mode? */
|
||||
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/openbsd-compat/port-linux.h
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux.h
|
||||
@@ -20,9 +20,10 @@
|
||||
#ifdef WITH_SELINUX
|
||||
int ssh_selinux_enabled(void);
|
||||
void ssh_selinux_setup_pty(char *, const char *);
|
||||
-void ssh_selinux_setup_exec_context(char *);
|
||||
void ssh_selinux_change_context(const char *);
|
||||
void ssh_selinux_setfscreatecon(const char *);
|
||||
+
|
||||
+void sshd_selinux_setup_exec_context(char *);
|
||||
#endif
|
||||
|
||||
#ifdef LINUX_OOM_ADJUST
|
||||
Index: openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ openssh-8.4p1/openbsd-compat/port-linux-sshd.c
|
||||
@@ -0,0 +1,425 @@
|
||||
+/*
|
||||
+ * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
|
||||
+ * Copyright (c) 2014 Petr Lautrbach <plautrba@redhat.com>
|
||||
+ *
|
||||
+ * Permission to use, copy, modify, and distribute this software for any
|
||||
+ * purpose with or without fee is hereby granted, provided that the above
|
||||
+ * copyright notice and this permission notice appear in all copies.
|
||||
+ *
|
||||
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
+ */
|
||||
+
|
||||
+/*
|
||||
+ * Linux-specific portability code - just SELinux support for sshd at present
|
||||
+ */
|
||||
+
|
||||
+#include "includes.h"
|
||||
+
|
||||
+#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST)
|
||||
+#include <errno.h>
|
||||
+#include <stdarg.h>
|
||||
+#include <string.h>
|
||||
+#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
+
|
||||
+#include "log.h"
|
||||
+#include "xmalloc.h"
|
||||
+#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */
|
||||
+#include "servconf.h"
|
||||
+#include "port-linux.h"
|
||||
+#include "sshkey.h"
|
||||
+#include "hostfile.h"
|
||||
+#include "auth.h"
|
||||
+
|
||||
+#ifdef WITH_SELINUX
|
||||
+#include <selinux/selinux.h>
|
||||
+#include <selinux/context.h>
|
||||
+#include <selinux/get_context_list.h>
|
||||
+#include <selinux/get_default_type.h>
|
||||
+
|
||||
+#ifdef HAVE_LINUX_AUDIT
|
||||
+#include <libaudit.h>
|
||||
+#include <unistd.h>
|
||||
+#endif
|
||||
+
|
||||
+extern ServerOptions options;
|
||||
+extern Authctxt *the_authctxt;
|
||||
+extern int inetd_flag;
|
||||
+extern int rexeced_flag;
|
||||
+
|
||||
+/* Send audit message */
|
||||
+static int
|
||||
+sshd_selinux_send_audit_message(int success, security_context_t default_context,
|
||||
+ security_context_t selected_context)
|
||||
+{
|
||||
+ int rc=0;
|
||||
+#ifdef HAVE_LINUX_AUDIT
|
||||
+ char *msg = NULL;
|
||||
+ int audit_fd = audit_open();
|
||||
+ security_context_t default_raw=NULL;
|
||||
+ security_context_t selected_raw=NULL;
|
||||
+ rc = -1;
|
||||
+ if (audit_fd < 0) {
|
||||
+ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
|
||||
+ errno == EAFNOSUPPORT)
|
||||
+ return 0; /* No audit support in kernel */
|
||||
+ error("Error connecting to audit system.");
|
||||
+ return rc;
|
||||
+ }
|
||||
+ if (selinux_trans_to_raw_context(default_context, &default_raw) < 0) {
|
||||
+ error("Error translating default context.");
|
||||
+ default_raw = NULL;
|
||||
+ }
|
||||
+ if (selinux_trans_to_raw_context(selected_context, &selected_raw) < 0) {
|
||||
+ error("Error translating selected context.");
|
||||
+ selected_raw = NULL;
|
||||
+ }
|
||||
+ if (asprintf(&msg, "sshd: default-context=%s selected-context=%s",
|
||||
+ default_raw ? default_raw : (default_context ? default_context: "?"),
|
||||
+ selected_context ? selected_raw : (selected_context ? selected_context :"?")) < 0) {
|
||||
+ error("Error allocating memory.");
|
||||
+ goto out;
|
||||
+ }
|
||||
+ if (audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,
|
||||
+ msg, NULL, NULL, NULL, success) <= 0) {
|
||||
+ error("Error sending audit message.");
|
||||
+ goto out;
|
||||
+ }
|
||||
+ rc = 0;
|
||||
+ out:
|
||||
+ free(msg);
|
||||
+ freecon(default_raw);
|
||||
+ freecon(selected_raw);
|
||||
+ close(audit_fd);
|
||||
+#endif
|
||||
+ return rc;
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+mls_range_allowed(security_context_t src, security_context_t dst)
|
||||
+{
|
||||
+ struct av_decision avd;
|
||||
+ int retval;
|
||||
+ access_vector_t bit;
|
||||
+ security_class_t class;
|
||||
+
|
||||
+ debug("%s: src:%s dst:%s", __func__, src, dst);
|
||||
+ class = string_to_security_class("context");
|
||||
+ if (!class) {
|
||||
+ error("string_to_security_class failed to translate security class context");
|
||||
+ return 1;
|
||||
+ }
|
||||
+ bit = string_to_av_perm(class, "contains");
|
||||
+ if (!bit) {
|
||||
+ error("string_to_av_perm failed to translate av perm contains");
|
||||
+ return 1;
|
||||
+ }
|
||||
+ retval = security_compute_av(src, dst, class, bit, &avd);
|
||||
+ if (retval || ((bit & avd.allowed) != bit))
|
||||
+ return 0;
|
||||
+
|
||||
+ return 1;
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+get_user_context(const char *sename, const char *role, const char *lvl,
|
||||
+ security_context_t *sc) {
|
||||
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
+ if (lvl == NULL || lvl[0] == '\0' || get_default_context_with_level(sename, lvl, NULL, sc) != 0) {
|
||||
+ /* User may have requested a level completely outside of his
|
||||
+ allowed range. We get a context just for auditing as the
|
||||
+ range check below will certainly fail for default context. */
|
||||
+#endif
|
||||
+ if (get_default_context(sename, NULL, sc) != 0) {
|
||||
+ *sc = NULL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
+ }
|
||||
+#endif
|
||||
+ if (role != NULL && role[0]) {
|
||||
+ context_t con;
|
||||
+ char *type=NULL;
|
||||
+ if (get_default_type(role, &type) != 0) {
|
||||
+ error("get_default_type: failed to get default type for '%s'",
|
||||
+ role);
|
||||
+ goto out;
|
||||
+ }
|
||||
+ con = context_new(*sc);
|
||||
+ if (!con) {
|
||||
+ goto out;
|
||||
+ }
|
||||
+ context_role_set(con, role);
|
||||
+ context_type_set(con, type);
|
||||
+ freecon(*sc);
|
||||
+ *sc = strdup(context_str(con));
|
||||
+ context_free(con);
|
||||
+ if (!*sc)
|
||||
+ return -1;
|
||||
+ }
|
||||
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
+ if (lvl != NULL && lvl[0]) {
|
||||
+ /* verify that the requested range is obtained */
|
||||
+ context_t con;
|
||||
+ security_context_t obtained_raw;
|
||||
+ security_context_t requested_raw;
|
||||
+ con = context_new(*sc);
|
||||
+ if (!con) {
|
||||
+ goto out;
|
||||
+ }
|
||||
+ context_range_set(con, lvl);
|
||||
+ if (selinux_trans_to_raw_context(*sc, &obtained_raw) < 0) {
|
||||
+ context_free(con);
|
||||
+ goto out;
|
||||
+ }
|
||||
+ if (selinux_trans_to_raw_context(context_str(con), &requested_raw) < 0) {
|
||||
+ freecon(obtained_raw);
|
||||
+ context_free(con);
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ debug("get_user_context: obtained context '%s' requested context '%s'",
|
||||
+ obtained_raw, requested_raw);
|
||||
+ if (strcmp(obtained_raw, requested_raw)) {
|
||||
+ /* set the context to the real requested one but fail */
|
||||
+ freecon(requested_raw);
|
||||
+ freecon(obtained_raw);
|
||||
+ freecon(*sc);
|
||||
+ *sc = strdup(context_str(con));
|
||||
+ context_free(con);
|
||||
+ return -1;
|
||||
+ }
|
||||
+ freecon(requested_raw);
|
||||
+ freecon(obtained_raw);
|
||||
+ context_free(con);
|
||||
+ }
|
||||
+#endif
|
||||
+ return 0;
|
||||
+ out:
|
||||
+ freecon(*sc);
|
||||
+ *sc = NULL;
|
||||
+ return -1;
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+ssh_selinux_get_role_level(char **role, const char **level)
|
||||
+{
|
||||
+ *role = NULL;
|
||||
+ *level = NULL;
|
||||
+ if (the_authctxt) {
|
||||
+ if (the_authctxt->role != NULL) {
|
||||
+ char *slash;
|
||||
+ *role = xstrdup(the_authctxt->role);
|
||||
+ if ((slash = strchr(*role, '/')) != NULL) {
|
||||
+ *slash = '\0';
|
||||
+ *level = slash + 1;
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+/* Return the default security context for the given username */
|
||||
+static int
|
||||
+sshd_selinux_getctxbyname(char *pwname,
|
||||
+ security_context_t *default_sc, security_context_t *user_sc)
|
||||
+{
|
||||
+ char *sename, *lvl;
|
||||
+ char *role;
|
||||
+ const char *reqlvl;
|
||||
+ int r = 0;
|
||||
+ context_t con = NULL;
|
||||
+
|
||||
+ ssh_selinux_get_role_level(&role, &reqlvl);
|
||||
+
|
||||
+#ifdef HAVE_GETSEUSERBYNAME
|
||||
+ if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
|
||||
+ sename = NULL;
|
||||
+ lvl = NULL;
|
||||
+ }
|
||||
+#else
|
||||
+ sename = pwname;
|
||||
+ lvl = "";
|
||||
+#endif
|
||||
+
|
||||
+ if (r == 0) {
|
||||
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
|
||||
+ r = get_default_context_with_level(sename, lvl, NULL, default_sc);
|
||||
+#else
|
||||
+ r = get_default_context(sename, NULL, default_sc);
|
||||
+#endif
|
||||
+ }
|
||||
+
|
||||
+ if (r == 0) {
|
||||
+ /* If launched from xinetd, we must use current level */
|
||||
+ if (inetd_flag && !rexeced_flag) {
|
||||
+ security_context_t sshdsc=NULL;
|
||||
+
|
||||
+ if (getcon_raw(&sshdsc) < 0)
|
||||
+ fatal("failed to allocate security context");
|
||||
+
|
||||
+ if ((con=context_new(sshdsc)) == NULL)
|
||||
+ fatal("failed to allocate selinux context");
|
||||
+ reqlvl = context_range_get(con);
|
||||
+ freecon(sshdsc);
|
||||
+ if (reqlvl !=NULL && lvl != NULL && strcmp(reqlvl, lvl) == 0)
|
||||
+ /* we actually don't change level */
|
||||
+ reqlvl = "";
|
||||
+
|
||||
+ debug("%s: current connection level '%s'", __func__, reqlvl);
|
||||
+
|
||||
+ }
|
||||
+
|
||||
+ if ((reqlvl != NULL && reqlvl[0]) || (role != NULL && role[0])) {
|
||||
+ r = get_user_context(sename, role, reqlvl, user_sc);
|
||||
+
|
||||
+ if (r == 0 && reqlvl != NULL && reqlvl[0]) {
|
||||
+ security_context_t default_level_sc = *default_sc;
|
||||
+ if (role != NULL && role[0]) {
|
||||
+ if (get_user_context(sename, role, lvl, &default_level_sc) < 0)
|
||||
+ default_level_sc = *default_sc;
|
||||
+ }
|
||||
+ /* verify that the requested range is contained in the user range */
|
||||
+ if (mls_range_allowed(default_level_sc, *user_sc)) {
|
||||
+ logit("permit MLS level %s (user range %s)", reqlvl, lvl);
|
||||
+ } else {
|
||||
+ r = -1;
|
||||
+ error("deny MLS level %s (user range %s)", reqlvl, lvl);
|
||||
+ }
|
||||
+ if (default_level_sc != *default_sc)
|
||||
+ freecon(default_level_sc);
|
||||
+ }
|
||||
+ } else {
|
||||
+ *user_sc = *default_sc;
|
||||
+ }
|
||||
+ }
|
||||
+ if (r != 0) {
|
||||
+ error("%s: Failed to get default SELinux security "
|
||||
+ "context for %s", __func__, pwname);
|
||||
+ }
|
||||
+
|
||||
+#ifdef HAVE_GETSEUSERBYNAME
|
||||
+ free(sename);
|
||||
+ free(lvl);
|
||||
+#endif
|
||||
+
|
||||
+ if (role != NULL)
|
||||
+ free(role);
|
||||
+ if (con)
|
||||
+ context_free(con);
|
||||
+
|
||||
+ return (r);
|
||||
+}
|
||||
+
|
||||
+/* Setup environment variables for pam_selinux */
|
||||
+static int
|
||||
+sshd_selinux_setup_pam_variables(void)
|
||||
+{
|
||||
+ const char *reqlvl;
|
||||
+ char *role;
|
||||
+ char *use_current;
|
||||
+ int rv;
|
||||
+
|
||||
+ debug3("%s: setting execution context", __func__);
|
||||
+
|
||||
+ ssh_selinux_get_role_level(&role, &reqlvl);
|
||||
+
|
||||
+ rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : "");
|
||||
+
|
||||
+ if (inetd_flag && !rexeced_flag) {
|
||||
+ use_current = "1";
|
||||
+ } else {
|
||||
+ use_current = "";
|
||||
+ rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
|
||||
+ }
|
||||
+
|
||||
+ rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current);
|
||||
+
|
||||
+ if (role != NULL)
|
||||
+ free(role);
|
||||
+
|
||||
+ return rv;
|
||||
+}
|
||||
+
|
||||
+/* Set the execution context to the default for the specified user */
|
||||
+void
|
||||
+sshd_selinux_setup_exec_context(char *pwname)
|
||||
+{
|
||||
+ security_context_t user_ctx = NULL;
|
||||
+ int r = 0;
|
||||
+ security_context_t default_ctx = NULL;
|
||||
+
|
||||
+ if (!ssh_selinux_enabled())
|
||||
+ return;
|
||||
+
|
||||
+ if (options.use_pam) {
|
||||
+ /* do not compute context, just setup environment for pam_selinux */
|
||||
+ if (sshd_selinux_setup_pam_variables()) {
|
||||
+ switch (security_getenforce()) {
|
||||
+ case -1:
|
||||
+ fatal("%s: security_getenforce() failed", __func__);
|
||||
+ case 0:
|
||||
+ error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.",
|
||||
+ __func__);
|
||||
+ break;
|
||||
+ default:
|
||||
+ fatal("%s: SELinux PAM variable setup failure. Aborting connection.",
|
||||
+ __func__);
|
||||
+ }
|
||||
+ }
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ debug3("%s: setting execution context", __func__);
|
||||
+
|
||||
+ r = sshd_selinux_getctxbyname(pwname, &default_ctx, &user_ctx);
|
||||
+ if (r >= 0) {
|
||||
+ r = setexeccon(user_ctx);
|
||||
+ if (r < 0) {
|
||||
+ error("%s: Failed to set SELinux execution context %s for %s",
|
||||
+ __func__, user_ctx, pwname);
|
||||
+ }
|
||||
+#ifdef HAVE_SETKEYCREATECON
|
||||
+ else if (setkeycreatecon(user_ctx) < 0) {
|
||||
+ error("%s: Failed to set SELinux keyring creation context %s for %s",
|
||||
+ __func__, user_ctx, pwname);
|
||||
+ }
|
||||
+#endif
|
||||
+ }
|
||||
+ if (user_ctx == NULL) {
|
||||
+ user_ctx = default_ctx;
|
||||
+ }
|
||||
+ if (r < 0 || user_ctx != default_ctx) {
|
||||
+ /* audit just the case when user changed a role or there was
|
||||
+ a failure */
|
||||
+ sshd_selinux_send_audit_message(r >= 0, default_ctx, user_ctx);
|
||||
+ }
|
||||
+ if (r < 0) {
|
||||
+ switch (security_getenforce()) {
|
||||
+ case -1:
|
||||
+ fatal("%s: security_getenforce() failed", __func__);
|
||||
+ case 0:
|
||||
+ error("%s: SELinux failure. Continuing in permissive mode.",
|
||||
+ __func__);
|
||||
+ break;
|
||||
+ default:
|
||||
+ fatal("%s: SELinux failure. Aborting connection.",
|
||||
+ __func__);
|
||||
+ }
|
||||
+ }
|
||||
+ if (user_ctx != NULL && user_ctx != default_ctx)
|
||||
+ freecon(user_ctx);
|
||||
+ if (default_ctx != NULL)
|
||||
+ freecon(default_ctx);
|
||||
+
|
||||
+ debug3("%s: done", __func__);
|
||||
+}
|
||||
+
|
||||
+#endif
|
||||
+#endif
|
||||
+
|
||||
Index: openssh-8.4p1/platform.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/platform.c
|
||||
+++ openssh-8.4p1/platform.c
|
||||
@@ -184,7 +184,7 @@ platform_setusercontext_post_groups(stru
|
||||
}
|
||||
#endif /* HAVE_SETPCRED */
|
||||
#ifdef WITH_SELINUX
|
||||
- ssh_selinux_setup_exec_context(pw->pw_name);
|
||||
+ sshd_selinux_setup_exec_context(pw->pw_name);
|
||||
#endif
|
||||
}
|
||||
|
||||
Index: openssh-8.4p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd.c
|
||||
+++ openssh-8.4p1/sshd.c
|
||||
@@ -2373,6 +2373,9 @@ main(int ac, char **av)
|
||||
restore_uid();
|
||||
}
|
||||
#endif
|
||||
+#ifdef WITH_SELINUX
|
||||
+ sshd_selinux_setup_exec_context(authctxt->pw->pw_name);
|
||||
+#endif
|
||||
#ifdef USE_PAM
|
||||
if (options.use_pam) {
|
||||
do_pam_setcred(1);
|
||||
39
openssh-7.9p1-keygen-preserve-perms.patch
Normal file
39
openssh-7.9p1-keygen-preserve-perms.patch
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
commit 07ffb49749c310b82e44278ae05e081d6f4a82bf
|
||||
Author: Hans Petter Jansson <hpj@cl.no>
|
||||
Date: Fri Sep 27 01:57:16 2019 +0200
|
||||
|
||||
ssh-keygen: Preserve known_hosts permissions on rewrite
|
||||
|
||||
Transfer the permissions of the old known_hosts file instead of
|
||||
just going with what mkstemp() gives us. This is useful in corner
|
||||
cases where known_hosts is shared between users.
|
||||
|
||||
diff --git a/ssh-keygen.c b/ssh-keygen.c
|
||||
index 03a7fe5..ca8a309 100644
|
||||
--- a/ssh-keygen.c
|
||||
+++ b/ssh-keygen.c
|
||||
@@ -1338,6 +1338,11 @@ do_known_hosts(struct passwd *pw, const char *name)
|
||||
if (inplace)
|
||||
unlink(tmp);
|
||||
} else if (inplace) {
|
||||
+ struct stat st;
|
||||
+
|
||||
+ /* Get metadata for existing file */
|
||||
+ r = stat(identity_file, &st);
|
||||
+
|
||||
/* Backup existing file */
|
||||
if (unlink(old) == -1 && errno != ENOENT)
|
||||
fatal("unlink %.100s: %s", old, strerror(errno));
|
||||
@@ -1352,6 +1357,12 @@ do_known_hosts(struct passwd *pw, const char *name)
|
||||
unlink(old);
|
||||
exit(1);
|
||||
}
|
||||
+ /* Preserve permissions; non-critical */
|
||||
+ if (r != -1)
|
||||
+ r = chown(identity_file, st.st_uid, st.st_gid);
|
||||
+ if (r != -1)
|
||||
+ chmod(identity_file,
|
||||
+ st.st_mode & (S_IRWXU | S_IRWXG | S_IRWXO));
|
||||
|
||||
printf("%s updated.\n", identity_file);
|
||||
printf("Original contents retained as %s\n", old);
|
||||
76
openssh-7.9p1-revert-new-qos-defaults.patch
Normal file
76
openssh-7.9p1-revert-new-qos-defaults.patch
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
commit 101aa2f70c937abb428c9433c39ba0fd9a91fe6b
|
||||
Author: Hans Petter Jansson <hpj@cl.no>
|
||||
Date: Thu Jun 20 23:54:11 2019 +0200
|
||||
|
||||
Revert IPQoS DSCP AF21/CS1 from upstream due to bugs in other software
|
||||
|
||||
Reverts OpenBSD-Commit-ID: d11d2a4484f461524ef0c20870523dfcdeb52181
|
||||
|
||||
diff --git a/readconf.c b/readconf.c
|
||||
index 24f2cb1..bbdea0d 100644
|
||||
--- a/readconf.c
|
||||
+++ b/readconf.c
|
||||
@@ -2183,9 +2183,9 @@ fill_default_options(Options * options)
|
||||
if (options->visual_host_key == -1)
|
||||
options->visual_host_key = 0;
|
||||
if (options->ip_qos_interactive == -1)
|
||||
- options->ip_qos_interactive = IPTOS_DSCP_AF21;
|
||||
+ options->ip_qos_interactive = IPTOS_LOWDELAY;
|
||||
if (options->ip_qos_bulk == -1)
|
||||
- options->ip_qos_bulk = IPTOS_DSCP_CS1;
|
||||
+ options->ip_qos_bulk = IPTOS_THROUGHPUT;
|
||||
if (options->request_tty == -1)
|
||||
options->request_tty = REQUEST_TTY_AUTO;
|
||||
if (options->proxy_use_fdpass == -1)
|
||||
diff --git a/servconf.c b/servconf.c
|
||||
index 13cf154..766ac6b 100644
|
||||
--- a/servconf.c
|
||||
+++ b/servconf.c
|
||||
@@ -445,9 +445,9 @@ fill_default_server_options(ServerOptions *options)
|
||||
if (options->permit_tun == -1)
|
||||
options->permit_tun = SSH_TUNMODE_NO;
|
||||
if (options->ip_qos_interactive == -1)
|
||||
- options->ip_qos_interactive = IPTOS_DSCP_AF21;
|
||||
+ options->ip_qos_interactive = IPTOS_LOWDELAY;
|
||||
if (options->ip_qos_bulk == -1)
|
||||
- options->ip_qos_bulk = IPTOS_DSCP_CS1;
|
||||
+ options->ip_qos_bulk = IPTOS_THROUGHPUT;
|
||||
if (options->version_addendum == NULL)
|
||||
options->version_addendum = xstrdup("");
|
||||
if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
|
||||
diff --git a/ssh_config.5 b/ssh_config.5
|
||||
index 3bf0502..10246f8 100644
|
||||
--- a/ssh_config.5
|
||||
+++ b/ssh_config.5
|
||||
@@ -1088,11 +1088,9 @@ If one argument is specified, it is used as the packet class unconditionally.
|
||||
If two values are specified, the first is automatically selected for
|
||||
interactive sessions and the second for non-interactive sessions.
|
||||
The default is
|
||||
-.Cm af21
|
||||
-(Low-Latency Data)
|
||||
+.Cm lowdelay
|
||||
for interactive sessions and
|
||||
-.Cm cs1
|
||||
-(Lower Effort)
|
||||
+.Cm throughput
|
||||
for non-interactive sessions.
|
||||
.It Cm KbdInteractiveAuthentication
|
||||
Specifies whether to use keyboard-interactive authentication.
|
||||
diff --git a/sshd_config.5 b/sshd_config.5
|
||||
index 50a4917..a276fcb 100644
|
||||
--- a/sshd_config.5
|
||||
+++ b/sshd_config.5
|
||||
@@ -868,11 +868,9 @@ If one argument is specified, it is used as the packet class unconditionally.
|
||||
If two values are specified, the first is automatically selected for
|
||||
interactive sessions and the second for non-interactive sessions.
|
||||
The default is
|
||||
-.Cm af21
|
||||
-(Low-Latency Data)
|
||||
+.Cm lowdelay
|
||||
for interactive sessions and
|
||||
-.Cm cs1
|
||||
-(Lower Effort)
|
||||
+.Cm throughput
|
||||
for non-interactive sessions.
|
||||
.It Cm KbdInteractiveAuthentication
|
||||
Specifies whether to allow keyboard-interactive authentication.
|
||||
3922
openssh-8.0p1-gssapi-keyex.patch
Normal file
3922
openssh-8.0p1-gssapi-keyex.patch
Normal file
File diff suppressed because it is too large
Load diff
2349
openssh-8.1p1-audit.patch
Normal file
2349
openssh-8.1p1-audit.patch
Normal file
File diff suppressed because it is too large
Load diff
74
openssh-8.1p1-ed25519-use-openssl-rng.patch
Normal file
74
openssh-8.1p1-ed25519-use-openssl-rng.patch
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
commit d281831d887044ede45d458c3dda74be9ae017e3
|
||||
Author: Hans Petter Jansson <hpj@hpjansson.org>
|
||||
Date: Fri Sep 25 23:26:58 2020 +0200
|
||||
|
||||
Use OpenSSL's FIPS approved RAND_bytes() to get randomness for Ed25519
|
||||
|
||||
diff --git a/ed25519.c b/ed25519.c
|
||||
index 767ec24..5d506a9 100644
|
||||
--- a/ed25519.c
|
||||
+++ b/ed25519.c
|
||||
@@ -9,6 +9,13 @@
|
||||
#include "includes.h"
|
||||
#include "crypto_api.h"
|
||||
|
||||
+#ifdef WITH_OPENSSL
|
||||
+#include <openssl/rand.h>
|
||||
+#include <openssl/err.h>
|
||||
+#endif
|
||||
+
|
||||
+#include "log.h"
|
||||
+
|
||||
#include "ge25519.h"
|
||||
|
||||
static void get_hram(unsigned char *hram, const unsigned char *sm, const unsigned char *pk, unsigned char *playground, unsigned long long smlen)
|
||||
@@ -33,7 +40,15 @@ int crypto_sign_ed25519_keypair(
|
||||
unsigned char extsk[64];
|
||||
int i;
|
||||
|
||||
+#ifdef WITH_OPENSSL
|
||||
+ /* Use FIPS approved RNG */
|
||||
+ if (RAND_bytes(sk, 32) <= 0)
|
||||
+ fatal("Couldn't obtain random bytes (error 0x%lx)",
|
||||
+ (unsigned long)ERR_get_error());
|
||||
+#else
|
||||
randombytes(sk, 32);
|
||||
+#endif
|
||||
+
|
||||
crypto_hash_sha512(extsk, sk, 32);
|
||||
extsk[0] &= 248;
|
||||
extsk[31] &= 127;
|
||||
diff --git a/kexc25519.c b/kexc25519.c
|
||||
index f13d766..2604eda 100644
|
||||
--- a/kexc25519.c
|
||||
+++ b/kexc25519.c
|
||||
@@ -33,6 +33,13 @@
|
||||
#include <string.h>
|
||||
#include <signal.h>
|
||||
|
||||
+#ifdef WITH_OPENSSL
|
||||
+#include <openssl/rand.h>
|
||||
+#include <openssl/err.h>
|
||||
+#endif
|
||||
+
|
||||
+#include "log.h"
|
||||
+
|
||||
#include "sshkey.h"
|
||||
#include "kex.h"
|
||||
#include "sshbuf.h"
|
||||
@@ -51,7 +58,15 @@ kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
|
||||
{
|
||||
static const u_char basepoint[CURVE25519_SIZE] = {9};
|
||||
|
||||
+#ifdef WITH_OPENSSL
|
||||
+ /* Use FIPS approved RNG */
|
||||
+ if (RAND_bytes(key, CURVE25519_SIZE) <= 0)
|
||||
+ fatal("Couldn't obtain random bytes (error 0x%lx)",
|
||||
+ (unsigned long)ERR_get_error());
|
||||
+#else
|
||||
arc4random_buf(key, CURVE25519_SIZE);
|
||||
+#endif
|
||||
+
|
||||
crypto_scalarmult_curve25519(pub, key, basepoint);
|
||||
}
|
||||
|
||||
25
openssh-8.1p1-seccomp-clock_gettime64.patch
Normal file
25
openssh-8.1p1-seccomp-clock_gettime64.patch
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
From b110cefdfbf5a20f49b774a55062d6ded2fb6e22 Mon Sep 17 00:00:00 2001
|
||||
From: Khem Raj <raj.khem@gmail.com>
|
||||
Date: Tue, 7 Jan 2020 16:26:45 -0800
|
||||
Subject: [PATCH] seccomp: Allow clock_gettime64() in sandbox.
|
||||
|
||||
This helps sshd accept connections on mips platforms with
|
||||
upcoming glibc ( 2.31 )
|
||||
---
|
||||
sandbox-seccomp-filter.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
|
||||
index 3ef30c9d5..999c46c9f 100644
|
||||
--- a/sandbox-seccomp-filter.c
|
||||
+++ b/sandbox-seccomp-filter.c
|
||||
@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = {
|
||||
#ifdef __NR_clock_nanosleep_time64
|
||||
SC_ALLOW(__NR_clock_nanosleep_time64),
|
||||
#endif
|
||||
+#ifdef __NR_clock_gettime64
|
||||
+ SC_ALLOW(__NR_clock_gettime64),
|
||||
+#endif
|
||||
#ifdef __NR__newselect
|
||||
SC_ALLOW(__NR__newselect),
|
||||
#endif
|
||||
14
openssh-8.1p1-seccomp-clock_nanosleep.patch
Normal file
14
openssh-8.1p1-seccomp-clock_nanosleep.patch
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
|
||||
index c1e689e..74f69bc 100644
|
||||
--- a/sandbox-seccomp-filter.c
|
||||
+++ b/sandbox-seccomp-filter.c
|
||||
@@ -264,6 +264,9 @@ static const struct sock_filter preauth_insns[] = {
|
||||
#ifdef __NR_clock_gettime64
|
||||
SC_ALLOW(__NR_clock_gettime64),
|
||||
#endif
|
||||
+#ifdef __NR_clock_nanosleep
|
||||
+ SC_ALLOW(__NR_clock_nanosleep),
|
||||
+#endif
|
||||
#ifdef __NR__newselect
|
||||
SC_ALLOW(__NR__newselect),
|
||||
#endif
|
||||
24
openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
Normal file
24
openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
From 5af6fd5461bb709304e6979c8b7856c7af921c9e Mon Sep 17 00:00:00 2001
|
||||
From: Darren Tucker <dtucker@dtucker.net>
|
||||
Date: Mon, 16 Dec 2019 13:55:56 +1100
|
||||
Subject: [PATCH] Allow clock_nanosleep_time64 in seccomp sandbox.
|
||||
|
||||
Needed on Linux ARM. bz#3100, patch from jjelen@redhat.com.
|
||||
---
|
||||
sandbox-seccomp-filter.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
Index: openssh-8.1p1/sandbox-seccomp-filter.c
|
||||
===================================================================
|
||||
--- openssh-8.1p1.orig/sandbox-seccomp-filter.c
|
||||
+++ openssh-8.1p1/sandbox-seccomp-filter.c
|
||||
@@ -251,6 +251,9 @@ static const struct sock_filter preauth_
|
||||
#ifdef __NR_clock_nanosleep
|
||||
SC_ALLOW(__NR_clock_nanosleep),
|
||||
#endif
|
||||
+#ifdef __NR_clock_nanosleep_time64
|
||||
+ SC_ALLOW(__NR_clock_nanosleep_time64),
|
||||
+#endif
|
||||
#ifdef __NR__newselect
|
||||
SC_ALLOW(__NR__newselect),
|
||||
#endif
|
||||
157
openssh-8.1p1-use-openssl-kdf.patch
Normal file
157
openssh-8.1p1-use-openssl-kdf.patch
Normal file
|
|
@ -0,0 +1,157 @@
|
|||
diff --git a/kex.c b/kex.c
|
||||
index 96e44a5..7cd37d6 100644
|
||||
--- a/kex.c
|
||||
+++ b/kex.c
|
||||
@@ -38,6 +38,7 @@
|
||||
#ifdef WITH_OPENSSL
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/dh.h>
|
||||
+#include <openssl/kdf.h>
|
||||
#endif
|
||||
|
||||
#include "ssh.h"
|
||||
@@ -1109,8 +1110,92 @@ kex_choose_conf(struct ssh *ssh)
|
||||
return r;
|
||||
}
|
||||
|
||||
+#ifdef WITH_OPENSSL
|
||||
+
|
||||
+static const EVP_MD *
|
||||
+get_openssl_md_for_hash_alg (int hash_alg)
|
||||
+{
|
||||
+ if (hash_alg < 0 || hash_alg >= SSH_DIGEST_MAX)
|
||||
+ return NULL;
|
||||
+
|
||||
+ switch (hash_alg)
|
||||
+ {
|
||||
+ case SSH_DIGEST_MD5:
|
||||
+ return EVP_md5();
|
||||
+ case SSH_DIGEST_SHA1:
|
||||
+ return EVP_sha1();
|
||||
+ case SSH_DIGEST_SHA256:
|
||||
+ return EVP_sha256();
|
||||
+ case SSH_DIGEST_SHA384:
|
||||
+ return EVP_sha384();
|
||||
+ case SSH_DIGEST_SHA512:
|
||||
+ return EVP_sha512();
|
||||
+ default:
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
+ return NULL;
|
||||
+}
|
||||
+
|
||||
static int
|
||||
-derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
|
||||
+derive_key_via_openssl(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
|
||||
+ const struct sshbuf *shared_secret, u_char **keyp)
|
||||
+{
|
||||
+ struct kex *kex = ssh->kex;
|
||||
+ EVP_KDF_CTX *hashctx = NULL;
|
||||
+ const EVP_MD *md = NULL;
|
||||
+ u_char *digest = NULL;
|
||||
+ int r = SSH_ERR_LIBCRYPTO_ERROR;
|
||||
+
|
||||
+ hashctx = EVP_KDF_CTX_new_id (EVP_KDF_SSHKDF);
|
||||
+ if (!hashctx)
|
||||
+ goto out;
|
||||
+
|
||||
+ md = get_openssl_md_for_hash_alg (kex->hash_alg);
|
||||
+ if (!md)
|
||||
+ goto out;
|
||||
+
|
||||
+ if (EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_MD,
|
||||
+ md) != 1
|
||||
+ || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_KEY,
|
||||
+ sshbuf_ptr(shared_secret), sshbuf_len(shared_secret)) != 1
|
||||
+ || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE,
|
||||
+ (int) id) != 1
|
||||
+ || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
|
||||
+ hash, (size_t) hashlen) != 1
|
||||
+ || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
|
||||
+ kex->session_id, (size_t) kex->session_id_len) != 1)
|
||||
+ goto out;
|
||||
+
|
||||
+ digest = calloc (1, need);
|
||||
+ if (!digest) {
|
||||
+ r = SSH_ERR_ALLOC_FAIL;
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ if (EVP_KDF_derive (hashctx, digest, need) != 1)
|
||||
+ goto out;
|
||||
+
|
||||
+ *keyp = digest;
|
||||
+ digest = NULL;
|
||||
+ r = 0;
|
||||
+
|
||||
+ out:
|
||||
+ if (hashctx)
|
||||
+ EVP_KDF_CTX_free(hashctx);
|
||||
+
|
||||
+ if (digest)
|
||||
+ free(digest);
|
||||
+
|
||||
+ return r;
|
||||
+}
|
||||
+
|
||||
+#else
|
||||
+# error This version of openssh must be built with openssl to benefit from FIPS certification.
|
||||
+#endif
|
||||
+
|
||||
+static int
|
||||
+derive_key_via_internal(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
|
||||
const struct sshbuf *shared_secret, u_char **keyp)
|
||||
{
|
||||
struct kex *kex = ssh->kex;
|
||||
@@ -1174,6 +1259,50 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
|
||||
return r;
|
||||
}
|
||||
|
||||
+/* Belt and suspenders; we want the output from openssl because it's FIPS certified. However,
|
||||
+ * if there's a bug in the implementation, we should not proceed. Minimize risk by requiring
|
||||
+ * the implementations agree. */
|
||||
+static int
|
||||
+derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
|
||||
+ const struct sshbuf *shared_secret, u_char **keyp)
|
||||
+{
|
||||
+#ifdef WITH_OPENSSL
|
||||
+
|
||||
+ u_char *buf_openssl = NULL, *buf_internal = NULL;
|
||||
+ int r;
|
||||
+
|
||||
+ r = derive_key_via_openssl (ssh, id, need, hash, hashlen, shared_secret, &buf_openssl);
|
||||
+ if (r != 0)
|
||||
+ goto out;
|
||||
+
|
||||
+ r = derive_key_via_internal (ssh, id, need, hash, hashlen, shared_secret, &buf_internal);
|
||||
+ if (r != 0)
|
||||
+ goto out;
|
||||
+
|
||||
+ if (memcmp (buf_openssl, buf_internal, need))
|
||||
+ {
|
||||
+ r = SSH_ERR_LIBCRYPTO_ERROR;
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ *keyp = buf_openssl;
|
||||
+ buf_openssl = NULL;
|
||||
+
|
||||
+ out:
|
||||
+ if (buf_openssl)
|
||||
+ free (buf_openssl);
|
||||
+ if (buf_internal)
|
||||
+ free (buf_internal);
|
||||
+
|
||||
+ return r;
|
||||
+
|
||||
+#else
|
||||
+
|
||||
+ return derive_key_via_internal (ssh, id, need, hash, hashlen, shared_secret, keyp);
|
||||
+
|
||||
+#endif
|
||||
+}
|
||||
+
|
||||
#define NKEYS 6
|
||||
int
|
||||
kex_derive_keys(struct ssh *ssh, u_char *hash, u_int hashlen,
|
||||
14
openssh-8.4p1.tar.gz.asc
Normal file
14
openssh-8.4p1.tar.gz.asc
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQHDBAABCgAdFiEEWcIRjtIG2SfmZ+vj0+X1a22SDTAFAl9wQnwACgkQ0+X1a22S
|
||||
DTAR6wyAjRcvW7Jg9v73AR7TUO4WAD085sYi4ZLsECMZqhVZUBVv0Ofmcz2ISg3I
|
||||
NU1nr9Kiqf1/i05OUIR64kJEd4wTSwv+4HhyP5MPJqyCkKcFJ9TyRy6pASZtyH6D
|
||||
hKezJ79iGUg1U46bI6yyxchcAKrz0if97fKd0/1h5yE7T5lcbo+zQPsAg9dDXHBJ
|
||||
nL5mpBQXU3xbU8bC+E+vZ7VAyxEm6kzuY7MRW2wOhpPQ5DJgEjAUjtvzvd9SJhKl
|
||||
u/hgKXqIJBQB1pHlAFI1knfTrGUGrzob8QphukrvmbMJC3dO/o3Dplvx6lZkes0c
|
||||
6hP66rhTRp5Tmw9ae3iUmoDf6SyStlo/4QomCuw0NxHrSOng16VjCR+NRWHvZbXC
|
||||
JckIqparyOJ2jtHz0+e52sRZCZKauFBDMZboNj7f+htwQRUFOVfeSecpJiYut4bM
|
||||
YALdayOQwL96J6aMdoMKfMGZUevCPN6OM96E6cMC1fmanBenZQ/vatmskIvvvO/P
|
||||
rwECYTpGVRezhAvXMEy9x+EVdV6ctA==
|
||||
=PW3D
|
||||
-----END PGP SIGNATURE-----
|
||||
29
openssh-CVE-2021-28041-agent-double-free.patch
Normal file
29
openssh-CVE-2021-28041-agent-double-free.patch
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
OpenBSD 6.8 errata 015, March 4, 2021:
|
||||
|
||||
Double free in ssh-agent(1)
|
||||
|
||||
Apply by doing:
|
||||
signify -Vep /etc/signify/openbsd-68-base.pub -x 015_sshagent.patch.sig \
|
||||
-m - | (cd /usr/src && patch -p0)
|
||||
|
||||
And then rebuild and install ssh (as well as ssh-agent)
|
||||
cd /usr/src/usr.bin/ssh
|
||||
make obj
|
||||
make clean
|
||||
make
|
||||
make install
|
||||
|
||||
Index: ssh-agent.c
|
||||
===================================================================
|
||||
RCS file: /cvs/src/usr.bin/ssh/ssh-agent.c,v
|
||||
diff -u -p -u -r1.264 ssh-agent.c
|
||||
--- a/ssh-agent.c 18 Sep 2020 08:16:38 -0000 1.264
|
||||
+++ b/ssh-agent.c 3 Mar 2021 01:08:25 -0000
|
||||
@@ -567,6 +567,7 @@ process_add_identity(SocketEntry *e)
|
||||
goto err;
|
||||
}
|
||||
free(ext_name);
|
||||
+ ext_name = NULL;
|
||||
break;
|
||||
default:
|
||||
error("%s: Unknown constraint %d", __func__, ctype);
|
||||
30
openssh-CVE-2023-38408-PKCS11-execution.patch
Normal file
30
openssh-CVE-2023-38408-PKCS11-execution.patch
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
From 892506b13654301f69f9545f48213fc210e5c5cc Mon Sep 17 00:00:00 2001
|
||||
From: "djm@openbsd.org" <djm@openbsd.org>
|
||||
Date: Wed, 19 Jul 2023 13:55:53 +0000
|
||||
Subject: [PATCH] upstream: terminate process if requested to load a PKCS#11
|
||||
provider
|
||||
|
||||
that isn't a PKCS#11 provider; from / ok markus@
|
||||
|
||||
OpenBSD-Commit-ID: 39532cf18b115881bb4cfaee32084497aadfa05c
|
||||
---
|
||||
ssh-pkcs11.c | 8 +++-----
|
||||
1 file changed, 3 insertions(+), 5 deletions(-)
|
||||
|
||||
Index: openssh-8.4p1/ssh-pkcs11.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/ssh-pkcs11.c
|
||||
+++ openssh-8.4p1/ssh-pkcs11.c
|
||||
@@ -1519,10 +1519,8 @@ pkcs11_register_provider(char *provider_
|
||||
error("dlopen %s failed: %s", provider_id, dlerror());
|
||||
goto fail;
|
||||
}
|
||||
- if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) {
|
||||
- error("dlsym(C_GetFunctionList) failed: %s", dlerror());
|
||||
- goto fail;
|
||||
- }
|
||||
+ if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL)
|
||||
+ fatal("dlsym(C_GetFunctionList) failed: %s", dlerror());
|
||||
p = xcalloc(1, sizeof(*p));
|
||||
p->name = xstrdup(provider_id);
|
||||
p->handle = handle;
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
From a6414400ec94a17871081f7df24f910a6ee01b8b Mon Sep 17 00:00:00 2001
|
||||
From: Ali Abdallah <aabdallah@suse.de>
|
||||
Date: Wed, 24 Nov 2021 13:33:39 +0100
|
||||
Subject: [PATCH] CVE-2021-41617 fix
|
||||
|
||||
backport of the following two upstream commits
|
||||
|
||||
f3cbe43e28fe71427d41cfe3a17125b972710455
|
||||
bf944e3794eff5413f2df1ef37cddf96918c6bde
|
||||
|
||||
CVE-2021-41617 failed to correctly initialise supplemental groups
|
||||
when executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand,
|
||||
where a AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser
|
||||
directive has been set to run the command as a different user. Instead
|
||||
these commands would inherit the groups that sshd(8) was started with.
|
||||
---
|
||||
auth.c | 8 ++++++++
|
||||
1 file changed, 8 insertions(+)
|
||||
|
||||
diff --git a/auth.c b/auth.c
|
||||
index 163038f..a47b267 100644
|
||||
--- a/auth.c
|
||||
+++ b/auth.c
|
||||
@@ -52,6 +52,7 @@
|
||||
#include <limits.h>
|
||||
#include <netdb.h>
|
||||
#include <time.h>
|
||||
+#include <grp.h>
|
||||
|
||||
#include "xmalloc.h"
|
||||
#include "match.h"
|
||||
@@ -851,6 +852,13 @@ subprocess(const char *tag, struct passwd *pw, const char *command,
|
||||
}
|
||||
closefrom(STDERR_FILENO + 1);
|
||||
|
||||
+ if (geteuid() == 0 &&
|
||||
+ initgroups(pw->pw_name, pw->pw_gid) == -1) {
|
||||
+ error("%s: initgroups(%s, %u): %s", tag,
|
||||
+ pw->pw_name, (u_int)pw->pw_gid, strerror(errno));
|
||||
+ _exit(1);
|
||||
+ }
|
||||
+
|
||||
/* Don't use permanently_set_uid() here to avoid fatal() */
|
||||
if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) {
|
||||
error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid,
|
||||
--
|
||||
2.26.2
|
||||
|
||||
401
openssh-cve-2023-48795.patch
Normal file
401
openssh-cve-2023-48795.patch
Normal file
|
|
@ -0,0 +1,401 @@
|
|||
Index: openssh-8.4p1/PROTOCOL
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/PROTOCOL
|
||||
+++ openssh-8.4p1/PROTOCOL
|
||||
@@ -102,6 +102,25 @@ OpenSSH supports the use of ECDH in Curv
|
||||
described at:
|
||||
http://git.libssh.org/users/aris/libssh.git/plain/doc/curve25519-sha256@libssh.org.txt?h=curve25519
|
||||
|
||||
+1.9 transport: strict key exchange extension
|
||||
+
|
||||
+OpenSSH supports a number of transport-layer hardening measures under
|
||||
+a "strict KEX" feature. This feature is signalled similarly to the
|
||||
+RFC8305 ext-info feature: by including a additional algorithm in the
|
||||
+SSH2_MSG_KEXINIT kex_algorithms field. The client may append
|
||||
+"kex-strict-c-v00@openssh.com" to its kex_algorithms and the server
|
||||
+may append "kex-strict-s-v00@openssh.com".
|
||||
+
|
||||
+When endpoint that supports this extension observes this algorithm
|
||||
+name in a peer's KEXINIT packet, it MUST make the following changes to
|
||||
+the the protocol:
|
||||
+
|
||||
+a) During initial KEX, terminate the connection if any unexpected or
|
||||
+ out-of-sequence packet is received. This includes terminating the
|
||||
+ connection if the first packet received is not SSH2_MSG_KEXINIT.
|
||||
+b) At each SSH2_MSG_NEWKEYS message, reset the packet sequence number
|
||||
+ to zero.
|
||||
+
|
||||
2. Connection protocol changes
|
||||
|
||||
2.1. connection: Channel write close extension "eow@openssh.com"
|
||||
Index: openssh-8.4p1/kex.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/kex.c
|
||||
+++ openssh-8.4p1/kex.c
|
||||
@@ -72,7 +72,7 @@
|
||||
#include "fips.h"
|
||||
|
||||
/* prototype */
|
||||
-static int kex_choose_conf(struct ssh *);
|
||||
+static int kex_choose_conf(struct ssh *, uint32_t seq);
|
||||
static int kex_input_newkeys(int, u_int32_t, struct ssh *);
|
||||
|
||||
static const char *proposal_names[PROPOSAL_MAX] = {
|
||||
@@ -255,6 +255,24 @@ kex_names_valid(const char *names)
|
||||
return 1;
|
||||
}
|
||||
|
||||
+/* returns non-zero if proposal contains any algorithm from algs */
|
||||
+static int
|
||||
+has_any_alg(const char *proposal, const char *algs)
|
||||
+{
|
||||
+ char *cp;
|
||||
+
|
||||
+ if ((cp = match_list(proposal, algs, NULL)) == NULL)
|
||||
+ return 0;
|
||||
+ free(cp);
|
||||
+ return 1;
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+kexalgs_contains (char **peer, const char *ext)
|
||||
+{
|
||||
+ return has_any_alg(peer[PROPOSAL_KEX_ALGS], ext);
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* Concatenate algorithm names, avoiding duplicates in the process.
|
||||
* Caller must free returned string.
|
||||
@@ -262,7 +280,7 @@ kex_names_valid(const char *names)
|
||||
char *
|
||||
kex_names_cat(const char *a, const char *b)
|
||||
{
|
||||
- char *ret = NULL, *tmp = NULL, *cp, *p, *m;
|
||||
+ char *ret = NULL, *tmp = NULL, *cp, *p;
|
||||
size_t len;
|
||||
|
||||
if (a == NULL || *a == '\0')
|
||||
@@ -279,10 +297,8 @@ kex_names_cat(const char *a, const char
|
||||
}
|
||||
strlcpy(ret, a, len);
|
||||
for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) {
|
||||
- if ((m = match_list(ret, p, NULL)) != NULL) {
|
||||
- free(m);
|
||||
+ if (has_any_alg(ret, p))
|
||||
continue; /* Algorithm already present */
|
||||
- }
|
||||
if (strlcat(ret, ",", len) >= len ||
|
||||
strlcat(ret, p, len) >= len) {
|
||||
free(tmp);
|
||||
@@ -514,7 +530,12 @@ kex_protocol_error(int type, u_int32_t s
|
||||
{
|
||||
int r;
|
||||
|
||||
- error("kex protocol error: type %d seq %u", type, seq);
|
||||
+ /* If in strict mode, any unexpected message is an error */
|
||||
+ if ((ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict) {
|
||||
+ ssh_packet_disconnect(ssh, "strict KEX violation: "
|
||||
+ "unexpected packet type %u (seqnr %u)", type, seq);
|
||||
+ }
|
||||
+ error("type %u seq %u", type, seq);
|
||||
if ((r = sshpkt_start(ssh, SSH2_MSG_UNIMPLEMENTED)) != 0 ||
|
||||
(r = sshpkt_put_u32(ssh, seq)) != 0 ||
|
||||
(r = sshpkt_send(ssh)) != 0)
|
||||
@@ -586,6 +607,11 @@ kex_input_ext_info(int type, u_int32_t s
|
||||
ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &kex_protocol_error);
|
||||
if ((r = sshpkt_get_u32(ssh, &ninfo)) != 0)
|
||||
return r;
|
||||
+ if (ninfo >= 1024) {
|
||||
+ error("SSH2_MSG_EXT_INFO with too many entries, expected "
|
||||
+ "<=1024, received %u", ninfo);
|
||||
+ return dispatch_protocol_error(type, seq, ssh);
|
||||
+ }
|
||||
for (i = 0; i < ninfo; i++) {
|
||||
if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0)
|
||||
return r;
|
||||
@@ -686,7 +712,7 @@ kex_input_kexinit(int type, u_int32_t se
|
||||
error("%s: no hex", __func__);
|
||||
return SSH_ERR_INTERNAL_ERROR;
|
||||
}
|
||||
- ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
|
||||
+ ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_protocol_error);
|
||||
ptr = sshpkt_ptr(ssh, &dlen);
|
||||
if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
|
||||
return r;
|
||||
@@ -722,7 +748,7 @@ kex_input_kexinit(int type, u_int32_t se
|
||||
if (!(kex->flags & KEX_INIT_SENT))
|
||||
if ((r = kex_send_kexinit(ssh)) != 0)
|
||||
return r;
|
||||
- if ((r = kex_choose_conf(ssh)) != 0)
|
||||
+ if ((r = kex_choose_conf(ssh, seq)) != 0)
|
||||
return r;
|
||||
|
||||
if (kex->kex_type < KEX_MAX && kex->kex[kex->kex_type] != NULL)
|
||||
@@ -999,7 +1025,7 @@ proposals_match(char *my[PROPOSAL_MAX],
|
||||
}
|
||||
|
||||
static int
|
||||
-kex_choose_conf(struct ssh *ssh)
|
||||
+kex_choose_conf(struct ssh *ssh, uint32_t seq)
|
||||
{
|
||||
struct kex *kex = ssh->kex;
|
||||
struct newkeys *newkeys;
|
||||
@@ -1024,13 +1050,23 @@ kex_choose_conf(struct ssh *ssh)
|
||||
sprop=peer;
|
||||
}
|
||||
|
||||
- /* Check whether client supports ext_info_c */
|
||||
- if (kex->server && (kex->flags & KEX_INITIAL)) {
|
||||
- char *ext;
|
||||
-
|
||||
- ext = match_list("ext-info-c", peer[PROPOSAL_KEX_ALGS], NULL);
|
||||
- kex->ext_info_c = (ext != NULL);
|
||||
- free(ext);
|
||||
+ /* Check whether peer supports ext_info/kex_strict */
|
||||
+ if ((kex->flags & KEX_INITIAL) != 0) {
|
||||
+ if (kex->server) {
|
||||
+ kex->ext_info_c = kexalgs_contains(peer, "ext-info-c");
|
||||
+ kex->kex_strict = kexalgs_contains(peer,
|
||||
+ "kex-strict-c-v00@openssh.com");
|
||||
+ } else {
|
||||
+ kex->kex_strict = kexalgs_contains(peer,
|
||||
+ "kex-strict-s-v00@openssh.com");
|
||||
+ }
|
||||
+ if (kex->kex_strict) {
|
||||
+ debug3("will use strict KEX ordering");
|
||||
+ if (seq != 0)
|
||||
+ ssh_packet_disconnect(ssh,
|
||||
+ "strict KEX violation: "
|
||||
+ "KEXINIT was not the first packet");
|
||||
+ }
|
||||
}
|
||||
|
||||
/* Algorithm Negotiation */
|
||||
Index: openssh-8.4p1/kex.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/kex.h
|
||||
+++ openssh-8.4p1/kex.h
|
||||
@@ -154,6 +154,7 @@ struct kex {
|
||||
u_int kex_type;
|
||||
char *server_sig_algs;
|
||||
int ext_info_c;
|
||||
+ int kex_strict;
|
||||
struct sshbuf *my;
|
||||
struct sshbuf *peer;
|
||||
struct sshbuf *client_version;
|
||||
Index: openssh-8.4p1/packet.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/packet.c
|
||||
+++ openssh-8.4p1/packet.c
|
||||
@@ -1255,6 +1255,11 @@ ssh_packet_send2_wrapped(struct ssh *ssh
|
||||
state->p_send.bytes += len;
|
||||
sshbuf_reset(state->outgoing_packet);
|
||||
|
||||
+ if (type == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
|
||||
+ debug("resetting send seqnr %u", state->p_send.seqnr);
|
||||
+ state->p_send.seqnr = 0;
|
||||
+ }
|
||||
+
|
||||
if (type == SSH2_MSG_NEWKEYS)
|
||||
r = ssh_set_newkeys(ssh, MODE_OUT);
|
||||
else if (type == SSH2_MSG_USERAUTH_SUCCESS && state->server_side)
|
||||
@@ -1388,8 +1393,7 @@ ssh_packet_read_seqnr(struct ssh *ssh, u
|
||||
/* Stay in the loop until we have received a complete packet. */
|
||||
for (;;) {
|
||||
/* Try to read a packet from the buffer. */
|
||||
- r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p);
|
||||
- if (r != 0)
|
||||
+ if ((r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p)) != 0)
|
||||
break;
|
||||
/* If we got a packet, return it. */
|
||||
if (*typep != SSH_MSG_NONE)
|
||||
@@ -1677,6 +1681,7 @@ ssh_packet_read_poll2(struct ssh *ssh, u
|
||||
if ((r = sshbuf_consume(state->input, mac->mac_len)) != 0)
|
||||
goto out;
|
||||
}
|
||||
+
|
||||
if (seqnr_p != NULL)
|
||||
*seqnr_p = state->p_read.seqnr;
|
||||
if (++state->p_read.seqnr == 0)
|
||||
@@ -1746,6 +1751,10 @@ ssh_packet_read_poll2(struct ssh *ssh, u
|
||||
#endif
|
||||
/* reset for next packet */
|
||||
state->packlen = 0;
|
||||
+ if (*typep == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
|
||||
+ debug("resetting read seqnr %u", state->p_read.seqnr);
|
||||
+ state->p_read.seqnr = 0;
|
||||
+ }
|
||||
|
||||
/* do we need to rekey? */
|
||||
if (ssh_packet_need_rekeying(ssh, 0)) {
|
||||
@@ -1770,10 +1779,39 @@ ssh_packet_read_poll_seqnr(struct ssh *s
|
||||
r = ssh_packet_read_poll2(ssh, typep, seqnr_p);
|
||||
if (r != 0)
|
||||
return r;
|
||||
- if (*typep) {
|
||||
- state->keep_alive_timeouts = 0;
|
||||
- DBG(debug("received packet type %d", *typep));
|
||||
+ if (*typep == 0) {
|
||||
+ /* no message ready */
|
||||
+ return 0;
|
||||
+ }
|
||||
+ state->keep_alive_timeouts = 0;
|
||||
+ DBG(debug("received packet type %d", *typep));
|
||||
+
|
||||
+ /* Always process disconnect messages */
|
||||
+ if (*typep == SSH2_MSG_DISCONNECT) {
|
||||
+ if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
|
||||
+ (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
|
||||
+ return r;
|
||||
+ /* Ignore normal client exit notifications */
|
||||
+ do_log2(ssh->state->server_side &&
|
||||
+ reason == SSH2_DISCONNECT_BY_APPLICATION ?
|
||||
+ SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
|
||||
+ "Received disconnect from %s port %d:"
|
||||
+ "%u: %.400s", ssh_remote_ipaddr(ssh),
|
||||
+ ssh_remote_port(ssh), reason, msg);
|
||||
+ free(msg);
|
||||
+ return SSH_ERR_DISCONNECTED;
|
||||
}
|
||||
+
|
||||
+ /*
|
||||
+ * Do not implicitly handle any messages here during initial
|
||||
+ * KEX when in strict mode. They will be need to be allowed
|
||||
+ * explicitly by the KEX dispatch table or they will generate
|
||||
+ * protocol errors.
|
||||
+ */
|
||||
+ if (ssh->kex != NULL &&
|
||||
+ (ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict)
|
||||
+ return 0;
|
||||
+ /* Implicitly handle transport-level messages */
|
||||
switch (*typep) {
|
||||
case SSH2_MSG_IGNORE:
|
||||
debug3("Received SSH2_MSG_IGNORE");
|
||||
@@ -1788,19 +1826,6 @@ ssh_packet_read_poll_seqnr(struct ssh *s
|
||||
debug("Remote: %.900s", msg);
|
||||
free(msg);
|
||||
break;
|
||||
- case SSH2_MSG_DISCONNECT:
|
||||
- if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
|
||||
- (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
|
||||
- return r;
|
||||
- /* Ignore normal client exit notifications */
|
||||
- do_log2(ssh->state->server_side &&
|
||||
- reason == SSH2_DISCONNECT_BY_APPLICATION ?
|
||||
- SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
|
||||
- "Received disconnect from %s port %d:"
|
||||
- "%u: %.400s", ssh_remote_ipaddr(ssh),
|
||||
- ssh_remote_port(ssh), reason, msg);
|
||||
- free(msg);
|
||||
- return SSH_ERR_DISCONNECTED;
|
||||
case SSH2_MSG_UNIMPLEMENTED:
|
||||
if ((r = sshpkt_get_u32(ssh, &seqnr)) != 0)
|
||||
return r;
|
||||
@@ -2346,6 +2371,7 @@ kex_to_blob(struct sshbuf *m, struct kex
|
||||
(r = sshbuf_put_u32(m, kex->hostkey_type)) != 0 ||
|
||||
(r = sshbuf_put_u32(m, kex->hostkey_nid)) != 0 ||
|
||||
(r = sshbuf_put_u32(m, kex->kex_type)) != 0 ||
|
||||
+ (r = sshbuf_put_u32(m, kex->kex_strict)) != 0 ||
|
||||
(r = sshbuf_put_stringb(m, kex->my)) != 0 ||
|
||||
(r = sshbuf_put_stringb(m, kex->peer)) != 0 ||
|
||||
(r = sshbuf_put_stringb(m, kex->client_version)) != 0 ||
|
||||
@@ -2511,6 +2537,7 @@ kex_from_blob(struct sshbuf *m, struct k
|
||||
(r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_type)) != 0 ||
|
||||
(r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_nid)) != 0 ||
|
||||
(r = sshbuf_get_u32(m, &kex->kex_type)) != 0 ||
|
||||
+ (r = sshbuf_get_u32(m, &kex->kex_strict)) != 0 ||
|
||||
(r = sshbuf_get_stringb(m, kex->my)) != 0 ||
|
||||
(r = sshbuf_get_stringb(m, kex->peer)) != 0 ||
|
||||
(r = sshbuf_get_stringb(m, kex->client_version)) != 0 ||
|
||||
@@ -2847,6 +2874,7 @@ sshpkt_disconnect(struct ssh *ssh, const
|
||||
vsnprintf(buf, sizeof(buf), fmt, args);
|
||||
va_end(args);
|
||||
|
||||
+ debug2("sending SSH2_MSG_DISCONNECT: %s", buf);
|
||||
if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
|
||||
(r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_PROTOCOL_ERROR)) != 0 ||
|
||||
(r = sshpkt_put_cstring(ssh, buf)) != 0 ||
|
||||
Index: openssh-8.4p1/sshconnect2.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshconnect2.c
|
||||
+++ openssh-8.4p1/sshconnect2.c
|
||||
@@ -233,8 +233,12 @@ ssh_kex2(struct ssh *ssh, char *host, st
|
||||
fatal("%s: kex_assemble_namelist", __func__);
|
||||
free(all_key);
|
||||
|
||||
- if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
|
||||
- fatal("%s: kex_names_cat", __func__);
|
||||
+ /* Append EXT_INFO signalling to KexAlgorithms */
|
||||
+ if ((s = kex_names_cat(options.kex_algorithms, ssh->kex->server ?
|
||||
+ "kex-strict-s-v00@openssh.com" :
|
||||
+ "ext-info-c,kex-strict-c-v00@openssh.com")) == NULL)
|
||||
+ fatal("kex_names_cat");
|
||||
+
|
||||
myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(s);
|
||||
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
|
||||
compat_cipher_proposal(options.ciphers);
|
||||
@@ -417,7 +421,6 @@ struct cauthmethod {
|
||||
};
|
||||
|
||||
static int input_userauth_service_accept(int, u_int32_t, struct ssh *);
|
||||
-static int input_userauth_ext_info(int, u_int32_t, struct ssh *);
|
||||
static int input_userauth_success(int, u_int32_t, struct ssh *);
|
||||
static int input_userauth_failure(int, u_int32_t, struct ssh *);
|
||||
static int input_userauth_banner(int, u_int32_t, struct ssh *);
|
||||
@@ -540,7 +543,7 @@ ssh_userauth2(struct ssh *ssh, const cha
|
||||
|
||||
ssh->authctxt = &authctxt;
|
||||
ssh_dispatch_init(ssh, &input_userauth_error);
|
||||
- ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &input_userauth_ext_info);
|
||||
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, kex_input_ext_info);
|
||||
ssh_dispatch_set(ssh, SSH2_MSG_SERVICE_ACCEPT, &input_userauth_service_accept);
|
||||
ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &authctxt.success); /* loop until success */
|
||||
pubkey_cleanup(ssh);
|
||||
@@ -585,13 +588,6 @@ input_userauth_service_accept(int type,
|
||||
return r;
|
||||
}
|
||||
|
||||
-/* ARGSUSED */
|
||||
-static int
|
||||
-input_userauth_ext_info(int type, u_int32_t seqnr, struct ssh *ssh)
|
||||
-{
|
||||
- return kex_input_ext_info(type, seqnr, ssh);
|
||||
-}
|
||||
-
|
||||
void
|
||||
userauth(struct ssh *ssh, char *authlist)
|
||||
{
|
||||
@@ -673,6 +669,7 @@ input_userauth_success(int type, u_int32
|
||||
free(authctxt->methoddata);
|
||||
authctxt->methoddata = NULL;
|
||||
authctxt->success = 1; /* break out */
|
||||
+ ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, dispatch_protocol_error);
|
||||
return 0;
|
||||
}
|
||||
|
||||
Index: openssh-8.4p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd.c
|
||||
+++ openssh-8.4p1/sshd.c
|
||||
@@ -2371,9 +2371,19 @@ do_ssh2_kex(struct ssh *ssh)
|
||||
char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
|
||||
struct kex *kex;
|
||||
int r;
|
||||
+ char *s;
|
||||
|
||||
- myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
|
||||
- options.kex_algorithms);
|
||||
+ /* Append EXT_INFO signalling to KexAlgorithms */
|
||||
+ if (options.kex_algorithms == NULL)
|
||||
+ s = strdup("kex-strict-s-v00@openssh.com");
|
||||
+ else
|
||||
+ s = kex_names_cat(options.kex_algorithms,
|
||||
+ "kex-strict-s-v00@openssh.com");
|
||||
+
|
||||
+ if (s == NULL)
|
||||
+ fatal("%s: kex_names_cat", __func__);
|
||||
+
|
||||
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(s);
|
||||
myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal(
|
||||
options.ciphers);
|
||||
myproposal[PROPOSAL_ENC_ALGS_STOC] = compat_cipher_proposal(
|
||||
19
openssh-do-not-send-empty-message.patch
Normal file
19
openssh-do-not-send-empty-message.patch
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
--- openssh-8.4p1.orig/auth-pam.c 2020-09-27 09:25:01.000000000 +0200
|
||||
+++ openssh-8.4p1/auth-pam.c 2022-03-04 13:02:23.447712697 +0100
|
||||
@@ -638,10 +638,12 @@
|
||||
switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
|
||||
case PAM_ERROR_MSG:
|
||||
case PAM_TEXT_INFO:
|
||||
- if ((r = sshbuf_putf(loginmsg, "%s\n",
|
||||
- PAM_MSG_MEMBER(msg, i, msg))) != 0)
|
||||
- fatal("%s: buffer error: %s",
|
||||
- __func__, ssh_err(r));
|
||||
+ if (strlen(PAM_MSG_MEMBER(msg, i, msg)) != 0) {
|
||||
+ if ((r = sshbuf_putf(loginmsg, "%s\n",
|
||||
+ PAM_MSG_MEMBER(msg, i, msg))) != 0)
|
||||
+ fatal("%s: buffer error: %s",
|
||||
+ __func__, ssh_err(r));
|
||||
+ }
|
||||
reply[i].resp_retcode = PAM_SUCCESS;
|
||||
break;
|
||||
default:
|
||||
78
openssh-fips-ensure-approved-moduli.patch
Normal file
78
openssh-fips-ensure-approved-moduli.patch
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
commit 15c95d6eb2e8bc549719578c9a16541015363360
|
||||
Author: Hans Petter Jansson <hpj@hpjansson.org>
|
||||
Date: Mon Oct 26 22:26:46 2020 +0100
|
||||
|
||||
Ensure DHGs are approved in FIPS mode using OpenSSL's DH_check_params()
|
||||
|
||||
diff --git a/dh.c b/dh.c
|
||||
index 7cb135d..3fe7f75 100644
|
||||
--- a/dh.c
|
||||
+++ b/dh.c
|
||||
@@ -143,6 +143,28 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static int
|
||||
+dhg_is_approved(const struct dhgroup *dhg)
|
||||
+{
|
||||
+ BIGNUM *g, *p;
|
||||
+ DH *dh;
|
||||
+ int dh_status;
|
||||
+ int is_ok = 0;
|
||||
+
|
||||
+ /* DH_set0_pqg() transfers ownership of the bignums, so we
|
||||
+ * make temporary copies here for simplicity. */
|
||||
+ g = BN_dup(dhg->g);
|
||||
+ p = BN_dup(dhg->p);
|
||||
+ dh = dh_new_group(g, p);
|
||||
+
|
||||
+ if (dh) {
|
||||
+ is_ok = DH_check_params(dh, &dh_status);
|
||||
+ }
|
||||
+
|
||||
+ DH_free(dh);
|
||||
+ return is_ok;
|
||||
+}
|
||||
+
|
||||
DH *
|
||||
choose_dh(int min, int wantbits, int max)
|
||||
{
|
||||
@@ -161,12 +183,20 @@ choose_dh(int min, int wantbits, int max)
|
||||
linenum = 0;
|
||||
best = bestcount = 0;
|
||||
while (getline(&line, &linesize, f) != -1) {
|
||||
+ int dhg_is_ok;
|
||||
+
|
||||
linenum++;
|
||||
if (!parse_prime(linenum, line, &dhg))
|
||||
continue;
|
||||
+
|
||||
+ dhg_is_ok = dhg_is_approved(&dhg);
|
||||
+
|
||||
BN_clear_free(dhg.g);
|
||||
BN_clear_free(dhg.p);
|
||||
|
||||
+ if (!dhg_is_ok)
|
||||
+ continue;
|
||||
+
|
||||
if (dhg.size > max || dhg.size < min)
|
||||
continue;
|
||||
|
||||
@@ -193,10 +223,16 @@ choose_dh(int min, int wantbits, int max)
|
||||
linenum = 0;
|
||||
bestcount = 0;
|
||||
while (getline(&line, &linesize, f) != -1) {
|
||||
+ int dhg_is_ok;
|
||||
+
|
||||
linenum++;
|
||||
if (!parse_prime(linenum, line, &dhg))
|
||||
continue;
|
||||
- if ((dhg.size > max || dhg.size < min) ||
|
||||
+
|
||||
+ dhg_is_ok = dhg_is_approved(&dhg);
|
||||
+
|
||||
+ if (!dhg_is_ok ||
|
||||
+ (dhg.size > max || dhg.size < min) ||
|
||||
dhg.size != best ||
|
||||
bestcount++ != which) {
|
||||
BN_clear_free(dhg.g);
|
||||
30
openssh-fix-ssh-copy-id.patch
Normal file
30
openssh-fix-ssh-copy-id.patch
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
From 66f16e5425eb881570e82bfef7baeac2e7accc0a Mon Sep 17 00:00:00 2001
|
||||
From: Oleg <Fallmay@users.noreply.github.com>
|
||||
Date: Thu, 1 Oct 2020 12:09:08 +0300
|
||||
Subject: [PATCH] Fix `EOF: command not found` error in ssh-copy-id
|
||||
|
||||
---
|
||||
contrib/ssh-copy-id | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
|
||||
index 392f64f94..a76907717 100644
|
||||
--- a/contrib/ssh-copy-id
|
||||
+++ b/contrib/ssh-copy-id
|
||||
@@ -247,7 +247,7 @@ installkeys_sh() {
|
||||
# the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
|
||||
# the cat adds the keys we're getting via STDIN
|
||||
# and if available restorecon is used to restore the SELinux context
|
||||
- INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
|
||||
+ INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
|
||||
cd;
|
||||
umask 077;
|
||||
mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
|
||||
@@ -258,6 +258,7 @@ installkeys_sh() {
|
||||
restorecon -F .ssh ${AUTH_KEY_FILE};
|
||||
fi
|
||||
EOF
|
||||
+ )
|
||||
|
||||
# to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
|
||||
printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"
|
||||
15
openssh-link-with-sk.patch
Normal file
15
openssh-link-with-sk.patch
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
diff --git a/Makefile.in b/Makefile.in
|
||||
index 6dec09c..25e74ac 100644
|
||||
--- a/Makefile.in
|
||||
+++ b/Makefile.in
|
||||
@@ -251,8 +251,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
|
||||
ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
|
||||
$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
|
||||
|
||||
-sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
|
||||
- $(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
|
||||
+sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o $(SFTPSERVER_OBJS)
|
||||
+ $(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
|
||||
|
||||
sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
|
||||
$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
|
||||
357
openssh-mitigate-lingering-secrets.patch
Normal file
357
openssh-mitigate-lingering-secrets.patch
Normal file
|
|
@ -0,0 +1,357 @@
|
|||
From ebd24c765804ad0b70426f7298d7f6c8daa7038b Mon Sep 17 00:00:00 2001
|
||||
From: Hans Petter Jansson <hpj@hpjansson.org>
|
||||
Date: Mon, 7 Jun 2021 22:12:05 +0200
|
||||
Subject: [PATCH] Add mitigations for secrets potentially lingering in memory
|
||||
|
||||
---
|
||||
kex.c | 8 ++++----
|
||||
mac.c | 4 ++--
|
||||
monitor.c | 8 ++++++--
|
||||
packet.c | 49 +++++++++++++++++++++++++++++++++++++++----------
|
||||
packet.h | 1 +
|
||||
sshbuf.c | 25 +++++++++++++++++++++++++
|
||||
sshbuf.h | 3 +++
|
||||
sshd.c | 25 ++++++++++++++++++++++++-
|
||||
8 files changed, 104 insertions(+), 19 deletions(-)
|
||||
|
||||
Index: openssh-8.4p1/kex.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/kex.c
|
||||
+++ openssh-8.4p1/kex.c
|
||||
@@ -1398,16 +1398,16 @@ enc_destroy(struct sshenc *enc)
|
||||
return;
|
||||
|
||||
if (enc->key) {
|
||||
- memset(enc->key, 0, enc->key_len);
|
||||
+ explicit_bzero(enc->key, enc->key_len);
|
||||
free(enc->key);
|
||||
}
|
||||
|
||||
if (enc->iv) {
|
||||
- memset(enc->iv, 0, enc->iv_len);
|
||||
+ explicit_bzero(enc->iv, enc->iv_len);
|
||||
free(enc->iv);
|
||||
}
|
||||
|
||||
- memset(enc, 0, sizeof(*enc));
|
||||
+ explicit_bzero(enc, sizeof(*enc));
|
||||
}
|
||||
|
||||
void
|
||||
@@ -1418,7 +1418,7 @@ newkeys_destroy(struct newkeys *newkeys)
|
||||
|
||||
enc_destroy(&newkeys->enc);
|
||||
mac_destroy(&newkeys->mac);
|
||||
- memset(&newkeys->comp, 0, sizeof(newkeys->comp));
|
||||
+ explicit_bzero(&newkeys->comp, sizeof(newkeys->comp));
|
||||
}
|
||||
|
||||
/*
|
||||
Index: openssh-8.4p1/mac.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/mac.c
|
||||
+++ openssh-8.4p1/mac.c
|
||||
@@ -284,11 +284,11 @@ mac_destroy(struct sshmac *mac)
|
||||
return;
|
||||
|
||||
if (mac->key) {
|
||||
- memset(mac->key, 0, mac->key_len);
|
||||
+ explicit_bzero(mac->key, mac->key_len);
|
||||
free(mac->key);
|
||||
}
|
||||
|
||||
- memset(mac, 0, sizeof(*mac));
|
||||
+ explicit_bzero(mac, sizeof(*mac));
|
||||
}
|
||||
|
||||
/* XXX copied from ciphers_valid */
|
||||
Index: openssh-8.4p1/monitor.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/monitor.c
|
||||
+++ openssh-8.4p1/monitor.c
|
||||
@@ -1778,8 +1778,12 @@ mm_answer_audit_end_command(struct ssh *
|
||||
void
|
||||
monitor_clear_keystate(struct ssh *ssh, struct monitor *pmonitor)
|
||||
{
|
||||
- ssh_clear_newkeys(ssh, MODE_IN);
|
||||
- ssh_clear_newkeys(ssh, MODE_OUT);
|
||||
+ u_int mode;
|
||||
+
|
||||
+ for (mode = 0; mode < MODE_MAX; mode++) {
|
||||
+ ssh_clear_curkeys(ssh, mode); /* current keys */
|
||||
+ ssh_clear_newkeys(ssh, mode); /* next keys */
|
||||
+ }
|
||||
sshbuf_free(child_state);
|
||||
child_state = NULL;
|
||||
}
|
||||
Index: openssh-8.4p1/packet.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/packet.c
|
||||
+++ openssh-8.4p1/packet.c
|
||||
@@ -667,6 +667,7 @@ ssh_packet_close_internal(struct ssh *ss
|
||||
ssh->local_ipaddr = NULL;
|
||||
free(ssh->remote_ipaddr);
|
||||
ssh->remote_ipaddr = NULL;
|
||||
+ explicit_bzero(ssh->state, sizeof(*ssh->state));
|
||||
free(ssh->state);
|
||||
ssh->state = NULL;
|
||||
kex_free(ssh->kex);
|
||||
@@ -795,8 +796,10 @@ compress_buffer(struct ssh *ssh, struct
|
||||
case Z_OK:
|
||||
/* Append compressed data to output_buffer. */
|
||||
if ((r = sshbuf_put(out, buf, sizeof(buf) -
|
||||
- ssh->state->compression_out_stream.avail_out)) != 0)
|
||||
+ ssh->state->compression_out_stream.avail_out)) != 0) {
|
||||
+ explicit_bzero(buf, sizeof(buf));
|
||||
return r;
|
||||
+ }
|
||||
break;
|
||||
case Z_STREAM_ERROR:
|
||||
default:
|
||||
@@ -831,8 +834,10 @@ uncompress_buffer(struct ssh *ssh, struc
|
||||
switch (status) {
|
||||
case Z_OK:
|
||||
if ((r = sshbuf_put(out, buf, sizeof(buf) -
|
||||
- ssh->state->compression_in_stream.avail_out)) != 0)
|
||||
+ ssh->state->compression_in_stream.avail_out)) != 0) {
|
||||
+ explicit_bzero(buf, sizeof(buf));
|
||||
return r;
|
||||
+ }
|
||||
break;
|
||||
case Z_BUF_ERROR:
|
||||
/*
|
||||
@@ -882,6 +887,17 @@ uncompress_buffer(struct ssh *ssh, struc
|
||||
#endif /* WITH_ZLIB */
|
||||
|
||||
void
|
||||
+ssh_clear_curkeys(struct ssh *ssh, int mode)
|
||||
+{
|
||||
+ struct session_state *state = ssh->state;
|
||||
+
|
||||
+ if (state && state->newkeys[mode]) {
|
||||
+ kex_free_newkeys(state->newkeys[mode]);
|
||||
+ state->newkeys[mode] = NULL;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+void
|
||||
ssh_clear_newkeys(struct ssh *ssh, int mode)
|
||||
{
|
||||
if (ssh->kex && ssh->kex->newkeys[mode]) {
|
||||
@@ -1432,6 +1448,7 @@ ssh_packet_read_seqnr(struct ssh *ssh, u
|
||||
goto out;
|
||||
}
|
||||
out:
|
||||
+ explicit_bzero(buf, sizeof (buf));
|
||||
free(setp);
|
||||
return r;
|
||||
}
|
||||
@@ -2403,9 +2420,12 @@ ssh_packet_get_state(struct ssh *ssh, st
|
||||
(r = sshbuf_put_u32(m, state->p_read.packets)) != 0 ||
|
||||
(r = sshbuf_put_u64(m, state->p_read.bytes)) != 0 ||
|
||||
(r = sshbuf_put_stringb(m, state->input)) != 0 ||
|
||||
- (r = sshbuf_put_stringb(m, state->output)) != 0)
|
||||
+ (r = sshbuf_put_stringb(m, state->output)) != 0) {
|
||||
+ sshbuf_obfuscate(m);
|
||||
return r;
|
||||
+ }
|
||||
|
||||
+ sshbuf_obfuscate(m);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -2524,6 +2544,8 @@ ssh_packet_set_state(struct ssh *ssh, st
|
||||
size_t ilen, olen;
|
||||
int r;
|
||||
|
||||
+ sshbuf_unobfuscate(m);
|
||||
+
|
||||
if ((r = kex_from_blob(m, &ssh->kex)) != 0 ||
|
||||
(r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 ||
|
||||
(r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 ||
|
||||
@@ -2537,7 +2559,7 @@ ssh_packet_set_state(struct ssh *ssh, st
|
||||
(r = sshbuf_get_u64(m, &state->p_read.blocks)) != 0 ||
|
||||
(r = sshbuf_get_u32(m, &state->p_read.packets)) != 0 ||
|
||||
(r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0)
|
||||
- return r;
|
||||
+ goto out;
|
||||
/*
|
||||
* We set the time here so that in post-auth privsep child we
|
||||
* count from the completion of the authentication.
|
||||
@@ -2546,10 +2568,10 @@ ssh_packet_set_state(struct ssh *ssh, st
|
||||
/* XXX ssh_set_newkeys overrides p_read.packets? XXX */
|
||||
if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0 ||
|
||||
(r = ssh_set_newkeys(ssh, MODE_OUT)) != 0)
|
||||
- return r;
|
||||
+ goto out;
|
||||
|
||||
if ((r = ssh_packet_set_postauth(ssh)) != 0)
|
||||
- return r;
|
||||
+ goto out;
|
||||
|
||||
sshbuf_reset(state->input);
|
||||
sshbuf_reset(state->output);
|
||||
@@ -2557,12 +2579,19 @@ ssh_packet_set_state(struct ssh *ssh, st
|
||||
(r = sshbuf_get_string_direct(m, &output, &olen)) != 0 ||
|
||||
(r = sshbuf_put(state->input, input, ilen)) != 0 ||
|
||||
(r = sshbuf_put(state->output, output, olen)) != 0)
|
||||
- return r;
|
||||
+ goto out;
|
||||
|
||||
- if (sshbuf_len(m))
|
||||
- return SSH_ERR_INVALID_FORMAT;
|
||||
+ if (sshbuf_len(m)) {
|
||||
+ r = SSH_ERR_INVALID_FORMAT;
|
||||
+ goto out;
|
||||
+ }
|
||||
debug3("%s: done", __func__);
|
||||
- return 0;
|
||||
+
|
||||
+ r = 0;
|
||||
+out:
|
||||
+ if (r != 0)
|
||||
+ sshbuf_obfuscate(m);
|
||||
+ return r;
|
||||
}
|
||||
|
||||
/* NEW API */
|
||||
Index: openssh-8.4p1/packet.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/packet.h
|
||||
+++ openssh-8.4p1/packet.h
|
||||
@@ -103,6 +103,7 @@ void ssh_packet_close(struct ssh *);
|
||||
void ssh_packet_set_input_hook(struct ssh *, ssh_packet_hook_fn *, void *);
|
||||
void ssh_packet_clear_keys(struct ssh *);
|
||||
void ssh_packet_clear_keys_noaudit(struct ssh *);
|
||||
+void ssh_clear_curkeys(struct ssh *, int);
|
||||
void ssh_clear_newkeys(struct ssh *, int);
|
||||
|
||||
int ssh_packet_is_rekeying(struct ssh *);
|
||||
Index: openssh-8.4p1/sshbuf.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshbuf.c
|
||||
+++ openssh-8.4p1/sshbuf.c
|
||||
@@ -283,6 +283,31 @@ sshbuf_mutable_ptr(const struct sshbuf *
|
||||
return buf->d + buf->off;
|
||||
}
|
||||
|
||||
+/* Trivially obfuscate the buffer. This is used to make sensitive data
|
||||
+ * (e.g. keystate) slightly less obvious if found lingering in kernel
|
||||
+ * memory after being sent from the privsep child to its parent.
|
||||
+ *
|
||||
+ * Longer term we should consider using a one-time pad or a stream cipher
|
||||
+ * here. */
|
||||
+void
|
||||
+sshbuf_obfuscate(struct sshbuf *buf)
|
||||
+{
|
||||
+ size_t i;
|
||||
+
|
||||
+ if (sshbuf_check_sanity(buf) != 0 || buf->readonly || buf->refcount > 1)
|
||||
+ return;
|
||||
+
|
||||
+ for (i = buf->off; i < buf->size; i++) {
|
||||
+ buf->d [i] ^= 0xaa;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+void
|
||||
+sshbuf_unobfuscate(struct sshbuf *buf)
|
||||
+{
|
||||
+ sshbuf_obfuscate(buf);
|
||||
+}
|
||||
+
|
||||
int
|
||||
sshbuf_check_reserve(const struct sshbuf *buf, size_t len)
|
||||
{
|
||||
Index: openssh-8.4p1/sshbuf.h
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshbuf.h
|
||||
+++ openssh-8.4p1/sshbuf.h
|
||||
@@ -309,6 +309,9 @@ int sshbuf_load_file(const char *, struc
|
||||
int sshbuf_write_file(const char *path, struct sshbuf *buf)
|
||||
__attribute__((__nonnull__ (2)));
|
||||
|
||||
+void sshbuf_obfuscate(struct sshbuf *buf);
|
||||
+void sshbuf_unobfuscate(struct sshbuf *buf);
|
||||
+
|
||||
/* Macros for decoding/encoding integers */
|
||||
#define PEEK_U64(p) \
|
||||
(((u_int64_t)(((const u_char *)(p))[0]) << 56) | \
|
||||
Index: openssh-8.4p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-8.4p1.orig/sshd.c
|
||||
+++ openssh-8.4p1/sshd.c
|
||||
@@ -275,6 +275,19 @@ static void do_ssh2_kex(struct ssh *);
|
||||
static char *listener_proctitle;
|
||||
|
||||
/*
|
||||
+ * Clear some stack space. This is a bit naive, but hopefully helps mitigate
|
||||
+ * information leaks due to registers and other data having been stored on
|
||||
+ * the stack. Called after fork() and before exit().
|
||||
+ */
|
||||
+static void
|
||||
+clobber_stack(void)
|
||||
+{
|
||||
+ char data [32768];
|
||||
+
|
||||
+ explicit_bzero(data, 32768);
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
* Close all listening sockets
|
||||
*/
|
||||
static void
|
||||
@@ -443,6 +456,8 @@ destroy_sensitive_data(struct ssh *ssh,
|
||||
sensitive_data.host_certificates[i] = NULL;
|
||||
}
|
||||
}
|
||||
+
|
||||
+ clobber_stack();
|
||||
}
|
||||
|
||||
/* Demote private to public keys for network child */
|
||||
@@ -615,6 +630,8 @@ privsep_preauth(struct ssh *ssh)
|
||||
static void
|
||||
privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
|
||||
{
|
||||
+ clobber_stack();
|
||||
+
|
||||
#ifdef DISABLE_FD_PASSING
|
||||
if (1) {
|
||||
#else
|
||||
@@ -2328,6 +2345,7 @@ main(int ac, char **av)
|
||||
if (use_privsep) {
|
||||
mm_send_keystate(ssh, pmonitor);
|
||||
ssh_packet_clear_keys(ssh);
|
||||
+ clobber_stack();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
@@ -2404,6 +2422,7 @@ main(int ac, char **av)
|
||||
if (use_privsep)
|
||||
mm_terminate();
|
||||
|
||||
+ clobber_stack();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
@@ -2574,8 +2593,10 @@ cleanup_exit(int i)
|
||||
/* cleanup_exit can be called at the very least from the privsep
|
||||
wrappers used for auditing. Make sure we don't recurse
|
||||
indefinitely. */
|
||||
- if (in_cleanup)
|
||||
+ if (in_cleanup) {
|
||||
+ clobber_stack();
|
||||
_exit(i);
|
||||
+ }
|
||||
in_cleanup = 1;
|
||||
if (the_active_state != NULL && the_authctxt != NULL) {
|
||||
do_cleanup(the_active_state, the_authctxt);
|
||||
@@ -2600,5 +2621,7 @@ cleanup_exit(int i)
|
||||
(!use_privsep || mm_is_monitor()))
|
||||
audit_event(the_active_state, SSH_CONNECTION_ABANDON);
|
||||
#endif
|
||||
+
|
||||
+ clobber_stack();
|
||||
_exit(i);
|
||||
}
|
||||
41
openssh-reenable-dh-group14-sha1-default.patch
Normal file
41
openssh-reenable-dh-group14-sha1-default.patch
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
diff --git a/myproposal.h b/myproposal.h
|
||||
index 5312e60..83fd62d 100644
|
||||
--- a/myproposal.h
|
||||
+++ b/myproposal.h
|
||||
@@ -33,7 +33,8 @@
|
||||
"diffie-hellman-group-exchange-sha256," \
|
||||
"diffie-hellman-group16-sha512," \
|
||||
"diffie-hellman-group18-sha512," \
|
||||
- "diffie-hellman-group14-sha256"
|
||||
+ "diffie-hellman-group14-sha256," \
|
||||
+ "diffie-hellman-group14-sha1"
|
||||
|
||||
#define KEX_CLIENT_KEX KEX_SERVER_KEX
|
||||
|
||||
diff --git a/ssh_config.5 b/ssh_config.5
|
||||
index d5888f2..100563e 100644
|
||||
--- a/ssh_config.5
|
||||
+++ b/ssh_config.5
|
||||
@@ -1170,7 +1170,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
|
||||
diffie-hellman-group-exchange-sha256,
|
||||
diffie-hellman-group16-sha512,
|
||||
diffie-hellman-group18-sha512,
|
||||
-diffie-hellman-group14-sha256
|
||||
+diffie-hellman-group14-sha256,
|
||||
+diffie-hellman-group14-sha1
|
||||
.Ed
|
||||
.Pp
|
||||
The list of available key exchange algorithms may also be obtained using
|
||||
diff --git a/sshd_config.5 b/sshd_config.5
|
||||
index 0f5fe53..97364f5 100644
|
||||
--- a/sshd_config.5
|
||||
+++ b/sshd_config.5
|
||||
@@ -986,7 +986,7 @@ curve25519-sha256,curve25519-sha256@libssh.org,
|
||||
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
|
||||
diffie-hellman-group-exchange-sha256,
|
||||
diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
|
||||
-diffie-hellman-group14-sha256
|
||||
+diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
|
||||
.Ed
|
||||
.Pp
|
||||
The list of available key exchange algorithms may also be obtained using
|
||||
3554
openssh.changes
Normal file
3554
openssh.changes
Normal file
File diff suppressed because it is too large
Load diff
211
openssh.keyring
Normal file
211
openssh.keyring
Normal file
|
|
@ -0,0 +1,211 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
Version: GnuPG v2.0.22 (OpenBSD)
|
||||
|
||||
mQGiBDqa5pwRBADJSEyXXsgXiyytN93prDPTPmrueRP9lQQfgaQvCvqK0bN0AF1Z
|
||||
Vxxk9wlSXQp3+Qw5+qqsN5ovzsn39r9pqGslfCqQn9ACTmsn42+VCyW4hdwUGSBS
|
||||
5myh65ZJTK1ufWCZFssxQ0EiALagu4DlH6Z2O7tFDnJNagF55vlnK0uMQwCg/8RU
|
||||
QYDmisEHjkarAapPaupxjhkD/j9riCVasWPYJwAuhiQWAKxGRwp/ZyTaWCSERUBR
|
||||
4Dg9QxpuwHKIT8BeDA3hJa/9Yxu5jec2NVKbtVSZvRkgUfRNOkrcH2eiY8Iz6est
|
||||
J64dGWuGMKQW0GEqW+OXpRTTPJZ0mgPmU16qDzLPdx6F3BAk2LG+TTwlKUPuGqOt
|
||||
6u2EA/4+1CBYZ8mXq9GJnLRBPAoYwSJJzbQnMm9Jat/yg9N6nigSIiFyG8ixh167
|
||||
gGGKfzvpjY7DeJzDI0Cub+tRova8gFg+T15AcPMST5v7v6O/ug9aYWERZ0zjUhRH
|
||||
ybtYLYhUUbdYM29PwGBNfZhGIOYwfFE9UpPS5LeXHs28oVLlH4jcBCARAgCcBQJS
|
||||
ppQ+lR0BVGhpcyBrZXkgaGFzIGJlZW4gc3VwZXJzZWRlZCBieSBrZXkgSUQgNkQ5
|
||||
MjBEMzAKS2V5IGZpbmdlcnByaW50ID0gNTlDMiAxMThFIEQyMDYgRDkyNyBFNjY3
|
||||
ICBFQkUzIEQzRTUgRjU2QiA2RDkyIDBEMzAKUGxlYXNlIHVwZGF0ZSB0byB0aGlz
|
||||
IG5ldyBrZXkuAAoJEM6OywOG/5xIWdMAoJZA/6ls+J6YIpVDFHkb4/8fl0w4AJ90
|
||||
K3I7hssc7QuWHfPlq3EozRtjIbQuRGFtaWVuIE1pbGxlciAoUGVyc29uYWwgS2V5
|
||||
KSA8ZGptQG1pbmRyb3Qub3JnPohXBBMRAgAXBQI6muacBQsHCgMEAxUDAgMWAgEC
|
||||
F4AACgkQzo7LA4b/nEiDMgCZAUzKq241h5GTJxC0guS6ht9i9ZsAoL/oXCmFsofA
|
||||
RehZF6AakIdasvS9iEYEExECAAYFAj77h64ACgkQmD+U6HbiLS3r4ACfclqiFP6E
|
||||
TBkTbjqC328yXlT2rlEAnR6Wv3SNayY4jOgfxCMxi61S2CkAiQGsBBABAgAGBQJS
|
||||
ppEIAAoJENPl9Wttkg0wMMsMf0tC6QkZnCkTiEVSar2Bd0gJWRCZOGgWwYnXVXif
|
||||
5UaQhRgfXyXDxADWi76UYl4v8UFrH9yODXhZM0hoNbt6T98stHmw3dIvrYfhRgQ0
|
||||
83p/N7II3i1iDJDUZ9PA8n4c5BWXirOUXPxtp23WgsEqG5DaN3CGo99YZO8aB3AH
|
||||
hWd8xvGGDOKOMpAPQekgG/CZw3pcdaSOsZvOEOnbk/VuI2DVjTu/hX0PmRKkfeVf
|
||||
aafi6bcDkm8Vs7Sw4TIrNmGJTKIDhwXSrFlDfs/CmZJUxzP/S7W+dZ4kvESDSWia
|
||||
wmxQFMIxRqgHeLiRHYXCL5Fg+WYFv+EMj/ta5PVot86/iWfrj0MRKZFCpRfDjqTv
|
||||
t0G0ziOW9kTFK8TpxBacJR7n4whM6SNf6L9onHn7xqx2r0J8TLcua9hTvapuNPdL
|
||||
y1cxAKMZO8q10AMGkYd03qLlHxtgKXBeWkV/UYAc1zArv4JFdWTraLbIHmi8jpvE
|
||||
NM3qcNWuNVyiTi4Kxum+CFd8V7b4X/6yBLRD/U6/dMUy4Li5Ag0EOprm1BAIAPP9
|
||||
ecJzKV72GbGDKe2vfllAkrH2Dp+0HDXvwlLAzc7sk04anf3wSHhD2uQSnk0fWpV5
|
||||
wb3ncW551P0gBeqvymOnm12oxgJxorL5onRLDXNUPZU5jeHtLJ9TbmlxiIcRrWCt
|
||||
8o9WhabncjBYZVW2q4Xl2KYB7vn4PRpfJUI6/QTP3CAlHofr2Wnj9wPYbI1oZqvB
|
||||
j0cu8cW9c41jaqb8ZXk6PI5Q7jWCZDinJdCH6ChwUUeszQDO94izCA2knTE1Zdfy
|
||||
JcayvdgK+qbsmghT0krENX73pvEMt9N0qmgtgpvrxZ22YDKWyKjn6Jl9a105v9em
|
||||
TZjHkt1p3L3/6febpy8ABREIAKu+hVJt3QxHQVZf5sFnQ2NJw0GjeQ9JIKdDqNEe
|
||||
iSTPnmv4wd7t2rEInema7tpE6XZ+C6DrChv7v6pd8qR79N1PrC4JvgJ0VLq0+A+t
|
||||
9hX6LCrY0H8Fq148aDtnpQAtpQtDSbzcMIRUsk2eN6YR0ii5KF6WKQAA7tAMoyvu
|
||||
8CMfyfTPAynBExee8IzrNiVL2LWQ6bwtUBOTRbKKGlAZJpO6R0+MqUbuwrAy7bSy
|
||||
wr0MZWk+C6VNnusepeXiO5jwtDaPh081o+gpYbwm4FUKzJ/YPoY1b3s98pBKTMV5
|
||||
mxtUHhJFCtVNyGAFJijFFVbd8uT/JzdMLkBuHoamPiLNrBSIRgQYEQIABgUCOprm
|
||||
1AAKCRDOjssDhv+cSB+2AJ0chlQNUBYNFrmyJKLwCiz4iLICAACfTbAY6XVaj9gn
|
||||
5Fj5zoo3nxOYA8SZAaIEN0f88hEEALFoLiocrbjP/CMKikUkAT2h0U8lTI7Ly6+7
|
||||
lCKFtqn9FVQ1cbkl8uCv5ON0P7LMNpw4qVJEu+LzIBs4FEJOASNC5KD0iFaF6Pr+
|
||||
uSgkm6zDWJu5Rhje2ZBYOc1g33VRYjeT/7VIPdVH5giO9c6e/EpbcgTPhSzyYQWB
|
||||
NHb5Bw4zAKDe+OFwg00TAESSyvAx9Tt3k5BPtQP/W68qSvFRV9fid432Zs+5w9kr
|
||||
ffuv65HDPj/Fe2xx7bUlS7MIU2fGzGb+WiY7Msj65xRS5pT3XWkAzQ9X1RXr6xzk
|
||||
20pzI7fJSirIeM/hRQkEwfMLaV27NsR458tTsvJMIgp2ArQ693zmJ6KhZAjME9rp
|
||||
W3Chmdy+pJ3lBkr1joQEAK6oQ2hsLGX5L84qxvb6PzxQcHXijY/7QzhPtUkGrA09
|
||||
C94Hf7X5mSwQnndskO2saaUJUESHDS9uPhh3n02OWPdk+xi1SINnCuSVLTCjJoFo
|
||||
97M8l4uTnECsUHYZgYLFrrciY+kpQB0g64xYVWmyHiSrsrmc8Ycr5ks84wbLoLGs
|
||||
iFEEIBECAAkFAjqaxWgCHQEAEgkQormJ9RG1dI8HZUdQRwABAescAJ9xcRB9sD1R
|
||||
Zc1Sn9PUobsBH7KYmACgpChIU+KlYxkNg+HMILaGdN6UIBC0JURhbWllbiBNaWxs
|
||||
ZXIgPGRtaWxsZXJAaWxvZ2ljLmNvbS5hdT6IXwQTEQIAFwUCOiRbBgULBwoDBAMV
|
||||
AwIDFgIBAheAABIJEKK5ifURtXSPB2VHUEcAAQFOAQCghSGVq6nzI3PMyoZ36E0h
|
||||
ALf6I1MAn3qpCrKTqelKqtbZa9aMmJjeT+WOiEYEEBECAAYFAjgwlv8ACgkQfZ7C
|
||||
dhxDQaxfwwCePG3n5ClFBqIF+LT3yAM27vmrlD8AoKeNYojEanqoFm7Btbo6Q51U
|
||||
Eaf8tB9EYW1pZW4gTWlsbGVyIDxkam1AbWluZHJvdC5vcmc+iF8EExECABcFAjok
|
||||
Wy8FCwcKAwQDFQMCAxYCAQIXgAASCRCiuYn1EbV0jwdlR1BHAAEBv0EAnA/tG5nF
|
||||
eWmEW/CUPUPg3iotn6n8AKCdINUw4zfmaSgGjiPecGlYBo2AIYhGBBARAgAGBQI4
|
||||
MJcIAAoJEH2ewnYcQ0Gs3TMAnAlm/txIYP8Cup6yHmx2JQwcHGCwAKDFyG6E8a3U
|
||||
Ye9Ud/+D3c00fYNr0LQlRGFtaWVuIE1pbGxlciA8ZG1pbGxlckB2aXRuZXQuY29t
|
||||
LnNnPohfBBMRAgAXBQI6JFsvBQsHCgMEAxUDAgMWAgECF4AAEgkQormJ9RG1dI8H
|
||||
ZUdQRwABAfakAJwM6cxduFeyvOD0EykNFeWtRIhpgQCgyINcD1+2UkQxwawGiyqR
|
||||
Iq549TCIRgQQEQIABgUCODCXCAAKCRB9nsJ2HENBrJ32AJsGatu8d4dBFdLftIt4
|
||||
+3QpQ+XjFwCcD+AL8rhrss96hjmMVxv9UboaqLm5AQ0EN0f9AhAEAN+bUno4vM9S
|
||||
VWkAKSrhClYWQJts2mSxYgLrCqkvv0V1ISBUyOw7v3SUzzg5t6S0BJxeHr6N6oKJ
|
||||
Ej+a3+WPviT1H5EujU6J7NvZpwlclj5fPt8iWkz21+9PHvq+WVrjd9HPXZfAa+5h
|
||||
8ya7E0bpk/aklT1JJc7++yTgMQRkxIQHAAMFA/9DHpaZ8q2TVRY2v8Tm6Pzi+K+p
|
||||
sMDtKcitUKhPALhjt+1INFjukDcYBSykfJfvbKHequCgBAcYQNA4layRTZE7s2uh
|
||||
0eYttmOHolTWzwvCKkbheqOCgt83o2YKT6QKaqztJjJqOxl3AaZKQkvL8ydPRL3x
|
||||
MWwCwdCZLhkJ+0iJrIhJBCgRAgAJBQI6msQRAh0BAAoJEKK5ifURtXSPfhsAn0xK
|
||||
sjiC0ruTcw4XFK6qZJz5V1/2AKCP73w6vJEBtEJXW7VrAvjFkB/c7IhUBBgRAgAM
|
||||
BQI3R/0CBQkCx+oAABIJEKK5ifURtXSPB2VHUEcAAQHypgCfRDHTW4PeMEkKx2/K
|
||||
ClQCn4xWbUwAoLrF3lPHbjmk4Em/PV6wBgk290x7uQENBDokXxUUBADnpW+TNB42
|
||||
/O1nD4iMtlALMTsA56Ox+70fVi36Xyoz8JO16GtOask4Rdi/epHl2WQJueMmqcnl
|
||||
4TTxqrhcqmDDsMV/mkMlK9d7h9yk5AGgyjJAuYwAJHGcE5PrRDbAf0rasqmx+fyl
|
||||
TqAn8RBRQDFYE210JxBqalC/lhs+AMuiDwAFFwQAoYYPqxV3LADJ3u0CtvNeqeuC
|
||||
5uOAQeOp+lnWaEk/OKzqtGTXfn2Eqn0XGjyRx4zuJQBB/tXYEI6asZBL3qHSj7Is
|
||||
aC0HR3e+rEkQ3F9eSIVhvjgTQg+JOmNQyy2ITxOW1E6EGJvJD4VUt8rjC7jYbQ57
|
||||
TUFEX0C+wScUDNAPP2+ISQQoEQIACQUCOprEFQIdAQAKCRCiuYn1EbV0j9TvAJwN
|
||||
wnAyXdWVA9iq/OkPQ0ropkjLgACgl++zOn2nSIsuNeSt7yH2nZf57KuITgQYEQIA
|
||||
BgUCOiRfFQASCRCiuYn1EbV0jwdlR1BHAAEB15kAnRGzqB9wxPi/ZHhOTgye4+gr
|
||||
xz0YAKCWZueK/xD8yp7vYE7CNCfu6CIe3pkBogQ6mt1BEQQAj4Snp2k7phJXeS9O
|
||||
nec+MpeAAn/lbFQ/fCJtLJWXyk3KjG92PVc6uAnbjlW+qeDPcl9m48QpNprZoOYr
|
||||
pz7rXhplW2EjXHe8o5vYIqnuhJ8V5MV5gj/wFQNJAdPV2HLI5jBW0RWoV6N8aXRM
|
||||
QI8lOiVcQv+tZF/IeKGMY7VsPwcAoM39qozTxF7IRNJcKaBsHMMZOXJ1BACCylZO
|
||||
hvq3LrLrKG9gIj483EJwmWDc6B6TTkpMCJ1fzKjej29a3inCUOOERcoevn7HXjTN
|
||||
vu4nxfuQ0mQdd/uX4ZrTba8iHjIHx9J2Fbu2JZTxJkpjznREaY4m8V28RI1jPJ+K
|
||||
igXu4mFR1rQfo/Tuh8gAd+ph3KK2CLPTbx5e+gP/ZJfngU+Itv44z0EOFeK62F5e
|
||||
zORFsaYDEslMM6jP2D2WQlyU6s7+hcVFHOy6a3ThCG80DsiaroCqh80AnpIou23M
|
||||
gMLtTa1f82pk4XqzfpdFKiAK41lYdCFWoKV6bRqKFau7J6Hn/Fvys2UEVQta3BEN
|
||||
81d0w9yEGZo8fGYFgqm0LkRhbWllbiBNaWxsZXIgKFBlcnNvbmFsIEtleSkgPGRq
|
||||
bUBtaW5kcm90Lm9yZz6IXwQTEQIAFwUCOprdQQULBwoDBAMVAwIDFgIBAheAABIJ
|
||||
EKgZothpHvjaB2VHUEcAAQFcvQCfUagvlvsWQqJN4HBGTIh8tZW6Mr4AnjEjv5Xe
|
||||
m6y3M+KPPzjDMDZ3tiGXiQGsBBABAgAGBQJSpo20AAoJENPl9Wttkg0wpO8Mf0y4
|
||||
4KTKxWv7YJPv26AEWhZbACf+DoMomOt9eGG08qmratUVcFh05Z9UCZ/M11qR1Ivb
|
||||
HH26MRWKs7yk9YOk1wJINX7uZrogQkzFVQrmsFxA69IlcX7BaAg4yynnDFMasH4/
|
||||
YC95IrZG4xmu2HGZ1HADqCzlsbFzbOUGZipf/hNuoihgAdbMv8DFONCo6zhINdn7
|
||||
yKA3pnhn1YD3XgoZIaQ5Ju7qQd9lL8w22bCju3h8aAWFtbESctOE8pf4cF5zQn6m
|
||||
CeNgbiE65BDkg69+TE2Li8wuZeZdbkF4gmiWcSxojPp4JE++nZFUODnAoKI7g4of
|
||||
Gnk/k5DOx2JAqFY3v+meOcDc7BtZU8RPQCkwc6YtGShr+f1lUkNWp7guem4HXw/Y
|
||||
4zK4bFcFn5iAjfM6zrWC3DiVerFGvoWcvHnRKmUZLfd2/K9BdlwxFWCHfNHXm3BV
|
||||
hMbopdkwzmdJ35IMUQ6vsLcHpuda60XN4Cx9VEfzVrEpgtjL4+40gxngPoCG0RTR
|
||||
OvmtmBtWo38TXTAWfzq5AQ0EOprdQxAEAKfycj/ga8be0+b00yUlDFkozgvmgTWT
|
||||
RRR2xvSlt8fKqBO3f0mCxiKh17HBkNGuoM6HtNQxYg6L7YqTOoPxWqwj40VTDe9k
|
||||
hI7tqb+4ZRq/33Mh4SjmMHMWglRTkHrZZyquM1ayb3NDmQ/57G0Qh9s3t0+cbUkO
|
||||
yJSf6w1H/9ibAAMGA/9odnrEBD0MvDEaRYXAWfGd4lWgGdC0oL6GqfESgUps0vUB
|
||||
2IJP1ODfZFugRUAX5htNmhjCzflh8vKDDDVRGicZEL11O3r3drzyJPZlvCUnqgBm
|
||||
u3ZmUY1ZCjwQ8u/XkqDP2fBm9UxZyifY7vrPqanYtGyT7A7cvsgPvejBTsuXqYhO
|
||||
BBgRAgAGBQI6mt1DABIJEKgZothpHvjaB2VHUEcAAQFQxwCeNB/Ncc9JFUnevzVR
|
||||
ywxHe/vfF7QAn2Zgc5m8W0NXYZyoN4cQAmbysDCrmQGdBFKmggUBDICUNqm4cNh7
|
||||
tdEbwaNhbnwqLiHpILeXT6sddGI0Stz5ofB1uvIHm9kXYG5XUUwlc5ywjIZm2Jeu
|
||||
Kqrd/6wAz5laLagFA6k86EZzzuBE3b5FxSQ4EN4K5XZEJo61xASEF7z1mQCiqoA6
|
||||
/F407ht7nNoiVE95kOmqJlv4cqbpCw3n8f2VW+mVUH6MYRZVrYAC9NnJWv24rem2
|
||||
fjgFhNT1/bx44G7H9bVJqL7hMEGa+xYQBI3YT/ulEu9HYmLFVeiZm1gB1eKXW7jS
|
||||
4ctLl5uPrxayA5DX/qNB2yqgVVlIKFwUm8gGPGPOnsNKo0xBseE7E0F/KeGpaT5a
|
||||
S9yFgPm9A652Jx9felYgb0e9Ipt3lxriPQwgF/cxLGuP/WEbN5fpWFnuV0Viklus
|
||||
uVI2e8GHJGU5bQD5AlzvWu4Sv6oBOcDCabScydY7IxPBk/XBWCF9QDIa2qa32Mc9
|
||||
dYc8EnJszPeVCHX5hG23omDRmdLGLwH7F+CuBvCxAKCymZtJl5DhRmnhdzRg9d+0
|
||||
VG4hLF7O06ANABEBAAG0H0RhbWllbiBNaWxsZXIgPGRqbUBtaW5kcm90Lm9yZz6J
|
||||
Ac0EEwECACcCGwMFCQ1H67ECHgECF4AFAlKmjJwECwkIBwYVCgkICwIFFgIDAQAA
|
||||
CgkQ0+X1a22SDTB2TAx9E1ozPJKUGWJPZefqsSr8KsO6Dp3QuPrw2Zwgo2QfeCT+
|
||||
uzNA5AKCDIAaYEpVbQsvu4sDy8dAW1+HENCxVrMXWG+SH41lcdAdI4io0PGHVQDl
|
||||
42R5jX3e9pfjYCQALVv5BDXddK6054nyxEmudQ3ICFCYXIcqQbA1nfj3Uk06jGhu
|
||||
M99B2/akbxCoFSiUX9uHDZKNYAGpU7/FCF9xCZF4Kd9Twvyy17jDIg7km3/Q4Jy+
|
||||
+VP8FyvE5JjBdLRQSBzSG9GCjv9fyKWW7S0bMY4D3SKKt/Jm1XchEMgpRr4eBpgC
|
||||
s3rxO1hXjzqm3te97uy6/q8CuJUtupJsPKc9Wh4+ogUZifC0ta7UrxZp8yZTRvPS
|
||||
UxYrlvDzM32VDLQ3FX6Y2i4VNo48PSJMA+BPUx7DTcZKIXt457zsLD4jF4sRdwOk
|
||||
/QF/GXCkH2GAyKHWCPXIOe+jIXgiuajcqZm9cAWjL3hidSohKfefvKkzsg75mDmj
|
||||
hvAtDncIbmImJNjXIe2PQU4iY9Vq5i0vlaVKgBgKSohGBBARAgAGBQJSpovfAAoJ
|
||||
EM6OywOG/5xInf8An0A7MPrfJIz2e643VEV4AX3dO9+IAJ9MOsQiB4LnqtTcc9NB
|
||||
MHf9VLE46IkCHAQQAQIABgUCUxbDcAAKCRDl+qzcmIqkoN2cEACjGFvRgkVSsHfH
|
||||
8QSKL6IbA6GDiv6bFKfH/PyCtfmlvRLGHIJ86XfGLjnBGvT1ne/1Pu9P9n8eKsiJ
|
||||
HCf6Hyj/VMwbraIKnVtW+FSEgz9LeXDvfgxOJ0iqHdIUHYyTTN+tdZq+pSIcNg+e
|
||||
gXSM1riZeXgkg58kEHeog7eY98BC5wSbfGJ2AuE8rSRc4PUe4hX5DjSiWVqWZYI/
|
||||
goUrjFTIzKmvZevpmGSsuBVNpmZLOBLy4lmJxkABz41PYfiloKCG01y790XPjWJY
|
||||
FxKxAqWWhgfPaIhCB6h+zWuHvoLcTC9v0YKC4FhLDDyQZ7+gJ7l/HFV9RKhiU+QM
|
||||
5h1ZlpSR6qUl8PIO8iEY7R2fVCiTiGprR4Q33C6SPJUhsG9KrshfzsAXKW8lpBXT
|
||||
oR301fulY7S8B24jwySBFZAn3MiLVvbPZe/FONs6slxbIFDXI670dPTjH9Hl0RFU
|
||||
RoKNDuoJWF0cFAxRv0rQrCmBQ1M9iBHuGvTI8xgkgdG1EeZyhVcaJkjTUFcOkKO6
|
||||
Hhn17chBv/ys4ZAx7FVilOqikkyuX7pkCFCRxiQgokGumtP+gV3aAvyFT2xYDPzB
|
||||
8AI9N9IcmIG+duZdAVQ/fjRGLOGe2V5K3RB0iI9m02g1dlssCGF3G8cKLyZUE/oM
|
||||
XgcTKDCX/c8wGOYlQZ/fOTPOTTV76YhGBBARCAAGBQJS6egeAAoJEMmCgMeP9Ppp
|
||||
APEAnRXb/PSzZAHtVitoKY3VuJsV1QrFAJsH/fhhVcMevcik18HK779vYJQ9VokC
|
||||
HAQQAQIABgUCUxanvwAKCRBLtE+DBgCPha3fD/9DcZIVDDqOz1VigGBANeSUOpr3
|
||||
4VJDSPDApTz9q9KA5t4X/7A3YYuz9aSP1qpXP1wFUC2Q7SWX2Rb1OKtHhd2bPbl9
|
||||
472YzhhkKL1U54qECFdScR064rnBW5FBGjKnWkIhRQJW9PaiG0GgpSq20mtXfKD/
|
||||
hvAOzSCsasMEDA5NCNVCrrNkDeKdHARLhXZ7ZW5MMJ8rHu1q2Uv+ynDRoh3hZPAf
|
||||
w+t1ctiEksjkZngU5AO6/KrOBgAfqqzU7PsbBEEwuw8eDc9hbYBJqVzonxNE8XN5
|
||||
++tWgHzWqPG2LpCG2xe0sNmb38JxF4pIi95uLmBT3C7Bn09yhUiq2uvVa5vw3WVR
|
||||
jgycAC6qNQqT3Vevaqav3uqukik3Sa3OmCnhWTMox0RU+CIVRuyr1AI0JLdEXBte
|
||||
yYpzpSduhTB/Z6LFNkZVSbhElCR/cczIFroBeVI+o0JZuYfz1ijRLV/z4xQhY5Gn
|
||||
H31s0RjhINZqgfAeju1LbQE27eJjVfwTGRRqjR9CauuETNJ90OU2iIVCFv9I7BEt
|
||||
UyqyfelvjJvyYgXerU14wJZOwfpvXiO3xAO8unboJtEKcNfguGiKKUGsmoLj3/4Y
|
||||
nEKka/4ILrSrDvr4SfYnunAdWXXPgTRgq5qT6wC5jGypoMO4vWSNYlhNKYo1/JIg
|
||||
SaGWk2+Eaj0/LSomC4kCHAQQAQIABgUCUxdiyQAKCRDWl98yR/R/Hz0DD/9DEZde
|
||||
4fUDHUkb1E9B8v3FQlMDbOIVoYwOZPnlimXty8To52RBAO0tDotO3MjpSh+6jYPM
|
||||
QONijNzTw7RDPFOgr5HSewXLa9TjjFCHS6uOPOQQ7D3HKFXOSfDEX/uARUKHXfAf
|
||||
I3pE7/635/3l4ntzNdqY4svGa8ngRaHf9wv1SwkMDBuHjM4Guvmp7nOulOs7XhJx
|
||||
tEMkuLnJCYgJXMWKiyt0pulgfxZUfC5kjzwBJfcR+VvIEqwBmUYPcObTlZzjrA1l
|
||||
N8nwcc4vF2ZzEXO/ttlzrs5EJUAw0TP6/C+WjOqxoy00VKW79yVNdYH9PuclAKq1
|
||||
g/irpoMhnXMVp3xB0UGQO41d3hF6aBNpijomd82gNIGUZhu+OfhPjEveuI0znRMt
|
||||
2RCE7kgjrWj44sknm2EqcYbqKnQObCIAv6i34oExA0ImOC5608WadbkBoXG8wShA
|
||||
EnCyuphR4zE50xZvYQoZw/FJo3wRaRzYb710uofmXaYC7htlxL9w7S7PDfxO7odM
|
||||
zd/JbqV+TK/RgtxDq017Xv01hkFZV1OI+tCdhYlJN/Dka8sgzHdy0uW406mhEZKn
|
||||
frsO7rbjO3U1PHKIXDIDPr8Opd3zYPPiN9TKcvTekC0tuqj9G/rmCmaV+VBth/Y/
|
||||
npK2e0XgayweLNlSAxwaHOqkW10yOyOkn/xM/YkCHAQQAQIABgUCUxeYtwAKCRAj
|
||||
zU+6DAF98gGqD/40lpTfvtEprNFoDeuyRw2YV6VProrpmiktlV12pCHgCrvJK2ui
|
||||
iKpk2nZptc0ifN8oa+qt045wmjjC3EghGgnos3jB3lGyz4jNc5XFx946qWcSDydp
|
||||
WU7MkngBAEME99DSI8kpTl+QWv2ZJ0PIoqqpGTNTwcamCHIzfIozmOfS+DUJ07HZ
|
||||
9JuqQHtZtesw97BpY1byXkLr6MmqsZzhEIc352I84hSJE20SodG5No6txo6WCo5t
|
||||
B9Mg869cXBuUd9Q2W/p+bVgyg2FF/j7Q4fMqYM6G0wUNSU5e3tqnrvxKWxXHEarL
|
||||
tUvZCcgt48mM6ZNgX/Jn7Hx+mfhVEfABCluu7wUEBUSFdB+FggWsyNpNf4mzaGi6
|
||||
iiTQ4dI96fPVwHZV3YnvAq/pHdF0CfxMamgT6U4lVhhXhFcaPXAtfMxb/DfGbzpx
|
||||
AcCWe+7moimAIzVBHxPFu0V9G2YJCEuYF3LhUYCw3B6lhIRU2rEjm5jcfK625pGV
|
||||
J8rnLQhbt4mAADr6QWTRF158FOUv/xtfYI3zZS0EgXAp+gOHyaNbMz4QvVQ/bLn9
|
||||
tRZGWGdnRk9VNQmJsOOsLG+mchvIXeenw91ZDBen7NdtzbgpiicHb+HQgLSl3os5
|
||||
tysLqn4iLT6/gmZRe34AUr8UpZRKz930YqOsOrnrv9pzHcav/lakkn4tI4kCHAQQ
|
||||
AQIABgUCUxsaxQAKCRBl65Y28CxXBANcEACxYZ3kj/eOJJteSzKq+ABjmkrcUlr/
|
||||
ha9zXA7/y1zmfaJTBxmSKwFdspeoVtLzzokFyRjNvrdR+UNoG5LT7fxeSw/5UfHM
|
||||
TDgnw21QOZ1M4udpmOyeq79eQJiTc5cTq1LDsRiKdgLgRSPjS3Js1tbwOFTfKGNt
|
||||
s3j2ErAMgDTg6WC8M5i71of5+hpG/Q3K+XeTOnJTyZb8go09xzpJiwjwU7/yOJZt
|
||||
NOKS1vqXqcH5h4tV6Fw1ywoawVNHGlet/inSCmkpGWnxoYXTknjE9rYurKrvvVQZ
|
||||
uoNtO2WlOOsMwE3VXwiZIQD5PBzIv/Od76lz4ZdOlRYtymKy+rbEontF+rzZTH5E
|
||||
NaG3Ydih1bakhYTvtKcIy0OhIuV9DCGJNjPFxVCFdUT5kOEXb32zLiaclywcU2Ni
|
||||
LQe9GR7xJlzk2C2AIQB/lL0jg6HCD9uCP5ncj24k8YKWFWvKTBcO9GgP9cz1n7WQ
|
||||
mFntJffIpnFFtmD5Jy5d28TlfgiOIOVxVv/OKsUtU8ttvLyCuxpp2cdgDMmkgNMP
|
||||
OHfcEJ8SXKzUktTN7mLxyyAhK+B1j/pU4/MBXd5HdFEZwfGG3O87Mv0a6MvyjygK
|
||||
4Wwh2/TvsPirguX9QbuLmXP6NmXJKec3yiO8bVG1vdeDwfYW6Pk15Ewa3vZ2ZEkI
|
||||
zgy+sDyyGp2Bb7kBnQRSpoIFAQyA1OdwfpwXKch+O00W1FsQSMcEjahGmo84WTro
|
||||
M/qjTd7Ysld300PMv3wkQn2WdhyTca/EmkW0fVTGSYs7Z3v5SpPf0prYSjmfu8Wl
|
||||
Xoz64ApdXqGHjj9KAeq2OuUtWrwobgiQEzU4Hxlz94X/65BgG5k7OTyE3J6bgRcM
|
||||
wJCgCkwjK85wbbBkGH+Jo9o/Zw9TPczQcE7BmGYkkLNAXbw7omKBOL4Z6w9sXToz
|
||||
9UnQ0EB9s4TvAbHGKX9y2PEQjZN+wkzR3DavWB7ql8vHZIRmspAsDAJvDT1ofsNt
|
||||
u8MB8wJcxvZaoZ7j9wULYpnaNYx9xxEhgbB9o1mBcYsdDj3xz5jrgtq/cpdgGC6b
|
||||
g+awDc/ylQ1mNglKfY8P9hFIhIANZilnmAlk5GSoWclP/69m+u34KKoHU4Yc3I1p
|
||||
PNcL6Nyi0bh8mHqe9WedKfod7Y4yM1S20fXaS4vrLIlKgxbsDpWiWrk0ltV03uyC
|
||||
7eqDe3nzzGW/2GLTHj5xsA2+HwGtPom5mmzjvV5PFNpS7a90JQARAQABiQG1BBgB
|
||||
AgAPBQJSpoIFAhsMBQkNR+uxAAoJENPl9Wttkg0wEScMf2QjDWm3XawJxNA8pqqx
|
||||
rFeTEo+GESznVRTUeprrUFd1GHw33qaAvqLixZ+x8cr+1Gj/fJd5eiIVJfRLYbXl
|
||||
C8su8JZXngfX0VhuMcUob/FTikfpcoYkRzriUsJEB3/OmjlLjGgnQm5Gz9TV1ity
|
||||
F3bzoHkR8svWEKKKzNoIEPHLU3y7bqSkOrjnY3bZfdVRh618XbjV28NMuoZsV8E4
|
||||
pOuQoy+3s5IjmIf/mkSiFE3VJwdaPem23UsXatFb/eoC/Ahi0iCd/8ioFwi+oHT2
|
||||
Pnt9HrzVF6E8gBVO3vKo6UJgDTr9Qt27Nc6eHL0O5j50ins9ob/3DoOC3P5A08zh
|
||||
l+w466yGEv5+Es/usUAs/4ng4ksI3DTLK9Ygj70l5oBuMFYd3b5KGVfAIlGc5mwI
|
||||
OIG41YLIzZTrGuOuTymjwCdC9cUZJ6R2Cv/Vx0htZ0hqDdyaDO0Io9OG/W2s2T71
|
||||
60tY9ic4MwBCFemzwFELIBIIHNY/n/wsmxQGkI3Oj86JpOVVgR5lXWR+BrGcBjkS
|
||||
Eyg=
|
||||
=3za3
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
516
openssh.spec
Normal file
516
openssh.spec
Normal file
|
|
@ -0,0 +1,516 @@
|
|||
#
|
||||
# spec file for package openssh
|
||||
#
|
||||
# Copyright (c) 2022-2023 ZhuningOS
|
||||
#
|
||||
|
||||
|
||||
%define sandbox_seccomp 0
|
||||
%ifnarch ppc
|
||||
%define sandbox_seccomp 1
|
||||
%endif
|
||||
%if 0%{?suse_version} >= 1500
|
||||
%bcond_without tirpc
|
||||
%else
|
||||
%bcond_with tirpc
|
||||
%endif
|
||||
%define _fwdir %{_sysconfdir}/sysconfig/SuSEfirewall2.d
|
||||
%define _fwdefdir %{_fwdir}/services
|
||||
%define _appdefdir %( grep "configdirspec=" $( which xmkmf ) | sed -r 's,^[^=]+=.*-I(.*)/config.*$,\\1/app-defaults,' )
|
||||
%define CHECKSUM_SUFFIX .hmac
|
||||
%define CHECKSUM_HMAC_KEY "HMAC_KEY:OpenSSH-FIPS@SLE"
|
||||
%define _tmpenableddir %{_localstatedir}/lib/sshd
|
||||
%define _tmpenabledfile %{_tmpenableddir}/is-enabled.rpmtmp
|
||||
|
||||
#Compat macro for new _fillupdir macro introduced in Nov 2017
|
||||
%if ! %{defined _fillupdir}
|
||||
%define _fillupdir %{_localstatedir}/adm/fillup-templates
|
||||
%endif
|
||||
Name: openssh
|
||||
Version: 8.4p1
|
||||
Release: 150300.3.27.1
|
||||
Summary: Secure Shell Client and Server (Remote Login Program)
|
||||
License: BSD-2-Clause AND MIT
|
||||
Group: Productivity/Networking/SSH
|
||||
URL: https://www.openssh.com/
|
||||
Source0: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||
Source1: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
|
||||
Source2: sshd.pamd
|
||||
Source3: README.SUSE
|
||||
Source4: README.kerberos
|
||||
Source5: ssh.reg
|
||||
Source6: ssh-askpass
|
||||
Source7: sshd.fw
|
||||
Source8: sysconfig.ssh
|
||||
Source9: sshd-gen-keys-start
|
||||
Source10: sshd.service
|
||||
Source11: README.FIPS
|
||||
Source12: cavs_driver-ssh.pl
|
||||
Source13: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc#/openssh.keyring
|
||||
Source14: sysusers-sshd.conf
|
||||
Patch0: openssh-7.7p1-allow_root_password_login.patch
|
||||
Patch1: openssh-7.7p1-X11_trusted_forwarding.patch
|
||||
Patch3: openssh-7.7p1-enable_PAM_by_default.patch
|
||||
Patch4: openssh-7.7p1-eal3.patch
|
||||
Patch6: openssh-7.7p1-send_locale.patch
|
||||
Patch7: openssh-7.7p1-hostname_changes_when_forwarding_X.patch
|
||||
Patch8: openssh-7.7p1-remove_xauth_cookies_on_exit.patch
|
||||
Patch9: openssh-7.7p1-pts_names_formatting.patch
|
||||
Patch10: openssh-7.7p1-pam_check_locks.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=2752
|
||||
Patch14: openssh-7.7p1-seccomp_stat.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=2752
|
||||
Patch15: openssh-7.7p1-seccomp_ipc_flock.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=2752
|
||||
# Local FIPS patchset
|
||||
Patch17: openssh-7.7p1-fips.patch
|
||||
# Local cavs patchset
|
||||
Patch18: openssh-7.7p1-cavstest-ctr.patch
|
||||
# Local cavs patchset
|
||||
Patch19: openssh-7.7p1-cavstest-kdf.patch
|
||||
# Local FIPS patchset
|
||||
Patch20: openssh-7.7p1-fips_checks.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=2641
|
||||
Patch22: openssh-7.7p1-systemd-notify.patch
|
||||
Patch23: openssh-8.0p1-gssapi-keyex.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=1402
|
||||
Patch24: openssh-8.1p1-audit.patch
|
||||
# Local patch to disable runtime abi SSL checks, quite pointless for us
|
||||
Patch26: openssh-7.7p1-disable_openssl_abi_check.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=2641
|
||||
Patch27: openssh-7.7p1-no_fork-no_pid_file.patch
|
||||
Patch28: openssh-7.7p1-host_ident.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=1844
|
||||
Patch29: openssh-7.7p1-sftp_force_permissions.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=2143
|
||||
Patch30: openssh-7.7p1-X_forward_with_disabled_ipv6.patch
|
||||
Patch31: openssh-7.7p1-ldap.patch
|
||||
# https://bugzilla.mindrot.org/show_bug.cgi?id=2213
|
||||
Patch32: openssh-7.7p1-IPv6_X_forwarding.patch
|
||||
Patch33: openssh-7.7p1-sftp_print_diagnostic_messages.patch
|
||||
Patch34: openssh-7.9p1-keygen-preserve-perms.patch
|
||||
Patch35: openssh-7.9p1-revert-new-qos-defaults.patch
|
||||
Patch36: openssh-8.1p1-seccomp-clock_nanosleep.patch
|
||||
Patch37: openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
|
||||
Patch38: openssh-8.1p1-seccomp-clock_gettime64.patch
|
||||
Patch39: openssh-8.1p1-use-openssl-kdf.patch
|
||||
Patch40: openssh-8.1p1-ed25519-use-openssl-rng.patch
|
||||
Patch41: openssh-fips-ensure-approved-moduli.patch
|
||||
Patch42: openssh-link-with-sk.patch
|
||||
Patch43: openssh-reenable-dh-group14-sha1-default.patch
|
||||
Patch44: openssh-fix-ssh-copy-id.patch
|
||||
Patch45: openssh-7.6p1-audit_race_condition.patch
|
||||
Patch46: openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
|
||||
Patch47: openssh-CVE-2021-28041-agent-double-free.patch
|
||||
Patch48: openssh-do-not-send-empty-message.patch
|
||||
Patch49: openssh-mitigate-lingering-secrets.patch
|
||||
Patch50: openssh-CVE-2023-38408-PKCS11-execution.patch
|
||||
Patch51: openssh-7.8p1-role-mls.patch
|
||||
Patch52: openssh-6.6p1-privsep-selinux.patch
|
||||
Patch53: openssh-6.6p1-keycat.patch
|
||||
Patch54: openssh-6.6.1p1-selinux-contexts.patch
|
||||
Patch55: openssh-7.6p1-cleanup-selinux.patch
|
||||
Patch56: openssh-cve-2023-48795.patch
|
||||
BuildRequires: audit-devel
|
||||
BuildRequires: automake
|
||||
BuildRequires: groff
|
||||
BuildRequires: libedit-devel
|
||||
BuildRequires: libselinux-devel
|
||||
BuildRequires: openldap2-devel
|
||||
BuildRequires: openssl-devel
|
||||
BuildRequires: pam-devel
|
||||
BuildRequires: pkgconfig
|
||||
BuildRequires: zlib-devel
|
||||
BuildRequires: pkgconfig(libfido2)
|
||||
BuildRequires: pkgconfig(libsystemd)
|
||||
BuildRequires: sysuser-shadow
|
||||
BuildRequires: sysuser-tools
|
||||
Requires: %{name}-clients = %{version}-%{release}
|
||||
Requires: %{name}-server = %{version}-%{release}
|
||||
%if %{with tirpc}
|
||||
BuildRequires: libtirpc-devel
|
||||
%endif
|
||||
%if 0%{?suse_version} >= 1550
|
||||
BuildRequires: pkgconfig(krb5)
|
||||
%else
|
||||
BuildRequires: krb5-mini-devel
|
||||
%endif
|
||||
Requires(pre): findutils
|
||||
Requires(pre): grep
|
||||
|
||||
%description
|
||||
SSH (Secure Shell) is a program for logging into and executing commands
|
||||
on a remote machine. It replaces rsh (rlogin and rsh) and
|
||||
provides secure encrypted communication between two untrusted
|
||||
hosts over an insecure network.
|
||||
|
||||
xorg-x11 (X Window System) connections and arbitrary TCP/IP ports can
|
||||
also be forwarded over the secure channel.
|
||||
|
||||
This is a dummy package that pulls in both the client and server
|
||||
components.
|
||||
|
||||
%package common
|
||||
Summary: SSH (Secure Shell) common files
|
||||
Group: Productivity/Networking/SSH
|
||||
Conflicts: nonfreessh
|
||||
Conflicts: %{name}-fips < %{version}-%{release}
|
||||
Conflicts: %{name}-fips > %{version}-%{release}
|
||||
|
||||
%description common
|
||||
SSH (Secure Shell) is a program for logging into and executing commands
|
||||
on a remote machine. It replaces rsh (rlogin and rsh) and
|
||||
provides secure encrypted communication between two untrusted
|
||||
hosts over an insecure network.
|
||||
|
||||
xorg-x11 (X Window System) connections and arbitrary TCP/IP ports can
|
||||
also be forwarded over the secure channel.
|
||||
|
||||
This package contains common files for the Secure Shell server and
|
||||
clients.
|
||||
|
||||
%package server
|
||||
Summary: SSH (Secure Shell) server
|
||||
Group: Productivity/Networking/SSH
|
||||
Requires: %{name}-common = %{version}-%{release}
|
||||
Recommends: audit
|
||||
Requires(pre): findutils
|
||||
Requires(pre): grep
|
||||
Requires(post): %fillup_prereq
|
||||
Requires(post): permissions
|
||||
Provides: openssh:%{_sbindir}/sshd
|
||||
%sysusers_requires
|
||||
|
||||
%description server
|
||||
SSH (Secure Shell) is a program for logging into and executing commands
|
||||
on a remote machine. It replaces rsh (rlogin and rsh) and
|
||||
provides secure encrypted communication between two untrusted
|
||||
hosts over an insecure network.
|
||||
|
||||
xorg-x11 (X Window System) connections and arbitrary TCP/IP ports can
|
||||
also be forwarded over the secure channel.
|
||||
|
||||
This package contains the Secure Shell daemon, which allows clients to
|
||||
securely connect to your server.
|
||||
|
||||
%package clients
|
||||
Summary: SSH (Secure Shell) client applications
|
||||
Group: Productivity/Networking/SSH
|
||||
Requires: %{name}-common = %{version}-%{release}
|
||||
Provides: openssh:%{_bindir}/ssh
|
||||
|
||||
%description clients
|
||||
SSH (Secure Shell) is a program for logging into and executing commands
|
||||
on a remote machine. It replaces rsh (rlogin and rsh) and
|
||||
provides secure encrypted communication between two untrusted
|
||||
hosts over an insecure network.
|
||||
|
||||
xorg-x11 (X Window System) connections and arbitrary TCP/IP ports can
|
||||
also be forwarded over the secure channel.
|
||||
|
||||
This package contains clients for making secure connections to Secure
|
||||
Shell servers.
|
||||
|
||||
%package helpers
|
||||
Summary: OpenSSH AuthorizedKeysCommand helpers
|
||||
Group: Productivity/Networking/SSH
|
||||
Requires: %{name}-common = %{version}-%{release}
|
||||
|
||||
%description helpers
|
||||
SSH (Secure Shell) is a program for logging into and executing commands
|
||||
on a remote machine. It replaces rsh (rlogin and rsh) and
|
||||
provides secure encrypted communication between two untrusted
|
||||
hosts over an insecure network.
|
||||
|
||||
xorg-x11 (X Window System) connections and arbitrary TCP/IP ports can
|
||||
also be forwarded over the secure channel.
|
||||
|
||||
This package contains helper applications for OpenSSH which retrieve
|
||||
keys from various sources.
|
||||
|
||||
%package fips
|
||||
Summary: OpenSSH FIPS crypto module HMACs
|
||||
Group: Productivity/Networking/SSH
|
||||
Requires: %{name}-common = %{version}-%{release}
|
||||
Conflicts: %{name}-common < %{version}-%{release}
|
||||
Conflicts: %{name}-common > %{version}-%{release}
|
||||
Obsoletes: %{name}-hmac
|
||||
|
||||
%description fips
|
||||
This package contains hashes that, together with the main openssh packages,
|
||||
form the FIPS certifiable crypto module.
|
||||
|
||||
%package cavs
|
||||
Summary: OpenSSH FIPS crypto module CAVS tests
|
||||
Group: Productivity/Networking/SSH
|
||||
Requires: %{name}-common = %{version}-%{release}
|
||||
|
||||
%description cavs
|
||||
This package contains the FIPS-140 CAVS (Cryptographic Algorithm
|
||||
Validation Program/Suite) related tests of OpenSSH.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
cp %{SOURCE3} %{SOURCE4} %{SOURCE11} .
|
||||
|
||||
%autopatch -p1
|
||||
|
||||
# set libexec dir in the LDAP patch
|
||||
sed -i.libexec 's,@LIBEXECDIR@,%{_libexecdir}/ssh,' \
|
||||
$( grep -Rl @LIBEXECDIR@ \
|
||||
$( grep "^+++" openssh-7.7p1-ldap.patch | sed -r 's@^.+/([^/\t ]+).*$@\1@' )
|
||||
)
|
||||
|
||||
%build
|
||||
autoreconf -fiv
|
||||
%ifarch s390 s390x %{sparc}
|
||||
PIEFLAGS="-fPIE"
|
||||
%else
|
||||
PIEFLAGS="-fpie"
|
||||
%endif
|
||||
CFLAGS="%{optflags} $PIEFLAGS -fstack-protector"
|
||||
CXXFLAGS="%{optflags} $PIEFLAGS -fstack-protector"
|
||||
LDFLAGS="-pie -Wl,--as-needed"
|
||||
#CPPFLAGS="%%{optflags} -DUSE_INTERNAL_B64"
|
||||
export LDFLAGS CFLAGS CXXFLAGS CPPFLAGS
|
||||
%configure \
|
||||
--sysconfdir=%{_sysconfdir}/ssh \
|
||||
--libexecdir=%{_libexecdir}/ssh \
|
||||
--with-selinux \
|
||||
--with-pid-dir=/run \
|
||||
--with-systemd \
|
||||
--with-ssl-engine \
|
||||
--with-pam \
|
||||
--with-kerberos5=%{_prefix} \
|
||||
--with-privsep-path=%{_localstatedir}/lib/empty \
|
||||
%if %{sandbox_seccomp}
|
||||
--with-sandbox=seccomp_filter \
|
||||
%else
|
||||
--with-sandbox=rlimit \
|
||||
%endif
|
||||
--disable-strip \
|
||||
--with-audit=linux \
|
||||
--with-ldap \
|
||||
--with-xauth=%{_bindir}/xauth \
|
||||
--with-libedit \
|
||||
--with-security-key-builtin \
|
||||
--target=%{_target_cpu}-suse-linux
|
||||
|
||||
%make_build
|
||||
%sysusers_generate_pre %{SOURCE14} sshd
|
||||
|
||||
%install
|
||||
%make_install
|
||||
%if %{defined _distconfdir}
|
||||
install -d -m 755 %{buildroot}%{_distconfdir}/pam.d
|
||||
install -m 644 %{SOURCE2} %{buildroot}%{_distconfdir}/pam.d/sshd
|
||||
%else
|
||||
install -d -m 755 %{buildroot}%{_sysconfdir}/pam.d
|
||||
install -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/pam.d/sshd
|
||||
%endif
|
||||
install -d -m 755 %{buildroot}%{_localstatedir}/lib/sshd
|
||||
install -d -m 755 %{buildroot}%{_sysconfdir}/slp.reg.d/
|
||||
install -m 644 %{SOURCE5} %{buildroot}%{_sysconfdir}/slp.reg.d/
|
||||
install -D -m 0644 %{SOURCE10} %{buildroot}%{_unitdir}/sshd.service
|
||||
ln -s service %{buildroot}%{_sbindir}/rcsshd
|
||||
install -d -m 755 %{buildroot}%{_fillupdir}
|
||||
install -m 644 %{SOURCE8} %{buildroot}%{_fillupdir}
|
||||
# install shell script to automate the process of adding your public key to a remote machine
|
||||
install -m 755 contrib/ssh-copy-id %{buildroot}%{_bindir}
|
||||
install -m 644 contrib/ssh-copy-id.1 %{buildroot}%{_mandir}/man1
|
||||
sed -i -e s@%{_prefix}/libexec@%{_libexecdir}@g %{buildroot}%{_sysconfdir}/ssh/sshd_config
|
||||
|
||||
%if 0%{?suse_version} < 1550
|
||||
# install firewall definitions
|
||||
mkdir -p %{buildroot}%{_fwdefdir}
|
||||
install -m 644 %{SOURCE7} %{buildroot}%{_fwdefdir}/sshd
|
||||
%endif
|
||||
|
||||
# askpass wrapper
|
||||
sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" < %{SOURCE6} > %{buildroot}%{_libexecdir}/ssh/ssh-askpass
|
||||
sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" < %{SOURCE12} > %{buildroot}%{_libexecdir}/ssh/cavs_driver-ssh.pl
|
||||
rm -f %{buildroot}%{_datadir}/Ssh.bin
|
||||
# sshd keys generator wrapper
|
||||
install -D -m 0755 %{SOURCE9} %{buildroot}%{_sbindir}/sshd-gen-keys-start
|
||||
|
||||
# Install sysusers.d config for sshd user
|
||||
mkdir -p %{buildroot}%{_sysusersdir}
|
||||
install -m 644 %{SOURCE14} %{buildroot}%{_sysusersdir}/sshd.conf
|
||||
|
||||
rm %{buildroot}/usr/lib/ssh/ssh-keycat
|
||||
|
||||
# the hmac hashes - taken from openssl
|
||||
#
|
||||
# re-define the __os_install_post macro: the macro strips
|
||||
# the binaries and thereby invalidates any hashes created earlier.
|
||||
#
|
||||
# this shows up earlier because otherwise the %%expand of
|
||||
# the macro is too late.
|
||||
%{expand:%%global __os_install_post {%__os_install_post
|
||||
for b in \
|
||||
%{_bindir}/ssh \
|
||||
%{_sbindir}/sshd \
|
||||
%{_libexecdir}/ssh/sftp-server \
|
||||
; do
|
||||
openssl dgst -sha256 -binary -hmac %{CHECKSUM_HMAC_KEY} < %{buildroot}$b > %{buildroot}$b%{CHECKSUM_SUFFIX}
|
||||
done
|
||||
|
||||
}}
|
||||
|
||||
%pre
|
||||
# Remember whether the sshd service was enabled prior to an upgrade. This
|
||||
# is needed when upgrading to a split-off openssh-server package. The
|
||||
# %%service_add_post scriptlet (in %%post server) will see it as a new service
|
||||
# and apply the preset, disabling it. We need to reenable it afterwards if
|
||||
# necessary.
|
||||
mkdir -p %{_tmpenableddir} || :
|
||||
if [ -x %{_bindir}/systemctl ]; then
|
||||
%{_bindir}/systemctl is-enabled sshd > %{_tmpenabledfile} || :
|
||||
else
|
||||
if find %{_sysconfdir}/init.d/rc[35].d -type l -regex '.*/S[0-9]+sshd' \
|
||||
-exec readlink -f {} \; | grep '/etc/init.d/sshd$' >/dev/null 2>&1
|
||||
then echo "enabled" > %{_tmpenabledfile} || :; fi
|
||||
fi
|
||||
|
||||
%pre server -f sshd.pre
|
||||
%if %{defined _distconfdir}
|
||||
# move outdated pam.d/*.rpmsave file away
|
||||
test -f /etc/pam.d/sshd.rpmsave && mv -v /etc/pam.d/sshd.rpmsave /etc/pam.d/sshd.rpmsave.old ||:
|
||||
%endif
|
||||
|
||||
# See %%pre.
|
||||
mkdir -p %{_tmpenableddir} || :
|
||||
if [ -x %{_bindir}/systemctl ]; then
|
||||
%{_bindir}/systemctl is-enabled sshd > %{_tmpenabledfile} || :
|
||||
else
|
||||
if find %{_sysconfdir}/init.d/rc[35].d -type l -regex '.*/S[0-9]+sshd' \
|
||||
-exec readlink -f {} \; | grep '/etc/init.d/sshd$' >/dev/null 2>&1
|
||||
then echo "enabled" > %{_tmpenabledfile} || :; fi
|
||||
fi
|
||||
|
||||
%service_add_pre sshd.service
|
||||
|
||||
%post server
|
||||
%{fillup_only -n ssh}
|
||||
%service_add_post sshd.service
|
||||
%set_permissions %{_sysconfdir}/ssh/sshd_config
|
||||
|
||||
# Work around %%service_add_post disabling the service on upgrades where
|
||||
# the package name changed.
|
||||
if [ -x %{_bindir}/systemctl ] && [ -f %{_tmpenabledfile} ] \
|
||||
&& [ x$(cat %{_tmpenabledfile} || :) == "xenabled" ]; then
|
||||
systemctl enable sshd || :
|
||||
fi
|
||||
|
||||
rm -f %{_tmpenabledfile}
|
||||
|
||||
%preun server
|
||||
%service_del_preun sshd.service
|
||||
|
||||
%postun server
|
||||
# The openssh-fips trigger script for openssh will normally restart sshd once
|
||||
# it gets installed, so only restart the service here if openssh-fips is not
|
||||
# present.
|
||||
if rpm -q openssh-fips >/dev/null 2>/dev/null; then
|
||||
%service_del_postun_without_restart sshd.service
|
||||
else
|
||||
%service_del_postun sshd.service
|
||||
fi
|
||||
|
||||
%if %{defined _distconfdir}
|
||||
%posttrans server
|
||||
# Migration to /usr/etc.
|
||||
test -f /etc/pam.d/sshd.rpmsave && mv -v /etc/pam.d/sshd.rpmsave /etc/pam.d/sshd ||:
|
||||
%endif
|
||||
|
||||
|
||||
%triggerin -n openssh-fips -- %{name} = %{version}-%{release}
|
||||
%restart_on_update sshd
|
||||
|
||||
%verifyscript server
|
||||
%verify_permissions -e %{_sysconfdir}/ssh/sshd_config
|
||||
|
||||
%files
|
||||
# openssh is an empty package that depends on -clients and -server,
|
||||
# resulting in a clean upgrade path from prior to the split even when
|
||||
# recommends are disabled.
|
||||
|
||||
%files common
|
||||
%license LICENCE
|
||||
%doc README.SUSE README.kerberos README.FIPS ChangeLog OVERVIEW README TODO CREDITS
|
||||
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
|
||||
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
|
||||
%attr(0444,root,root) %{_mandir}/man1/ssh-keygen.1*
|
||||
%attr(0444,root,root) %{_mandir}/man5/moduli.5*
|
||||
%attr(0755,root,root) %{_bindir}/ssh-keygen*
|
||||
|
||||
%files server
|
||||
%attr(0755,root,root) %{_sbindir}/sshd
|
||||
%attr(0755,root,root) %{_sbindir}/rcsshd
|
||||
%attr(0755,root,root) %{_sbindir}/sshd-gen-keys-start
|
||||
%dir %attr(755,root,root) %{_localstatedir}/lib/sshd
|
||||
%verify(not mode) %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
|
||||
%if %{defined _distconfdir}
|
||||
%attr(0644,root,root) %{_distconfdir}/pam.d/sshd
|
||||
%else
|
||||
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/sshd
|
||||
%endif
|
||||
%attr(0644,root,root) %{_unitdir}/sshd.service
|
||||
%attr(0644,root,root) %{_sysusersdir}/sshd.conf
|
||||
%attr(0444,root,root) %{_mandir}/man5/sshd_config*
|
||||
%attr(0444,root,root) %{_mandir}/man8/sftp-server.8*
|
||||
%attr(0444,root,root) %{_mandir}/man8/sshd.8*
|
||||
%attr(0755,root,root) %{_libexecdir}/ssh/sftp-server
|
||||
%dir %{_sysconfdir}/slp.reg.d
|
||||
%config %{_sysconfdir}/slp.reg.d/ssh.reg
|
||||
%{_fillupdir}/sysconfig.ssh
|
||||
%if 0%{?suse_version} < 1550
|
||||
%dir %{_fwdir}
|
||||
%dir %{_fwdefdir}
|
||||
%config %{_fwdefdir}/sshd
|
||||
%endif
|
||||
|
||||
%files clients
|
||||
%verify(not mode) %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
|
||||
%attr(0755,root,root) %{_bindir}/ssh
|
||||
%attr(0755,root,root) %{_bindir}/scp*
|
||||
%attr(0755,root,root) %{_bindir}/sftp*
|
||||
%attr(0755,root,root) %{_bindir}/ssh-add*
|
||||
%attr(0755,root,root) %{_bindir}/ssh-agent*
|
||||
%attr(0755,root,root) %{_bindir}/ssh-copy-id*
|
||||
%attr(0755,root,root) %{_bindir}/ssh-keyscan*
|
||||
%attr(0755,root,root) %dir %{_libexecdir}/ssh
|
||||
%attr(0755,root,root) %{_libexecdir}/ssh/ssh-askpass*
|
||||
%attr(0755,root,root) %{_libexecdir}/ssh/ssh-keysign*
|
||||
%attr(0755,root,root) %{_libexecdir}/ssh/ssh-pkcs11-helper*
|
||||
%attr(0755,root,root) %{_libexecdir}/ssh/ssh-sk-helper*
|
||||
%attr(0444,root,root) %{_mandir}/man1/scp.1*
|
||||
%attr(0444,root,root) %{_mandir}/man1/sftp.1*
|
||||
%attr(0444,root,root) %{_mandir}/man1/ssh-add.1*
|
||||
%attr(0444,root,root) %{_mandir}/man1/ssh-agent.1*
|
||||
%attr(0444,root,root) %{_mandir}/man1/ssh-keyscan.1*
|
||||
%attr(0444,root,root) %{_mandir}/man1/ssh.1*
|
||||
%attr(0444,root,root) %{_mandir}/man1/ssh-copy-id.1*
|
||||
%attr(0444,root,root) %{_mandir}/man5/ssh_config.5*
|
||||
%attr(0444,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
|
||||
%attr(0444,root,root) %{_mandir}/man8/ssh-sk-helper.8*
|
||||
%attr(0444,root,root) %{_mandir}/man8/ssh-keysign.8*
|
||||
|
||||
%files helpers
|
||||
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
|
||||
%verify(not mode) %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ldap.conf
|
||||
%attr(0755,root,root) %dir %{_libexecdir}/ssh
|
||||
%attr(0755,root,root) %{_libexecdir}/ssh/ssh-ldap*
|
||||
%attr(0444,root,root) %{_mandir}/man5/ssh-ldap*
|
||||
%attr(0444,root,root) %{_mandir}/man8/ssh-ldap*
|
||||
%doc HOWTO.ldap-keys openssh-lpk-openldap.schema openssh-lpk-sun.schema
|
||||
|
||||
%files fips
|
||||
%attr(0444,root,root) %{_bindir}/ssh%{CHECKSUM_SUFFIX}
|
||||
%attr(0444,root,root) %{_sbindir}/sshd%{CHECKSUM_SUFFIX}
|
||||
%attr(0444,root,root) %{_libexecdir}/ssh/sftp-server%{CHECKSUM_SUFFIX}
|
||||
|
||||
%files cavs
|
||||
%attr(0755,root,root) %{_libexecdir}/ssh/cavs*
|
||||
|
||||
%changelog
|
||||
26
ssh-askpass
Normal file
26
ssh-askpass
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
#!/bin/bash
|
||||
|
||||
SESSION=
|
||||
|
||||
if [ -n "$KDE_FULL_SESSION" ] ; then
|
||||
SESSION=kde
|
||||
fi
|
||||
|
||||
if [ "$DESKTOP_SESSION" = "lxqt" ]; then
|
||||
SESSION=kde
|
||||
fi
|
||||
|
||||
GNOME_SSH_ASKPASS="@LIBEXECDIR@/ssh/gnome-ssh-askpass"
|
||||
KDE_SSH_ASKPASS="@LIBEXECDIR@/ssh/ksshaskpass"
|
||||
|
||||
case "$SESSION" in
|
||||
kde)
|
||||
[ -e $KDE_SSH_ASKPASS ] && exec $KDE_SSH_ASKPASS ${1+"$@"}
|
||||
exec $GNOME_SSH_ASKPASS ${1+"$@"}
|
||||
;;
|
||||
*)
|
||||
[ -e $GNOME_SSH_ASKPASS ] && exec $GNOME_SSH_ASKPASS ${1+"$@"}
|
||||
exec $KDE_SSH_ASKPASS ${1+"$@"}
|
||||
;;
|
||||
esac
|
||||
|
||||
18
ssh.reg
Normal file
18
ssh.reg
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
#############################################################################
|
||||
#
|
||||
# OpenSLP registration file
|
||||
#
|
||||
# register SSH daemon
|
||||
#
|
||||
#############################################################################
|
||||
|
||||
# Register the usual sshd, if it is running
|
||||
service:ssh://$HOSTNAME:22,en,65535
|
||||
tcp-port=22
|
||||
description=Secure Shell Daemon
|
||||
|
||||
# ssh can get used to copy files with konqueror using the fish:/ protocol
|
||||
service:fish://$HOSTNAME:22,en,65535
|
||||
tcp-port=22
|
||||
description=KDE file transfer via SSH
|
||||
|
||||
8
sshd-gen-keys-start
Normal file
8
sshd-gen-keys-start
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
#!/bin/sh
|
||||
|
||||
. /etc/sysconfig/ssh
|
||||
|
||||
if [ "x$SSHD_AUTO_KEYGEN" != "xno" ]; then
|
||||
echo "Checking for missing server keys in /etc/ssh"
|
||||
ssh-keygen -A
|
||||
fi
|
||||
5
sshd.fw
Normal file
5
sshd.fw
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
## Name: Secure Shell Server
|
||||
## Description: Open ports for Secure Shell Server
|
||||
|
||||
# space separated list of allowed TCP ports
|
||||
TCP="ssh"
|
||||
10
sshd.pamd
Normal file
10
sshd.pamd
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
#%PAM-1.0
|
||||
auth requisite pam_nologin.so
|
||||
auth include common-auth
|
||||
account requisite pam_nologin.so
|
||||
account include common-account
|
||||
password include common-password
|
||||
session required pam_loginuid.so
|
||||
session include common-session
|
||||
session optional pam_lastlog.so silent noupdate showfailed
|
||||
session optional pam_keyinit.so force revoke
|
||||
18
sshd.service
Normal file
18
sshd.service
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
[Unit]
|
||||
Description=OpenSSH Daemon
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
EnvironmentFile=-/etc/sysconfig/ssh
|
||||
ExecStartPre=/usr/sbin/sshd-gen-keys-start
|
||||
ExecStartPre=/usr/sbin/sshd -t $SSHD_OPTS
|
||||
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
RestartPreventExitStatus=255
|
||||
TasksMax=infinity
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
14
sysconfig.ssh
Normal file
14
sysconfig.ssh
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
## Path: Network/Remote access/SSH
|
||||
## Description: SSH server settings
|
||||
## Type: string
|
||||
## Default: ""
|
||||
## ServiceRestart: sshd
|
||||
#
|
||||
# Options for sshd
|
||||
#
|
||||
SSHD_OPTS=""
|
||||
|
||||
#
|
||||
# Whether to run ssh-keygen -A
|
||||
#
|
||||
SSHD_AUTO_KEYGEN="yes"
|
||||
2
sysusers-sshd.conf
Normal file
2
sysusers-sshd.conf
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# Type Name ID GECOS [HOME]
|
||||
u sshd - "SSH daemon" /var/lib/sshd
|
||||
Loading…
Add table
Reference in a new issue