From 9a804fa2663b764c9df3fde472c3cc49b958bfa2 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Wed, 23 Sep 2015 14:16:43 +0200 Subject: [PATCH] Apply GSSAPI key exchange methods in client offered list (#1261414) --- openssh-6.6p1-gsskex.patch | 4 ++-- openssh-6.7p1-fips.patch | 8 ++++---- openssh-7.0p1-gssKexAlgorithms.patch | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/openssh-6.6p1-gsskex.patch b/openssh-6.6p1-gsskex.patch index fa67de1..b2c942c 100644 --- a/openssh-6.6p1-gsskex.patch +++ b/openssh-6.6p1-gsskex.patch @@ -2290,7 +2290,7 @@ diff -up openssh-7.0p1/sshconnect2.c.gsskex openssh-7.0p1/sshconnect2.c + if (options.gss_keyex) { + /* Add the GSSAPI mechanisms currently supported on this + * client to the key exchange algorithm proposal */ -+ orig = myproposal[PROPOSAL_KEX_ALGS]; ++ orig = options.kex_algorithms; + + if (options.gss_trust_dns) + gss_host = (char *)get_canonical_hostname(1); @@ -2300,7 +2300,7 @@ diff -up openssh-7.0p1/sshconnect2.c.gsskex openssh-7.0p1/sshconnect2.c + gss = ssh_gssapi_client_mechanisms(gss_host, options.gss_client_identity); + if (gss) { + debug("Offering GSSAPI proposal: %s", gss); -+ xasprintf(&myproposal[PROPOSAL_KEX_ALGS], ++ xasprintf(&options.kex_algorithms, + "%s,%s", gss, orig); + } + } diff --git a/openssh-6.7p1-fips.patch b/openssh-6.7p1-fips.patch index 3427ff5..62f9e26 100644 --- a/openssh-6.7p1-fips.patch +++ b/openssh-6.7p1-fips.patch @@ -492,7 +492,7 @@ diff -up openssh-7.0p1/sshconnect2.c.fips openssh-7.0p1/sshconnect2.c if (options.gss_keyex) { - /* Add the GSSAPI mechanisms currently supported on this - * client to the key exchange algorithm proposal */ -- orig = myproposal[PROPOSAL_KEX_ALGS]; +- orig = options.kex_algorithms; - - if (options.gss_trust_dns) - gss_host = (char *)get_canonical_hostname(1); @@ -503,7 +503,7 @@ diff -up openssh-7.0p1/sshconnect2.c.fips openssh-7.0p1/sshconnect2.c - options.gss_client_identity, options.gss_kex_algorithms); - if (gss) { - debug("Offering GSSAPI proposal: %s", gss); -- xasprintf(&myproposal[PROPOSAL_KEX_ALGS], +- xasprintf(&options.kex_algorithms, - "%s,%s", gss, orig); + if (FIPS_mode()) { + logit("Disabling GSSAPIKeyExchange. Not usable in FIPS mode"); @@ -511,7 +511,7 @@ diff -up openssh-7.0p1/sshconnect2.c.fips openssh-7.0p1/sshconnect2.c + } else { + /* Add the GSSAPI mechanisms currently supported on this + * client to the key exchange algorithm proposal */ -+ orig = myproposal[PROPOSAL_KEX_ALGS]; ++ orig = options.kex_algorithms; + + if (options.gss_trust_dns) + gss_host = (char *)get_canonical_hostname(1); @@ -522,7 +522,7 @@ diff -up openssh-7.0p1/sshconnect2.c.fips openssh-7.0p1/sshconnect2.c + options.gss_client_identity, options.gss_kex_algorithms); + if (gss) { + debug("Offering GSSAPI proposal: %s", gss); -+ xasprintf(&myproposal[PROPOSAL_KEX_ALGS], ++ xasprintf(&options.kex_algorithms, + "%s,%s", gss, orig); + } } diff --git a/openssh-7.0p1-gssKexAlgorithms.patch b/openssh-7.0p1-gssKexAlgorithms.patch index b8fe76c..8ecc207 100644 --- a/openssh-7.0p1-gssKexAlgorithms.patch +++ b/openssh-7.0p1-gssKexAlgorithms.patch @@ -362,7 +362,7 @@ diff -up openssh-7.0p1/sshconnect2.c.gsskexalg openssh-7.0p1/sshconnect2.c + options.gss_client_identity, options.gss_kex_algorithms); if (gss) { debug("Offering GSSAPI proposal: %s", gss); - xasprintf(&myproposal[PROPOSAL_KEX_ALGS], + xasprintf(&options.kex_algorithms, diff -up openssh-7.0p1/sshd_config.5.gsskexalg openssh-7.0p1/sshd_config.5 --- openssh-7.0p1/sshd_config.5.gsskexalg 2015-08-19 12:28:38.082518830 +0200 +++ openssh-7.0p1/sshd_config.5 2015-08-19 12:36:25.121471501 +0200