Remove unused patches
This commit is contained in:
parent
5410d2d3a7
commit
f33aef5318
|
@ -1,13 +0,0 @@
|
||||||
diff -up openssh-5.8p2/mux.c.remove_stale openssh-5.8p2/mux.c
|
|
||||||
--- openssh-5.8p2/mux.c.remove_stale 2011-01-14 02:01:32.000000000 +0100
|
|
||||||
+++ openssh-5.8p2/mux.c 2011-06-09 15:27:42.556360291 +0200
|
|
||||||
@@ -1867,6 +1867,9 @@ muxclient(const char *path)
|
|
||||||
unlink(path);
|
|
||||||
} else if (errno == ENOENT) {
|
|
||||||
debug("Control socket \"%.100s\" does not exist", path);
|
|
||||||
+ } else if (errno == ECONNREFUSED) {
|
|
||||||
+ debug("Removing stale control socket \"%.100s\"", path);
|
|
||||||
+ unlink(path);
|
|
||||||
} else {
|
|
||||||
error("Control socket connect(%.100s): %s", path,
|
|
||||||
strerror(errno));
|
|
|
@ -1,13 +0,0 @@
|
||||||
diff -up openssh-5.9p0/entropy.c.randclean openssh-5.9p0/entropy.c
|
|
||||||
--- openssh-5.9p0/entropy.c.randclean 2011-08-30 13:52:45.000000000 +0200
|
|
||||||
+++ openssh-5.9p0/entropy.c 2011-08-30 13:57:44.630111338 +0200
|
|
||||||
@@ -217,6 +217,9 @@ seed_rng(void)
|
|
||||||
fatal("OpenSSL version mismatch. Built against %lx, you "
|
|
||||||
"have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
|
|
||||||
|
|
||||||
+ /* clean the PRNG status when exiting the program */
|
|
||||||
+ atexit(RAND_cleanup);
|
|
||||||
+
|
|
||||||
#ifndef OPENSSL_PRNG_ONLY
|
|
||||||
if (RAND_status() == 1) {
|
|
||||||
debug3("RNG is ready, skipping seeding");
|
|
|
@ -1,206 +0,0 @@
|
||||||
diff --git a/dh.h b/dh.h
|
|
||||||
index 48f7b68..9ff39f4 100644
|
|
||||||
--- a/dh.h
|
|
||||||
+++ b/dh.h
|
|
||||||
@@ -45,6 +45,7 @@ int dh_estimate(int);
|
|
||||||
|
|
||||||
/* Min and max values from RFC4419. */
|
|
||||||
#define DH_GRP_MIN 1024
|
|
||||||
+#define DH_GRP_MIN_FIPS 2048
|
|
||||||
#define DH_GRP_MAX 8192
|
|
||||||
|
|
||||||
/*
|
|
||||||
diff --git a/kex.c b/kex.c
|
|
||||||
index a468805..3a0eb16 100644
|
|
||||||
--- a/kex.c
|
|
||||||
+++ b/kex.c
|
|
||||||
@@ -34,6 +34,7 @@
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
#include <openssl/crypto.h>
|
|
||||||
+#include <openssl/fips.h>
|
|
||||||
|
|
||||||
#include "xmalloc.h"
|
|
||||||
#include "ssh2.h"
|
|
||||||
@@ -93,6 +94,20 @@ static const struct kexalg kexalgs[] = {
|
|
||||||
{ NULL, -1, -1, NULL},
|
|
||||||
};
|
|
||||||
|
|
||||||
+static const struct kexalg kexalgs_fips[] = {
|
|
||||||
+ { KEX_DH14, KEX_DH_GRP14_SHA1, 0, EVP_sha1 },
|
|
||||||
+ { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, EVP_sha1 },
|
|
||||||
+#ifdef HAVE_EVP_SHA256
|
|
||||||
+ { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, EVP_sha256 },
|
|
||||||
+#endif
|
|
||||||
+#ifdef OPENSSL_HAS_ECC
|
|
||||||
+ { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2, NID_X9_62_prime256v1, EVP_sha256 },
|
|
||||||
+ { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1, EVP_sha384 },
|
|
||||||
+ { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1, EVP_sha512 },
|
|
||||||
+#endif
|
|
||||||
+ { NULL, -1, -1, NULL},
|
|
||||||
+};
|
|
||||||
+
|
|
||||||
char *
|
|
||||||
kex_alg_list(void)
|
|
||||||
{
|
|
||||||
@@ -116,7 +131,7 @@ kex_alg_by_name(const char *name)
|
|
||||||
{
|
|
||||||
const struct kexalg *k;
|
|
||||||
|
|
||||||
- for (k = kexalgs; k->name != NULL; k++) {
|
|
||||||
+ for (k = (FIPS_mode() ? kexalgs_fips : kexalgs); k->name != NULL; k++) {
|
|
||||||
if (strcmp(k->name, name) == 0)
|
|
||||||
return k;
|
|
||||||
#ifdef GSSAPI
|
|
||||||
@@ -141,7 +156,10 @@ kex_names_valid(const char *names)
|
|
||||||
for ((p = strsep(&cp, ",")); p && *p != '\0';
|
|
||||||
(p = strsep(&cp, ","))) {
|
|
||||||
if (kex_alg_by_name(p) == NULL) {
|
|
||||||
- error("Unsupported KEX algorithm \"%.100s\"", p);
|
|
||||||
+ if (FIPS_mode())
|
|
||||||
+ error("\"%.100s\" is not allowed in FIPS mode", p);
|
|
||||||
+ else
|
|
||||||
+ error("Unsupported KEX algorithm \"%.100s\"", p);
|
|
||||||
free(s);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
diff --git a/kexecdhc.c b/kexecdhc.c
|
|
||||||
index 6193836..d435f1f 100644
|
|
||||||
--- a/kexecdhc.c
|
|
||||||
+++ b/kexecdhc.c
|
|
||||||
@@ -154,6 +154,7 @@ kexecdh_client(Kex *kex)
|
|
||||||
|
|
||||||
kex_derive_keys(kex, hash, hashlen, shared_secret);
|
|
||||||
BN_clear_free(shared_secret);
|
|
||||||
+ memset(hash, 0, hashlen);
|
|
||||||
kex_finish(kex);
|
|
||||||
}
|
|
||||||
#else /* OPENSSL_HAS_ECC */
|
|
||||||
diff --git a/kexecdhs.c b/kexecdhs.c
|
|
||||||
index 3a580aa..9a06905 100644
|
|
||||||
--- a/kexecdhs.c
|
|
||||||
+++ b/kexecdhs.c
|
|
||||||
@@ -155,6 +155,7 @@ kexecdh_server(Kex *kex)
|
|
||||||
|
|
||||||
kex_derive_keys(kex, hash, hashlen, shared_secret);
|
|
||||||
BN_clear_free(shared_secret);
|
|
||||||
+ memset(hash, 0, hashlen);
|
|
||||||
kex_finish(kex);
|
|
||||||
}
|
|
||||||
#else /* OPENSSL_HAS_ECC */
|
|
||||||
diff --git a/kexgexc.c b/kexgexc.c
|
|
||||||
index 5a3be20..a931b6e 100644
|
|
||||||
--- a/kexgexc.c
|
|
||||||
+++ b/kexgexc.c
|
|
||||||
@@ -26,6 +26,8 @@
|
|
||||||
|
|
||||||
#include "includes.h"
|
|
||||||
|
|
||||||
+#include <openssl/fips.h>
|
|
||||||
+
|
|
||||||
#include <sys/types.h>
|
|
||||||
|
|
||||||
#include <openssl/dh.h>
|
|
||||||
@@ -64,13 +66,13 @@ kexgex_client(Kex *kex)
|
|
||||||
/* Old GEX request */
|
|
||||||
packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
|
|
||||||
packet_put_int(nbits);
|
|
||||||
- min = DH_GRP_MIN;
|
|
||||||
+ min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
|
|
||||||
max = DH_GRP_MAX;
|
|
||||||
|
|
||||||
debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD(%u) sent", nbits);
|
|
||||||
} else {
|
|
||||||
/* New GEX request */
|
|
||||||
- min = DH_GRP_MIN;
|
|
||||||
+ min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
|
|
||||||
max = DH_GRP_MAX;
|
|
||||||
packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST);
|
|
||||||
packet_put_int(min);
|
|
||||||
diff --git a/kexgexs.c b/kexgexs.c
|
|
||||||
index 4e473fc..2ed49bd 100644
|
|
||||||
--- a/kexgexs.c
|
|
||||||
+++ b/kexgexs.c
|
|
||||||
@@ -76,16 +76,16 @@ kexgex_server(Kex *kex)
|
|
||||||
omin = min = packet_get_int();
|
|
||||||
onbits = nbits = packet_get_int();
|
|
||||||
omax = max = packet_get_int();
|
|
||||||
- min = MAX(DH_GRP_MIN, min);
|
|
||||||
+ min = MAX(FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN, min);
|
|
||||||
max = MIN(DH_GRP_MAX, max);
|
|
||||||
- nbits = MAX(DH_GRP_MIN, nbits);
|
|
||||||
+ nbits = MAX(FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN, nbits);
|
|
||||||
nbits = MIN(DH_GRP_MAX, nbits);
|
|
||||||
break;
|
|
||||||
case SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:
|
|
||||||
debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received");
|
|
||||||
onbits = nbits = packet_get_int();
|
|
||||||
/* unused for old GEX */
|
|
||||||
- omin = min = DH_GRP_MIN;
|
|
||||||
+ omin = min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
|
|
||||||
omax = max = DH_GRP_MAX;
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
diff --git a/myproposal.h b/myproposal.h
|
|
||||||
index ee69ea2..1b68c5b 100644
|
|
||||||
--- a/myproposal.h
|
|
||||||
+++ b/myproposal.h
|
|
||||||
@@ -72,6 +72,12 @@
|
|
||||||
"diffie-hellman-group14-sha1," \
|
|
||||||
"diffie-hellman-group1-sha1"
|
|
||||||
|
|
||||||
+#define KEX_DEFAULT_KEX_FIPS \
|
|
||||||
+ KEX_ECDH_METHODS \
|
|
||||||
+ KEX_SHA256_METHODS \
|
|
||||||
+ "diffie-hellman-group-exchange-sha1," \
|
|
||||||
+ "diffie-hellman-group14-sha1"
|
|
||||||
+
|
|
||||||
#define KEX_DEFAULT_PK_ALG \
|
|
||||||
HOSTKEY_ECDSA_CERT_METHODS \
|
|
||||||
"ssh-rsa-cert-v01@openssh.com," \
|
|
||||||
diff --git a/ssh-keygen.c b/ssh-keygen.c
|
|
||||||
index cac6762..2569016 100644
|
|
||||||
--- a/ssh-keygen.c
|
|
||||||
+++ b/ssh-keygen.c
|
|
||||||
@@ -183,8 +183,14 @@ type_bits_valid(int type, u_int32_t *bitsp)
|
|
||||||
fprintf(stderr, "key bits exceeds maximum %d\n", maxbits);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
- if (type == KEY_DSA && *bitsp != 1024)
|
|
||||||
+ if (type == KEY_DSA && FIPS_mode())
|
|
||||||
+ fatal("DSA keys are not allowed in FIPS mode");
|
|
||||||
+ else if (type == KEY_DSA && *bitsp != 1024)
|
|
||||||
fatal("DSA keys must be 1024 bits");
|
|
||||||
+ else if (type == KEY_RSA && bits < DEFAULT_BITS && FIPS_mode()) {
|
|
||||||
+ fprintf(stderr, "RSA keys must be at least %d bits in FIPS mode\n", DEFAULT_BITS);
|
|
||||||
+ exit(1);
|
|
||||||
+ }
|
|
||||||
else if (type != KEY_ECDSA && *bitsp < 768)
|
|
||||||
fatal("Key must at least be 768 bits");
|
|
||||||
else if (type == KEY_ECDSA && key_ecdsa_bits_to_nid(*bitsp) == -1)
|
|
||||||
diff --git a/sshconnect2.c b/sshconnect2.c
|
|
||||||
index 7e48880..3179d82 100644
|
|
||||||
--- a/sshconnect2.c
|
|
||||||
+++ b/sshconnect2.c
|
|
||||||
@@ -231,6 +231,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
|
|
||||||
}
|
|
||||||
if (options.kex_algorithms != NULL)
|
|
||||||
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
|
|
||||||
+ else if (FIPS_mode())
|
|
||||||
+ myproposal[PROPOSAL_KEX_ALGS] = KEX_DEFAULT_KEX_FIPS;
|
|
||||||
|
|
||||||
#ifdef GSSAPI
|
|
||||||
/* If we've got GSSAPI algorithms, then we also support the
|
|
||||||
diff --git a/sshd.c b/sshd.c
|
|
||||||
index 11adbf6..f5e98bc 100644
|
|
||||||
--- a/sshd.c
|
|
||||||
+++ b/sshd.c
|
|
||||||
@@ -2605,6 +2605,8 @@ do_ssh2_kex(void)
|
|
||||||
}
|
|
||||||
if (options.kex_algorithms != NULL)
|
|
||||||
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
|
|
||||||
+ else if (FIPS_mode())
|
|
||||||
+ myproposal[PROPOSAL_KEX_ALGS] = KEX_DEFAULT_KEX_FIPS;
|
|
||||||
|
|
||||||
if (options.rekey_limit || options.rekey_interval)
|
|
||||||
packet_set_rekey_limits((u_int32_t)options.rekey_limit,
|
|
Loading…
Reference in New Issue