Date: Sun, 20 Apr 2014 13:12:32 +0000 (UTC) From: Dag-Erling Smørgrav <des@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r264693 - stable/9/crypto/openssh Message-ID: <201404201312.s3KDCWFl039130@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: des Date: Sun Apr 20 13:12:32 2014 New Revision: 264693 URL: http://svnweb.freebsd.org/changeset/base/264693 Log: MFH (r264691): merge upstream patch for EC calculation bug Modified: stable/9/crypto/openssh/bufaux.c stable/9/crypto/openssh/compat.c stable/9/crypto/openssh/compat.h stable/9/crypto/openssh/ssh_config stable/9/crypto/openssh/ssh_config.5 stable/9/crypto/openssh/sshconnect2.c stable/9/crypto/openssh/sshd.c stable/9/crypto/openssh/sshd_config stable/9/crypto/openssh/sshd_config.5 stable/9/crypto/openssh/version.h Directory Properties: stable/9/ (props changed) stable/9/crypto/openssh/ (props changed) Modified: stable/9/crypto/openssh/bufaux.c ============================================================================== --- stable/9/crypto/openssh/bufaux.c Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/bufaux.c Sun Apr 20 13:12:32 2014 (r264693) @@ -1,4 +1,4 @@ -/* $OpenBSD: bufaux.c,v 1.56 2014/02/02 03:44:31 djm Exp $ */ +/* $OpenBSD: bufaux.c,v 1.57 2014/04/16 23:22:45 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -372,6 +372,9 @@ buffer_put_bignum2_from_string(Buffer *b if (l > 8 * 1024) fatal("%s: length %u too long", __func__, l); + /* Skip leading zero bytes */ + for (; l > 0 && *s == 0; l--, s++) + ; p = buf = xmalloc(l + 1); /* * If most significant bit is set then prepend a zero byte to Modified: stable/9/crypto/openssh/compat.c ============================================================================== --- stable/9/crypto/openssh/compat.c Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/compat.c Sun Apr 20 13:12:32 2014 (r264693) @@ -97,6 +97,9 @@ compat_datafellows(const char *version) { "Sun_SSH_1.0*", SSH_BUG_NOREKEY|SSH_BUG_EXTEOF}, { "OpenSSH_4*", 0 }, { "OpenSSH_5*", SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT}, + { "OpenSSH_6.6.1*", SSH_NEW_OPENSSH}, + { "OpenSSH_6.5*," + "OpenSSH_6.6*", SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD}, { "OpenSSH*", SSH_NEW_OPENSSH }, { "*MindTerm*", 0 }, { "2.1.0*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC| @@ -263,7 +266,6 @@ compat_cipher_proposal(char *cipher_prop return cipher_prop; } - char * compat_pkalg_proposal(char *pkalg_prop) { @@ -277,3 +279,16 @@ compat_pkalg_proposal(char *pkalg_prop) return pkalg_prop; } +char * +compat_kex_proposal(char *kex_prop) +{ + if (!(datafellows & SSH_BUG_CURVE25519PAD)) + return kex_prop; + debug2("%s: original KEX proposal: %s", __func__, kex_prop); + kex_prop = filter_proposal(kex_prop, "curve25519-sha256@libssh.org"); + debug2("%s: compat KEX proposal: %s", __func__, kex_prop); + if (*kex_prop == '\0') + fatal("No supported key exchange algorithms found"); + return kex_prop; +} + Modified: stable/9/crypto/openssh/compat.h ============================================================================== --- stable/9/crypto/openssh/compat.h Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/compat.h Sun Apr 20 13:12:32 2014 (r264693) @@ -60,7 +60,9 @@ #define SSH_BUG_RFWD_ADDR 0x02000000 #define SSH_NEW_OPENSSH 0x04000000 #define SSH_BUG_DYNAMIC_RPORT 0x08000000 -#define SSH_BUG_LARGEWINDOW 0x10000000 +#define SSH_BUG_CURVE25519PAD 0x10000000 + +#define SSH_BUG_LARGEWINDOW 0x80000000 void enable_compat13(void); void enable_compat20(void); @@ -68,6 +70,7 @@ void compat_datafellows(const char * int proto_spec(const char *); char *compat_cipher_proposal(char *); char *compat_pkalg_proposal(char *); +char *compat_kex_proposal(char *); extern int compat13; extern int compat20; Modified: stable/9/crypto/openssh/ssh_config ============================================================================== --- stable/9/crypto/openssh/ssh_config Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/ssh_config Sun Apr 20 13:12:32 2014 (r264693) @@ -47,4 +47,4 @@ # VisualHostKey no # ProxyCommand ssh -q -W %h:%p gateway.example.com # RekeyLimit 1G 1h -# VersionAddendum FreeBSD-20140324 +# VersionAddendum FreeBSD-20140420 Modified: stable/9/crypto/openssh/ssh_config.5 ============================================================================== --- stable/9/crypto/openssh/ssh_config.5 Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/ssh_config.5 Sun Apr 20 13:12:32 2014 (r264693) @@ -1420,7 +1420,7 @@ See also VERIFYING HOST KEYS in Specifies a string to append to the regular version string to identify OS- or site-specific modifications. The default is -.Dq FreeBSD-20140324 . +.Dq FreeBSD-20140420 . .It Cm VisualHostKey If this flag is set to .Dq yes , Modified: stable/9/crypto/openssh/sshconnect2.c ============================================================================== --- stable/9/crypto/openssh/sshconnect2.c Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/sshconnect2.c Sun Apr 20 13:12:32 2014 (r264693) @@ -207,6 +207,8 @@ ssh_kex2(char *host, struct sockaddr *ho } if (options.kex_algorithms != NULL) myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms; + myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal( + myproposal[PROPOSAL_KEX_ALGS]); if (options.rekey_limit || options.rekey_interval) packet_set_rekey_limits((u_int32_t)options.rekey_limit, Modified: stable/9/crypto/openssh/sshd.c ============================================================================== --- stable/9/crypto/openssh/sshd.c Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/sshd.c Sun Apr 20 13:12:32 2014 (r264693) @@ -2528,6 +2528,9 @@ do_ssh2_kex(void) if (options.kex_algorithms != NULL) myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms; + myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal( + myproposal[PROPOSAL_KEX_ALGS]); + if (options.rekey_limit || options.rekey_interval) packet_set_rekey_limits((u_int32_t)options.rekey_limit, (time_t)options.rekey_interval); Modified: stable/9/crypto/openssh/sshd_config ============================================================================== --- stable/9/crypto/openssh/sshd_config Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/sshd_config Sun Apr 20 13:12:32 2014 (r264693) @@ -120,7 +120,7 @@ #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none -#VersionAddendum FreeBSD-20140324 +#VersionAddendum FreeBSD-20140420 # no default banner path #Banner none Modified: stable/9/crypto/openssh/sshd_config.5 ============================================================================== --- stable/9/crypto/openssh/sshd_config.5 Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/sshd_config.5 Sun Apr 20 13:12:32 2014 (r264693) @@ -1253,7 +1253,7 @@ restrictions. Optionally specifies additional text to append to the SSH protocol banner sent by the server upon connection. The default is -.Dq FreeBSD-20140324 . +.Dq FreeBSD-20140420 . .It Cm X11DisplayOffset Specifies the first display number available for .Xr sshd 8 Ns 's Modified: stable/9/crypto/openssh/version.h ============================================================================== --- stable/9/crypto/openssh/version.h Sun Apr 20 12:46:18 2014 (r264692) +++ stable/9/crypto/openssh/version.h Sun Apr 20 13:12:32 2014 (r264693) @@ -1,10 +1,10 @@ /* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */ /* $FreeBSD$ */ -#define SSH_VERSION "OpenSSH_6.6" +#define SSH_VERSION "OpenSSH_6.6.1" #define SSH_PORTABLE "p1" #define SSH_RELEASE SSH_VERSION SSH_PORTABLE -#define SSH_VERSION_FREEBSD "FreeBSD-20140324" +#define SSH_VERSION_FREEBSD "FreeBSD-20140420" #define SSH_VERSION_HPN "_hpn13v11"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201404201312.s3KDCWFl039130>