svn commit: r264693 - stable/9/crypto/openssh
Dag-Erling Smørgrav
des at FreeBSD.org
Sun Apr 20 13:12:35 UTC 2014
Author: des
Date: Sun Apr 20 13:12:32 2014
New Revision: 264693
URL: http://svnweb.freebsd.org/changeset/base/264693
Log:
MFH (r264691): merge upstream patch for EC calculation bug
Modified:
stable/9/crypto/openssh/bufaux.c
stable/9/crypto/openssh/compat.c
stable/9/crypto/openssh/compat.h
stable/9/crypto/openssh/ssh_config
stable/9/crypto/openssh/ssh_config.5
stable/9/crypto/openssh/sshconnect2.c
stable/9/crypto/openssh/sshd.c
stable/9/crypto/openssh/sshd_config
stable/9/crypto/openssh/sshd_config.5
stable/9/crypto/openssh/version.h
Directory Properties:
stable/9/ (props changed)
stable/9/crypto/openssh/ (props changed)
Modified: stable/9/crypto/openssh/bufaux.c
==============================================================================
--- stable/9/crypto/openssh/bufaux.c Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/bufaux.c Sun Apr 20 13:12:32 2014 (r264693)
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufaux.c,v 1.56 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: bufaux.c,v 1.57 2014/04/16 23:22:45 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -372,6 +372,9 @@ buffer_put_bignum2_from_string(Buffer *b
if (l > 8 * 1024)
fatal("%s: length %u too long", __func__, l);
+ /* Skip leading zero bytes */
+ for (; l > 0 && *s == 0; l--, s++)
+ ;
p = buf = xmalloc(l + 1);
/*
* If most significant bit is set then prepend a zero byte to
Modified: stable/9/crypto/openssh/compat.c
==============================================================================
--- stable/9/crypto/openssh/compat.c Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/compat.c Sun Apr 20 13:12:32 2014 (r264693)
@@ -97,6 +97,9 @@ compat_datafellows(const char *version)
{ "Sun_SSH_1.0*", SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
{ "OpenSSH_4*", 0 },
{ "OpenSSH_5*", SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT},
+ { "OpenSSH_6.6.1*", SSH_NEW_OPENSSH},
+ { "OpenSSH_6.5*,"
+ "OpenSSH_6.6*", SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD},
{ "OpenSSH*", SSH_NEW_OPENSSH },
{ "*MindTerm*", 0 },
{ "2.1.0*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
@@ -263,7 +266,6 @@ compat_cipher_proposal(char *cipher_prop
return cipher_prop;
}
-
char *
compat_pkalg_proposal(char *pkalg_prop)
{
@@ -277,3 +279,16 @@ compat_pkalg_proposal(char *pkalg_prop)
return pkalg_prop;
}
+char *
+compat_kex_proposal(char *kex_prop)
+{
+ if (!(datafellows & SSH_BUG_CURVE25519PAD))
+ return kex_prop;
+ debug2("%s: original KEX proposal: %s", __func__, kex_prop);
+ kex_prop = filter_proposal(kex_prop, "curve25519-sha256 at libssh.org");
+ debug2("%s: compat KEX proposal: %s", __func__, kex_prop);
+ if (*kex_prop == '\0')
+ fatal("No supported key exchange algorithms found");
+ return kex_prop;
+}
+
Modified: stable/9/crypto/openssh/compat.h
==============================================================================
--- stable/9/crypto/openssh/compat.h Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/compat.h Sun Apr 20 13:12:32 2014 (r264693)
@@ -60,7 +60,9 @@
#define SSH_BUG_RFWD_ADDR 0x02000000
#define SSH_NEW_OPENSSH 0x04000000
#define SSH_BUG_DYNAMIC_RPORT 0x08000000
-#define SSH_BUG_LARGEWINDOW 0x10000000
+#define SSH_BUG_CURVE25519PAD 0x10000000
+
+#define SSH_BUG_LARGEWINDOW 0x80000000
void enable_compat13(void);
void enable_compat20(void);
@@ -68,6 +70,7 @@ void compat_datafellows(const char *
int proto_spec(const char *);
char *compat_cipher_proposal(char *);
char *compat_pkalg_proposal(char *);
+char *compat_kex_proposal(char *);
extern int compat13;
extern int compat20;
Modified: stable/9/crypto/openssh/ssh_config
==============================================================================
--- stable/9/crypto/openssh/ssh_config Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/ssh_config Sun Apr 20 13:12:32 2014 (r264693)
@@ -47,4 +47,4 @@
# VisualHostKey no
# ProxyCommand ssh -q -W %h:%p gateway.example.com
# RekeyLimit 1G 1h
-# VersionAddendum FreeBSD-20140324
+# VersionAddendum FreeBSD-20140420
Modified: stable/9/crypto/openssh/ssh_config.5
==============================================================================
--- stable/9/crypto/openssh/ssh_config.5 Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/ssh_config.5 Sun Apr 20 13:12:32 2014 (r264693)
@@ -1420,7 +1420,7 @@ See also VERIFYING HOST KEYS in
Specifies a string to append to the regular version string to identify
OS- or site-specific modifications.
The default is
-.Dq FreeBSD-20140324 .
+.Dq FreeBSD-20140420 .
.It Cm VisualHostKey
If this flag is set to
.Dq yes ,
Modified: stable/9/crypto/openssh/sshconnect2.c
==============================================================================
--- stable/9/crypto/openssh/sshconnect2.c Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/sshconnect2.c Sun Apr 20 13:12:32 2014 (r264693)
@@ -207,6 +207,8 @@ ssh_kex2(char *host, struct sockaddr *ho
}
if (options.kex_algorithms != NULL)
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+ myproposal[PROPOSAL_KEX_ALGS]);
if (options.rekey_limit || options.rekey_interval)
packet_set_rekey_limits((u_int32_t)options.rekey_limit,
Modified: stable/9/crypto/openssh/sshd.c
==============================================================================
--- stable/9/crypto/openssh/sshd.c Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/sshd.c Sun Apr 20 13:12:32 2014 (r264693)
@@ -2528,6 +2528,9 @@ do_ssh2_kex(void)
if (options.kex_algorithms != NULL)
myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
+ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+ myproposal[PROPOSAL_KEX_ALGS]);
+
if (options.rekey_limit || options.rekey_interval)
packet_set_rekey_limits((u_int32_t)options.rekey_limit,
(time_t)options.rekey_interval);
Modified: stable/9/crypto/openssh/sshd_config
==============================================================================
--- stable/9/crypto/openssh/sshd_config Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/sshd_config Sun Apr 20 13:12:32 2014 (r264693)
@@ -120,7 +120,7 @@
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
-#VersionAddendum FreeBSD-20140324
+#VersionAddendum FreeBSD-20140420
# no default banner path
#Banner none
Modified: stable/9/crypto/openssh/sshd_config.5
==============================================================================
--- stable/9/crypto/openssh/sshd_config.5 Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/sshd_config.5 Sun Apr 20 13:12:32 2014 (r264693)
@@ -1253,7 +1253,7 @@ restrictions.
Optionally specifies additional text to append to the SSH protocol banner
sent by the server upon connection.
The default is
-.Dq FreeBSD-20140324 .
+.Dq FreeBSD-20140420 .
.It Cm X11DisplayOffset
Specifies the first display number available for
.Xr sshd 8 Ns 's
Modified: stable/9/crypto/openssh/version.h
==============================================================================
--- stable/9/crypto/openssh/version.h Sun Apr 20 12:46:18 2014 (r264692)
+++ stable/9/crypto/openssh/version.h Sun Apr 20 13:12:32 2014 (r264693)
@@ -1,10 +1,10 @@
/* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */
/* $FreeBSD$ */
-#define SSH_VERSION "OpenSSH_6.6"
+#define SSH_VERSION "OpenSSH_6.6.1"
#define SSH_PORTABLE "p1"
#define SSH_RELEASE SSH_VERSION SSH_PORTABLE
-#define SSH_VERSION_FREEBSD "FreeBSD-20140324"
+#define SSH_VERSION_FREEBSD "FreeBSD-20140420"
#define SSH_VERSION_HPN "_hpn13v11"
More information about the svn-src-stable-9
mailing list