From owner-freebsd-bugs@FreeBSD.ORG Tue Dec 6 18:10:08 2011 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6242E106564A for ; Tue, 6 Dec 2011 18:10:08 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 3C0EA8FC1D for ; Tue, 6 Dec 2011 18:10:08 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id pB6IA828042161 for ; Tue, 6 Dec 2011 18:10:08 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id pB6IA8ks042160; Tue, 6 Dec 2011 18:10:08 GMT (envelope-from gnats) Resent-Date: Tue, 6 Dec 2011 18:10:08 GMT Resent-Message-Id: <201112061810.pB6IA8ks042160@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Jeremy Chadwick Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E862B1065678 for ; Tue, 6 Dec 2011 18:05:44 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from qmta04.westchester.pa.mail.comcast.net (qmta04.westchester.pa.mail.comcast.net [76.96.62.40]) by mx1.freebsd.org (Postfix) with ESMTP id 8D1ED8FC08 for ; Tue, 6 Dec 2011 18:05:43 +0000 (UTC) Received: from omta23.westchester.pa.mail.comcast.net ([76.96.62.74]) by qmta04.westchester.pa.mail.comcast.net with comcast id 5sJd1i00S1c6gX854tsU0x; Tue, 06 Dec 2011 17:52:28 +0000 Received: from koitsu.dyndns.org ([67.180.84.87]) by omta23.westchester.pa.mail.comcast.net with comcast id 5tsT1i00w1t3BNj3jtsTAK; Tue, 06 Dec 2011 17:52:28 +0000 Received: by icarus.home.lan (Postfix, from userid 1000) id 13E7D102C1D; Tue, 6 Dec 2011 09:52:26 -0800 (PST) Message-Id: <20111206175226.13E7D102C1D@icarus.home.lan> Date: Tue, 6 Dec 2011 09:52:26 -0800 (PST) From: Jeremy Chadwick To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: bz@FreeBSD.org, brooks@FreeBSD.org Subject: bin/163095: Add WITH_OPENSSH_NONE_CIPHER src.conf(5) knob X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Jeremy Chadwick List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2011 18:10:08 -0000 >Number: 163095 >Category: bin >Synopsis: Add WITH_OPENSSH_NONE_CIPHER src.conf(5) knob >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Tue Dec 06 18:10:07 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Jeremy Chadwick >Release: FreeBSD 8.2-STABLE amd64 >Organization: >Environment: System: FreeBSD icarus.home.lan 8.2-STABLE FreeBSD 8.2-STABLE #0: Thu Dec 1 04:37:29 PST 2011 root@icarus.home.lan:/usr/obj/usr/src/sys/X7SBA_RELENG_8_amd64 amd64 >Description: The recently-committed addition of the HPN patches to the base system OpenSSH introduced the ability to make use of the "None" cipher: http://www.freebsd.org/cgi/cvsweb.cgi/src/crypto/openssh/README.hpn However, enabling use of it requires a somewhat "hackish" addition to /etc/make.conf like the following: .if ${.CURDIR:M/usr/src/secure/*} CFLAGS+=-DNONE_CIPHER_ENABLED .endif The below patch adds the ability to enable this cipher by simply adding WITH_OPENSSH_NONE_CIPHER to one's /etc/src.conf. The below patch was tested on RELENG_8 (with buildworld); may require minor adjustments for application to the 9.x source. Patch and situation itself was initially discussed with bz@ and brooks@ privately. Desire for this is also justified via the user community: http://lists.freebsd.org/pipermail/freebsd-stable/2011-December/064727.html >How-To-Repeat: n/a >Fix: Apply the below patch. Patch will also be available for download at the below URL, once I get a PR number. http://jdc.parodius.com/freebsd/{prnum}/ Committer should be aware that the src.conf.5 man page will need to be rebuilt prior to commit. I believe src/tools/build/options/makeman is for this purpose. diff -ruN /origsrc/secure/lib/libssh/Makefile src/secure/lib/libssh/Makefile --- /origsrc/secure/lib/libssh/Makefile 2010-04-20 23:33:10.000000000 -0700 +++ src/secure/lib/libssh/Makefile 2011-12-06 09:38:15.976388562 -0800 @@ -39,6 +39,10 @@ LDADD+= -lgssapi -lkrb5 -lhx509 -lasn1 -lcom_err -lmd -lroken .endif +.if ${MK_OPENSSH_NONE_CIPHER} != "no" +CFLAGS+= -DNONE_CIPHER_ENABLED +.endif + NO_LINT= DPADD+= ${LIBCRYPTO} ${LIBCRYPT} diff -ruN /origsrc/secure/usr.bin/ssh/Makefile src/secure/usr.bin/ssh/Makefile --- /origsrc/secure/usr.bin/ssh/Makefile 2010-04-20 23:33:10.000000000 -0700 +++ src/secure/usr.bin/ssh/Makefile 2011-12-06 09:38:24.173485693 -0800 @@ -25,6 +25,10 @@ LDADD+= -lgssapi .endif +.if ${MK_OPENSSH_NONE_CIPHER} != "no" +CFLAGS+= -DNONE_CIPHER_ENABLED +.endif + .if defined(X11BASE) || defined(LOCALBASE) # Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org # 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/ diff -ruN /origsrc/secure/usr.sbin/sshd/Makefile src/secure/usr.sbin/sshd/Makefile --- /origsrc/secure/usr.sbin/sshd/Makefile 2010-04-20 23:33:10.000000000 -0700 +++ src/secure/usr.sbin/sshd/Makefile 2011-12-06 09:37:56.833786139 -0800 @@ -38,6 +38,10 @@ LDADD+= -lgssapi_krb5 -lgssapi -lkrb5 -lasn1 .endif +.if ${MK_OPENSSH_NONE_CIPHER} != "no" +CFLAGS+= -DNONE_CIPHER_ENABLED +.endif + .if defined(X11BASE) # Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org # 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/ diff -ruN /origsrc/share/mk/bsd.own.mk src/share/mk/bsd.own.mk --- /origsrc/share/mk/bsd.own.mk 2010-05-25 13:16:36.000000000 -0700 +++ src/share/mk/bsd.own.mk 2011-12-06 09:38:46.729274164 -0800 @@ -408,7 +408,8 @@ BIND_SIGCHASE \ BIND_XML \ HESIOD \ - IDEA + IDEA \ + OPENSSH_NONE_CIPHER .if defined(WITH_${var}) && defined(WITHOUT_${var}) .error WITH_${var} and WITHOUT_${var} can't both be set. .endif diff -ruN /origsrc/tools/build/options/WITH_OPENSSH_NONE_CIPHER src/tools/build/options/WITH_OPENSSH_NONE_CIPHER --- /origsrc/tools/build/options/WITH_OPENSSH_NONE_CIPHER 1969-12-31 16:00:00.000000000 -0800 +++ src/tools/build/options/WITH_OPENSSH_NONE_CIPHER 2011-12-06 09:39:30.929282637 -0800 @@ -0,0 +1,8 @@ +.\" $FreeBSD: $ +Set to include the "None" cipher into OpenSSH and its libraries. +Additional adjustments may need to be done to system configuration +files, such as +.Xr sshd_config 5 , +to enable this cipher. Please see +.Pa /usr/src/crypto/openssh/README.hpn +for full details. >Release-Note: >Audit-Trail: >Unformatted: