Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 20 Apr 2014 12:46:18 +0000 (UTC)
From:      Dag-Erling Smørgrav <des@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r264692 - stable/10/crypto/openssh
Message-ID:  <201404201246.s3KCkI5L027257@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: des
Date: Sun Apr 20 12:46:18 2014
New Revision: 264692
URL: http://svnweb.freebsd.org/changeset/base/264692

Log:
  MFH (r264691): merge upstream patch for EC calculation bug

Modified:
  stable/10/crypto/openssh/bufaux.c
  stable/10/crypto/openssh/compat.c
  stable/10/crypto/openssh/compat.h
  stable/10/crypto/openssh/ssh_config
  stable/10/crypto/openssh/ssh_config.5
  stable/10/crypto/openssh/sshconnect2.c
  stable/10/crypto/openssh/sshd.c
  stable/10/crypto/openssh/sshd_config
  stable/10/crypto/openssh/sshd_config.5
  stable/10/crypto/openssh/version.h
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/crypto/openssh/bufaux.c
==============================================================================
--- stable/10/crypto/openssh/bufaux.c	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/bufaux.c	Sun Apr 20 12:46:18 2014	(r264692)
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufaux.c,v 1.56 2014/02/02 03:44:31 djm Exp $ */
+/* $OpenBSD: bufaux.c,v 1.57 2014/04/16 23:22:45 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -372,6 +372,9 @@ buffer_put_bignum2_from_string(Buffer *b
 
 	if (l > 8 * 1024)
 		fatal("%s: length %u too long", __func__, l);
+	/* Skip leading zero bytes */
+	for (; l > 0 && *s == 0; l--, s++)
+		;
 	p = buf = xmalloc(l + 1);
 	/*
 	 * If most significant bit is set then prepend a zero byte to

Modified: stable/10/crypto/openssh/compat.c
==============================================================================
--- stable/10/crypto/openssh/compat.c	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/compat.c	Sun Apr 20 12:46:18 2014	(r264692)
@@ -96,6 +96,9 @@ compat_datafellows(const char *version)
 		{ "Sun_SSH_1.0*",	SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
 		{ "OpenSSH_4*",		0 },
 		{ "OpenSSH_5*",		SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT},
+		{ "OpenSSH_6.6.1*",	SSH_NEW_OPENSSH},
+		{ "OpenSSH_6.5*,"
+		  "OpenSSH_6.6*",	SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD},
 		{ "OpenSSH*",		SSH_NEW_OPENSSH },
 		{ "*MindTerm*",		0 },
 		{ "2.1.0*",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
@@ -262,7 +265,6 @@ compat_cipher_proposal(char *cipher_prop
 	return cipher_prop;
 }
 
-
 char *
 compat_pkalg_proposal(char *pkalg_prop)
 {
@@ -276,3 +278,16 @@ compat_pkalg_proposal(char *pkalg_prop)
 	return pkalg_prop;
 }
 
+char *
+compat_kex_proposal(char *kex_prop)
+{
+	if (!(datafellows & SSH_BUG_CURVE25519PAD))
+		return kex_prop;
+	debug2("%s: original KEX proposal: %s", __func__, kex_prop);
+	kex_prop = filter_proposal(kex_prop, "curve25519-sha256@libssh.org");
+	debug2("%s: compat KEX proposal: %s", __func__, kex_prop);
+	if (*kex_prop == '\0')
+		fatal("No supported key exchange algorithms found");
+	return kex_prop;
+}
+

Modified: stable/10/crypto/openssh/compat.h
==============================================================================
--- stable/10/crypto/openssh/compat.h	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/compat.h	Sun Apr 20 12:46:18 2014	(r264692)
@@ -60,7 +60,9 @@
 #define SSH_BUG_RFWD_ADDR	0x02000000
 #define SSH_NEW_OPENSSH		0x04000000
 #define SSH_BUG_DYNAMIC_RPORT	0x08000000
-#define SSH_BUG_LARGEWINDOW	0x10000000
+#define SSH_BUG_CURVE25519PAD	0x10000000
+
+#define SSH_BUG_LARGEWINDOW	0x80000000
 
 void     enable_compat13(void);
 void     enable_compat20(void);
@@ -68,6 +70,7 @@ void     compat_datafellows(const char *
 int	 proto_spec(const char *);
 char	*compat_cipher_proposal(char *);
 char	*compat_pkalg_proposal(char *);
+char	*compat_kex_proposal(char *);
 
 extern int compat13;
 extern int compat20;

Modified: stable/10/crypto/openssh/ssh_config
==============================================================================
--- stable/10/crypto/openssh/ssh_config	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/ssh_config	Sun Apr 20 12:46:18 2014	(r264692)
@@ -48,4 +48,4 @@
 #   ProxyCommand ssh -q -W %h:%p gateway.example.com
 #   RekeyLimit 1G 1h
 #   VerifyHostKeyDNS yes
-#   VersionAddendum FreeBSD-20140324
+#   VersionAddendum FreeBSD-20140420

Modified: stable/10/crypto/openssh/ssh_config.5
==============================================================================
--- stable/10/crypto/openssh/ssh_config.5	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/ssh_config.5	Sun Apr 20 12:46:18 2014	(r264692)
@@ -1423,7 +1423,7 @@ See also VERIFYING HOST KEYS in
 Specifies a string to append to the regular version string to identify
 OS- or site-specific modifications.
 The default is
-.Dq FreeBSD-20140324 .
+.Dq FreeBSD-20140420 .
 .It Cm VisualHostKey
 If this flag is set to
 .Dq yes ,

Modified: stable/10/crypto/openssh/sshconnect2.c
==============================================================================
--- stable/10/crypto/openssh/sshconnect2.c	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/sshconnect2.c	Sun Apr 20 12:46:18 2014	(r264692)
@@ -206,6 +206,8 @@ ssh_kex2(char *host, struct sockaddr *ho
 	}
 	if (options.kex_algorithms != NULL)
 		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
+	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+	    myproposal[PROPOSAL_KEX_ALGS]);
 
 	if (options.rekey_limit || options.rekey_interval)
 		packet_set_rekey_limits((u_int32_t)options.rekey_limit,

Modified: stable/10/crypto/openssh/sshd.c
==============================================================================
--- stable/10/crypto/openssh/sshd.c	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/sshd.c	Sun Apr 20 12:46:18 2014	(r264692)
@@ -2528,6 +2528,9 @@ do_ssh2_kex(void)
 	if (options.kex_algorithms != NULL)
 		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
 
+	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+	    myproposal[PROPOSAL_KEX_ALGS]);
+
 	if (options.rekey_limit || options.rekey_interval)
 		packet_set_rekey_limits((u_int32_t)options.rekey_limit,
 		    (time_t)options.rekey_interval);

Modified: stable/10/crypto/openssh/sshd_config
==============================================================================
--- stable/10/crypto/openssh/sshd_config	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/sshd_config	Sun Apr 20 12:46:18 2014	(r264692)
@@ -120,7 +120,7 @@
 #MaxStartups 10:30:100
 #PermitTunnel no
 #ChrootDirectory none
-#VersionAddendum FreeBSD-20140324
+#VersionAddendum FreeBSD-20140420
 
 # no default banner path
 #Banner none

Modified: stable/10/crypto/openssh/sshd_config.5
==============================================================================
--- stable/10/crypto/openssh/sshd_config.5	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/sshd_config.5	Sun Apr 20 12:46:18 2014	(r264692)
@@ -1253,7 +1253,7 @@ restrictions.
 Optionally specifies additional text to append to the SSH protocol banner
 sent by the server upon connection.
 The default is
-.Dq FreeBSD-20140324 .
+.Dq FreeBSD-20140420 .
 .It Cm X11DisplayOffset
 Specifies the first display number available for
 .Xr sshd 8 Ns 's

Modified: stable/10/crypto/openssh/version.h
==============================================================================
--- stable/10/crypto/openssh/version.h	Sun Apr 20 11:34:33 2014	(r264691)
+++ stable/10/crypto/openssh/version.h	Sun Apr 20 12:46:18 2014	(r264692)
@@ -1,10 +1,10 @@
 /* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */
 /* $FreeBSD$ */
 
-#define SSH_VERSION	"OpenSSH_6.6"
+#define SSH_VERSION	"OpenSSH_6.6.1"
 
 #define SSH_PORTABLE	"p1"
 #define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
 
-#define SSH_VERSION_FREEBSD	"FreeBSD-20140324"
+#define SSH_VERSION_FREEBSD	"FreeBSD-20140420"
 #define SSH_VERSION_HPN		"_hpn13v11"



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201404201246.s3KCkI5L027257>