From 3657adf0baa6224cf76d3b478f5bf65890423e07 Mon Sep 17 00:00:00 2001 From: Jan F Date: Mar 22 2011 18:04:37 +0000 Subject: use /dev/random or /dev/urandom for seeding prng --- diff --git a/openssh-5.8p1-entropy.patch b/openssh-5.8p1-entropy.patch index 1758912..14c7970 100644 --- a/openssh-5.8p1-entropy.patch +++ b/openssh-5.8p1-entropy.patch @@ -1,13 +1,85 @@ -diff -up openssh-5.8p1/entropy.c.reseed openssh-5.8p1/entropy.c ---- openssh-5.8p1/entropy.c.reseed 2011-01-13 11:05:29.000000000 +0100 -+++ openssh-5.8p1/entropy.c 2011-03-15 10:18:16.623980109 +0100 -@@ -70,6 +70,9 @@ static uid_t original_uid, original_euid - void - seed_rng(void) - { -+#ifdef USE_PRNG_DEVICE -+/* not yet */ -+#endif - #ifndef OPENSSL_PRNG_ONLY - int devnull; - int p[2]; +diff -up openssh-5.8p1/entropy.c.entropy openssh-5.8p1/entropy.c +--- openssh-5.8p1/entropy.c.entropy 2011-01-13 11:05:29.000000000 +0100 ++++ openssh-5.8p1/entropy.c 2011-03-22 18:26:41.013648606 +0100 +@@ -144,6 +144,9 @@ seed_rng(void) + memset(buf, '\0', sizeof(buf)); + + #endif /* OPENSSL_PRNG_ONLY */ ++#ifdef __linux__ ++ linux_seed(); ++#endif /* __linux__ */ + if (RAND_status() != 1) + fatal("PRNG is not seeded"); + } +diff -up openssh-5.8p1/openbsd-compat/Makefile.in.entropy openssh-5.8p1/openbsd-compat/Makefile.in +--- openssh-5.8p1/openbsd-compat/Makefile.in.entropy 2010-10-07 13:19:24.000000000 +0200 ++++ openssh-5.8p1/openbsd-compat/Makefile.in 2011-03-22 18:28:31.835648739 +0100 +@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport + + COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o + +-PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o ++PORTS=port-aix.o port-irix.o port-linux.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o + + .c.o: + $(CC) $(CFLAGS) $(CPPFLAGS) -c $< +diff -up openssh-5.8p1/openbsd-compat/port-linux-prng.c.entropy openssh-5.8p1/openbsd-compat/port-linux-prng.c +--- openssh-5.8p1/openbsd-compat/port-linux-prng.c.entropy 2011-03-22 18:27:57.422648991 +0100 ++++ openssh-5.8p1/openbsd-compat/port-linux-prng.c 2011-03-22 18:27:57.401648964 +0100 +@@ -0,0 +1,56 @@ ++/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */ ++ ++/* ++ * Copyright (c) 2005 Daniel Walsh ++ * Copyright (c) 2006 Damien Miller ++ * ++ * Permission to use, copy, modify, and distribute this software for any ++ * purpose with or without fee is hereby granted, provided that the above ++ * copyright notice and this permission notice appear in all copies. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES ++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF ++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF ++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ */ ++ ++/* ++ * Linux-specific portability code - prng support ++ */ ++ ++#include "includes.h" ++ ++#include ++#include ++#include ++#include ++ ++#include "log.h" ++#include "xmalloc.h" ++#include "servconf.h" ++#include "port-linux.h" ++#include "key.h" ++#include "hostfile.h" ++#include "auth.h" ++ ++void ++linux_seed(void) ++{ ++ int len; ++ char *env = getenv("SSH_USE_STRONG_RNG"); ++ char *random = "/dev/urandom"; ++ ++ if (env && !strcmp(env, "1")) ++ random = "/dev/random"; ++ ++ errno = 0; ++ if ((len = RAND_load_file(random, 48)) != 48) { ++ if (errno) ++ fatal ("cannot read from %s, %s", random, strerror(errno)); ++ else ++ fatal ("EOF reading %s", random); ++ } ++} diff --git a/openssh-5.8p1-selinux-role.patch b/openssh-5.8p1-selinux-role.patch index f29ad9a..bb01add 100644 --- a/openssh-5.8p1-selinux-role.patch +++ b/openssh-5.8p1-selinux-role.patch @@ -1,6 +1,6 @@ diff -up openssh-5.8p1/auth1.c.role openssh-5.8p1/auth1.c --- openssh-5.8p1/auth1.c.role 2010-08-31 14:36:39.000000000 +0200 -+++ openssh-5.8p1/auth1.c 2011-02-12 14:34:11.000000000 +0100 ++++ openssh-5.8p1/auth1.c 2011-03-22 18:32:17.907648664 +0100 @@ -384,6 +384,9 @@ do_authentication(Authctxt *authctxt) { u_int ulen; @@ -37,8 +37,8 @@ diff -up openssh-5.8p1/auth1.c.role openssh-5.8p1/auth1.c /* Verify that the user is a valid user. */ if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) diff -up openssh-5.8p1/auth2.c.role openssh-5.8p1/auth2.c ---- openssh-5.8p1/auth2.c.role 2010-08-31 14:36:39.000000000 +0200 -+++ openssh-5.8p1/auth2.c 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/auth2.c.role 2011-03-22 18:32:10.876648814 +0100 ++++ openssh-5.8p1/auth2.c 2011-03-22 18:32:17.959648657 +0100 @@ -216,6 +216,9 @@ input_userauth_request(int type, u_int32 Authctxt *authctxt = ctxt; Authmethod *m = NULL; @@ -61,7 +61,7 @@ diff -up openssh-5.8p1/auth2.c.role openssh-5.8p1/auth2.c if ((style = strchr(user, ':')) != NULL) *style++ = 0; -@@ -252,8 +260,15 @@ input_userauth_request(int type, u_int32 +@@ -249,8 +257,15 @@ input_userauth_request(int type, u_int32 use_privsep ? " [net]" : ""); authctxt->service = xstrdup(service); authctxt->style = style ? xstrdup(style) : NULL; @@ -80,7 +80,7 @@ diff -up openssh-5.8p1/auth2.c.role openssh-5.8p1/auth2.c strcmp(service, authctxt->service) != 0) { diff -up openssh-5.8p1/auth2-gss.c.role openssh-5.8p1/auth2-gss.c --- openssh-5.8p1/auth2-gss.c.role 2007-12-02 12:59:45.000000000 +0100 -+++ openssh-5.8p1/auth2-gss.c 2011-02-12 14:34:11.000000000 +0100 ++++ openssh-5.8p1/auth2-gss.c 2011-03-22 18:32:18.009679649 +0100 @@ -258,6 +258,7 @@ input_gssapi_mic(int type, u_int32_t ple Authctxt *authctxt = ctxt; Gssctxt *gssctxt; @@ -114,8 +114,8 @@ diff -up openssh-5.8p1/auth2-gss.c.role openssh-5.8p1/auth2-gss.c authctxt->postponed = 0; diff -up openssh-5.8p1/auth2-hostbased.c.role openssh-5.8p1/auth2-hostbased.c ---- openssh-5.8p1/auth2-hostbased.c.role 2011-02-12 14:34:10.000000000 +0100 -+++ openssh-5.8p1/auth2-hostbased.c 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/auth2-hostbased.c.role 2011-03-22 18:32:12.012648649 +0100 ++++ openssh-5.8p1/auth2-hostbased.c 2011-03-22 18:32:18.052648698 +0100 @@ -106,7 +106,15 @@ userauth_hostbased(Authctxt *authctxt) buffer_put_string(&b, session_id2, session_id2_len); /* reconstruct packet */ @@ -134,8 +134,8 @@ diff -up openssh-5.8p1/auth2-hostbased.c.role openssh-5.8p1/auth2-hostbased.c buffer_put_cstring(&b, "hostbased"); buffer_put_string(&b, pkalg, alen); diff -up openssh-5.8p1/auth2-pubkey.c.role openssh-5.8p1/auth2-pubkey.c ---- openssh-5.8p1/auth2-pubkey.c.role 2011-02-12 14:34:11.000000000 +0100 -+++ openssh-5.8p1/auth2-pubkey.c 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/auth2-pubkey.c.role 2011-03-22 18:32:16.318648486 +0100 ++++ openssh-5.8p1/auth2-pubkey.c 2011-03-22 18:32:18.107648652 +0100 @@ -122,7 +122,15 @@ userauth_pubkey(Authctxt *authctxt) } /* reconstruct packet */ @@ -154,8 +154,8 @@ diff -up openssh-5.8p1/auth2-pubkey.c.role openssh-5.8p1/auth2-pubkey.c datafellows & SSH_BUG_PKSERVICE ? "ssh-userauth" : diff -up openssh-5.8p1/auth.h.role openssh-5.8p1/auth.h ---- openssh-5.8p1/auth.h.role 2011-02-12 14:34:10.000000000 +0100 -+++ openssh-5.8p1/auth.h 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/auth.h.role 2011-03-22 18:32:12.117648630 +0100 ++++ openssh-5.8p1/auth.h 2011-03-22 18:32:18.170648709 +0100 @@ -58,6 +58,9 @@ struct Authctxt { char *service; struct passwd *pw; /* set if 'valid' */ @@ -168,7 +168,7 @@ diff -up openssh-5.8p1/auth.h.role openssh-5.8p1/auth.h #ifdef BSD_AUTH diff -up openssh-5.8p1/auth-pam.c.role openssh-5.8p1/auth-pam.c --- openssh-5.8p1/auth-pam.c.role 2009-07-12 14:07:21.000000000 +0200 -+++ openssh-5.8p1/auth-pam.c 2011-02-12 14:34:11.000000000 +0100 ++++ openssh-5.8p1/auth-pam.c 2011-03-22 18:32:18.230844134 +0100 @@ -1069,7 +1069,7 @@ is_pam_session_open(void) * during the ssh authentication process. */ @@ -180,7 +180,7 @@ diff -up openssh-5.8p1/auth-pam.c.role openssh-5.8p1/auth-pam.c #ifdef HAVE_PAM_PUTENV diff -up openssh-5.8p1/auth-pam.h.role openssh-5.8p1/auth-pam.h --- openssh-5.8p1/auth-pam.h.role 2004-09-11 14:17:26.000000000 +0200 -+++ openssh-5.8p1/auth-pam.h 2011-02-12 14:34:11.000000000 +0100 ++++ openssh-5.8p1/auth-pam.h 2011-03-22 18:32:18.280648665 +0100 @@ -38,7 +38,7 @@ void do_pam_session(void); void do_pam_set_tty(const char *); void do_pam_setcred(int ); @@ -191,9 +191,9 @@ diff -up openssh-5.8p1/auth-pam.h.role openssh-5.8p1/auth-pam.h char ** fetch_pam_child_environment(void); void free_pam_environment(char **); diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c ---- openssh-5.8p1/monitor.c.role 2011-02-12 14:34:11.000000000 +0100 -+++ openssh-5.8p1/monitor.c 2011-02-12 14:34:11.000000000 +0100 -@@ -138,6 +138,9 @@ int mm_answer_sign(int, Buffer *); +--- openssh-5.8p1/monitor.c.role 2011-03-22 18:32:14.465661970 +0100 ++++ openssh-5.8p1/monitor.c 2011-03-22 18:32:18.337831292 +0100 +@@ -140,6 +140,9 @@ int mm_answer_sign(int, Buffer *); int mm_answer_pwnamallow(int, Buffer *); int mm_answer_auth2_read_banner(int, Buffer *); int mm_answer_authserv(int, Buffer *); @@ -203,7 +203,7 @@ diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c int mm_answer_authpassword(int, Buffer *); int mm_answer_bsdauthquery(int, Buffer *); int mm_answer_bsdauthrespond(int, Buffer *); -@@ -218,6 +221,9 @@ struct mon_table mon_dispatch_proto20[] +@@ -221,6 +224,9 @@ struct mon_table mon_dispatch_proto20[] {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, @@ -213,7 +213,7 @@ diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, #ifdef USE_PAM -@@ -703,6 +709,9 @@ mm_answer_pwnamallow(int sock, Buffer *m +@@ -708,6 +714,9 @@ mm_answer_pwnamallow(int sock, Buffer *m else { /* Allow service/style information on the auth context */ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); @@ -223,7 +223,7 @@ diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); } -@@ -747,6 +756,25 @@ mm_answer_authserv(int sock, Buffer *m) +@@ -752,6 +761,25 @@ mm_answer_authserv(int sock, Buffer *m) return (0); } @@ -249,7 +249,7 @@ diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c int mm_answer_authpassword(int sock, Buffer *m) { -@@ -1112,7 +1140,7 @@ static int +@@ -1117,7 +1145,7 @@ static int monitor_valid_userblob(u_char *data, u_int datalen) { Buffer b; @@ -258,7 +258,7 @@ diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c u_int len; int fail = 0; -@@ -1138,6 +1166,8 @@ monitor_valid_userblob(u_char *data, u_i +@@ -1143,6 +1171,8 @@ monitor_valid_userblob(u_char *data, u_i if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) fail++; p = buffer_get_string(&b, NULL); @@ -267,7 +267,7 @@ diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c if (strcmp(authctxt->user, p) != 0) { logit("wrong user name passed to monitor: expected %s != %.100s", authctxt->user, p); -@@ -1169,7 +1199,7 @@ monitor_valid_hostbasedblob(u_char *data +@@ -1174,7 +1204,7 @@ monitor_valid_hostbasedblob(u_char *data char *chost) { Buffer b; @@ -276,7 +276,7 @@ diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c u_int len; int fail = 0; -@@ -1186,6 +1216,8 @@ monitor_valid_hostbasedblob(u_char *data +@@ -1191,6 +1221,8 @@ monitor_valid_hostbasedblob(u_char *data if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) fail++; p = buffer_get_string(&b, NULL); @@ -286,8 +286,8 @@ diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c logit("wrong user name passed to monitor: expected %s != %.100s", authctxt->user, p); diff -up openssh-5.8p1/monitor.h.role openssh-5.8p1/monitor.h ---- openssh-5.8p1/monitor.h.role 2011-02-12 14:34:11.000000000 +0100 -+++ openssh-5.8p1/monitor.h 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/monitor.h.role 2011-03-22 18:32:14.512648974 +0100 ++++ openssh-5.8p1/monitor.h 2011-03-22 18:32:18.382648691 +0100 @@ -31,6 +31,9 @@ enum monitor_reqtype { MONITOR_REQ_MODULI, MONITOR_ANS_MODULI, @@ -299,8 +299,8 @@ diff -up openssh-5.8p1/monitor.h.role openssh-5.8p1/monitor.h MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER, diff -up openssh-5.8p1/monitor_wrap.c.role openssh-5.8p1/monitor_wrap.c ---- openssh-5.8p1/monitor_wrap.c.role 2011-02-12 14:34:11.000000000 +0100 -+++ openssh-5.8p1/monitor_wrap.c 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/monitor_wrap.c.role 2011-03-22 18:32:14.612774442 +0100 ++++ openssh-5.8p1/monitor_wrap.c 2011-03-22 18:32:18.433648592 +0100 @@ -298,6 +298,25 @@ mm_inform_authserv(char *service, char * buffer_free(&m); } @@ -328,8 +328,8 @@ diff -up openssh-5.8p1/monitor_wrap.c.role openssh-5.8p1/monitor_wrap.c int mm_auth_password(Authctxt *authctxt, char *password) diff -up openssh-5.8p1/monitor_wrap.h.role openssh-5.8p1/monitor_wrap.h ---- openssh-5.8p1/monitor_wrap.h.role 2011-02-12 14:34:11.000000000 +0100 -+++ openssh-5.8p1/monitor_wrap.h 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/monitor_wrap.h.role 2011-03-22 18:32:14.659648967 +0100 ++++ openssh-5.8p1/monitor_wrap.h 2011-03-22 18:32:18.486648682 +0100 @@ -41,6 +41,9 @@ int mm_is_monitor(void); DH *mm_choose_dh(int, int, int); int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); @@ -341,20 +341,20 @@ diff -up openssh-5.8p1/monitor_wrap.h.role openssh-5.8p1/monitor_wrap.h char *mm_auth2_read_banner(void); int mm_auth_password(struct Authctxt *, char *); diff -up openssh-5.8p1/openbsd-compat/Makefile.in.role openssh-5.8p1/openbsd-compat/Makefile.in ---- openssh-5.8p1/openbsd-compat/Makefile.in.role 2010-10-07 13:19:24.000000000 +0200 -+++ openssh-5.8p1/openbsd-compat/Makefile.in 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/openbsd-compat/Makefile.in.role 2011-03-22 18:32:15.000000000 +0100 ++++ openssh-5.8p1/openbsd-compat/Makefile.in 2011-03-22 18:34:43.962648778 +0100 @@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o --PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o -+PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o +-PORTS=port-aix.o port-irix.o port-linux.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o ++PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o .c.o: $(CC) $(CFLAGS) $(CPPFLAGS) -c $< diff -up openssh-5.8p1/openbsd-compat/port-linux.c.role openssh-5.8p1/openbsd-compat/port-linux.c ---- openssh-5.8p1/openbsd-compat/port-linux.c.role 2011-02-12 14:34:11.000000000 +0100 -+++ openssh-5.8p1/openbsd-compat/port-linux.c 2011-02-12 14:37:31.000000000 +0100 +--- openssh-5.8p1/openbsd-compat/port-linux.c.role 2011-03-22 18:32:17.782648196 +0100 ++++ openssh-5.8p1/openbsd-compat/port-linux.c 2011-03-22 18:32:18.604648721 +0100 @@ -31,48 +31,73 @@ #include "log.h" @@ -531,8 +531,8 @@ diff -up openssh-5.8p1/openbsd-compat/port-linux.c.role openssh-5.8p1/openbsd-co #ifdef LINUX_OOM_ADJUST diff -up openssh-5.8p1/openbsd-compat/port-linux_part_2.c.role openssh-5.8p1/openbsd-compat/port-linux_part_2.c ---- openssh-5.8p1/openbsd-compat/port-linux_part_2.c.role 2011-02-12 14:34:11.000000000 +0100 -+++ openssh-5.8p1/openbsd-compat/port-linux_part_2.c 2011-02-12 14:34:11.000000000 +0100 +--- openssh-5.8p1/openbsd-compat/port-linux_part_2.c.role 2011-03-22 18:32:18.632648682 +0100 ++++ openssh-5.8p1/openbsd-compat/port-linux_part_2.c 2011-03-22 18:32:18.641648698 +0100 @@ -0,0 +1,75 @@ +/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */ + diff --git a/openssh.spec b/openssh.spec index 584940d..2f6cf62 100644 --- a/openssh.spec +++ b/openssh.spec @@ -71,7 +71,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %define openssh_ver 5.8p1 -%define openssh_rel 18 +%define openssh_rel 19 %define pam_ssh_agent_ver 0.9.2 %define pam_ssh_agent_rel 30 @@ -669,6 +669,9 @@ fi %endif %changelog +* Tue Mar 22 2011 Jan F. Chadima - 5.8p1-19 + 0.9.2-30 +- use /dev/random or /dev/urandom for seeding prng + * Thu Mar 17 2011 Jan F. Chadima - 5.8p1-18 + 0.9.2-30 - add periodical reseeding of random generator - change selinux contex for internal sftp in do_usercontext