From 61d8caa61f40893ddbfd847c36853c5f1b778b03 Mon Sep 17 00:00:00 2001 From: Jan F. Chadima Date: Jan 28 2010 11:52:51 +0000 Subject: optimized FD_CLOEXEC on accept socket --- diff --git a/openssh-5.1p1-cloexec.patch b/openssh-5.1p1-cloexec.patch index e9fa4d1..3d88be5 100644 --- a/openssh-5.1p1-cloexec.patch +++ b/openssh-5.1p1-cloexec.patch @@ -1,6 +1,6 @@ diff -up openssh-5.3p1/channels.c.cloexec openssh-5.3p1/channels.c ---- openssh-5.3p1/channels.c.cloexec 2010-01-19 09:26:50.000000000 +0100 -+++ openssh-5.3p1/channels.c 2010-01-19 09:26:51.000000000 +0100 +--- openssh-5.3p1/channels.c.cloexec 2010-01-25 17:25:58.000000000 +0100 ++++ openssh-5.3p1/channels.c 2010-01-25 17:26:01.000000000 +0100 @@ -60,6 +60,7 @@ #include #include @@ -29,8 +29,8 @@ diff -up openssh-5.3p1/channels.c.cloexec openssh-5.3p1/channels.c c->wfd = wfd; c->sock = (rfd == wfd) ? rfd : -1; diff -up openssh-5.3p1/sshconnect2.c.cloexec openssh-5.3p1/sshconnect2.c ---- openssh-5.3p1/sshconnect2.c.cloexec 2010-01-19 09:26:50.000000000 +0100 -+++ openssh-5.3p1/sshconnect2.c 2010-01-19 09:26:51.000000000 +0100 +--- openssh-5.3p1/sshconnect2.c.cloexec 2010-01-25 17:25:58.000000000 +0100 ++++ openssh-5.3p1/sshconnect2.c 2010-01-25 17:26:01.000000000 +0100 @@ -39,6 +39,7 @@ #include #include @@ -49,7 +49,7 @@ diff -up openssh-5.3p1/sshconnect2.c.cloexec openssh-5.3p1/sshconnect2.c if (dup2(from[1], STDOUT_FILENO) < 0) diff -up openssh-5.3p1/sshconnect.c.cloexec openssh-5.3p1/sshconnect.c --- openssh-5.3p1/sshconnect.c.cloexec 2009-06-21 10:53:53.000000000 +0200 -+++ openssh-5.3p1/sshconnect.c 2010-01-19 09:26:51.000000000 +0100 ++++ openssh-5.3p1/sshconnect.c 2010-01-25 17:26:01.000000000 +0100 @@ -38,6 +38,7 @@ #include #include @@ -72,13 +72,16 @@ diff -up openssh-5.3p1/sshconnect.c.cloexec openssh-5.3p1/sshconnect.c /* Bind the socket to an alternative local IP address */ if (options.bind_address == NULL) diff -up openssh-5.3p1/sshd.c.cloexec openssh-5.3p1/sshd.c ---- openssh-5.3p1/sshd.c.cloexec 2010-01-19 09:43:45.000000000 +0100 -+++ openssh-5.3p1/sshd.c 2010-01-19 09:47:04.000000000 +0100 -@@ -1105,6 +1105,7 @@ server_accept_loop(int *sock_in, int *so - error("accept: %.100s", strerror(errno)); - continue; - } -+ fcntl(*newsock, F_SETFD, FD_CLOEXEC); - if (unset_nonblock(*newsock) == -1) { - close(*newsock); - continue; +--- openssh-5.3p1/sshd.c.cloexec 2010-01-25 17:25:55.000000000 +0100 ++++ openssh-5.3p1/sshd.c 2010-01-25 18:29:23.000000000 +0100 +@@ -1756,6 +1756,10 @@ main(int ac, char **av) + sock_in, sock_out, newsock, startup_pipe, config_s[0]); + } + ++ /* set fd cloexec on io/sockets to avoid to forward them to childern */ ++ fcntl(sock_out, F_SETFD, FD_CLOEXEC); ++ fcntl(sock_in, F_SETFD, FD_CLOEXEC); ++ + /* + * Disable the key regeneration alarm. We will not regenerate the + * key since we are no longer in a position to give it to anyone. We diff --git a/openssh-5.3p1-randclean.patch b/openssh-5.3p1-randclean.patch index 897c3f8..61a56d1 100644 --- a/openssh-5.3p1-randclean.patch +++ b/openssh-5.3p1-randclean.patch @@ -1,110 +1,13 @@ -diff -up openssh-5.3p1/ssh-add.c.randclean openssh-5.3p1/ssh-add.c ---- openssh-5.3p1/ssh-add.c.randclean 2010-01-20 19:13:28.000000000 +0100 -+++ openssh-5.3p1/ssh-add.c 2010-01-20 19:13:29.000000000 +0100 -@@ -41,6 +41,7 @@ - #include - #include - -+#include - #include - #include - #include "openbsd-compat/openssl-compat.h" -@@ -471,6 +472,9 @@ main(int argc, char **argv) - int use_nss = 0; - #endif - -+ /* clean the PRNG status when exiting the program */ -+ atexit(RAND_cleanup); -+ - /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ - sanitise_stdfd(); - -diff -up openssh-5.3p1/ssh.c.randclean openssh-5.3p1/ssh.c ---- openssh-5.3p1/ssh.c.randclean 2010-01-20 19:13:29.000000000 +0100 -+++ openssh-5.3p1/ssh.c 2010-01-20 19:13:29.000000000 +0100 -@@ -70,6 +70,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -220,6 +221,9 @@ main(int ac, char **av) - struct servent *sp; - Forward fwd; - -+ /* clean the PRNG status when exiting the program */ -+ atexit(RAND_cleanup); -+ - /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ - sanitise_stdfd(); - -diff -up openssh-5.3p1/sshd.c.randclean openssh-5.3p1/sshd.c ---- openssh-5.3p1/sshd.c.randclean 2010-01-20 19:13:29.000000000 +0100 -+++ openssh-5.3p1/sshd.c 2010-01-20 19:13:29.000000000 +0100 -@@ -1263,6 +1263,9 @@ main(int ac, char **av) - Key *key; - Authctxt *authctxt; - -+ /* clean the PRNG status when exiting the program */ -+ atexit(RAND_cleanup); -+ - #ifdef HAVE_SECUREWARE - (void)set_auth_parameters(ac, av); - #endif -diff -up openssh-5.3p1/ssh-keygen.c.randclean openssh-5.3p1/ssh-keygen.c ---- openssh-5.3p1/ssh-keygen.c.randclean 2010-01-20 19:13:29.000000000 +0100 -+++ openssh-5.3p1/ssh-keygen.c 2010-01-20 19:13:29.000000000 +0100 -@@ -19,6 +19,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -1120,6 +1121,9 @@ main(int argc, char **argv) - extern int optind; - extern char *optarg; - -+ /* clean the PRNG status when exiting the program */ -+ atexit(RAND_cleanup); -+ - /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ - sanitise_stdfd(); - -diff -up openssh-5.3p1/ssh-keyscan.c.randclean openssh-5.3p1/ssh-keyscan.c ---- openssh-5.3p1/ssh-keyscan.c.randclean 2009-01-28 06:31:23.000000000 +0100 -+++ openssh-5.3p1/ssh-keyscan.c 2010-01-20 19:21:16.000000000 +0100 -@@ -18,6 +18,7 @@ - #include - #include - -+#include - #include - - #include -@@ -730,6 +731,9 @@ main(int argc, char **argv) - extern int optind; - extern char *optarg; - -+ /* clean the PRNG status when exiting the program */ -+ atexit(RAND_cleanup); -+ - __progname = ssh_get_progname(argv[0]); - init_rng(); - seed_rng(); -diff -up openssh-5.3p1/ssh-keysign.c.randclean openssh-5.3p1/ssh-keysign.c ---- openssh-5.3p1/ssh-keysign.c.randclean 2006-09-01 07:38:37.000000000 +0200 -+++ openssh-5.3p1/ssh-keysign.c 2010-01-20 19:13:29.000000000 +0100 -@@ -158,6 +158,9 @@ main(int argc, char **argv) - u_int slen, dlen; - u_int32_t rnd[256]; +diff -up openssh-5.3p1/entropy.c.randclean openssh-5.3p1/entropy.c +--- openssh-5.3p1/entropy.c.randclean 2010-01-21 09:26:30.000000000 +0100 ++++ openssh-5.3p1/entropy.c 2010-01-21 09:26:37.000000000 +0100 +@@ -159,6 +159,9 @@ init_rng(void) + fatal("OpenSSL version mismatch. Built against %lx, you " + "have %lx", OPENSSL_VERSION_NUMBER, SSLeay()); + /* clean the PRNG status when exiting the program */ + atexit(RAND_cleanup); + - /* Ensure that stdin and stdout are connected */ - if ((fd = open(_PATH_DEVNULL, O_RDWR)) < 2) - exit(1); + #ifndef OPENSSL_PRNG_ONLY + original_uid = getuid(); + original_euid = geteuid(); diff --git a/openssh.spec b/openssh.spec index 2b55317..43ef768 100644 --- a/openssh.spec +++ b/openssh.spec @@ -69,7 +69,7 @@ Summary: An open source implementation of SSH protocol versions 1 and 2 Name: openssh Version: 5.3p1 -Release: 16%{?dist}%{?rescue_rel} +Release: 18%{?dist}%{?rescue_rel} URL: http://www.openssh.com/portable.html #URL1: http://pamsshauth.sourceforge.net #Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz @@ -527,6 +527,12 @@ fi %endif %changelog +* Thu Jan 28 2010 Jan F. Chadima - 5.3p1-18 +- optimized FD_CLOEXEC on accept socket (#541809) + +* Thu Jan 21 2010 Jan F. Chadima - 5.3p1-17 +- optimized RAND_cleanup patch (#557166) + * Wed Jan 20 2010 Jan F. Chadima - 5.3p1-16 - add RAND_cleanup at the exit of each program using RAND (#557166)