Import OpenSSH 9.3 + the fix from p2 for the PKCS#11 remote provider
The previous version was OpenSSH 9.1 OpenSSH 9.3p2 (2023-07-19) OpenSSH 9.3p2 was released on 2023-07-19. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html Changes since OpenSSH 9.3 ========================= This release fixes a security bug. Security ======== Fix CVE-2023-38408 - a condition where specific libaries loaded via ssh-agent(1)'s PKCS#11 support could be abused to achieve remote code execution via a forwarded agent socket if the following conditions are met: * Exploitation requires the presence of specific libraries on the victim system. * Remote exploitation requires that the agent was forwarded to an attacker-controlled system. Exploitation can also be prevented by starting ssh-agent(1) with an empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring an allowlist that contains only specific provider libraries. This vulnerability was discovered and demonstrated to be exploitable by the Qualys Security Advisory team. In addition to removing the main precondition for exploitation, this release removes the ability for remote ssh-agent(1) clients to load PKCS#11 modules by default (see below). Potentially-incompatible changes -------------------------------- * ssh-agent(8): the agent will now refuse requests to load PKCS#11 modules issued by remote clients by default. A flag has been added to restore the previous behaviour "-Oallow-remote-pkcs11". Note that ssh-agent(8) depends on the SSH client to identify requests that are remote. The OpenSSH >=8.9 ssh(1) client does this, but forwarding access to an agent socket using other tools may circumvent this restriction. Checksums: ========== - SHA1 (openssh-9.3p2.tar.gz) = 219cf700c317f400bb20b001c0406056f7188ea4 - SHA256 (openssh-9.3p2.tar.gz) = IA6+FH9ss/EB/QzfngJEKvfdyimN/9n0VoeOfMrGdug= Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc Reporting Bugs: =============== - Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com OpenSSH 9.3/9.3p1 (2023-03-15) OpenSSH 9.3 was released on 2023-03-15. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html Changes since OpenSSH 9.2 ========================= This release fixes a number of security bugs. Security ======== This release contains fixes for a security problem and a memory safety problem. The memory safety problem is not believed to be exploitable, but we report most network-reachable memory faults as security bugs. * ssh-add(1): when adding smartcard keys to ssh-agent(1) with the per-hop destination constraints (ssh-add -h ...) added in OpenSSH 8.9, a logic error prevented the constraints from being communicated to the agent. This resulted in the keys being added without constraints. The common cases of non-smartcard keys and keys without destination constraints are unaffected. This problem was reported by Luci Stanescu. * ssh(1): Portable OpenSSH provides an implementation of the getrrsetbyname(3) function if the standard library does not provide it, for use by the VerifyHostKeyDNS feature. A specifically crafted DNS response could cause this function to perform an out-of-bounds read of adjacent stack data, but this condition does not appear to be exploitable beyond denial-of- service to the ssh(1) client. The getrrsetbyname(3) replacement is only included if the system's standard library lacks this function and portable OpenSSH was not compiled with the ldns library (--with-ldns). getrrsetbyname(3) is only invoked if using VerifyHostKeyDNS to fetch SSHFP records. This problem was found by the Coverity static analyzer. New features ------------ * ssh-keygen(1), ssh-keyscan(1): accept -Ohashalg=sha1|sha256 when outputting SSHFP fingerprints to allow algorithm selection. bz3493 * sshd(8): add a `sshd -G` option that parses and prints the effective configuration without attempting to load private keys and perform other checks. This allows usage of the option before keys have been generated and for configuration evaluation and verification by unprivileged users. Bugfixes -------- * scp(1), sftp(1): fix progressmeter corruption on wide displays; bz3534 * ssh-add(1), ssh-keygen(1): use RSA/SHA256 when testing usability of private keys as some systems are starting to disable RSA/SHA1 in libcrypto. * sftp-server(8): fix a memory leak. GHPR363 * ssh(1), sshd(8), ssh-keyscan(1): remove vestigal protocol compatibility code and simplify what's left. * Fix a number of low-impact Coverity static analysis findings. These include several reported via bz2687 * ssh_config(5), sshd_config(5): mention that some options are not first-match-wins. * Rework logging for the regression tests. Regression tests will now capture separate logs for each ssh and sshd invocation in a test. * ssh(1): make `ssh -Q CASignatureAlgorithms` work as the manpage says it should; bz3532. * ssh(1): ensure that there is a terminating newline when adding a new entry to known_hosts; bz3529 Portability ----------- * sshd(8): harden Linux seccomp sandbox. Move to an allowlist of mmap(2), madvise(2) and futex(2) flags, removing some concerning kernel attack surface. * sshd(8): improve Linux seccomp-bpf sandbox for older systems; bz3537 Checksums: ========== - SHA1 (openssh-9.3.tar.gz) = 5f9d2f73ddfe94f3f0a78bdf46704b6ad7b66ec7 - SHA256 (openssh-9.3.tar.gz) = eRcXkFZByz70DUBUcyIdvU0pVxP2X280FrmV8pyUdrk= - SHA1 (openssh-9.3p1.tar.gz) = 610959871bf8d6baafc3525811948f85b5dd84ab - SHA256 (openssh-9.3p1.tar.gz) = 6bq6dwGnalHz2Fpiw4OjydzZf6kAuFm8fbEUwYaK+Kg= Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc Reporting Bugs: =============== - Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com OpenSSH 9.2/9.2p1 (2023-02-02) OpenSSH 9.2 was released on 2023-02-02. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html Changes since OpenSSH 9.1 ========================= This release fixes a number of security bugs. Security ======== This release contains fixes for two security problems and a memory safety problem. The memory safety problem is not believed to be exploitable, but we report most network-reachable memory faults as security bugs. * sshd(8): fix a pre-authentication double-free memory fault introduced in OpenSSH 9.1. This is not believed to be exploitable, and it occurs in the unprivileged pre-auth process that is subject to chroot(2) and is further sandboxed on most major platforms. * ssh(8): in OpenSSH releases after 8.7, the PermitRemoteOpen option would ignore its first argument unless it was one of the special keywords "any" or "none", causing the permission list to fail open if only one permission was specified. bz3515 * ssh(1): if the CanonicalizeHostname and CanonicalizePermittedCNAMEs options were enabled, and the system/libc resolver did not check that names in DNS responses were valid, then use of these options could allow an attacker with control of DNS to include invalid characters (possibly including wildcards) in names added to known_hosts files when they were updated. These names would still have to match the CanonicalizePermittedCNAMEs allow-list, so practical exploitation appears unlikely. Potentially-incompatible changes -------------------------------- * ssh(1): add a new EnableEscapeCommandline ssh_config(5) option that controls whether the client-side ~C escape sequence that provides a command-line is available. Among other things, the ~C command-line could be used to add additional port-forwards at runtime. This option defaults to "no", disabling the ~C command-line that was previously enabled by default. Turning off the command-line allows platforms that support sandboxing of the ssh(1) client (currently only OpenBSD) to use a stricter default sandbox policy. New features ------------ * sshd(8): add support for channel inactivity timeouts via a new sshd_config(5) ChannelTimeout directive. This allows channels that have not seen traffic in a configurable interval to be automatically closed. Different timeouts may be applied to session, X11, agent and TCP forwarding channels. * sshd(8): add a sshd_config UnusedConnectionTimeout option to terminate client connections that have no open channels for a length of time. This complements the ChannelTimeout option above. * sshd(8): add a -V (version) option to sshd like the ssh client has. * ssh(1): add a "Host" line to the output of ssh -G showing the original hostname argument. bz3343 * scp(1), sftp(1): add a -X option to both scp(1) and sftp(1) to allow control over some SFTP protocol parameters: the copy buffer length and the number of in-flight requests, both of which are used during upload/download. Previously these could be controlled in sftp(1) only. This makes them available in both SFTP protocol clients using the same option character sequence. * ssh-keyscan(1): allow scanning of complete CIDR address ranges, e.g. "ssh-keyscan 192.168.0.0/24". If a CIDR range is passed, then it will be expanded to all possible addresses in the range including the all-0s and all-1s addresses. bz#976 * ssh(1): support dynamic remote port forwarding in escape command-line's -R processing. bz#3499 Bugfixes -------- * ssh(1): when restoring non-blocking mode to stdio fds, restore exactly the flags that ssh started with and don't just clobber them with zero, as this could also remove the append flag from the set. bz3523 * ssh(1): avoid printf("%s", NULL) if using UserKnownHostsFile=none and a hostkey in one of the system known hosts file changes. * scp(1): switch scp from using pipes to a socket-pair for communication with its ssh sub-processes, matching how sftp(1) operates. * sshd(8): clear signal mask early in main(); sshd may have been started with one or more signals masked (sigprocmask(2) is not cleared on fork/exec) and this could interfere with various things, e.g. the login grace timer. Execution environments that fail to clear the signal mask before running sshd are clearly broken, but apparently they do exist. * ssh(1): warn if no host keys for hostbased auth can be loaded. * sshd(8): Add server debugging for hostbased auth that is queued and sent to the client after successful authentication, but also logged to assist in diagnosis of HostbasedAuthentication problems. bz3507 * ssh(1): document use of the IdentityFile option as being usable to list public keys as well as private keys. GHPR352 * sshd(8): check for and disallow MaxStartups values less than or equal to zero during config parsing, rather than failing later at runtime. bz3489 * ssh-keygen(1): fix parsing of hex cert expiry times specified on the command-line when acting as a CA. * scp(1): when scp(1) is using the SFTP protocol for transport (the default), better match scp/rcp's handling of globs that don't match the globbed characters but do match literally (e.g. trying to transfer a file named "foo.[1]"). Previously scp(1) in SFTP mode would not match these pathnames but legacy scp/rcp mode would. bz3488 * ssh-agent(1): document the "-O no-restrict-websafe" command-line option. * ssh(1): honour user's umask(2) if it is more restrictive then the ssh default (022). Portability ----------- * sshd(8): allow writev(2) in the Linux seccomp sandbox. This seems to be used by recent glibcs at least in some configurations during error conditions. bz3512. * sshd(8): simply handling of SSH_CONNECTION PAM env var, removing global variable and checking the return value from pam_putenv. bz3508 * sshd(8): disable SANDBOX_SECCOMP_FILTER_DEBUG that was mistakenly enabled during the OpenSSH 9.1 release cycle. * misc: update autotools and regenerate the config files using the latest autotools * all: use -fzero-call-used-regs=used on clang 15 instead of -fzero-call-used-reg=all, as some versions of clang 15 have miscompile code when it was enabled. bz3475 * sshd(8): defer PRNG seeding until after the initial closefrom(2) call. PRNG seeding will initialize OpenSSL, and some engine providers (e.g. Intel's QAT) will open descriptors for their own use that closefrom(2) could clobber. bz3483 * misc: in the poll(2)/ppoll(2) compatibility code, avoid assuming the layout of fd_set. * sftp-server(8), ssh-agent(1): fix ptrace(2) disabling on older FreeBSD kernels. Some versions do not support using id 0 to refer to the current PID for procctl, so try again with getpid() explicitly before failing. * configure.ac: fix -Wstrict-prototypes in configure test code. Clang 16 now warns on this and legacy prototypes will be removed in C23. GHPR355 * configure.ac: fix setres*id checks to work with clang-16. glibc has the prototypes for setresuid behind _GNU_SOURCE, and clang 16 will error out on implicit function definitions. bz3497 Checksums: ========== - SHA1 (openssh-9.2.tar.gz) = e4b806b7c81b87d6c90afe97b3d016ba6cf3ba1c - SHA256 (openssh-9.2.tar.gz) = yYe9uaaWSeetXGXOxuaaEiIsLnvITmGW+l5dgMZb9QU= - SHA1 (openssh-9.2p1.tar.gz) = 3b172b8e971773a7018bbf3231f6589ae539ca4b - SHA256 (openssh-9.2p1.tar.gz) = P2bb8WVftF9Q4cVtpiqwEhjCKIB7ITONY068351xz0Y= Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc Reporting Bugs: =============== - Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh@openssh.com
This commit is contained in:
christos
parent
5d8d648fc2
commit
673be2cba9
|
|
@ -52,9 +52,13 @@ int addr_sa_pton(const char *h, const char *s, struct sockaddr *sa,
|
|||
int addr_pton_cidr(const char *p, struct xaddr *n, u_int *l);
|
||||
int addr_ntop(const struct xaddr *n, char *p, size_t len);
|
||||
int addr_and(struct xaddr *dst, const struct xaddr *a, const struct xaddr *b);
|
||||
int addr_or(struct xaddr *dst, const struct xaddr *a, const struct xaddr *b);
|
||||
int addr_cmp(const struct xaddr *a, const struct xaddr *b);
|
||||
int addr_is_all0s(const struct xaddr *n);
|
||||
int addr_host_is_all0s(const struct xaddr *n, u_int masklen);
|
||||
int addr_host_to_all0s(struct xaddr *a, u_int masklen);
|
||||
int addr_host_to_all1s(struct xaddr *a, u_int masklen);
|
||||
int addr_netmatch(const struct xaddr *host, const struct xaddr *net,
|
||||
u_int masklen);
|
||||
void addr_increment(struct xaddr *a);
|
||||
#endif /* _ADDR_H */
|
||||
|
|
|
|||
|
|
@ -0,0 +1,119 @@
|
|||
#!/bin/sh
|
||||
# $OpenBSD: ed25519.sh,v 1.1 2023/01/15 23:05:32 djm Exp $
|
||||
# Placed in the Public Domain.
|
||||
#
|
||||
AUTHOR="supercop-20221122/crypto_sign/ed25519/ref/implementors"
|
||||
FILES="
|
||||
supercop-20221122/crypto_verify/32/ref/verify.c
|
||||
supercop-20221122/crypto_sign/ed25519/ref/fe25519.h
|
||||
supercop-20221122/crypto_sign/ed25519/ref/fe25519.c
|
||||
supercop-20221122/crypto_sign/ed25519/ref/sc25519.h
|
||||
supercop-20221122/crypto_sign/ed25519/ref/sc25519.c
|
||||
supercop-20221122/crypto_sign/ed25519/ref/ge25519.h
|
||||
supercop-20221122/crypto_sign/ed25519/ref/ge25519.c
|
||||
supercop-20221122/crypto_sign/ed25519/ref/keypair.c
|
||||
supercop-20221122/crypto_sign/ed25519/ref/sign.c
|
||||
supercop-20221122/crypto_sign/ed25519/ref/open.c
|
||||
"
|
||||
###
|
||||
|
||||
DATA="supercop-20221122/crypto_sign/ed25519/ref/ge25519_base.data"
|
||||
|
||||
set -e
|
||||
cd $1
|
||||
echo -n '/* $'
|
||||
echo 'OpenBSD: $ */'
|
||||
echo
|
||||
echo '/*'
|
||||
echo ' * Public Domain, Authors:'
|
||||
sed -e '/Alphabetical order:/d' -e 's/^/ * - /' < $AUTHOR
|
||||
echo ' */'
|
||||
echo
|
||||
echo '#include <string.h>'
|
||||
echo
|
||||
echo '#include "crypto_api.h"'
|
||||
echo
|
||||
# Map the types used in this code to the ones in crypto_api.h. We use #define
|
||||
# instead of typedef since some systems have existing intXX types and do not
|
||||
# permit multiple typedefs even if they do not conflict.
|
||||
for t in int8 uint8 int16 uint16 int32 uint32 int64 uint64; do
|
||||
echo "#define $t crypto_${t}"
|
||||
done
|
||||
echo
|
||||
for i in $FILES; do
|
||||
echo "/* from $i */"
|
||||
# Changes to all files:
|
||||
# - inline ge25519_base.data where it is included
|
||||
# - expand CRYPTO_NAMESPACE() namespacing define
|
||||
# - remove all includes, we inline everything required.
|
||||
# - make functions not required elsewhere static.
|
||||
# - rename the functions we do use.
|
||||
sed \
|
||||
-e "/#include \"ge25519_base.data\"/r $DATA" \
|
||||
-e "/#include/d" \
|
||||
-e "s/^void /static void /g" \
|
||||
-e 's/CRYPTO_NAMESPACE[(]\([a-zA-Z0-9_]*\)[)]/crypto_sign_ed25519_ref_\1/g' \
|
||||
$i | \
|
||||
case "$i" in
|
||||
*/crypto_verify/32/ref/verify.c)
|
||||
# rename crypto_verify() to the name that the ed25519 code expects.
|
||||
sed -e "/^#include.*/d" \
|
||||
-e "s/crypto_verify/crypto_verify_32/g" \
|
||||
-e "s/^int /static int /g"
|
||||
;;
|
||||
*/crypto_sign/ed25519/ref/sign.c)
|
||||
# rename signing function to the name OpenSSH expects
|
||||
sed -e "s/crypto_sign/crypto_sign_ed25519/g"
|
||||
;;
|
||||
*/crypto_sign/ed25519/ref/keypair.c)
|
||||
# rename key generation function to the name OpenSSH expects
|
||||
sed -e "s/crypto_sign_keypair/crypto_sign_ed25519_keypair/g"
|
||||
;;
|
||||
*/crypto_sign/ed25519/ref/open.c)
|
||||
# rename verification function to the name OpenSSH expects
|
||||
sed -e "s/crypto_sign_open/crypto_sign_ed25519_open/g"
|
||||
;;
|
||||
*/crypto_sign/ed25519/ref/fe25519.*)
|
||||
# avoid a couple of name collions with other files
|
||||
sed -e "s/reduce_add_sub/fe25519_reduce_add_sub/g" \
|
||||
-e "s/ equal[(]/ fe25519_equal(/g" \
|
||||
-e "s/^int /static int /g"
|
||||
;;
|
||||
*/crypto_sign/ed25519/ref/sc25519.h)
|
||||
# Lots of unused prototypes to remove
|
||||
sed -e "s/^int /static int /g" \
|
||||
-e '/shortsc25519_from16bytes/d' \
|
||||
-e '/sc25519_iszero_vartime/d' \
|
||||
-e '/sc25519_isshort_vartime/d' \
|
||||
-e '/sc25519_lt_vartime/d' \
|
||||
-e '/sc25519_sub_nored/d' \
|
||||
-e '/sc25519_mul_shortsc/d' \
|
||||
-e '/sc25519_from_shortsc/d' \
|
||||
-e '/sc25519_window5/d'
|
||||
;;
|
||||
*/crypto_sign/ed25519/ref/sc25519.c)
|
||||
# Lots of unused code to remove, some name collisions to avoid
|
||||
sed -e "s/reduce_add_sub/sc25519_reduce_add_sub/g" \
|
||||
-e "s/ equal[(]/ sc25519_equal(/g" \
|
||||
-e "s/^int /static int /g" \
|
||||
-e "s/m[[]/sc25519_m[/g" \
|
||||
-e "s/mu[[]/sc25519_mu[/g" \
|
||||
-e '/shortsc25519_from16bytes/,/^}$/d' \
|
||||
-e '/sc25519_iszero_vartime/,/^}$/d' \
|
||||
-e '/sc25519_isshort_vartime/,/^}$/d' \
|
||||
-e '/sc25519_lt_vartime/,/^}$/d' \
|
||||
-e '/sc25519_sub_nored/,/^}$/d' \
|
||||
-e '/sc25519_mul_shortsc/,/^}$/d' \
|
||||
-e '/sc25519_from_shortsc/,/^}$/d' \
|
||||
-e '/sc25519_window5/,/^}$/d'
|
||||
;;
|
||||
*/crypto_sign/ed25519/ref//ge25519.*)
|
||||
sed -e "s/^int /static int /g"
|
||||
;;
|
||||
# Default: pass through.
|
||||
*)
|
||||
cat
|
||||
;;
|
||||
esac | \
|
||||
sed -e 's/[ ]*$//'
|
||||
done
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
#!/bin/sh
|
||||
# $OpenBSD: sntrup761.sh,v 1.5 2021/01/08 02:33:13 dtucker Exp $
|
||||
# $OpenBSD: sntrup761.sh,v 1.7 2023/01/11 02:13:52 djm Exp $
|
||||
# Placed in the Public Domain.
|
||||
#
|
||||
AUTHOR="supercop-20201130/crypto_kem/sntrup761/ref/implementors"
|
||||
|
|
@ -45,7 +45,7 @@ for i in $FILES; do
|
|||
# - remove all includes, we inline everything required.
|
||||
# - make functions not required elsewhere static.
|
||||
# - rename the functions we do use.
|
||||
# - remove unneccesary defines and externs.
|
||||
# - remove unnecessary defines and externs.
|
||||
sed -e "/#include/d" \
|
||||
-e "s/crypto_kem_/crypto_kem_sntrup761_/g" \
|
||||
-e "s/^void /static void /g" \
|
||||
|
|
@ -54,6 +54,7 @@ for i in $FILES; do
|
|||
-e "/^extern /d" \
|
||||
-e '/CRYPTO_NAMESPACE/d' \
|
||||
-e "/^#define int32 crypto_int32/d" \
|
||||
-e 's/[ ]*$//' \
|
||||
$i | \
|
||||
case "$i" in
|
||||
# Use int64_t for intermediate values in int32_MINMAX to prevent signed
|
||||
|
|
|
|||
Loading…
Reference in New Issue