From 431023a318e680258f02c1fb5fdca176c68e5cb7 Mon Sep 17 00:00:00 2001 From: Nicolás Reynolds Date: Thu, 24 Apr 2014 03:30:57 +0000 Subject: Thu Apr 24 03:25:33 UTC 2014 --- core/bash/PKGBUILD | 12 +- ...2-do-not-use-memcpy-on-overlapping-memory.patch | 12 -- core/bash/bash-4.3-debug-trap.patch | 30 ---- core/bash/bash-4.3-test-nameref.patch | 25 --- core/openssh/PKGBUILD | 11 +- core/openssh/curve25519pad.patch | 171 +++++++++++++++++++++ core/readline/PKGBUILD | 10 +- 7 files changed, 196 insertions(+), 75 deletions(-) delete mode 100644 core/bash/bash-4.2-do-not-use-memcpy-on-overlapping-memory.patch delete mode 100644 core/bash/bash-4.3-debug-trap.patch delete mode 100644 core/bash/bash-4.3-test-nameref.patch create mode 100644 core/openssh/curve25519pad.patch (limited to 'core') diff --git a/core/bash/PKGBUILD b/core/bash/PKGBUILD index facd6a1ac..8ee46db7c 100644 --- a/core/bash/PKGBUILD +++ b/core/bash/PKGBUILD @@ -1,13 +1,13 @@ -# $Id: PKGBUILD 209915 2014-04-08 15:23:40Z anatolik $ +# $Id: PKGBUILD 211713 2014-04-23 18:51:16Z bpiotrowski $ # Maintainer: Bartłomiej Piotrowski # Contributor: Allan McRae # Contributor: Aaron Griffin pkgname=bash _basever=4.3 -_patchlevel=008 +_patchlevel=011 pkgver=$_basever.$_patchlevel -pkgrel=2 +pkgrel=1 pkgdesc='The GNU Bourne Again shell' arch=('i686' 'x86_64') license=('GPL') @@ -94,4 +94,10 @@ md5sums=('81348932d5da294953e15d4814c74dd1' 'dcf471d222bcd83283d3094e6ceeb6f8' 'SKIP' 'f7553416646dc26c266454c78a916d36' + 'SKIP' + '7e73d2151f4064b484a4ba2c4b09960e' + 'SKIP' + 'a275463d21735bb6d7161f9fbd320d8f' + 'SKIP' + 'c17103ee20420d77e46b224c8d3fceda' 'SKIP') diff --git a/core/bash/bash-4.2-do-not-use-memcpy-on-overlapping-memory.patch b/core/bash/bash-4.2-do-not-use-memcpy-on-overlapping-memory.patch deleted file mode 100644 index c621f0af8..000000000 --- a/core/bash/bash-4.2-do-not-use-memcpy-on-overlapping-memory.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Naur bash-4.2-orig/general.c bash-4.2/general.c ---- bash-4.2-orig/general.c 2010-12-13 06:06:27.000000000 +1000 -+++ bash-4.2/general.c 2013-08-25 21:52:36.681484302 +1000 -@@ -766,7 +766,7 @@ - *nbeg++ = '.'; - - nlen = nend - ntail; -- memcpy (nbeg, ntail, nlen); -+ memmove (nbeg, ntail, nlen); - nbeg[nlen] = '\0'; - - return name; diff --git a/core/bash/bash-4.3-debug-trap.patch b/core/bash/bash-4.3-debug-trap.patch deleted file mode 100644 index 8d0a73288..000000000 --- a/core/bash/bash-4.3-debug-trap.patch +++ /dev/null @@ -1,30 +0,0 @@ -*** ../bash-4.3/trap.c 2014-02-05 10:03:21.000000000 -0500 ---- trap.c 2014-02-28 09:51:43.000000000 -0500 -*************** -*** 921,925 **** - - #if defined (JOB_CONTROL) -! save_pipeline (1); /* XXX only provides one save level */ - #endif - ---- 921,926 ---- - - #if defined (JOB_CONTROL) -! if (sig != DEBUG_TRAP) /* run_debug_trap does this */ -! save_pipeline (1); /* XXX only provides one save level */ - #endif - -*************** -*** 941,945 **** - - #if defined (JOB_CONTROL) -! restore_pipeline (1); - #endif - ---- 942,947 ---- - - #if defined (JOB_CONTROL) -! if (sig != DEBUG_TRAP) /* run_debug_trap does this */ -! restore_pipeline (1); - #endif - diff --git a/core/bash/bash-4.3-test-nameref.patch b/core/bash/bash-4.3-test-nameref.patch deleted file mode 100644 index d64a3ccfa..000000000 --- a/core/bash/bash-4.3-test-nameref.patch +++ /dev/null @@ -1,25 +0,0 @@ -*** ../bash-4.3/test.c 2014-02-04 16:52:58.000000000 -0500 ---- test.c 2014-02-28 21:22:44.000000000 -0500 -*************** -*** 647,652 **** - - case 'R': -! v = find_variable (arg); -! return (v && invisible_p (v) == 0 && var_isset (v) && nameref_p (v) ? TRUE : FALSE); - } - ---- 647,652 ---- - - case 'R': -! v = find_variable_noref (arg); -! return ((v && invisible_p (v) == 0 && var_isset (v) && nameref_p (v)) ? TRUE : FALSE); - } - -*************** -*** 724,727 **** ---- 724,728 ---- - case 'u': case 'v': case 'w': case 'x': case 'z': - case 'G': case 'L': case 'O': case 'S': case 'N': -+ case 'R': - return (1); - } diff --git a/core/openssh/PKGBUILD b/core/openssh/PKGBUILD index 06aba8955..e6b313ec1 100644 --- a/core/openssh/PKGBUILD +++ b/core/openssh/PKGBUILD @@ -1,11 +1,11 @@ -# $Id: PKGBUILD 208093 2014-03-17 20:47:18Z bisson $ +# $Id: PKGBUILD 211715 2014-04-23 20:12:34Z bisson $ # Maintainer: Gaetan Bisson # Contributor: Aaron Griffin # Contributor: judd pkgname=openssh pkgver=6.6p1 -pkgrel=1 +pkgrel=2 pkgdesc='Free version of the SSH connectivity tools' url='http://www.openssh.org/portable.html' license=('custom:BSD') @@ -15,12 +15,14 @@ depends=('krb5' 'openssl' 'libedit' 'ldns') optdepends=('xorg-xauth: X11 forwarding' 'x11-ssh-askpass: input passphrase in X') source=("ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/${pkgname}-${pkgver}.tar.gz"{,.asc} + 'curve25519pad.patch' 'sshdgenkeys.service' 'sshd@.service' 'sshd.service' 'sshd.socket' 'sshd.pam') sha1sums=('b850fd1af704942d9b3c2eff7ef6b3a59b6a6b6e' 'SKIP' + '13b74b57b3d9b9a256eeb44b4fca29a8f27aa7ad' 'cc1ceec606c98c7407e7ac21ade23aed81e31405' '6a0ff3305692cf83aca96e10f3bb51e1c26fccda' 'ec49c6beba923e201505f5669cea48cad29014db' @@ -31,6 +33,11 @@ backup=('etc/ssh/ssh_config' 'etc/ssh/sshd_config' 'etc/pam.d/sshd') install=install +prepare() { + cd "${srcdir}/${pkgname}-${pkgver}" + patch -p0 -i ../curve25519pad.patch +} + build() { cd "${srcdir}/${pkgname}-${pkgver}" diff --git a/core/openssh/curve25519pad.patch b/core/openssh/curve25519pad.patch new file mode 100644 index 000000000..9774a9399 --- /dev/null +++ b/core/openssh/curve25519pad.patch @@ -0,0 +1,171 @@ +Hi, + +So I screwed up when writing the support for the curve25519 KEX method +that doesn't depend on OpenSSL's BIGNUM type - a bug in my code left +leading zero bytes where they should have been skipped. The impact of +this is that OpenSSH 6.5 and 6.6 will fail during key exchange with a +peer that implements curve25519-sha256@libssh.org properly about 0.2% +of the time (one in every 512ish connections). + +We've fixed this for OpenSSH 6.7 by avoiding the curve25519-sha256 +key exchange for previous versions, but I'd recommend distributors +of OpenSSH apply this patch so the affected code doesn't become +too entrenched in LTS releases. + +The patch fixes the bug and makes OpenSSH identify itself as 6.6.1 so as +to distinguish itself from the incorrect versions so the compatibility +code to disable the affected KEX isn't activated. + +I've committed this on the 6.6 branch too. + +Apologies for the hassle. + +-d + +Index: version.h +=================================================================== +RCS file: /var/cvs/openssh/version.h,v +retrieving revision 1.82 +diff -u -p -r1.82 version.h +--- version.h 27 Feb 2014 23:01:54 -0000 1.82 ++++ version.h 20 Apr 2014 03:35:15 -0000 +@@ -1,6 +1,6 @@ + /* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */ + +-#define SSH_VERSION "OpenSSH_6.6" ++#define SSH_VERSION "OpenSSH_6.6.1" + + #define SSH_PORTABLE "p1" + #define SSH_RELEASE SSH_VERSION SSH_PORTABLE +Index: compat.c +=================================================================== +RCS file: /var/cvs/openssh/compat.c,v +retrieving revision 1.82 +retrieving revision 1.85 +diff -u -p -r1.82 -r1.85 +--- compat.c 31 Dec 2013 01:25:41 -0000 1.82 ++++ compat.c 20 Apr 2014 03:33:59 -0000 1.85 +@@ -95,6 +95,9 @@ compat_datafellows(const char *version) + { "Sun_SSH_1.0*", SSH_BUG_NOREKEY|SSH_BUG_EXTEOF}, + { "OpenSSH_4*", 0 }, + { "OpenSSH_5*", SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT}, ++ { "OpenSSH_6.6.1*", SSH_NEW_OPENSSH}, ++ { "OpenSSH_6.5*," ++ "OpenSSH_6.6*", SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD}, + { "OpenSSH*", SSH_NEW_OPENSSH }, + { "*MindTerm*", 0 }, + { "2.1.0*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC| +@@ -251,7 +254,6 @@ compat_cipher_proposal(char *cipher_prop + return cipher_prop; + } + +- + char * + compat_pkalg_proposal(char *pkalg_prop) + { +@@ -263,5 +265,18 @@ compat_pkalg_proposal(char *pkalg_prop) + if (*pkalg_prop == '\0') + fatal("No supported PK algorithms found"); + return pkalg_prop; ++} ++ ++char * ++compat_kex_proposal(char *kex_prop) ++{ ++ if (!(datafellows & SSH_BUG_CURVE25519PAD)) ++ return kex_prop; ++ debug2("%s: original KEX proposal: %s", __func__, kex_prop); ++ kex_prop = filter_proposal(kex_prop, "curve25519-sha256@libssh.org"); ++ debug2("%s: compat KEX proposal: %s", __func__, kex_prop); ++ if (*kex_prop == '\0') ++ fatal("No supported key exchange algorithms found"); ++ return kex_prop; + } + +Index: compat.h +=================================================================== +RCS file: /var/cvs/openssh/compat.h,v +retrieving revision 1.42 +retrieving revision 1.43 +diff -u -p -r1.42 -r1.43 +--- compat.h 31 Dec 2013 01:25:41 -0000 1.42 ++++ compat.h 20 Apr 2014 03:25:31 -0000 1.43 +@@ -59,6 +59,7 @@ + #define SSH_BUG_RFWD_ADDR 0x02000000 + #define SSH_NEW_OPENSSH 0x04000000 + #define SSH_BUG_DYNAMIC_RPORT 0x08000000 ++#define SSH_BUG_CURVE25519PAD 0x10000000 + + void enable_compat13(void); + void enable_compat20(void); +@@ -66,6 +67,7 @@ void compat_datafellows(const char * + int proto_spec(const char *); + char *compat_cipher_proposal(char *); + char *compat_pkalg_proposal(char *); ++char *compat_kex_proposal(char *); + + extern int compat13; + extern int compat20; +Index: sshd.c +=================================================================== +RCS file: /var/cvs/openssh/sshd.c,v +retrieving revision 1.448 +retrieving revision 1.453 +diff -u -p -r1.448 -r1.453 +--- sshd.c 26 Feb 2014 23:20:08 -0000 1.448 ++++ sshd.c 20 Apr 2014 03:28:41 -0000 1.453 +@@ -2462,6 +2438,9 @@ do_ssh2_kex(void) + if (options.kex_algorithms != NULL) + myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms; + ++ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal( ++ myproposal[PROPOSAL_KEX_ALGS]); ++ + if (options.rekey_limit || options.rekey_interval) + packet_set_rekey_limits((u_int32_t)options.rekey_limit, + (time_t)options.rekey_interval); +Index: sshconnect2.c +=================================================================== +RCS file: /var/cvs/openssh/sshconnect2.c,v +retrieving revision 1.197 +retrieving revision 1.199 +diff -u -p -r1.197 -r1.199 +--- sshconnect2.c 4 Feb 2014 00:20:16 -0000 1.197 ++++ sshconnect2.c 20 Apr 2014 03:25:31 -0000 1.199 +@@ -195,6 +196,8 @@ ssh_kex2(char *host, struct sockaddr *ho + } + if (options.kex_algorithms != NULL) + myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms; ++ myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal( ++ myproposal[PROPOSAL_KEX_ALGS]); + + if (options.rekey_limit || options.rekey_interval) + packet_set_rekey_limits((u_int32_t)options.rekey_limit, +Index: bufaux.c +=================================================================== +RCS file: /var/cvs/openssh/bufaux.c,v +retrieving revision 1.62 +retrieving revision 1.63 +diff -u -p -r1.62 -r1.63 +--- bufaux.c 4 Feb 2014 00:20:15 -0000 1.62 ++++ bufaux.c 20 Apr 2014 03:24:50 -0000 1.63 +@@ -1,4 +1,4 @@ +-/* $OpenBSD: bufaux.c,v 1.56 2014/02/02 03:44:31 djm Exp $ */ ++/* $OpenBSD: bufaux.c,v 1.57 2014/04/16 23:22:45 djm Exp $ */ + /* + * Author: Tatu Ylonen + * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland +@@ -372,6 +372,9 @@ buffer_put_bignum2_from_string(Buffer *b + + if (l > 8 * 1024) + fatal("%s: length %u too long", __func__, l); ++ /* Skip leading zero bytes */ ++ for (; l > 0 && *s == 0; l--, s++) ++ ; + p = buf = xmalloc(l + 1); + /* + * If most significant bit is set then prepend a zero byte to +_______________________________________________ +openssh-unix-dev mailing list +openssh-unix-dev@mindrot.org +https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev \ No newline at end of file diff --git a/core/readline/PKGBUILD b/core/readline/PKGBUILD index 4e23bbbe4..41b69608b 100644 --- a/core/readline/PKGBUILD +++ b/core/readline/PKGBUILD @@ -1,13 +1,13 @@ -# $Id: PKGBUILD 209916 2014-04-08 15:23:41Z anatolik $ +# $Id: PKGBUILD 211714 2014-04-23 18:51:17Z bpiotrowski $ # Maintainer: Bartłomiej Piotrowski # Contributor: Allan McRae # Contributor: judd pkgname=readline _basever=6.3 -_patchlevel=003 +_patchlevel=005 pkgver=$_basever.$_patchlevel -pkgrel=2 +pkgrel=1 pkgdesc='GNU readline library' arch=('i686' 'x86_64') url='http://tiswww.case.edu/php/chet/readline/rltop.html' @@ -59,4 +59,8 @@ md5sums=('33c8fb279e981274f485fd91da77e94a' '700295212f7e2978577feaee584afddb' 'SKIP' 'af4963862f5156fbf9111c2c6fa86ed7' + 'SKIP' + '11f9def89803a5052db3ba72394ce14f' + 'SKIP' + '93721c31cd225393f80cb3aadb165544' 'SKIP') -- cgit v1.2.3-54-g00ecf