1. photon
  2. Commit dca3ea32b8336310b977f11a96cdc2f937127172
Browse code

Allow gcm ciphers and dh kex algorithms in fips mode

Change-Id: If5661528bd6bf7b5229d890a58d94cc50ff6b99c
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4303
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Joao Lima
Reviewed-by: Sharath George
(cherry picked from commit d9b898b0b0b488c63229b48b06af5a3930ebd2ba)
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4405
Reviewed-by: Xiaolin Li <xiaolinl@vmware.com>

suezzelur authored on 2017/11/15 10:03:12
Showing 5 changed files
SPECS/openssh/openssh-7.4p1-configure-fips.patch
History View file @ dca3ea3
1 1 
deleted file mode 100644
... ... 
@@ -1,229 +0,0 @@
1 
-diff -rup openssh-7.4p1-fips/readconf.c openssh-7.4p1-fips-enable-1/readconf.c
2 
-+++ openssh-7.4p1-fips-enable-1/readconf.c	2017-02-15 17:08:04.946982460 -0800
3 
-@@ -171,7 +171,8 @@ typedef enum {
4 
- 	oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
5 
- 	oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
6 
- 	oPubkeyAcceptedKeyTypes, oProxyJump,
7 
--	oIgnoredUnknownOption, oDeprecated, oUnsupported
8 
-+	oIgnoredUnknownOption, oDeprecated, oUnsupported,
9 
-+	oFipsMode
10 
- } OpCodes;
11 
-
12 
- /* Textual representations of the tokens. */
13 
-@@ -291,6 +292,7 @@ static struct {
14 
- 	{ "streamlocalbindunlink", oStreamLocalBindUnlink },
15 
- 	{ "revokedhostkeys", oRevokedHostKeys },
16 
- 	{ "fingerprinthash", oFingerprintHash },
17 
-+	{ "fipsmode", oFipsMode },
18 
- 	{ "updatehostkeys", oUpdateHostkeys },
19 
- 	{ "hostbasedkeytypes", oHostbasedKeyTypes },
20 
- 	{ "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
21 
-@@ -965,6 +967,10 @@ parse_time:
22 
- 		intptr = &options->gss_deleg_creds;
23 
- 		goto parse_flag;
24 
-
25 
-+        case oFipsMode:
26 
-+                intptr = &options->fips_mode;
27 
-+                goto parse_flag;
28 
-+
29 
- 	case oBatchMode:
30 
- 		intptr = &options->batch_mode;
31 
- 		goto parse_flag;
32 
-@@ -1857,6 +1863,7 @@ initialize_options(Options * options)
33 
- 	options->update_hostkeys = -1;
34 
- 	options->hostbased_key_types = NULL;
35 
- 	options->pubkey_key_types = NULL;
36 
-+	options->fips_mode = -1;
37 
- }
38 
-
39 
- /*
40 
-@@ -2044,6 +2051,13 @@ fill_default_options(Options * options)
41 
- 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
42 
- 	if (options->update_hostkeys == -1)
43 
- 		options->update_hostkeys = 0;
44 
-+        if (options->fips_mode == -1)
45 
-+                options->fips_mode = 0;
46 
-+        /* Call FIPS_mode_set depending on whether fips mode is set or not */
47 
-+        if (options->fips_mode)
48 
-+                if (!FIPS_mode_set(1))
49 
-+                        fatal("FIPS mode could not be set");
50 
-+
51 
- 	if (kex_assemble_names((FIPS_mode() ? KEX_FIPS_ENCRYPT
52 
- 	        : KEX_CLIENT_ENCRYPT), &options->ciphers) != 0 ||
53 
- 	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_MAC
54 
-@@ -2535,6 +2549,7 @@ dump_client_config(Options *o, const cha
55 
- 	dump_cfg_fmtint(oVerifyHostKeyDNS, o->verify_host_key_dns);
56 
- 	dump_cfg_fmtint(oVisualHostKey, o->visual_host_key);
57 
- 	dump_cfg_fmtint(oUpdateHostkeys, o->update_hostkeys);
58 
-+	dump_cfg_fmtint(oFipsMode, o->fips_mode);
59 
-
60 
- 	/* Integer options */
61 
- 	dump_cfg_int(oCanonicalizeMaxDots, o->canonicalize_max_dots);
62 
-Only in openssh-7.4p1-fips-enable-1: readconf.c.orig
63 
-Only in openssh-7.4p1-fips-enable-1: readconf.c.rej
64 
-diff -rup openssh-7.4p1-fips/readconf.h openssh-7.4p1-fips-enable-1/readconf.h
65 
-+++ openssh-7.4p1-fips-enable-1/readconf.h	2017-02-15 17:03:52.938988153 -0800
66 
-@@ -157,6 +157,7 @@ typedef struct {
67 
- 	char	*revoked_host_keys;
68 
-
69 
- 	int	 fingerprint_hash;
70 
-+	int	 fips_mode;
71 
-
72 
- 	int	 update_hostkeys; /* one of SSH_UPDATE_HOSTKEYS_* */
73 
-
74 
-diff -rup openssh-7.4p1-fips/servconf.c openssh-7.4p1-fips-enable-1/servconf.c
75 
-+++ openssh-7.4p1-fips-enable-1/servconf.c	2017-02-15 17:03:52.938988153 -0800
76 
-@@ -164,6 +164,7 @@ initialize_server_options(ServerOptions
77 
- 	options->version_addendum = NULL;
78 
- 	options->fingerprint_hash = -1;
79 
- 	options->disable_forwarding = -1;
80 
-+	options->fips_mode = -1;
81 
- }
82 
-
83 
- /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
84 
-@@ -336,6 +337,13 @@ fill_default_server_options(ServerOption
85 
- 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
86 
- 	if (options->disable_forwarding == -1)
87 
- 		options->disable_forwarding = 0;
88 
-+	if (options->fips_mode == -1)
89 
-+		options->fips_mode = 0;
90 
-+
91 
-+        /* Call FIPS_mode_set depending on whether fips mode is set or not */
92 
-+        if (options->fips_mode)
93 
-+                if (!FIPS_mode_set(1))
94 
-+                        fatal("FIPS mode could not be set");
95 
-
96 
- 	assemble_algorithms(options);
97 
-
98 
-@@ -421,7 +429,8 @@ typedef enum {
99 
- 	sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
100 
- 	sStreamLocalBindMask, sStreamLocalBindUnlink,
101 
- 	sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
102 
--	sDeprecated, sIgnore, sUnsupported
103 
-+	sDeprecated, sIgnore, sUnsupported,
104 
-+	sFipsMode
105 
- } ServerOpCodes;
106 
-
107 
- #define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
108 
-@@ -564,6 +573,7 @@ static struct {
109 
- 	{ "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
110 
- 	{ "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
111 
- 	{ "disableforwarding", sDisableForwarding, SSHCFG_ALL },
112 
-+	{ "fipsmode", sFipsMode, SSHCFG_GLOBAL },
113 
- 	{ NULL, sBadOption, 0 }
114 
- };
115 
-
116 
-@@ -1839,6 +1849,10 @@ process_server_config_line(ServerOptions
117 
- 			options->fingerprint_hash = value;
118 
- 		break;
119 
-
120 
-+	case sFipsMode:
121 
-+		intptr = &options->fips_mode;
122 
-+		goto parse_flag;
123 
-+
124 
- 	case sDeprecated:
125 
- 	case sIgnore:
126 
- 	case sUnsupported:
127 
-@@ -2280,6 +2294,7 @@ dump_config(ServerOptions *o)
128 
- 	dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
129 
- 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
130 
- 	dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
131 
-+	dump_cfg_fmtint(sFipsMode, o->fips_mode);
132 
-
133 
- 	/* string arguments */
134 
- 	dump_cfg_string(sPidFile, o->pid_file);
135 
-Only in openssh-7.4p1-fips-enable-1: servconf.c.orig
136 
-diff -rup openssh-7.4p1-fips/servconf.h openssh-7.4p1-fips-enable-1/servconf.h
137 
-+++ openssh-7.4p1-fips-enable-1/servconf.h	2017-02-15 17:03:52.938988153 -0800
138 
-@@ -189,6 +189,7 @@ typedef struct {
139 
- 	char   *auth_methods[MAX_AUTH_METHODS];
140 
-
141 
- 	int	fingerprint_hash;
142 
-+	int fips_mode;
143 
- }       ServerOptions;
144 
-
145 
- /* Information about the incoming connection as used by Match */
146 
-diff -rup openssh-7.4p1-fips/ssh_config openssh-7.4p1-fips-enable-1/ssh_config
147 
-+++ openssh-7.4p1-fips-enable-1/ssh_config	2017-02-15 17:03:52.938988153 -0800
148 
-@@ -37,6 +37,7 @@
149 
- #   IdentityFile ~/.ssh/id_ecdsa
150 
- #   IdentityFile ~/.ssh/id_ed25519
151 
- #   Port 22
152 
-+#   FipsMode no
153 
- #   Protocol 2
154 
- #   Cipher 3des
155 
- #   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
156 
-diff -rup openssh-7.4p1-fips/ssh_config.0 openssh-7.4p1-fips-enable-1/ssh_config.0
157 
-+++ openssh-7.4p1-fips-enable-1/ssh_config.0	2017-02-15 17:03:52.938988153 -0800
158 
-@@ -362,6 +362,10 @@ DESCRIPTION
159 
-              Specifies the hash algorithm used when displaying key
160 
-              fingerprints.  Valid options are: md5 and sha256 (the default).
161 
-
162 
-+     FipsMode
163 
-+             Enables or disables FIPS mode. Requires FIPS capable ssl modules.
164 
-+             The default is no.
165 
-+
166 
-      ForwardAgent
167 
-              Specifies whether the connection to the authentication agent (if
168 
-              any) will be forwarded to the remote machine.  The argument must
169 
-diff -rup openssh-7.4p1-fips/ssh_config.5 openssh-7.4p1-fips-enable-1/ssh_config.5
170 
-+++ openssh-7.4p1-fips-enable-1/ssh_config.5	2017-02-15 17:03:52.938988153 -0800
171 
-@@ -658,6 +658,10 @@ Valid options are:
172 
- and
173 
- .Cm sha256
174 
- (the default).
175 
-+.It Cm FipsMode
176 
-+Enables or disables FIPS mode. Requires FIPS capable ssl modules.
177 
-+The default is
178 
-+.Cm no .
179 
- .It Cm ForwardAgent
180 
- Specifies whether the connection to the authentication agent (if any)
181 
- will be forwarded to the remote machine.
182 
-Only in openssh-7.4p1-fips-enable-1: ssh.c.orig
183 
-diff -rup openssh-7.4p1-fips/sshd_config openssh-7.4p1-fips-enable-1/sshd_config
184 
-+++ openssh-7.4p1-fips-enable-1/sshd_config	2017-02-15 17:03:52.938988153 -0800
185 
-@@ -105,6 +105,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
186 
- #ChrootDirectory none
187 
- #VersionAddendum none
188 
-
189 
-+#FipsMode no
190 
-+
191 
- # no default banner path
192 
- #Banner none
193 
-
194 
-diff -rup openssh-7.4p1-fips/sshd_config.0 openssh-7.4p1-fips-enable-1/sshd_config.0
195 
-+++ openssh-7.4p1-fips-enable-1/sshd_config.0	2017-02-15 17:03:52.938988153 -0800
196 
-@@ -331,6 +331,10 @@ DESCRIPTION
197 
-              Specifies the hash algorithm used when logging key fingerprints.
198 
-              Valid options are: md5 and sha256.  The default is sha256.
199 
-
200 
-+     FipsMode
201 
-+             Enables or disables FIPS mode. Requires FIPS capable ssl modules.
202 
-+             The default is no.
203 
-+
204 
-      ForceCommand
205 
-              Forces the execution of the command specified by ForceCommand,
206 
-              ignoring any command supplied by the client and ~/.ssh/rc if
207 
-diff -rup openssh-7.4p1-fips/sshd_config.5 openssh-7.4p1-fips-enable-1/sshd_config.5
208 
-+++ openssh-7.4p1-fips-enable-1/sshd_config.5	2017-02-15 17:03:52.942988153 -0800
209 
-@@ -578,6 +578,10 @@ and
210 
- .Cm sha256 .
211 
- The default is
212 
- .Cm sha256 .
213 
-+.It Cm FipsMode
214 
-+Enables or disables FIPS mode. Requires FIPS capable ssl modules.
215 
-+The default is
216 
-+.Cm no .
217 
- .It Cm ForceCommand
218 
- Forces the execution of the command specified by
219 
- .Cm ForceCommand ,
SPECS/openssh/openssh-7.4p1-fips.patch
History View file @ dca3ea3
220 1 
deleted file mode 100644
... ... 
@@ -1,423 +0,0 @@
1 
-diff -rup openssh-7.4p1/cipher.c openssh-7.4p1-fips/cipher.c
2 
-+++ openssh-7.4p1-fips/cipher.c	2017-02-02 15:51:07.008913721 -0800
3 
-@@ -136,6 +136,20 @@ static const struct sshcipher ciphers[]
4 
- 	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
5 
- };
6 
-
7 
-+static const struct sshcipher fips_ciphers[] = {
8 
-+	{ "none",	SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
9 
-+	{ "3des-cbc",	SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
10 
-+	{ "aes128-cbc",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
11 
-+	{ "aes192-cbc",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
12 
-+	{ "aes256-cbc",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
13 
-+	{ "rijndael-cbc@lysator.liu.se",
14 
-+			SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
15 
-+	{ "aes128-ctr",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
16 
-+	{ "aes192-ctr",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },
17 
-+	{ "aes256-ctr",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },
18 
-+	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
19 
-+};
20 
-+
21 
- /*--*/
22 
-
23 
- /* Returns a comma-separated list of supported ciphers. */
24 
-@@ -146,7 +160,7 @@ cipher_alg_list(char sep, int auth_only)
25 
- 	size_t nlen, rlen = 0;
26 
- 	const struct sshcipher *c;
27 
-
28 
--	for (c = ciphers; c->name != NULL; c++) {
29 
-+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++) {
30 
- 		if (c->number != SSH_CIPHER_SSH2)
31 
- 			continue;
32 
- 		if (auth_only && c->auth_len == 0)
33 
-@@ -242,7 +256,7 @@ const struct sshcipher *
34 
- cipher_by_name(const char *name)
35 
- {
36 
- 	const struct sshcipher *c;
37 
--	for (c = ciphers; c->name != NULL; c++)
38 
-+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
39 
- 		if (strcmp(c->name, name) == 0)
40 
- 			return c;
41 
- 	return NULL;
42 
-@@ -252,7 +266,7 @@ const struct sshcipher *
43 
- cipher_by_number(int id)
44 
- {
45 
- 	const struct sshcipher *c;
46 
--	for (c = ciphers; c->name != NULL; c++)
47 
-+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
48 
- 		if (c->number == id)
49 
- 			return c;
50 
- 	return NULL;
51 
-@@ -293,7 +307,7 @@ cipher_number(const char *name)
52 
- 	const struct sshcipher *c;
53 
- 	if (name == NULL)
54 
- 		return -1;
55 
--	for (c = ciphers; c->name != NULL; c++)
56 
-+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
57 
- 		if (strcasecmp(c->name, name) == 0)
58 
- 			return c->number;
59 
- 	return -1;
60 
-diff -rup openssh-7.4p1/cipher-ctr.c openssh-7.4p1-fips/cipher-ctr.c
61 
-+++ openssh-7.4p1-fips/cipher-ctr.c	2017-02-02 15:47:44.252918302 -0800
62 
-@@ -138,7 +138,8 @@ evp_aes_128_ctr(void)
63 
- 	aes_ctr.do_cipher = ssh_aes_ctr;
64 
- #ifndef SSH_OLD_EVP
65 
- 	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
66 
--	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
67 
-+	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV |
68 
-+	    EVP_CIPH_FLAG_FIPS;
69 
- #endif
70 
- 	return (&aes_ctr);
71 
- }
72 
-diff -rup openssh-7.4p1/dh.h openssh-7.4p1-fips/dh.h
73 
-+++ openssh-7.4p1-fips/dh.h	2017-02-02 15:52:37.552911676 -0800
74 
-@@ -51,6 +51,7 @@ u_int	 dh_estimate(int);
75 
-  * Miniumum increased in light of DH precomputation attacks.
76 
-  */
77 
- #define DH_GRP_MIN	2048
78 
-+#define DH_GRP_MIN_FIPS	2048
79 
- #define DH_GRP_MAX	8192
80 
-
81 
- /*
82 
-diff -rup openssh-7.4p1/entropy.c openssh-7.4p1-fips/entropy.c
83 
-+++ openssh-7.4p1-fips/entropy.c	2017-02-02 15:53:46.088910128 -0800
84 
-@@ -217,6 +217,9 @@ seed_rng(void)
85 
- 		fatal("OpenSSL version mismatch. Built against %lx, you "
86 
- 		    "have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
87 
-
88 
-+	/* clean the PRNG status when exiting the program */
89 
-+	atexit(RAND_cleanup);
90 
-+
91 
- #ifndef OPENSSL_PRNG_ONLY
92 
- 	if (RAND_status() == 1) {
93 
- 		debug3("RNG is ready, skipping seeding");
94 
-diff -rup openssh-7.4p1/kex.c openssh-7.4p1-fips/kex.c
95 
-+++ openssh-7.4p1-fips/kex.c	2017-02-02 16:06:13.120893252 -0800
96 
-@@ -114,6 +114,23 @@ static const struct kexalg kexalgs[] = {
97 
- 	{ NULL, -1, -1, -1},
98 
- };
99 
-
100 
-+static const struct kexalg kexalgs_fips[] = {
101 
-+#ifdef HAVE_EVP_SHA256
102 
-+	{ KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
103 
-+#endif
104 
-+#ifdef OPENSSL_HAS_ECC
105 
-+	{ KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,
106 
-+	    NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
107 
-+	{ KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1,
108 
-+	    SSH_DIGEST_SHA384 },
109 
-+# ifdef OPENSSL_HAS_NISTP521
110 
-+	{ KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
111 
-+	    SSH_DIGEST_SHA512 },
112 
-+# endif
113 
-+#endif
114 
-+	{ NULL, -1, -1, -1},
115 
-+};
116 
-+
117 
- char *
118 
- kex_alg_list(char sep)
119 
- {
120 
-@@ -121,7 +138,7 @@ kex_alg_list(char sep)
121 
- 	size_t nlen, rlen = 0;
122 
- 	const struct kexalg *k;
123 
-
124 
--	for (k = kexalgs; k->name != NULL; k++) {
125 
-+	for (k = (FIPS_mode() ? kexalgs_fips : kexalgs); k->name != NULL; k++) {
126 
- 		if (ret != NULL)
127 
- 			ret[rlen++] = sep;
128 
- 		nlen = strlen(k->name);
129 
-@@ -141,7 +158,7 @@ kex_alg_by_name(const char *name)
130 
- {
131 
- 	const struct kexalg *k;
132 
-
133 
--	for (k = kexalgs; k->name != NULL; k++) {
134 
-+	for (k = (FIPS_mode() ? kexalgs_fips : kexalgs); k->name != NULL; k++) {
135 
- 		if (strcmp(k->name, name) == 0)
136 
- 			return k;
137 
- 	}
138 
-@@ -161,7 +178,10 @@ kex_names_valid(const char *names)
139 
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
140 
- 	    (p = strsep(&cp, ","))) {
141 
- 		if (kex_alg_by_name(p) == NULL) {
142 
--			error("Unsupported KEX algorithm \"%.100s\"", p);
143 
-+			if (FIPS_mode())
144 
-+				error("\"%.100s\" is not allowed in FIPS mode", p);
145 
-+			else
146 
-+				error("Unsupported KEX algorithm \"%.100s\"", p);
147 
- 			free(s);
148 
- 			return 0;
149 
- 		}
150 
-diff -rup openssh-7.4p1/kexgexc.c openssh-7.4p1-fips/kexgexc.c
151 
-+++ openssh-7.4p1-fips/kexgexc.c	2017-02-02 16:10:36.604887300 -0800
152 
-@@ -63,7 +63,7 @@ kexgex_client(struct ssh *ssh)
153 
-
154 
- 	nbits = dh_estimate(kex->dh_need * 8);
155 
-
156 
--	kex->min = DH_GRP_MIN;
157 
-+	kex->min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
158 
- 	kex->max = DH_GRP_MAX;
159 
- 	kex->nbits = nbits;
160 
- 	if (datafellows & SSH_BUG_DHGEX_LARGE)
161 
-diff -rup openssh-7.4p1/kexgexs.c openssh-7.4p1-fips/kexgexs.c
162 
-+++ openssh-7.4p1-fips/kexgexs.c	2017-02-02 16:11:31.404886062 -0800
163 
-@@ -83,9 +83,9 @@ input_kex_dh_gex_request(int type, u_int
164 
- 	kex->nbits = nbits;
165 
- 	kex->min = min;
166 
- 	kex->max = max;
167 
--	min = MAXIMUM(DH_GRP_MIN, min);
168 
-+	min = MAXIMUM(FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN, min);
169 
- 	max = MINIMUM(DH_GRP_MAX, max);
170 
--	nbits = MAXIMUM(DH_GRP_MIN, nbits);
171 
-+	nbits = MAXIMUM(FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN, nbits);
172 
- 	nbits = MINIMUM(DH_GRP_MAX, nbits);
173 
-
174 
- 	if (kex->max < kex->min || kex->nbits < kex->min ||
175 
-diff -rup openssh-7.4p1/mac.c openssh-7.4p1-fips/mac.c
176 
-+++ openssh-7.4p1-fips/mac.c	2017-02-02 16:13:56.932882775 -0800
177 
-@@ -54,7 +54,7 @@ struct macalg {
178 
- 	int		etm;		/* Encrypt-then-MAC */
179 
- };
180 
-
181 
--static const struct macalg macs[] = {
182 
-+static const struct macalg all_macs[] = {
183 
- 	/* Encrypt-and-MAC (encrypt-and-authenticate) variants */
184 
- 	{ "hmac-sha1",				SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },
185 
- 	{ "hmac-sha1-96",			SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 0 },
186 
-@@ -89,6 +89,24 @@ static const struct macalg macs[] = {
187 
- 	{ NULL,					0, 0, 0, 0, 0, 0 }
188 
- };
189 
-
190 
-+static const struct macalg fips_macs[] = {
191 
-+	/* Encrypt-and-MAC (encrypt-and-authenticate) variants */
192 
-+	{ "hmac-sha1",				SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },
193 
-+#ifdef HAVE_EVP_SHA256
194 
-+	{ "hmac-sha2-256",			SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 0 },
195 
-+	{ "hmac-sha2-512",			SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 0 },
196 
-+#endif
197 
-+
198 
-+	/* Encrypt-then-MAC variants */
199 
-+	{ "hmac-sha1-etm@openssh.com",		SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 1 },
200 
-+#ifdef HAVE_EVP_SHA256
201 
-+	{ "hmac-sha2-256-etm@openssh.com",	SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 1 },
202 
-+	{ "hmac-sha2-512-etm@openssh.com",	SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 1 },
203 
-+#endif
204 
-+
205 
-+	{ NULL,					0, 0, 0, 0, 0, 0 }
206 
-+};
207 
-+
208 
- /* Returns a list of supported MACs separated by the specified char. */
209 
- char *
210 
- mac_alg_list(char sep)
211 
-@@ -97,7 +115,7 @@ mac_alg_list(char sep)
212 
- 	size_t nlen, rlen = 0;
213 
- 	const struct macalg *m;
214 
-
215 
--	for (m = macs; m->name != NULL; m++) {
216 
-+	for (m = FIPS_mode() ? fips_macs : all_macs; m->name != NULL; m++) {
217 
- 		if (ret != NULL)
218 
- 			ret[rlen++] = sep;
219 
- 		nlen = strlen(m->name);
220 
-@@ -136,7 +154,7 @@ mac_setup(struct sshmac *mac, char *name
221 
- {
222 
- 	const struct macalg *m;
223 
-
224 
--	for (m = macs; m->name != NULL; m++) {
225 
-+	for (m = FIPS_mode() ? fips_macs : all_macs; m->name != NULL; m++) {
226 
- 		if (strcmp(name, m->name) != 0)
227 
- 			continue;
228 
- 		if (mac != NULL)
229 
-diff -rup openssh-7.4p1/myproposal.h openssh-7.4p1-fips/myproposal.h
230 
-+++ openssh-7.4p1-fips/myproposal.h	2017-02-02 16:15:40.516880435 -0800
231 
-@@ -138,6 +138,26 @@
232 
-
233 
- #define KEX_CLIENT_MAC KEX_SERVER_MAC
234 
-
235 
-+#define KEX_DEFAULT_KEX_FIPS		\
236 
-+	KEX_ECDH_METHODS \
237 
-+	KEX_SHA2_METHODS
238 
-+#define	KEX_FIPS_ENCRYPT \
239 
-+	"aes128-ctr,aes192-ctr,aes256-ctr," \
240 
-+	"aes128-cbc,3des-cbc," \
241 
-+	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se"
242 
-+#ifdef HAVE_EVP_SHA256
243 
-+#define	KEX_FIPS_MAC \
244 
-+	"hmac-sha1," \
245 
-+	"hmac-sha2-256," \
246 
-+	"hmac-sha2-512," \
247 
-+	"hmac-sha1-etm@openssh.com," \
248 
-+	"hmac-sha2-256-etm@openssh.com," \
249 
-+	"hmac-sha2-512-etm@openssh.com"
250 
-+#else
251 
-+#define        KEX_FIPS_MAC \
252 
-+       "hmac-sha1"
253 
-+#endif
254 
-+
255 
- #else /* WITH_OPENSSL */
256 
-
257 
- #define KEX_SERVER_KEX		\
258 
-diff -rup openssh-7.4p1/openbsd-compat/openssl-compat.h openssh-7.4p1-fips/openbsd-compat/openssl-compat.h
259 
-+++ openssh-7.4p1-fips/openbsd-compat/openssl-compat.h	2017-02-02 16:17:03.024878571 -0800
260 
-@@ -24,6 +24,7 @@
261 
- #include <openssl/evp.h>
262 
- #include <openssl/rsa.h>
263 
- #include <openssl/dsa.h>
264 
-+#include <openssl/crypto.h>
265 
-
266 
- int ssh_compatible_openssl(long, long);
267 
-
268 
-diff -rup openssh-7.4p1/readconf.c openssh-7.4p1-fips/readconf.c
269 
-+++ openssh-7.4p1-fips/readconf.c	2017-02-02 16:19:05.624875801 -0800
270 
-@@ -2044,9 +2044,12 @@ fill_default_options(Options * options)
271 
- 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
272 
- 	if (options->update_hostkeys == -1)
273 
- 		options->update_hostkeys = 0;
274 
--	if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
275 
--	    kex_assemble_names(KEX_CLIENT_MAC, &options->macs) != 0 ||
276 
--	    kex_assemble_names(KEX_CLIENT_KEX, &options->kex_algorithms) != 0 ||
277 
-+	if (kex_assemble_names((FIPS_mode() ? KEX_FIPS_ENCRYPT
278 
-+	        : KEX_CLIENT_ENCRYPT), &options->ciphers) != 0 ||
279 
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_MAC
280 
-+	        : KEX_CLIENT_MAC), &options->macs) != 0 ||
281 
-+	    kex_assemble_names((FIPS_mode() ? KEX_DEFAULT_KEX_FIPS
282 
-+	        : KEX_CLIENT_KEX), &options->kex_algorithms) != 0 ||
283 
- 	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
284 
- 	    &options->hostbased_key_types) != 0 ||
285 
- 	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
286 
-diff -rup openssh-7.4p1/sandbox-seccomp-filter.c openssh-7.4p1-fips/sandbox-seccomp-filter.c
287 
-+++ openssh-7.4p1-fips/sandbox-seccomp-filter.c	2017-02-02 16:20:10.104874345 -0800
288 
-@@ -118,6 +118,9 @@ static const struct sock_filter preauth_
289 
- #ifdef __NR_open
290 
- 	SC_DENY(open, EACCES),
291 
- #endif
292 
-+#ifdef __NR_socket
293 
-+	SC_DENY(socket, EACCES),
294 
-+#endif
295 
- #ifdef __NR_openat
296 
- 	SC_DENY(openat, EACCES),
297 
- #endif
298 
-diff -rup openssh-7.4p1/servconf.c openssh-7.4p1-fips/servconf.c
299 
-+++ openssh-7.4p1-fips/servconf.c	2017-02-02 16:23:48.132869419 -0800
300 
-@@ -176,9 +176,12 @@ option_clear_or_none(const char *o)
301 
- static void
302 
- assemble_algorithms(ServerOptions *o)
303 
- {
304 
--	if (kex_assemble_names(KEX_SERVER_ENCRYPT, &o->ciphers) != 0 ||
305 
--	    kex_assemble_names(KEX_SERVER_MAC, &o->macs) != 0 ||
306 
--	    kex_assemble_names(KEX_SERVER_KEX, &o->kex_algorithms) != 0 ||
307 
-+	if (kex_assemble_names((FIPS_mode() ? KEX_FIPS_ENCRYPT
308 
-+	        : KEX_SERVER_ENCRYPT), &o->ciphers) != 0 ||
309 
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_MAC
310 
-+	        : KEX_SERVER_MAC), &o->macs) != 0 ||
311 
-+	    kex_assemble_names((FIPS_mode() ? KEX_DEFAULT_KEX_FIPS
312 
-+	        : KEX_SERVER_KEX), &o->kex_algorithms) != 0 ||
313 
- 	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
314 
- 	    &o->hostkeyalgorithms) != 0 ||
315 
- 	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
316 
-@@ -2281,8 +2284,10 @@ dump_config(ServerOptions *o)
317 
- 	/* string arguments */
318 
- 	dump_cfg_string(sPidFile, o->pid_file);
319 
- 	dump_cfg_string(sXAuthLocation, o->xauth_location);
320 
--	dump_cfg_string(sCiphers, o->ciphers ? o->ciphers : KEX_SERVER_ENCRYPT);
321 
--	dump_cfg_string(sMacs, o->macs ? o->macs : KEX_SERVER_MAC);
322 
-+	dump_cfg_string(sCiphers, o->ciphers ? o->ciphers : FIPS_mode()
323 
-+		? KEX_FIPS_ENCRYPT : KEX_SERVER_ENCRYPT);
324 
-+	dump_cfg_string(sMacs, o->macs ? o->macs : FIPS_mode()
325 
-+		? KEX_FIPS_MAC : KEX_SERVER_MAC);
326 
- 	dump_cfg_string(sBanner, o->banner);
327 
- 	dump_cfg_string(sForceCommand, o->adm_forced_command);
328 
- 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
329 
-@@ -2297,8 +2302,8 @@ dump_config(ServerOptions *o)
330 
- 	dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command);
331 
- 	dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user);
332 
- 	dump_cfg_string(sHostKeyAgent, o->host_key_agent);
333 
--	dump_cfg_string(sKexAlgorithms,
334 
--	    o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX);
335 
-+	dump_cfg_string(sKexAlgorithms, o->kex_algorithms ? o->kex_algorithms :
336 
-+		FIPS_mode() ? KEX_DEFAULT_KEX_FIPS : KEX_SERVER_KEX);
337 
- 	dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ?
338 
- 	    o->hostbased_key_types : KEX_DEFAULT_PK_ALG);
339 
- 	dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ?
340 
-diff -rup openssh-7.4p1/ssh.c openssh-7.4p1-fips/ssh.c
341 
-+++ openssh-7.4p1-fips/ssh.c	2017-02-02 16:49:00.060835265 -0800
342 
-@@ -609,6 +609,9 @@ main(int ac, char **av)
343 
- 	    "ACD:E:F:GI:J:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) {
344 
- 		switch (opt) {
345 
- 		case '1':
346 
-+			if (FIPS_mode()) {
347 
-+				fatal("Protocol 1 not allowed in the FIPS mode.");
348 
-+			}
349 
- 			options.protocol = SSH_PROTO_1;
350 
- 			break;
351 
- 		case '2':
352 
-@@ -1174,6 +1177,10 @@ main(int ac, char **av)
353 
- 	}
354 
-
355 
- 	seed_rng();
356 
-+
357 
-+	if (FIPS_mode()) {
358 
-+		logit("FIPS mode initialized");
359 
-+	}
360 
-
361 
- 	if (options.user == NULL)
362 
- 		options.user = xstrdup(pw->pw_name);
363 
-@@ -1263,6 +1270,12 @@ main(int ac, char **av)
364 
-
365 
- 	timeout_ms = options.connection_timeout * 1000;
366 
-
367 
-+	if (FIPS_mode()) {
368 
-+		options.protocol &= SSH_PROTO_2;
369 
-+		if (options.protocol == 0)
370 
-+			fatal("Protocol 2 disabled by configuration but required in the FIPS mode.");
371 
-+	}
372 
-+
373 
- 	/* Open a connection to the remote host. */
374 
- 	if (ssh_connect(host, addrs, &hostaddr, options.port,
375 
- 	    options.address_family, options.connection_attempts,
376 
-diff -rup openssh-7.4p1/sshd.c openssh-7.4p1-fips/sshd.c
377 
-+++ openssh-7.4p1-fips/sshd.c	2017-02-02 16:54:20.952828016 -0800
378 
-@@ -1827,6 +1827,10 @@ main(int ac, char **av)
379 
- 	/* Reinitialize the log (because of the fork above). */
380 
- 	log_init(__progname, options.log_level, options.log_facility, log_stderr);
381 
-
382 
-+	if (FIPS_mode()) {
383 
-+		logit("FIPS mode initialized");
384 
-+	}
385 
-+
386 
- 	/* Chdir to the root directory so that the current disk can be
387 
- 	   unmounted if desired. */
388 
- 	if (chdir("/") == -1)
389 
-diff -rup openssh-7.4p1/sshkey.c openssh-7.4p1-fips/sshkey.c
390 
-+++ openssh-7.4p1-fips/sshkey.c	2017-02-02 17:17:00.576797301 -0800
391 
-@@ -56,6 +56,7 @@
392 
- #include "digest.h"
393 
- #define SSHKEY_INTERNAL
394 
- #include "sshkey.h"
395 
-+#include "log.h"
396 
- #include "match.h"
397 
-
398 
- /* openssh private key file format */
399 
-@@ -1527,6 +1528,8 @@ rsa_generate_private_key(u_int bits, RSA
400 
- 	}
401 
- 	if (!BN_set_word(f4, RSA_F4) ||
402 
- 	    !RSA_generate_key_ex(private, bits, f4, NULL)) {
403 
-+			if (FIPS_mode())
404 
-+				logit("%s: the key length might be unsupported by FIPS mode approved key generation method", __func__);
405 
- 		ret = SSH_ERR_LIBCRYPTO_ERROR;
406 
- 		goto out;
407 
- 	}
SPECS/openssh/openssh-7.5p1-configure-fips.patch
History View file @ dca3ea3
... ... 
@@ -1,6 +1,29 @@
1 
-diff -rup openssh-7.5p1-fips/readconf.c openssh-7.5p1-fips-enable-1/readconf.c
2 
-+++ openssh-7.5p1-fips-enable-1/readconf.c	2017-02-15 17:08:04.946982460 -0800
1 
+From b7727ac11601d06e63fa67c8975994cfdbb7e62f Mon Sep 17 00:00:00 2001
2 
+From: Alexey Makhalov <amakhalov@vmware.com>
3 
+Date: Sat, 20 May 2017 05:19:04 +0000
4 
+Subject: [PATCH] Configure FIPS
5 
+
6 
+New parameter: FipsMode yes/no
7 
+
8 
+As soon as FipsMode option parsed FIPS_mode_set(1) will be called.
9 
+See Bug #1872327 for details.
10 
+---
11 
+ readconf.c    | 38 +++++++++++++++++++++++++++++++++++++-
12 
+ readconf.h    |  1 +
13 
+ servconf.c    | 34 +++++++++++++++++++++++++++++++++-
14 
+ servconf.h    |  1 +
15 
+ ssh_config    |  1 +
16 
+ ssh_config.0  |  4 ++++
17 
+ ssh_config.5  |  4 ++++
18 
+ sshd_config   |  2 ++
19 
+ sshd_config.0 |  4 ++++
20 
+ sshd_config.5 |  4 ++++
21 
+ 10 files changed, 91 insertions(+), 2 deletions(-)
22 
+
23 
+diff --git a/readconf.c b/readconf.c
24 
+index 7f401d6..2c970e2 100644
25 
+--- a/readconf.c
3 26 
 @@ -171,7 +171,8 @@ typedef enum {
4 27 
  	oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
5 28 
  	oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
... ... 
@@ -19,18 +42,43 @@ diff -rup openssh-7.5p1-fips/readconf.c openssh-7.5p1-fips-enable-1/readconf.c
19 19 
  	{ "updatehostkeys", oUpdateHostkeys },
20 20 
  	{ "hostbasedkeytypes", oHostbasedKeyTypes },
21 21 
  	{ "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
22 
-@@ -965,6 +967,10 @@ parse_time:
22 
+@@ -965,6 +967,35 @@ parse_time:
23 23 
  		intptr = &options->gss_deleg_creds;
24 24 
  		goto parse_flag;
25 25
26 26 
 +        case oFipsMode:
27 
-+                intptr = &options->fips_mode;
28 
-+                goto parse_flag;
27 
++		if (options->ciphers != NULL || options->cipher != -1)
28 
++			fatal("%.200s line %d: FipsMode should be set before "
29 
++			    "Ciphers option", filename, linenum);
30 
++		intptr = &options->fips_mode;
31 
++		multistate_ptr = multistate_flag;
32 
++		arg = strdelim(&s);
33 
++		if (!arg || *arg == '\0')
34 
++			fatal("%s line %d: missing argument.",
35 
++			    filename, linenum);
36 
++		value = -1;
37 
++		for (i = 0; multistate_ptr[i].key != NULL; i++) {
38 
++			if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
39 
++				value = multistate_ptr[i].value;
40 
++				break;
41 
++			}
42 
++		}
43 
++		if (value == -1)
44 
++			fatal("%s line %d: unsupported option \"%s\".",
45 
++			    filename, linenum, arg);
46 
++		if (*activep && *intptr == -1) {
47 
++			*intptr = value;
48 
++			/* Call FIPS_mode_set as soon as possible */
49 
++			if (*intptr == 1)
50 
++				if (!FIPS_mode_set(1))
51 
++					fatal("FIPS mode could not be set");
52 
++		}
53 
++		break;
29 54 
 +
30 55 
  	case oBatchMode:
31 56 
  		intptr = &options->batch_mode;
32 57 
  		goto parse_flag;
33 
-@@ -1857,6 +1863,7 @@ initialize_options(Options * options)
58 
+@@ -1857,6 +1888,7 @@ initialize_options(Options * options)
34 59 
  	options->update_hostkeys = -1;
35 60 
  	options->hostbased_key_types = NULL;
36 61 
  	options->pubkey_key_types = NULL;
... ... 
@@ -38,21 +86,17 @@ diff -rup openssh-7.5p1-fips/readconf.c openssh-7.5p1-fips-enable-1/readconf.c
38 38 
  }
39 39
40 40 
  /*
41 
-@@ -2044,6 +2051,13 @@ fill_default_options(Options * options)
41 
+@@ -2044,6 +2076,9 @@ fill_default_options(Options * options)
42 42 
  		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
43 43 
  	if (options->update_hostkeys == -1)
44 44 
  		options->update_hostkeys = 0;
45 45 
 +        if (options->fips_mode == -1)
46 46 
 +                options->fips_mode = 0;
47 
-+        /* Call FIPS_mode_set depending on whether fips mode is set or not */
48 
-+        if (options->fips_mode)
49 
-+                if (!FIPS_mode_set(1))
50 
-+                        fatal("FIPS mode could not be set");
51 47 
 +
52 48 
  	if (kex_assemble_names((FIPS_mode() ? KEX_FIPS_ENCRYPT
53 49 
  	        : KEX_CLIENT_ENCRYPT), &options->ciphers) != 0 ||
54 50 
  	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_MAC
55 
-@@ -2535,6 +2549,7 @@ dump_client_config(Options *o, const cha
51 
+@@ -2535,6 +2570,7 @@ dump_client_config(Options *o, const char *host)
56 52 
  	dump_cfg_fmtint(oVerifyHostKeyDNS, o->verify_host_key_dns);
57 53 
  	dump_cfg_fmtint(oVisualHostKey, o->visual_host_key);
58 54 
  	dump_cfg_fmtint(oUpdateHostkeys, o->update_hostkeys);
... ... 
@@ -60,11 +104,10 @@ diff -rup openssh-7.5p1-fips/readconf.c openssh-7.5p1-fips-enable-1/readconf.c
60 60
61 61 
  	/* Integer options */
62 62 
  	dump_cfg_int(oCanonicalizeMaxDots, o->canonicalize_max_dots);
63 
-Only in openssh-7.5p1-fips-enable-1: readconf.c.orig
64 
-Only in openssh-7.5p1-fips-enable-1: readconf.c.rej
65 
-diff -rup openssh-7.5p1-fips/readconf.h openssh-7.5p1-fips-enable-1/readconf.h
66 
-+++ openssh-7.5p1-fips-enable-1/readconf.h	2017-02-15 17:03:52.938988153 -0800
63 
+diff --git a/readconf.h b/readconf.h
64 
+index cef55f7..875931e 100644
65 
+--- a/readconf.h
67 66 
 @@ -157,6 +157,7 @@ typedef struct {
68 67 
  	char	*revoked_host_keys;
69 68
... ... 
@@ -73,10 +116,11 @@ diff -rup openssh-7.5p1-fips/readconf.h openssh-7.5p1-fips-enable-1/readconf.h
73 73
74 74 
  	int	 update_hostkeys; /* one of SSH_UPDATE_HOSTKEYS_* */
75 75
76 
-diff -rup openssh-7.5p1-fips/servconf.c openssh-7.5p1-fips-enable-1/servconf.c
77 
-+++ openssh-7.5p1-fips-enable-1/servconf.c	2017-02-15 17:03:52.938988153 -0800
78 
-@@ -164,6 +164,7 @@ initialize_server_options(ServerOptions
76 
+diff --git a/servconf.c b/servconf.c
77 
+index 4e5401c..107647a 100644
78 
+--- a/servconf.c
79 
+@@ -164,6 +164,7 @@ initialize_server_options(ServerOptions *options)
79 80 
  	options->version_addendum = NULL;
80 81 
  	options->fingerprint_hash = -1;
81 82 
  	options->disable_forwarding = -1;
... ... 
@@ -84,21 +128,16 @@ diff -rup openssh-7.5p1-fips/servconf.c openssh-7.5p1-fips-enable-1/servconf.c
84 84 
  }
85 85
86 86 
  /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
87 
-@@ -336,6 +337,13 @@ fill_default_server_options(ServerOption
87 
+@@ -336,6 +337,8 @@ fill_default_server_options(ServerOptions *options)
88 88 
  		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
89 89 
  	if (options->disable_forwarding == -1)
90 90 
  		options->disable_forwarding = 0;
91 91 
 +	if (options->fips_mode == -1)
92 92 
 +		options->fips_mode = 0;
93 
-+
94 
-+        /* Call FIPS_mode_set depending on whether fips mode is set or not */
95 
-+        if (options->fips_mode)
96 
-+                if (!FIPS_mode_set(1))
97 
-+                        fatal("FIPS mode could not be set");
98 93
99 94 
  	assemble_algorithms(options);
100 95
101 
-@@ -421,7 +429,8 @@ typedef enum {
96 
+@@ -421,7 +424,8 @@ typedef enum {
102 97 
  	sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
103 98 
  	sStreamLocalBindMask, sStreamLocalBindUnlink,
104 99 
  	sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
... ... 
@@ -108,7 +147,7 @@ diff -rup openssh-7.5p1-fips/servconf.c openssh-7.5p1-fips-enable-1/servconf.c
108 108 
  } ServerOpCodes;
109 109
110 110 
  #define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
111 
-@@ -564,6 +573,7 @@ static struct {
111 
+@@ -564,6 +568,7 @@ static struct {
112 112 
  	{ "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
113 113 
  	{ "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
114 114 
  	{ "disableforwarding", sDisableForwarding, SSHCFG_ALL },
... ... 
@@ -116,18 +155,40 @@ diff -rup openssh-7.5p1-fips/servconf.c openssh-7.5p1-fips-enable-1/servconf.c
116 116 
  	{ NULL, sBadOption, 0 }
117 117 
  };
118 118
119 
-@@ -1839,6 +1849,10 @@ process_server_config_line(ServerOptions
119 
+@@ -1839,6 +1844,32 @@ process_server_config_line(ServerOptions *options, char *line,
120 120 
  			options->fingerprint_hash = value;
121 121 
  		break;
122 122
123 123 
 +	case sFipsMode:
124 
++		if (options->ciphers != NULL)
125 
++			fatal("%.200s line %d: FipsMode should be set before "
126 
++			    "Ciphers option", filename, linenum);
124 127 
 +		intptr = &options->fips_mode;
125 
-+		goto parse_flag;
128 
++		arg = strdelim(&cp);
129 
++		if (!arg || *arg == '\0')
130 
++			fatal("%s line %d: missing yes/no argument.",
131 
++			    filename, linenum);
132 
++		value = 0;	/* silence compiler */
133 
++		if (strcmp(arg, "yes") == 0)
134 
++			value = 1;
135 
++		else if (strcmp(arg, "no") == 0)
136 
++			value = 0;
137 
++		else
138 
++			fatal("%s line %d: Bad yes/no argument: %s",
139 
++				filename, linenum, arg);
140 
++		if (*activep && *intptr == -1) {
141 
++			*intptr = value;
142 
++			/* Call FIPS_mode_set as soon as possible */
143 
++			if (*intptr == 1)
144 
++				if (!FIPS_mode_set(1))
145 
++					fatal("FIPS mode could not be set");
146 
++		}
147 
++		break;
126 148 
 +
127 149 
  	case sDeprecated:
128 150 
  	case sIgnore:
129 151 
  	case sUnsupported:
130 
-@@ -2278,6 +2285,7 @@ dump_config(ServerOptions *o)
152 
+@@ -2280,6 +2311,7 @@ dump_config(ServerOptions *o)
131 153 
  	dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
132 154 
  	dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
133 155 
  	dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
... ... 
@@ -135,10 +196,10 @@ diff -rup openssh-7.5p1-fips/servconf.c openssh-7.5p1-fips-enable-1/servconf.c
135 135
136 136 
  	/* string arguments */
137 137 
  	dump_cfg_string(sPidFile, o->pid_file);
138 
-Only in openssh-7.5p1-fips-enable-1: servconf.c.orig
139 
-diff -rup openssh-7.5p1-fips/servconf.h openssh-7.5p1-fips-enable-1/servconf.h
140 
-+++ openssh-7.5p1-fips-enable-1/servconf.h	2017-02-15 17:03:52.938988153 -0800
138 
+diff --git a/servconf.h b/servconf.h
139 
+index 5853a97..a9ec1a2 100644
140 
+--- a/servconf.h
141 141 
 @@ -189,6 +189,7 @@ typedef struct {
142 142 
  	char   *auth_methods[MAX_AUTH_METHODS];
143 143
... ... 
@@ -147,9 +208,10 @@ diff -rup openssh-7.5p1-fips/servconf.h openssh-7.5p1-fips-enable-1/servconf.h
147 147 
  }       ServerOptions;
148 148
149 149 
  /* Information about the incoming connection as used by Match */
150 
-diff -rup openssh-7.5p1-fips/ssh_config openssh-7.5p1-fips-enable-1/ssh_config
151 
-+++ openssh-7.5p1-fips-enable-1/ssh_config	2017-02-15 17:03:52.938988153 -0800
150 
+diff --git a/ssh_config b/ssh_config
151 
+index 90fb63f..fd6ab39 100644
152 
+--- a/ssh_config
152 153 
 @@ -37,6 +37,7 @@
153 154 
  #   IdentityFile ~/.ssh/id_ecdsa
154 155 
  #   IdentityFile ~/.ssh/id_ed25519
... ... 
@@ -158,9 +220,10 @@ diff -rup openssh-7.5p1-fips/ssh_config openssh-7.5p1-fips-enable-1/ssh_config
158 158 
  #   Protocol 2
159 159 
  #   Cipher 3des
160 160 
  #   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
161 
-diff -rup openssh-7.5p1-fips/ssh_config.0 openssh-7.5p1-fips-enable-1/ssh_config.0
162 
-+++ openssh-7.5p1-fips-enable-1/ssh_config.0	2017-02-15 17:03:52.938988153 -0800
161 
+diff --git a/ssh_config.0 b/ssh_config.0
162 
+index 4ca9a5f..33ac338 100644
163 
+--- a/ssh_config.0
163 164 
 @@ -362,6 +362,10 @@ DESCRIPTION
164 165 
               Specifies the hash algorithm used when displaying key
165 166 
               fingerprints.  Valid options are: md5 and sha256 (the default).
... ... 
@@ -172,9 +235,10 @@ diff -rup openssh-7.5p1-fips/ssh_config.0 openssh-7.5p1-fips-enable-1/ssh_config
172 172 
       ForwardAgent
173 173 
               Specifies whether the connection to the authentication agent (if
174 174 
               any) will be forwarded to the remote machine.  The argument must
175 
-diff -rup openssh-7.5p1-fips/ssh_config.5 openssh-7.5p1-fips-enable-1/ssh_config.5
176 
-+++ openssh-7.5p1-fips-enable-1/ssh_config.5	2017-02-15 17:03:52.938988153 -0800
175 
+diff --git a/ssh_config.5 b/ssh_config.5
176 
+index 591365f..df46e0d 100644
177 
+--- a/ssh_config.5
177 178 
 @@ -658,6 +658,10 @@ Valid options are:
178 179 
  and
179 180 
  .Cm sha256
... ... 
@@ -186,10 +250,10 @@ diff -rup openssh-7.5p1-fips/ssh_config.5 openssh-7.5p1-fips-enable-1/ssh_config
186 186 
  .It Cm ForwardAgent
187 187 
  Specifies whether the connection to the authentication agent (if any)
188 188 
  will be forwarded to the remote machine.
189 
-Only in openssh-7.5p1-fips-enable-1: ssh.c.orig
190 
-diff -rup openssh-7.5p1-fips/sshd_config openssh-7.5p1-fips-enable-1/sshd_config
191 
-+++ openssh-7.5p1-fips-enable-1/sshd_config	2017-02-15 17:03:52.938988153 -0800
189 
+diff --git a/sshd_config b/sshd_config
190 
+index 9f09e4a..1a0d68a 100644
191 
+--- a/sshd_config
192 192 
 @@ -105,6 +105,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
193 193 
  #ChrootDirectory none
194 194 
  #VersionAddendum none
... ... 
@@ -199,9 +263,10 @@ diff -rup openssh-7.5p1-fips/sshd_config openssh-7.5p1-fips-enable-1/sshd_config
199 199 
  # no default banner path
200 200 
  #Banner none
201 201
202 
-diff -rup openssh-7.5p1-fips/sshd_config.0 openssh-7.5p1-fips-enable-1/sshd_config.0
203 
-+++ openssh-7.5p1-fips-enable-1/sshd_config.0	2017-02-15 17:03:52.938988153 -0800
202 
+diff --git a/sshd_config.0 b/sshd_config.0
203 
+index 022c052..af813b2 100644
204 
+--- a/sshd_config.0
204 205 
 @@ -331,6 +331,10 @@ DESCRIPTION
205 206 
               Specifies the hash algorithm used when logging key fingerprints.
206 207 
               Valid options are: md5 and sha256.  The default is sha256.
... ... 
@@ -213,17 +278,21 @@ diff -rup openssh-7.5p1-fips/sshd_config.0 openssh-7.5p1-fips-enable-1/sshd_conf
213 213 
       ForceCommand
214 214 
               Forces the execution of the command specified by ForceCommand,
215 215 
               ignoring any command supplied by the client and ~/.ssh/rc if
216 
-diff -rup openssh-7.5p1-fips/sshd_config.5 openssh-7.5p1-fips-enable-1/sshd_config.5
217 
-+++ openssh-7.5p1-fips-enable-1/sshd_config.5	2017-02-15 17:03:52.942988153 -0800
216 
+diff --git a/sshd_config.5 b/sshd_config.5
217 
+index 32b29d2..c618359 100644
218 
+--- a/sshd_config.5
218 219 
 @@ -578,6 +578,10 @@ and
219 220 
  .Cm sha256 .
220 221 
  The default is
221 222 
  .Cm sha256 .
222 223 
 +.It Cm FipsMode
223 224 
 +Enables or disables FIPS mode. Requires FIPS capable ssl modules.
224 
-+The default is
225 
++The default is
225 226 
 +.Cm no .
226 227 
  .It Cm ForceCommand
227 228 
  Forces the execution of the command specified by
228 229 
  .Cm ForceCommand ,
230 
+--
231 
+2.8.1
232 
+
SPECS/openssh/openssh-7.5p1-fips.patch
History View file @ dca3ea3
... ... 
@@ -1,7 +1,7 @@
1 
-diff -rup openssh-7.5p1/cipher.c openssh-7.5p1-fips/cipher.c
2 
-+++ openssh-7.5p1-fips/cipher.c	2017-02-02 15:51:07.008913721 -0800
3 
-@@ -136,6 +136,20 @@ static const struct sshcipher ciphers[]
1 
+diff -rup openssh-7.5p1/cipher.c openssh-7.5p1-new/cipher.c
2 
+--- openssh-7.5p1/cipher.c	2017-03-19 19:39:27.000000000 -0700
3 
+@@ -136,6 +136,26 @@ static const struct sshcipher ciphers[]
4 4 
  	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
5 5 
  };
6 6
... ... 
@@ -16,13 +16,19 @@ diff -rup openssh-7.5p1/cipher.c openssh-7.5p1-fips/cipher.c
16 16 
 +	{ "aes128-ctr",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
17 17 
 +	{ "aes192-ctr",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },
18 18 
 +	{ "aes256-ctr",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },
19 
++# ifdef OPENSSL_HAVE_EVPGCM
20 
++	{ "aes128-gcm@openssh.com",
21 
++			SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
22 
++	{ "aes256-gcm@openssh.com",
23 
++			SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
24 
++# endif /* OPENSSL_HAVE_EVPGCM */
19 25 
 +	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
20 26 
 +};
21 27 
 +
22 28 
  /*--*/
23 29
24 30 
  /* Returns a comma-separated list of supported ciphers. */
25 
-@@ -146,7 +160,7 @@ cipher_alg_list(char sep, int auth_only)
31 
+@@ -146,7 +166,7 @@ cipher_alg_list(char sep, int auth_only)
26 32 
  	size_t nlen, rlen = 0;
27 33 
  	const struct sshcipher *c;
28 34
... ... 
@@ -31,7 +37,7 @@ diff -rup openssh-7.5p1/cipher.c openssh-7.5p1-fips/cipher.c
31 31 
  		if (c->number != SSH_CIPHER_SSH2)
32 32 
  			continue;
33 33 
  		if (auth_only && c->auth_len == 0)
34 
-@@ -242,7 +256,7 @@ const struct sshcipher *
34 
+@@ -242,7 +262,7 @@ const struct sshcipher *
35 35 
  cipher_by_name(const char *name)
36 36 
  {
37 37 
  	const struct sshcipher *c;
... ... 
@@ -40,7 +46,7 @@ diff -rup openssh-7.5p1/cipher.c openssh-7.5p1-fips/cipher.c
40 40 
  		if (strcmp(c->name, name) == 0)
41 41 
  			return c;
42 42 
  	return NULL;
43 
-@@ -252,7 +266,7 @@ const struct sshcipher *
43 
+@@ -252,7 +272,7 @@ const struct sshcipher *
44 44 
  cipher_by_number(int id)
45 45 
  {
46 46 
  	const struct sshcipher *c;
... ... 
@@ -49,7 +55,7 @@ diff -rup openssh-7.5p1/cipher.c openssh-7.5p1-fips/cipher.c
49 49 
  		if (c->number == id)
50 50 
  			return c;
51 51 
  	return NULL;
52 
-@@ -293,7 +307,7 @@ cipher_number(const char *name)
52 
+@@ -293,7 +313,7 @@ cipher_number(const char *name)
53 53 
  	const struct sshcipher *c;
54 54 
  	if (name == NULL)
55 55 
  		return -1;
... ... 
@@ -58,9 +64,9 @@ diff -rup openssh-7.5p1/cipher.c openssh-7.5p1-fips/cipher.c
58 58 
  		if (strcasecmp(c->name, name) == 0)
59 59 
  			return c->number;
60 60 
  	return -1;
61 
-diff -rup openssh-7.5p1/cipher-ctr.c openssh-7.5p1-fips/cipher-ctr.c
62 
-+++ openssh-7.5p1-fips/cipher-ctr.c	2017-02-02 15:47:44.252918302 -0800
61 
+diff -rup openssh-7.5p1/cipher-ctr.c openssh-7.5p1-new/cipher-ctr.c
62 
+--- openssh-7.5p1/cipher-ctr.c	2017-03-19 19:39:27.000000000 -0700
63 63 
 @@ -138,7 +138,8 @@ evp_aes_128_ctr(void)
64 64 
  	aes_ctr.do_cipher = ssh_aes_ctr;
65 65 
  #ifndef SSH_OLD_EVP
... ... 
@@ -71,9 +77,9 @@ diff -rup openssh-7.5p1/cipher-ctr.c openssh-7.5p1-fips/cipher-ctr.c
71 71 
  #endif
72 72 
  	return (&aes_ctr);
73 73 
  }
74 
-diff -rup openssh-7.5p1/dh.h openssh-7.5p1-fips/dh.h
75 
-+++ openssh-7.5p1-fips/dh.h	2017-02-02 15:52:37.552911676 -0800
74 
+diff -rup openssh-7.5p1/dh.h openssh-7.5p1-new/dh.h
75 
+--- openssh-7.5p1/dh.h	2017-03-19 19:39:27.000000000 -0700
76 76 
 @@ -51,6 +51,7 @@ u_int	 dh_estimate(int);
77 77 
   * Miniumum increased in light of DH precomputation attacks.
78 78 
   */
... ... 
@@ -82,9 +88,9 @@ diff -rup openssh-7.5p1/dh.h openssh-7.5p1-fips/dh.h
82 82 
  #define DH_GRP_MAX	8192
83 83
84 84 
  /*
85 
-diff -rup openssh-7.5p1/entropy.c openssh-7.5p1-fips/entropy.c
86 
-+++ openssh-7.5p1-fips/entropy.c	2017-02-02 15:53:46.088910128 -0800
85 
+diff -rup openssh-7.5p1/entropy.c openssh-7.5p1-new/entropy.c
86 
+--- openssh-7.5p1/entropy.c	2017-03-19 19:39:27.000000000 -0700
87 87 
 @@ -217,6 +217,9 @@ seed_rng(void)
88 88 
  		fatal("OpenSSL version mismatch. Built against %lx, you "
89 89 
  		    "have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
... ... 
@@ -95,14 +101,18 @@ diff -rup openssh-7.5p1/entropy.c openssh-7.5p1-fips/entropy.c
95 95 
  #ifndef OPENSSL_PRNG_ONLY
96 96 
  	if (RAND_status() == 1) {
97 97 
  		debug3("RNG is ready, skipping seeding");
98 
-diff -rup openssh-7.5p1/kex.c openssh-7.5p1-fips/kex.c
99 
-+++ openssh-7.5p1-fips/kex.c	2017-02-02 16:06:13.120893252 -0800
100 
-@@ -114,6 +114,23 @@ static const struct kexalg kexalgs[] = {
98 
+diff -rup openssh-7.5p1/kex.c openssh-7.5p1-new/kex.c
99 
+--- openssh-7.5p1/kex.c	2017-03-19 19:39:27.000000000 -0700
100 
+@@ -114,6 +114,27 @@ static const struct kexalg kexalgs[] = {
101 101 
  	{ NULL, -1, -1, -1},
102 102 
  };
103 103
104 104 
 +static const struct kexalg kexalgs_fips[] = {
105 
++	{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
106 
++	{ KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
107 
++	{ KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
108 
++	{ KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512 },
105 109 
 +#ifdef HAVE_EVP_SHA256
106 110 
 +	{ KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
107 111 
 +#endif
... ... 
@@ -122,7 +132,7 @@ diff -rup openssh-7.5p1/kex.c openssh-7.5p1-fips/kex.c
122 122 
  char *
123 123 
  kex_alg_list(char sep)
124 124 
  {
125 
-@@ -121,7 +138,7 @@ kex_alg_list(char sep)
125 
+@@ -121,7 +142,7 @@ kex_alg_list(char sep)
126 126 
  	size_t nlen, rlen = 0;
127 127 
  	const struct kexalg *k;
128 128
... ... 
@@ -131,7 +141,7 @@ diff -rup openssh-7.5p1/kex.c openssh-7.5p1-fips/kex.c
131 131 
  		if (ret != NULL)
132 132 
  			ret[rlen++] = sep;
133 133 
  		nlen = strlen(k->name);
134 
-@@ -141,7 +158,7 @@ kex_alg_by_name(const char *name)
134 
+@@ -141,7 +162,7 @@ kex_alg_by_name(const char *name)
135 135 
  {
136 136 
  	const struct kexalg *k;
137 137
... ... 
@@ -140,7 +150,7 @@ diff -rup openssh-7.5p1/kex.c openssh-7.5p1-fips/kex.c
140 140 
  		if (strcmp(k->name, name) == 0)
141 141 
  			return k;
142 142 
  	}
143 
-@@ -161,7 +178,10 @@ kex_names_valid(const char *names)
143 
+@@ -161,7 +182,10 @@ kex_names_valid(const char *names)
144 144 
  	for ((p = strsep(&cp, ",")); p && *p != '\0';
145 145 
  	    (p = strsep(&cp, ","))) {
146 146 
  		if (kex_alg_by_name(p) == NULL) {
... ... 
@@ -152,9 +162,9 @@ diff -rup openssh-7.5p1/kex.c openssh-7.5p1-fips/kex.c
152 152 
  			free(s);
153 153 
  			return 0;
154 154 
  		}
155 
-diff -rup openssh-7.5p1/kexgexc.c openssh-7.5p1-fips/kexgexc.c
156 
-+++ openssh-7.5p1-fips/kexgexc.c	2017-02-02 16:10:36.604887300 -0800
155 
+diff -rup openssh-7.5p1/kexgexc.c openssh-7.5p1-new/kexgexc.c
156 
+--- openssh-7.5p1/kexgexc.c	2017-03-19 19:39:27.000000000 -0700
157 157 
 @@ -63,7 +63,7 @@ kexgex_client(struct ssh *ssh)
158 158
159 159 
  	nbits = dh_estimate(kex->dh_need * 8);
... ... 
@@ -164,9 +174,9 @@ diff -rup openssh-7.5p1/kexgexc.c openssh-7.5p1-fips/kexgexc.c
164 164 
  	kex->max = DH_GRP_MAX;
165 165 
  	kex->nbits = nbits;
166 166 
  	if (datafellows & SSH_BUG_DHGEX_LARGE)
167 
-diff -rup openssh-7.5p1/kexgexs.c openssh-7.5p1-fips/kexgexs.c
168 
-+++ openssh-7.5p1-fips/kexgexs.c	2017-02-02 16:11:31.404886062 -0800
167 
+diff -rup openssh-7.5p1/kexgexs.c openssh-7.5p1-new/kexgexs.c
168 
+--- openssh-7.5p1/kexgexs.c	2017-03-19 19:39:27.000000000 -0700
169 169 
 @@ -83,9 +83,9 @@ input_kex_dh_gex_request(int type, u_int
170 170 
  	kex->nbits = nbits;
171 171 
  	kex->min = min;
... ... 
@@ -179,9 +189,9 @@ diff -rup openssh-7.5p1/kexgexs.c openssh-7.5p1-fips/kexgexs.c
179 179 
  	nbits = MINIMUM(DH_GRP_MAX, nbits);
180 180
181 181 
  	if (kex->max < kex->min || kex->nbits < kex->min ||
182 
-diff -rup openssh-7.5p1/mac.c openssh-7.5p1-fips/mac.c
183 
-+++ openssh-7.5p1-fips/mac.c	2017-02-02 16:13:56.932882775 -0800
182 
+diff -rup openssh-7.5p1/mac.c openssh-7.5p1-new/mac.c
183 
+--- openssh-7.5p1/mac.c	2017-03-19 19:39:27.000000000 -0700
184 184 
 @@ -54,7 +54,7 @@ struct macalg {
185 185 
  	int		etm;		/* Encrypt-then-MAC */
186 186 
  };
... ... 
@@ -234,20 +244,23 @@ diff -rup openssh-7.5p1/mac.c openssh-7.5p1-fips/mac.c
234 234 
  		if (strcmp(name, m->name) != 0)
235 235 
  			continue;
236 236 
  		if (mac != NULL)
237 
-diff -rup openssh-7.5p1/myproposal.h openssh-7.5p1-fips/myproposal.h
238 
-+++ openssh-7.5p1-fips/myproposal.h	2017-02-02 16:15:40.516880435 -0800
239 
-@@ -138,6 +138,26 @@
237 
+diff -rup openssh-7.5p1/myproposal.h openssh-7.5p1-new/myproposal.h
238 
+--- openssh-7.5p1/myproposal.h	2017-03-19 19:39:27.000000000 -0700
239 
+@@ -138,6 +138,29 @@
240 240
241 241 
  #define KEX_CLIENT_MAC KEX_SERVER_MAC
242 242
243 243 
 +#define KEX_DEFAULT_KEX_FIPS		\
244 244 
 +	KEX_ECDH_METHODS \
245 
-+	KEX_SHA2_METHODS
245 
++	KEX_SHA2_METHODS \
246 
++	KEX_SHA2_GROUP14 \
247 
++	"diffie-hellman-group14-sha1"
246 248 
 +#define	KEX_FIPS_ENCRYPT \
247 249 
 +	"aes128-ctr,aes192-ctr,aes256-ctr," \
248 250 
 +	"aes128-cbc,3des-cbc," \
249 
-+	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se"
251 
++	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se" \
252 
++	AESGCM_CIPHER_MODES
250 253 
 +#ifdef HAVE_EVP_SHA256
251 254 
 +#define	KEX_FIPS_MAC \
252 255 
 +	"hmac-sha1," \
... ... 
@@ -264,9 +277,9 @@ diff -rup openssh-7.5p1/myproposal.h openssh-7.5p1-fips/myproposal.h
264 264 
  #else /* WITH_OPENSSL */
265 265
266 266 
  #define KEX_SERVER_KEX		\
267 
-diff -rup openssh-7.5p1/openbsd-compat/openssl-compat.h openssh-7.5p1-fips/openbsd-compat/openssl-compat.h
268 
-+++ openssh-7.5p1-fips/openbsd-compat/openssl-compat.h	2017-02-02 16:17:03.024878571 -0800
267 
+diff -rup openssh-7.5p1/openbsd-compat/openssl-compat.h openssh-7.5p1-new/openbsd-compat/openssl-compat.h
268 
+--- openssh-7.5p1/openbsd-compat/openssl-compat.h	2017-03-19 19:39:27.000000000 -0700
269 269 
 @@ -24,6 +24,7 @@
270 270 
  #include <openssl/evp.h>
271 271 
  #include <openssl/rsa.h>
... ... 
@@ -275,10 +288,10 @@ diff -rup openssh-7.5p1/openbsd-compat/openssl-compat.h openssh-7.5p1-fips/openb
275 275
276 276 
  int ssh_compatible_openssl(long, long);
277 277
278 
-diff -rup openssh-7.5p1/readconf.c openssh-7.5p1-fips/readconf.c
279 
-+++ openssh-7.5p1-fips/readconf.c	2017-02-02 16:19:05.624875801 -0800
280 
-@@ -2044,9 +2044,12 @@ fill_default_options(Options * options)
278 
+diff -rup openssh-7.5p1/readconf.c openssh-7.5p1-new/readconf.c
279 
+--- openssh-7.5p1/readconf.c	2017-03-19 19:39:27.000000000 -0700
280 
+@@ -2066,9 +2066,12 @@ fill_default_options(Options * options)
281 281 
  		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
282 282 
  	if (options->update_hostkeys == -1)
283 283 
  		options->update_hostkeys = 0;
... ... 
@@ -294,10 +307,11 @@ diff -rup openssh-7.5p1/readconf.c openssh-7.5p1-fips/readconf.c
294 294 
  	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
295 295 
  	    &options->hostbased_key_types) != 0 ||
296 296 
  	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
297 
-diff -rup openssh-7.5p1/sandbox-seccomp-filter.c openssh-7.5p1-fips/sandbox-seccomp-filter.c
298 
-+++ openssh-7.5p1-fips/sandbox-seccomp-filter.c	2017-02-02 16:20:10.104874345 -0800
299 
-@@ -118,6 +118,9 @@ static const struct sock_filter preauth_
297 
+Only in openssh-7.5p1-new: readconf.c.orig
298 
+diff -rup openssh-7.5p1/sandbox-seccomp-filter.c openssh-7.5p1-new/sandbox-seccomp-filter.c
299 
+--- openssh-7.5p1/sandbox-seccomp-filter.c	2017-03-19 19:39:27.000000000 -0700
300 
+@@ -134,6 +134,9 @@ static const struct sock_filter preauth_
300 301 
  #ifdef __NR_open
301 302 
  	SC_DENY(__NR_open, EACCES),
302 303 
  #endif
... ... 
@@ -307,9 +321,10 @@ diff -rup openssh-7.5p1/sandbox-seccomp-filter.c openssh-7.5p1-fips/sandbox-secc
307 307 
  #ifdef __NR_openat
308 308 
  	SC_DENY(__NR_openat, EACCES),
309 309 
  #endif
310 
-diff -rup openssh-7.5p1/servconf.c openssh-7.5p1-fips/servconf.c
311 
-+++ openssh-7.5p1-fips/servconf.c	2017-02-02 16:23:48.132869419 -0800
310 
+Only in openssh-7.5p1-new: sandbox-seccomp-filter.c.orig
311 
+diff -rup openssh-7.5p1/servconf.c openssh-7.5p1-new/servconf.c
312 
+--- openssh-7.5p1/servconf.c	2017-03-19 19:39:27.000000000 -0700
312 313 
 @@ -176,9 +176,12 @@ option_clear_or_none(const char *o)
313 314 
  static void
314 315 
  assemble_algorithms(ServerOptions *o)
... ... 
@@ -326,7 +341,7 @@ diff -rup openssh-7.5p1/servconf.c openssh-7.5p1-fips/servconf.c
326 326 
  	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
327 327 
  	    &o->hostkeyalgorithms) != 0 ||
328 328 
  	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
329 
-@@ -2281,8 +2284,10 @@ dump_config(ServerOptions *o)
329 
+@@ -2282,8 +2285,10 @@ dump_config(ServerOptions *o)
330 330 
  	/* string arguments */
331 331 
  	dump_cfg_string(sPidFile, o->pid_file);
332 332 
  	dump_cfg_string(sXAuthLocation, o->xauth_location);
... ... 
@@ -339,7 +354,7 @@ diff -rup openssh-7.5p1/servconf.c openssh-7.5p1-fips/servconf.c
339 339 
  	dump_cfg_string(sBanner, o->banner);
340 340 
  	dump_cfg_string(sForceCommand, o->adm_forced_command);
341 341 
  	dump_cfg_string(sChrootDirectory, o->chroot_directory);
342 
-@@ -2297,8 +2302,8 @@ dump_config(ServerOptions *o)
342 
+@@ -2298,8 +2303,8 @@ dump_config(ServerOptions *o)
343 343 
  	dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command);
344 344 
  	dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user);
345 345 
  	dump_cfg_string(sHostKeyAgent, o->host_key_agent);
... ... 
@@ -350,9 +365,10 @@ diff -rup openssh-7.5p1/servconf.c openssh-7.5p1-fips/servconf.c
350 350 
  	dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ?
351 351 
  	    o->hostbased_key_types : KEX_DEFAULT_PK_ALG);
352 352 
  	dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ?
353 
-diff -rup openssh-7.5p1/ssh.c openssh-7.5p1-fips/ssh.c
354 
-+++ openssh-7.5p1-fips/ssh.c	2017-02-02 16:49:00.060835265 -0800
353 
+Only in openssh-7.5p1-new: servconf.c.orig
354 
+diff -rup openssh-7.5p1/ssh.c openssh-7.5p1-new/ssh.c
355 
+--- openssh-7.5p1/ssh.c	2017-03-19 19:39:27.000000000 -0700
355 356 
 @@ -609,6 +609,9 @@ main(int ac, char **av)
356 357 
  	    "ACD:E:F:GI:J:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) {
357 358 
  		switch (opt) {
... ... 
@@ -387,10 +403,10 @@ diff -rup openssh-7.5p1/ssh.c openssh-7.5p1-fips/ssh.c
387 387 
  	/* Open a connection to the remote host. */
388 388 
  	if (ssh_connect(host, addrs, &hostaddr, options.port,
389 389 
  	    options.address_family, options.connection_attempts,
390 
-diff -rup openssh-7.5p1/sshd.c openssh-7.5p1-fips/sshd.c
391 
-+++ openssh-7.5p1-fips/sshd.c	2017-02-02 16:54:20.952828016 -0800
392 
-@@ -1827,6 +1827,10 @@ main(int ac, char **av)
390 
+diff -rup openssh-7.5p1/sshd.c openssh-7.5p1-new/sshd.c
391 
+--- openssh-7.5p1/sshd.c	2017-03-19 19:39:27.000000000 -0700
392 
+@@ -1841,6 +1841,10 @@ main(int ac, char **av)
393 393 
  	/* Reinitialize the log (because of the fork above). */
394 394 
  	log_init(__progname, options.log_level, options.log_facility, log_stderr);
395 395
... ... 
@@ -401,9 +417,10 @@ diff -rup openssh-7.5p1/sshd.c openssh-7.5p1-fips/sshd.c
401 401 
  	/* Chdir to the root directory so that the current disk can be
402 402 
  	   unmounted if desired. */
403 403 
  	if (chdir("/") == -1)
404 
-diff -rup openssh-7.5p1/sshkey.c openssh-7.5p1-fips/sshkey.c
405 
-+++ openssh-7.5p1-fips/sshkey.c	2017-02-02 17:17:00.576797301 -0800
404 
+Only in openssh-7.5p1-new: sshd.c.orig
405 
+diff -rup openssh-7.5p1/sshkey.c openssh-7.5p1-new/sshkey.c
406 
+--- openssh-7.5p1/sshkey.c	2017-03-19 19:39:27.000000000 -0700
406 407 
 @@ -56,6 +56,7 @@
407 408 
  #include "digest.h"
408 409 
  #define SSHKEY_INTERNAL
... ... 
@@ -412,7 +429,7 @@ diff -rup openssh-7.5p1/sshkey.c openssh-7.5p1-fips/sshkey.c
412 412 
  #include "match.h"
413 413
414 414 
  /* openssh private key file format */
415 
-@@ -1527,6 +1528,8 @@ rsa_generate_private_key(u_int bits, RSA
415 
+@@ -1534,6 +1535,8 @@ rsa_generate_private_key(u_int bits, RSA
416 416 
  	}
417 417 
  	if (!BN_set_word(f4, RSA_F4) ||
418 418 
  	    !RSA_generate_key_ex(private, bits, f4, NULL)) {
... ... 
@@ -421,3 +438,4 @@ diff -rup openssh-7.5p1/sshkey.c openssh-7.5p1-fips/sshkey.c
421 421 
  		ret = SSH_ERR_LIBCRYPTO_ERROR;
422 422 
  		goto out;
423 423 
  	}
424 
+Only in openssh-7.5p1-new: sshkey.c.orig
SPECS/openssh/openssh.spec
History View file @ dca3ea3
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:        Free version of the SSH connectivity tools
2 2 
 Name:           openssh
3 3 
 Version:        7.5p1
4 
-Release:        8%{?dist}
4 
+Release:        9%{?dist}
5 5 
 License:        BSD
6 6 
 URL:            https://www.openssh.com/
7 7 
 Group:          System Environment/Security
... ... 
@@ -178,6 +178,8 @@ rm -rf %{buildroot}/*
178 178 
 %{_mandir}/man8/ssh-pkcs11-helper.8.gz
179 179
180 180 
 %changelog
181 
+*   Tue Nov 14 2017 Anish Swaminathan <anishs@vmware.com> 7.5p1-9
182 
+-   Add ciphers aes128-gcm, aes256-gcm and kex dh14/16/18 in fips mode
181 183 
 *   Tue Oct 10 2017 Alexey Makhalov <amakhalov@vmware.com> 7.5p1-8
182 184 
 -   No direct toybox dependency, shadow depends on toybox
183 185 
 *   Mon Sep 18 2017 Alexey Makhalov <amakhalov@vmware.com> 7.5p1-7