diff --git a/gsi-openssh.spec b/gsi-openssh.spec index 49140db..b21afe5 100644 --- a/gsi-openssh.spec +++ b/gsi-openssh.spec @@ -24,7 +24,7 @@ %global libedit 1 %global openssh_ver 9.6p1 -%global openssh_rel 1 +%global openssh_rel 3 Summary: An implementation of the SSH protocol with GSI authentication Name: gsi-openssh @@ -181,6 +181,9 @@ Patch1014: openssh-8.7p1-nohostsha1proof.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2294879 # Merged in OpenSSH 9.8 Patch1016: openssh-9.6p1-cve-2024-6387.patch +# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2 +# upstream 0832aac79517611dd4de93ad0a83577994d9c907 +Patch1021: openssh-9.9p2-error_processing.patch # This is the patch that adds GSI support # Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream @@ -246,6 +249,8 @@ Requires(pre): /usr/sbin/useradd Requires: pam >= 1.0.1-3 Requires: crypto-policies >= 20220824-1 %{?systemd_requires} +Requires(pre): policycoreutils-python-utils +Requires(postun): policycoreutils-python-utils %description SSH (Secure SHell) is a program for logging into and executing @@ -340,6 +345,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1013 -p1 -b .evp-fips-ecdh %patch -P 1014 -p1 -b .nosha1hostproof %patch -P 1016 -p1 -b .cve-2024-6387 +%patch -P 1021 -p1 -b .errcode_set %patch -P 100 -p1 -b .coverity @@ -348,8 +354,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} sed 's/sshd.pid/gsisshd.pid/' -i pathnames.h sed 's!$(piddir)/sshd.pid!$(piddir)/gsisshd.pid!' -i Makefile.in -sed 's!/etc/sysconfig/sshd!/etc/sysconfig/gsisshd!' -i sshd_config -sed 's!/etc/pam.d/sshd!/etc/pam.d/gsisshd!' -i sshd_config +sed 's!/etc/pam.d/sshd!/etc/pam.d/gsisshd!' -i sshd_config_redhat cp -p %{SOURCE99} . @@ -357,7 +362,6 @@ autoreconf %build %set_build_flags -CFLAGS="$CFLAGS"; export CFLAGS %if %{pie} %ifarch s390 s390x sparc sparcv9 sparc64 CFLAGS="$CFLAGS -fPIC" @@ -390,8 +394,8 @@ fi --sysconfdir=%{_sysconfdir}/gsissh \ --libexecdir=%{_libexecdir}/gsissh \ --datadir=%{_datadir}/gsissh \ - --with-default-path=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \ - --with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \ + --with-default-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \ + --with-superuser-path=%{_libexecdir}/gsissh/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \ --with-privsep-path=%{_datadir}/empty.sshd \ --disable-strip \ --without-zlib-version-check \ @@ -464,12 +468,10 @@ rm $RPM_BUILD_ROOT%{_bindir}/ssh-agent rm $RPM_BUILD_ROOT%{_bindir}/ssh-keyscan rm $RPM_BUILD_ROOT%{_libexecdir}/gsissh/ssh-keycat rm $RPM_BUILD_ROOT%{_libexecdir}/gsissh/ssh-pkcs11-helper -rm $RPM_BUILD_ROOT%{_libexecdir}/gsissh/ssh-sk-helper rm $RPM_BUILD_ROOT%{_mandir}/man1/ssh-add.1* rm $RPM_BUILD_ROOT%{_mandir}/man1/ssh-agent.1* rm $RPM_BUILD_ROOT%{_mandir}/man1/ssh-keyscan.1* rm $RPM_BUILD_ROOT%{_mandir}/man8/ssh-pkcs11-helper.8* -rm $RPM_BUILD_ROOT%{_mandir}/man8/ssh-sk-helper.8* for f in $RPM_BUILD_ROOT%{_bindir}/* \ $RPM_BUILD_ROOT%{_sbindir}/* \ @@ -477,13 +479,18 @@ for f in $RPM_BUILD_ROOT%{_bindir}/* \ mv $f `dirname $f`/gsi`basename $f` done -# Add symlink with alternative name for scp binary -ln -s gsiscp $RPM_BUILD_ROOT%{_bindir}/hpnscp +# Add scp and hpnscp symlinks in gsisshd's path +mkdir $RPM_BUILD_ROOT%{_libexecdir}/gsissh/bin +ln -nrs $RPM_BUILD_ROOT%{_bindir}/gsiscp \ + $RPM_BUILD_ROOT%{_libexecdir}/gsissh/bin/scp +ln -nrs $RPM_BUILD_ROOT%{_bindir}/gsiscp \ + $RPM_BUILD_ROOT%{_libexecdir}/gsissh/bin/hpnscp perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/* %pre server %sysusers_create_compat %{SOURCE19} +semanage port -a -t ssh_port_t -p tcp 2222 2>/dev/null || : %post server if [ $1 -gt 1 ]; then @@ -501,6 +508,9 @@ fi %postun server %systemd_postun_with_restart gsisshd.service +if [ $1 -eq 0 ]; then + semanage port -d -t ssh_port_t -p tcp 2222 2>/dev/null || : +fi %files %license LICENCE @@ -510,21 +520,25 @@ fi %attr(0755,root,root) %{_bindir}/gsissh-keygen %attr(0644,root,root) %{_mandir}/man1/gsissh-keygen.1* %attr(0755,root,root) %dir %{_libexecdir}/gsissh -%attr(4755,root,root) %{_libexecdir}/gsissh/ssh-keysign +%attr(4555,root,root) %{_libexecdir}/gsissh/ssh-keysign %attr(0644,root,root) %{_mandir}/man8/gsissh-keysign.8* %files clients %attr(0755,root,root) %{_bindir}/gsissh %attr(0644,root,root) %{_mandir}/man1/gsissh.1* %attr(0755,root,root) %{_bindir}/gsiscp -%{_bindir}/hpnscp %attr(0644,root,root) %{_mandir}/man1/gsiscp.1* %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/gsissh/ssh_config %dir %attr(0755,root,root) %{_sysconfdir}/gsissh/ssh_config.d/ %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/gsissh/ssh_config.d/50-redhat.conf %attr(0644,root,root) %{_mandir}/man5/gsissh_config.5* %attr(0755,root,root) %{_bindir}/gsisftp +%attr(0755,root,root) %{_libexecdir}/gsissh/ssh-sk-helper %attr(0644,root,root) %{_mandir}/man1/gsisftp.1* +%attr(0644,root,root) %{_mandir}/man8/gsissh-sk-helper.8* +%attr(0755,root,root) %dir %{_libexecdir}/gsissh/bin +%{_libexecdir}/gsissh/bin/scp +%{_libexecdir}/gsissh/bin/hpnscp %files server %dir %attr(0711,root,root) %{_datadir}/empty.sshd @@ -552,6 +566,12 @@ fi %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration %changelog +* Wed Mar 05 2025 Mattias Ellert - 9.6p1-3 +- Based on openssh-9.6p1-2.fc40 + +* Fri Jul 12 2024 Mattias Ellert - 9.6p1-2 +- Add scp and hpnscp symlinks in gsisshd's path + * Sat Jul 06 2024 Mattias Ellert - 9.6p1-1 - Based on openssh-9.6p1-1.fc40.4 diff --git a/openssh-9.6p1-hpn-18.3.1.patch b/openssh-9.6p1-hpn-18.3.1.patch index e9a43f8..68159b7 100644 --- a/openssh-9.6p1-hpn-18.3.1.patch +++ b/openssh-9.6p1-hpn-18.3.1.patch @@ -8177,8 +8177,8 @@ diff -Nur openssh-9.6p1.orig/clientloop.c openssh-9.6p1/clientloop.c if (want_subsystem) { diff -Nur openssh-9.6p1.orig/compat.c openssh-9.6p1/compat.c --- openssh-9.6p1.orig/compat.c 2024-07-10 13:32:39.574111737 +0200 -+++ openssh-9.6p1/compat.c 2024-07-10 13:34:02.716358582 +0200 -@@ -135,6 +135,36 @@ ++++ openssh-9.6p1/compat.c 2024-07-14 11:29:56.093866627 +0200 +@@ -135,6 +135,35 @@ ssh->compat = check[i].bugs; if (forbid_ssh_rsa) ssh->compat |= SSH_RH_RSASIGSHA; @@ -8188,27 +8188,26 @@ diff -Nur openssh-9.6p1.orig/compat.c openssh-9.6p1/compat.c + if (strstr(version, "hpn")) { + ssh->compat |= SSH_HPNSSH; + debug("Remote is HPN enabled"); -+ } -+ /* this checks to see if the remote -+ * version string indicates that we -+ * have access to hpn prefixed binaries -+ * You'll need to change this to include -+ * new major version numbers. Which is -+ * why we should figure out how to make -+ * the match pattern list work -+ */ -+ if ((strstr(version, "hpn16") != NULL) || -+ (strstr(version, "hpn17") != NULL) || -+ (strstr(version, "hpn18") != NULL)) { -+ ssh->compat |= SSH_HPNSSH_PREFIX; -+ debug("Remote uses HPNSSH prefixes."); -+ break; ++ /* this checks to see if the remote ++ * version string indicates that we ++ * have access to hpn prefixed binaries ++ * You'll need to change this to include ++ * new major version numbers. Which is ++ * why we should figure out how to make ++ * the match pattern list work ++ */ ++ if ((strstr(version, "hpn16") != NULL) || ++ (strstr(version, "hpn17") != NULL) || ++ (strstr(version, "hpn18") != NULL)) { ++ ssh->compat |= SSH_HPNSSH_PREFIX; ++ debug("Remote uses HPNSSH prefixes."); ++ } + } + /* if it's openssh and not hpn */ -+ if ((strstr(version, "OpenSSH_8.9") != NULL) || -+ (strstr(version, "OpenSSH_9") != NULL)) { ++ else if ((strstr(version, "OpenSSH_8.9") != NULL) || ++ (strstr(version, "OpenSSH_9") != NULL)) { + ssh->compat |= SSH_RESTRICT_WINDOW; -+ debug("Restricting adverstised window size."); ++ debug("Restricting advertised window size."); + } + } + debug("ssh->compat is %u", ssh->compat); @@ -8217,7 +8216,7 @@ diff -Nur openssh-9.6p1.orig/compat.c openssh-9.6p1/compat.c } diff -Nur openssh-9.6p1.orig/compat.h openssh-9.6p1/compat.h --- openssh-9.6p1.orig/compat.h 2024-07-10 13:32:39.574111737 +0200 -+++ openssh-9.6p1/compat.h 2024-07-10 13:34:02.716358582 +0200 ++++ openssh-9.6p1/compat.h 2024-07-14 11:29:56.093866627 +0200 @@ -46,12 +46,12 @@ /* #define unused 0x00010000 */ /* #define unused 0x00020000 */ @@ -8227,7 +8226,7 @@ diff -Nur openssh-9.6p1.orig/compat.h openssh-9.6p1/compat.h #define SSH_BUG_EXTEOF 0x00200000 #define SSH_BUG_PROBE 0x00400000 -/* #define unused 0x00800000 */ -+#define SSH_RESTRICT_WINDOW 0x00800000 /* restrict adverstised window to OpenSSH clients */ ++#define SSH_RESTRICT_WINDOW 0x00800000 /* restrict advertised window to OpenSSH clients */ #define SSH_OLD_FORWARD_ADDR 0x01000000 -/* #define unused 0x02000000 */ +#define SSH_HPNSSH_PREFIX 0x02000000 /* indicates that we have hpn prefixes binaries */ @@ -13533,7 +13532,7 @@ diff -Nur openssh-9.6p1.orig/umac.c openssh-9.6p1/umac.c + return (v); +} + -+#if (! __LITTLE_ENDIAN__) /* compile time warning thrown otherwise */ ++#if 0 /* compile time warning thrown otherwise */ +static __attribute__((__bounded__(__minbytes__, 1, 4))); +void umac_put_u32_le(void *vp, u_int32_t v) +{ diff --git a/openssh-9.9p2-error_processing.patch b/openssh-9.9p2-error_processing.patch new file mode 100644 index 0000000..692c6ac --- /dev/null +++ b/openssh-9.9p2-error_processing.patch @@ -0,0 +1,152 @@ +diff --git a/krl.c b/krl.c +index e2efdf06..0d0f6953 100644 +--- a/krl.c ++++ b/krl.c +@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf) + break; + case KRL_SECTION_CERT_SERIAL_BITMAP: + if (rs->lo - bitmap_start > INT_MAX) { ++ r = SSH_ERR_INVALID_FORMAT; + error_f("insane bitmap gap"); + goto out; + } +@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp) + } + + if ((krl = ssh_krl_init()) == NULL) { ++ r = SSH_ERR_ALLOC_FAIL; + error_f("alloc failed"); + goto out; + } +diff --git a/packet.c b/packet.c +index 486f8515..9dea2cfc 100644 +--- a/packet.c ++++ b/packet.c +@@ -1864,6 +1864,14 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) + if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0) + return r; + DBG(debug("Received SSH2_MSG_PING len %zu", len)); ++ if (!ssh->state->after_authentication) { ++ DBG(debug("Won't reply to PING in preauth")); ++ break; ++ } ++ if (ssh_packet_is_rekeying(ssh)) { ++ DBG(debug("Won't reply to PING during KEX")); ++ break; ++ } + if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 || + (r = sshpkt_put_string(ssh, d, len)) != 0 || + (r = sshpkt_send(ssh)) != 0) +diff --git a/ssh-agent.c b/ssh-agent.c +index 48973b2c..c27c5a95 100644 +--- a/ssh-agent.c ++++ b/ssh-agent.c +@@ -1220,6 +1220,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, + "restrict-destination-v00@openssh.com") == 0) { + if (*dcsp != NULL) { + error_f("%s already set", ext_name); ++ r = SSH_ERR_INVALID_FORMAT; + goto out; + } + if ((r = sshbuf_froms(m, &b)) != 0) { +@@ -1229,6 +1230,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, + while (sshbuf_len(b) != 0) { + if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) { + error_f("too many %s constraints", ext_name); ++ r = SSH_ERR_INVALID_FORMAT; + goto out; + } + *dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1, +@@ -1246,6 +1248,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, + } + if (*certs != NULL) { + error_f("%s already set", ext_name); ++ r = SSH_ERR_INVALID_FORMAT; + goto out; + } + if ((r = sshbuf_get_u8(m, &v)) != 0 || +@@ -1257,6 +1260,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, + while (sshbuf_len(b) != 0) { + if (*ncerts >= AGENT_MAX_EXT_CERTS) { + error_f("too many %s constraints", ext_name); ++ r = SSH_ERR_INVALID_FORMAT; + goto out; + } + *certs = xrecallocarray(*certs, *ncerts, *ncerts + 1, +@@ -1757,6 +1761,7 @@ process_ext_session_bind(SocketEntry *e) + /* record new key/sid */ + if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) { + error_f("too many session IDs recorded"); ++ r = -1; + goto out; + } + e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids, +diff --git a/ssh-sk-client.c b/ssh-sk-client.c +index 321fe53a..06fad221 100644 +--- a/ssh-sk-client.c ++++ b/ssh-sk-client.c +@@ -439,6 +439,7 @@ sshsk_load_resident(const char *provider_path, const char *device, + } + if ((srk = calloc(1, sizeof(*srk))) == NULL) { + error_f("calloc failed"); ++ r = SSH_ERR_ALLOC_FAIL; + goto out; + } + srk->key = key; +@@ -450,6 +451,7 @@ sshsk_load_resident(const char *provider_path, const char *device, + if ((tmp = recallocarray(srks, nsrks, nsrks + 1, + sizeof(*srks))) == NULL) { + error_f("recallocarray keys failed"); ++ r = SSH_ERR_ALLOC_FAIL; + goto out; + } + debug_f("srks[%zu]: %s %s uidlen %zu", nsrks, +diff --git a/sshconnect2.c b/sshconnect2.c +index a69c4da1..1ee6000a 100644 +--- a/sshconnect2.c ++++ b/sshconnect2.c +@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh) + options.required_rsa_size)) != 0) + fatal_r(r, "Bad server host key"); + if (verify_host_key(xxx_host, xxx_hostaddr, hostkey, +- xxx_conn_info) == -1) ++ xxx_conn_info) != 0) + fatal("Host key verification failed."); + return 0; + } +@@ -699,6 +699,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + + if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) { + debug_f("server sent unknown pkalg %s", pkalg); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) { +@@ -709,6 +710,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + error("input_userauth_pk_ok: type mismatch " + "for decoded key (received %d, expected %d)", + key->type, pktype); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + +@@ -728,6 +730,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + SSH_FP_DEFAULT); + error_f("server replied with unknown key: %s %s", + sshkey_type(key), fp == NULL ? "" : fp); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + ident = format_identity(id); +diff --git a/sshsig.c b/sshsig.c +index 6e03c0b0..3da005d6 100644 +--- a/sshsig.c ++++ b/sshsig.c +@@ -879,6 +879,7 @@ cert_filter_principals(const char *path, u_long linenum, + } + if ((principals = sshbuf_dup_string(nprincipals)) == NULL) { + error_f("buffer error"); ++ r = SSH_ERR_ALLOC_FAIL; + goto out; + } + /* success */