| Summary: | When no MAC is specified in config the server offers non-existing hmac-sha2* without openssl | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | Ashley <openssh> | ||||
| Component: | sshd | Assignee: | Assigned to nobody <unassigned-bugs> | ||||
| Status: | CLOSED FIXED | ||||||
| Severity: | normal | CC: | dtucker | ||||
| Priority: | P5 | ||||||
| Version: | -current | ||||||
| Hardware: | amd64 | ||||||
| OS: | Linux | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 3079 | ||||||
| Attachments: |
|
||||||
|
Description
Ashley
2016-06-14 15:04:18 AEST
That'll probably fix this particular case but the #ifdef mess is fragile. I'd like to filter the lists at runtime and simplify the ifdef maze (see bug#2466). Stick this one on the list for 7.3. I'd still rather do the aforementioned less fragile change, but if we don't get that one we should at least get this. retarget unfinished bugs to next release retarget unfinished bugs to next release retarget unfinished bugs to next release retarget unfinished bugs to next release OpenSSH 7.4 release is closing; punt the bugs to 7.5 Move incomplete bugs to openssh-7.6 target since 7.5 shipped a while back. To calibrate expectations, there's little chance all of these are going to make 7.6. remove 7.5 target Move to OpenSSH 7.8 tracking bug Retarget remaining bugs planned for 7.8 release to 7.9 Retarget remaining bugs planned for 7.8 release to 7.9 Retarget unfinished bugs to OpenSSH 8.0 Retarget unfinished bugs to OpenSSH 8.0 Retarget unfinished bugs to OpenSSH 8.0 Retarget outstanding bugs at next release Retarget these bugs to 8.2 release The #ifdef maze in myproposal.h was becoming increasingly problematic, so we finally moved the filtering to runtime and deleted all the ifdefs: https://github.com/openssh/openssh-portable/commit/c4b3a128954ee1b7fbcbda167baf8aca1a3d1c84 which should prevent this class of bug in future. We also added a regression test that has ssh parse its default config to ensure that it's usable (https://github.com/openssh/openssh-portable/blob/master/regress/sshcfgparse.sh) and enabled the internal SHA2 functions for these MACs in the --without-openssl case so the advertised ones do indeed work: $ ./configure --without-openssl && make && ./ssh -F/dev/null -G localhost | grep "macs " [...] macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 $ nm ssh | grep -i sha512 000000000004db40 T crypto_hash_sha512 0000000000067740 T SHA512Final 00000000000663c0 T SHA512Init 0000000000097300 r sha512_initial_hash_value 0000000000067550 T SHA512Pad 0000000000066430 T SHA512Transform 0000000000067300 T SHA512Update $ for i in `./ssh -F/dev/null -G localhost | awk '/macs /{print $2}' | tr , ' '`; do echo $i; ./ssh -omacs=$i localhost true; done umac-64-etm@openssh.com umac-128-etm@openssh.com hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com hmac-sha1-etm@openssh.com umac-64@openssh.com umac-128@openssh.com hmac-sha2-256 hmac-sha2-512 hmac-sha1 Thanks for the report. close bugs that were resolved in OpenSSH 8.5 release cycle |