kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
f09e2e
diff -up openssh-6.3p1/Makefile.in.fips openssh-6.3p1/Makefile.in
f09e2e
--- openssh-6.3p1/Makefile.in.fips	2013-10-11 22:24:32.850031186 +0200
f09e2e
+++ openssh-6.3p1/Makefile.in	2013-10-11 22:24:32.870031092 +0200
f09e2e
@@ -147,25 +147,25 @@ libssh.a: $(LIBSSH_OBJS)
f09e2e
 	$(RANLIB) $@
f09e2e
 
f09e2e
 ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
f09e2e
-	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS) $(GSSLIBS)
f09e2e
+	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHLIBS) $(LIBS) $(GSSLIBS)
f09e2e
 
f09e2e
 sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
f09e2e
-	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
f09e2e
+	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
f09e2e
 
f09e2e
 scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
f09e2e
 	$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
f09e2e
 
f09e2e
 ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
f09e2e
-	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
f09e2e
+	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
f09e2e
 
f09e2e
 ssh-agent$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-agent.o ssh-pkcs11-client.o
f09e2e
-	$(LD) -o $@ ssh-agent.o ssh-pkcs11-client.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
f09e2e
+	$(LD) -o $@ ssh-agent.o ssh-pkcs11-client.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
f09e2e
 
f09e2e
 ssh-keygen$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keygen.o
f09e2e
-	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
f09e2e
+	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
f09e2e
 
f09e2e
 ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o roaming_dummy.o readconf.o
f09e2e
-	$(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
f09e2e
+	$(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
f09e2e
 
f09e2e
 ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
f09e2e
 	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
f09e2e
@@ -177,7 +177,7 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh
f09e2e
 	$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
f09e2e
 
f09e2e
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
f09e2e
-	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
f09e2e
+	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
f09e2e
 
f09e2e
 sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
f09e2e
 	$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
f09e2e
diff -up openssh-6.3p1/auth-rsa.c.fips openssh-6.3p1/auth-rsa.c
f09e2e
--- openssh-6.3p1/auth-rsa.c.fips	2013-10-24 15:43:46.019999906 +0200
f09e2e
+++ openssh-6.3p1/auth-rsa.c	2013-10-24 15:44:09.262890686 +0200
f09e2e
@@ -240,7 +240,7 @@ rsa_key_allowed_in_file(struct passwd *p
f09e2e
 			    "actual %d vs. announced %d.",
f09e2e
 			    file, linenum, BN_num_bits(key->rsa->n), bits);
f09e2e
 
f09e2e
-		fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
f09e2e
+		fp = key_fingerprint(key, FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5, SSH_FP_HEX);
f09e2e
 		debug("matching key found: file %s, line %lu %s %s",
f09e2e
 		    file, linenum, key_type(key), fp);
f09e2e
 		free(fp);
f09e2e
diff -up openssh-6.3p1/auth2-pubkey.c.fips openssh-6.3p1/auth2-pubkey.c
f09e2e
--- openssh-6.3p1/auth2-pubkey.c.fips	2013-10-24 15:39:05.008319990 +0200
f09e2e
+++ openssh-6.3p1/auth2-pubkey.c	2013-10-24 15:39:05.029319892 +0200
f09e2e
@@ -209,7 +209,7 @@ pubkey_auth_info(Authctxt *authctxt, con
f09e2e
 
f09e2e
 	if (key_is_cert(key)) {
f09e2e
 		fp = key_fingerprint(key->cert->signature_key,
f09e2e
-		    SSH_FP_MD5, SSH_FP_HEX);
f09e2e
+		    FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5, SSH_FP_HEX);
f09e2e
 		auth_info(authctxt, "%s ID %s (serial %llu) CA %s %s%s%s", 
f09e2e
 		    key_type(key), key->cert->key_id,
f09e2e
 		    (unsigned long long)key->cert->serial,
f09e2e
@@ -217,7 +217,7 @@ pubkey_auth_info(Authctxt *authctxt, con
f09e2e
 		    extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
f09e2e
 		free(fp);
f09e2e
 	} else {
f09e2e
-		fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
f09e2e
+		fp = key_fingerprint(key, FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5, SSH_FP_HEX);
f09e2e
 		auth_info(authctxt, "%s %s%s%s", key_type(key), fp,
f09e2e
 		    extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
f09e2e
 		free(fp);
f09e2e
diff -up openssh-6.3p1/authfile.c.fips openssh-6.3p1/authfile.c
f09e2e
--- openssh-6.3p1/authfile.c.fips	2013-10-11 22:24:32.857031153 +0200
f09e2e
+++ openssh-6.3p1/authfile.c	2013-10-11 22:24:32.870031092 +0200
f09e2e
@@ -148,8 +148,14 @@ key_private_rsa1_to_blob(Key *key, Buffe
f09e2e
 	/* Allocate space for the private part of the key in the buffer. */
f09e2e
 	cp = buffer_append_space(&encrypted, buffer_len(&buffer));
f09e2e
 
f09e2e
-	cipher_set_key_string(&ciphercontext, cipher, passphrase,
f09e2e
-	    CIPHER_ENCRYPT);
f09e2e
+	if (cipher_set_key_string(&ciphercontext, cipher, passphrase,
f09e2e
+	    CIPHER_ENCRYPT) < 0) {
f09e2e
+		error("cipher_set_key_string failed.");
f09e2e
+		buffer_free(&encrypted);
f09e2e
+		buffer_free(&buffer);
f09e2e
+		return 0;
f09e2e
+	}
f09e2e
+
f09e2e
 	cipher_crypt(&ciphercontext, cp,
f09e2e
 	    buffer_ptr(&buffer), buffer_len(&buffer), 0, 0);
f09e2e
 	cipher_cleanup(&ciphercontext);
f09e2e
@@ -472,8 +478,13 @@ key_parse_private_rsa1(Buffer *blob, con
f09e2e
 	cp = buffer_append_space(&decrypted, buffer_len(©);;
f09e2e
 
f09e2e
 	/* Rest of the buffer is encrypted.  Decrypt it using the passphrase. */
f09e2e
-	cipher_set_key_string(&ciphercontext, cipher, passphrase,
f09e2e
-	    CIPHER_DECRYPT);
f09e2e
+	if (cipher_set_key_string(&ciphercontext, cipher, passphrase,
f09e2e
+	    CIPHER_DECRYPT) < 0) {
f09e2e
+		error("cipher_set_key_string failed.");
f09e2e
+		buffer_free(&decrypted);
f09e2e
+		goto fail;
f09e2e
+	}
f09e2e
+
f09e2e
 	cipher_crypt(&ciphercontext, cp,
f09e2e
 	    buffer_ptr(&copy), buffer_len(&copy), 0, 0);
f09e2e
 	cipher_cleanup(&ciphercontext);
f09e2e
diff -up openssh-6.3p1/cipher-ctr.c.fips openssh-6.3p1/cipher-ctr.c
f09e2e
--- openssh-6.3p1/cipher-ctr.c.fips	2013-06-02 00:07:32.000000000 +0200
f09e2e
+++ openssh-6.3p1/cipher-ctr.c	2013-10-11 22:24:32.870031092 +0200
f09e2e
@@ -138,7 +138,8 @@ evp_aes_128_ctr(void)
f09e2e
 	aes_ctr.do_cipher = ssh_aes_ctr;
f09e2e
 #ifndef SSH_OLD_EVP
f09e2e
 	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
f09e2e
-	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
f09e2e
+	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV |
f09e2e
+	    EVP_CIPH_FLAG_FIPS;
f09e2e
 #endif
f09e2e
 	return (&aes_ctr);
f09e2e
 }
f09e2e
diff -up openssh-6.3p1/cipher.c.fips openssh-6.3p1/cipher.c
f09e2e
--- openssh-6.3p1/cipher.c.fips	2013-10-11 22:24:32.820031327 +0200
f09e2e
+++ openssh-6.3p1/cipher.c	2013-10-11 22:24:32.871031087 +0200
f09e2e
@@ -40,6 +40,7 @@
f09e2e
 #include <sys/types.h>
f09e2e
 
f09e2e
 #include <openssl/md5.h>
f09e2e
+#include <openssl/fips.h>
f09e2e
 
f09e2e
 #include <string.h>
f09e2e
 #include <stdarg.h>
f09e2e
@@ -86,6 +87,27 @@ static const struct Cipher ciphers[] = {
f09e2e
 	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
f09e2e
 };
f09e2e
 
f09e2e
+static const struct Cipher fips_ciphers[] = {
f09e2e
+	{ "none",	SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
f09e2e
+	{ "des",	SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
f09e2e
+	{ "3des",	SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
f09e2e
+	{ "3des-cbc",	SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
f09e2e
+	{ "aes128-cbc",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
f09e2e
+	{ "aes192-cbc",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
f09e2e
+	{ "aes256-cbc",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
f09e2e
+	{ "rijndael-cbc@lysator.liu.se",
f09e2e
+			SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
f09e2e
+	{ "aes128-ctr",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
f09e2e
+	{ "aes192-ctr",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },
f09e2e
+	{ "aes256-ctr",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },
f09e2e
+#ifdef OPENSSL_HAVE_EVPGCM
f09e2e
+	{ "aes128-gcm@openssh.com",
f09e2e
+			SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
f09e2e
+	{ "aes256-gcm@openssh.com",
f09e2e
+			SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
f09e2e
+#endif
f09e2e
+	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
f09e2e
+};
f09e2e
 /*--*/
f09e2e
 
f09e2e
 /* Returns a comma-separated list of supported ciphers. */
f09e2e
@@ -96,7 +118,7 @@ cipher_alg_list(void)
f09e2e
 	size_t nlen, rlen = 0;
f09e2e
 	const Cipher *c;
f09e2e
 
f09e2e
-	for (c = ciphers; c->name != NULL; c++) {
f09e2e
+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++) {
f09e2e
 		if (c->number != SSH_CIPHER_SSH2)
f09e2e
 			continue;
f09e2e
 		if (ret != NULL)
f09e2e
@@ -161,7 +183,7 @@ const Cipher *
f09e2e
 cipher_by_name(const char *name)
f09e2e
 {
f09e2e
 	const Cipher *c;
f09e2e
-	for (c = ciphers; c->name != NULL; c++)
f09e2e
+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
f09e2e
 		if (strcmp(c->name, name) == 0)
f09e2e
 			return c;
f09e2e
 	return NULL;
f09e2e
@@ -171,7 +193,7 @@ const Cipher *
f09e2e
 cipher_by_number(int id)
f09e2e
 {
f09e2e
 	const Cipher *c;
f09e2e
-	for (c = ciphers; c->name != NULL; c++)
f09e2e
+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
f09e2e
 		if (c->number == id)
f09e2e
 			return c;
f09e2e
 	return NULL;
f09e2e
@@ -215,7 +237,7 @@ cipher_number(const char *name)
f09e2e
 	const Cipher *c;
f09e2e
 	if (name == NULL)
f09e2e
 		return -1;
f09e2e
-	for (c = ciphers; c->name != NULL; c++)
f09e2e
+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
f09e2e
 		if (strcasecmp(c->name, name) == 0)
f09e2e
 			return c->number;
f09e2e
 	return -1;
f09e2e
@@ -374,14 +396,15 @@ cipher_cleanup(CipherContext *cc)
f09e2e
  * passphrase and using the resulting 16 bytes as the key.
f09e2e
  */
f09e2e
 
f09e2e
-void
f09e2e
+int
f09e2e
 cipher_set_key_string(CipherContext *cc, const Cipher *cipher,
f09e2e
     const char *passphrase, int do_encrypt)
f09e2e
 {
f09e2e
 	MD5_CTX md;
f09e2e
 	u_char digest[16];
f09e2e
 
f09e2e
-	MD5_Init(&md);
f09e2e
+	if (MD5_Init(&md) <= 0)
f09e2e
+		return -1;
f09e2e
 	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
f09e2e
 	MD5_Final(digest, &md);
f09e2e
 
f09e2e
@@ -389,6 +412,7 @@ cipher_set_key_string(CipherContext *cc,
f09e2e
 
f09e2e
 	memset(digest, 0, sizeof(digest));
f09e2e
 	memset(&md, 0, sizeof(md));
f09e2e
+	return 0;
f09e2e
 }
f09e2e
 
f09e2e
 /*
f09e2e
diff -up openssh-6.3p1/cipher.h.fips openssh-6.3p1/cipher.h
f09e2e
--- openssh-6.3p1/cipher.h.fips	2013-10-11 22:24:32.820031327 +0200
f09e2e
+++ openssh-6.3p1/cipher.h	2013-10-11 22:24:32.871031087 +0200
f09e2e
@@ -92,7 +92,7 @@ void	 cipher_init(CipherContext *, const
f09e2e
 void	 cipher_crypt(CipherContext *, u_char *, const u_char *,
f09e2e
     u_int, u_int, u_int);
f09e2e
 void	 cipher_cleanup(CipherContext *);
f09e2e
-void	 cipher_set_key_string(CipherContext *, const Cipher *, const char *, int);
f09e2e
+int	 cipher_set_key_string(CipherContext *, const Cipher *, const char *, int);
f09e2e
 u_int	 cipher_blocksize(const Cipher *);
f09e2e
 u_int	 cipher_keylen(const Cipher *);
f09e2e
 u_int	 cipher_authlen(const Cipher *);
f09e2e
diff -up openssh-6.3p1/key.c.fips openssh-6.3p1/key.c
f09e2e
--- openssh-6.3p1/key.c.fips	2013-10-11 22:24:32.821031322 +0200
f09e2e
+++ openssh-6.3p1/key.c	2013-10-11 22:24:32.871031087 +0200
f09e2e
@@ -40,6 +40,7 @@
f09e2e
 #include <sys/types.h>
f09e2e
 
f09e2e
 #include <openssl/evp.h>
f09e2e
+#include <openssl/fips.h>
f09e2e
 #include <openbsd-compat/openssl-compat.h>
f09e2e
 
f09e2e
 #include <stdarg.h>
f09e2e
@@ -606,9 +607,13 @@ key_fingerprint_selection(void)
f09e2e
 	char *env;
f09e2e
 
f09e2e
 	if (!rv_defined) {
f09e2e
-		env = getenv("SSH_FINGERPRINT_TYPE");
f09e2e
-		rv = (env && !strcmp (env, "sha")) ?
f09e2e
-			SSH_FP_SHA1 : SSH_FP_MD5;
f09e2e
+		if (FIPS_mode())
f09e2e
+			rv = SSH_FP_SHA1;
f09e2e
+		else {
f09e2e
+			env = getenv("SSH_FINGERPRINT_TYPE");
f09e2e
+			rv = (env && !strcmp (env, "sha")) ?
f09e2e
+				SSH_FP_SHA1 : SSH_FP_MD5;
f09e2e
+		}
f09e2e
 		rv_defined = 1;
f09e2e
 	}
f09e2e
 	return rv;
f09e2e
diff -up openssh-6.3p1/mac.c.fips openssh-6.3p1/mac.c
f09e2e
--- openssh-6.3p1/mac.c.fips	2013-10-11 22:24:32.821031322 +0200
f09e2e
+++ openssh-6.3p1/mac.c	2013-10-11 22:25:35.394737186 +0200
f09e2e
@@ -28,6 +28,7 @@
f09e2e
 #include <sys/types.h>
f09e2e
 
f09e2e
 #include <openssl/hmac.h>
f09e2e
+#include <openssl/fips.h>
f09e2e
 
f09e2e
 #include <stdarg.h>
f09e2e
 #include <string.h>
f09e2e
@@ -60,7 +61,7 @@ struct macalg {
f09e2e
 	int		etm;		/* Encrypt-then-MAC */
f09e2e
 };
f09e2e
 
f09e2e
-static const struct macalg macs[] = {
f09e2e
+static const struct macalg all_macs[] = {
f09e2e
 	/* Encrypt-and-MAC (encrypt-and-authenticate) variants */
f09e2e
 	{ "hmac-sha1",				SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
f09e2e
 	{ "hmac-sha1-96",			SSH_EVP, EVP_sha1, 96, 0, 0, 0 },
f09e2e
@@ -91,6 +92,18 @@ static const struct macalg macs[] = {
f09e2e
 	{ NULL,					0, NULL, 0, 0, 0, 0 }
f09e2e
 };
f09e2e
 
f09e2e
+static const struct macalg fips_macs[] = {
f09e2e
+	{ "hmac-sha1",				SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
f09e2e
+	{ "hmac-sha1-etm@openssh.com",		SSH_EVP, EVP_sha1, 0, 0, 0, 1 },
f09e2e
+#ifdef HAVE_EVP_SHA256
f09e2e
+	{ "hmac-sha2-256",			SSH_EVP, EVP_sha256, 0, 0, 0, 0 },
f09e2e
+	{ "hmac-sha2-512",			SSH_EVP, EVP_sha512, 0, 0, 0, 0 },
f09e2e
+	{ "hmac-sha2-256-etm@openssh.com",	SSH_EVP, EVP_sha256, 0, 0, 0, 1 },
f09e2e
+	{ "hmac-sha2-512-etm@openssh.com",	SSH_EVP, EVP_sha512, 0, 0, 0, 1 },
f09e2e
+#endif
f09e2e
+	{ NULL,					0, NULL, 0, 0, 0, 0 }
f09e2e
+};
f09e2e
+
f09e2e
 /* Returns a comma-separated list of supported MACs. */
f09e2e
 char *
f09e2e
 mac_alg_list(void)
f09e2e
@@ -99,7 +112,7 @@ mac_alg_list(void)
f09e2e
 	size_t nlen, rlen = 0;
f09e2e
 	const struct macalg *m;
f09e2e
 
f09e2e
-	for (m = macs; m->name != NULL; m++) {
f09e2e
+	for (m = FIPS_mode() ? fips_macs : all_macs; m->name != NULL; m++) {
f09e2e
 		if (ret != NULL)
f09e2e
 			ret[rlen++] = '\n';
f09e2e
 		nlen = strlen(m->name);
f09e2e
@@ -136,7 +149,7 @@ mac_setup(Mac *mac, char *name)
f09e2e
 {
f09e2e
 	const struct macalg *m;
f09e2e
 
f09e2e
-	for (m = macs; m->name != NULL; m++) {
f09e2e
+	for (m = FIPS_mode() ? fips_macs : all_macs; m->name != NULL; m++) {
f09e2e
 		if (strcmp(name, m->name) != 0)
f09e2e
 			continue;
f09e2e
 		if (mac != NULL)
f09e2e
diff -up openssh-6.3p1/myproposal.h.fips openssh-6.3p1/myproposal.h
f09e2e
--- openssh-6.3p1/myproposal.h.fips	2013-06-11 04:10:02.000000000 +0200
f09e2e
+++ openssh-6.3p1/myproposal.h	2013-10-11 22:24:32.872031082 +0200
f09e2e
@@ -114,6 +114,19 @@
f09e2e
 #define	KEX_DEFAULT_COMP	"none,zlib@openssh.com,zlib"
f09e2e
 #define	KEX_DEFAULT_LANG	""
f09e2e
 
f09e2e
+#define	KEX_FIPS_ENCRYPT \
f09e2e
+	"aes128-ctr,aes192-ctr,aes256-ctr," \
f09e2e
+	"aes128-cbc,3des-cbc," \
f09e2e
+	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se"
f09e2e
+#ifdef HAVE_EVP_SHA256
f09e2e
+#define	KEX_FIPS_MAC \
f09e2e
+	"hmac-sha1," \
f09e2e
+	"hmac-sha2-256," \
f09e2e
+	"hmac-sha2-512"
f09e2e
+#else
f09e2e
+#define	KEX_FIPS_MAC \
f09e2e
+	"hmac-sha1"
f09e2e
+#endif
f09e2e
 
f09e2e
 static char *myproposal[PROPOSAL_MAX] = {
f09e2e
 	KEX_DEFAULT_KEX,
f09e2e
diff -up openssh-6.3p1/openbsd-compat/bsd-arc4random.c.fips openssh-6.3p1/openbsd-compat/bsd-arc4random.c
f09e2e
--- openssh-6.3p1/openbsd-compat/bsd-arc4random.c.fips	2010-03-25 22:52:02.000000000 +0100
f09e2e
+++ openssh-6.3p1/openbsd-compat/bsd-arc4random.c	2013-10-11 22:24:32.872031082 +0200
f09e2e
@@ -37,25 +37,18 @@
f09e2e
 #define REKEY_BYTES	(1 << 24)
f09e2e
 
f09e2e
 static int rc4_ready = 0;
f09e2e
-static RC4_KEY rc4;
f09e2e
 
f09e2e
 unsigned int
f09e2e
 arc4random(void)
f09e2e
 {
f09e2e
 	unsigned int r = 0;
f09e2e
-	static int first_time = 1;
f09e2e
+	void *rp = &r;
f09e2e
 
f09e2e
-	if (rc4_ready <= 0) {
f09e2e
-		if (first_time)
f09e2e
-			seed_rng();
f09e2e
-		first_time = 0;
f09e2e
+	if (!rc4_ready) {
f09e2e
 		arc4random_stir();
f09e2e
 	}
f09e2e
+	RAND_bytes(rp, sizeof(r));
f09e2e
 
f09e2e
-	RC4(&rc4, sizeof(r), (unsigned char *)&r, (unsigned char *)&r);
f09e2e
-
f09e2e
-	rc4_ready -= sizeof(r);
f09e2e
-	
f09e2e
 	return(r);
f09e2e
 }
f09e2e
 
f09e2e
@@ -63,24 +56,11 @@ void
f09e2e
 arc4random_stir(void)
f09e2e
 {
f09e2e
 	unsigned char rand_buf[SEED_SIZE];
f09e2e
-	int i;
f09e2e
 
f09e2e
-	memset(&rc4, 0, sizeof(rc4));
f09e2e
 	if (RAND_bytes(rand_buf, sizeof(rand_buf)) <= 0)
f09e2e
 		fatal("Couldn't obtain random bytes (error %ld)",
f09e2e
 		    ERR_get_error());
f09e2e
-	RC4_set_key(&rc4, sizeof(rand_buf), rand_buf);
f09e2e
-
f09e2e
-	/*
f09e2e
-	 * Discard early keystream, as per recommendations in:
f09e2e
-	 * http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps
f09e2e
-	 */
f09e2e
-	for(i = 0; i <= 256; i += sizeof(rand_buf))
f09e2e
-		RC4(&rc4, sizeof(rand_buf), rand_buf, rand_buf);
f09e2e
-
f09e2e
-	memset(rand_buf, 0, sizeof(rand_buf));
f09e2e
-
f09e2e
-	rc4_ready = REKEY_BYTES;
f09e2e
+	rc4_ready = 1;
f09e2e
 }
f09e2e
 #endif /* !HAVE_ARC4RANDOM */
f09e2e
 
f09e2e
diff -up openssh-6.3p1/ssh-keygen.c.fips openssh-6.3p1/ssh-keygen.c
f09e2e
--- openssh-6.3p1/ssh-keygen.c.fips	2013-10-24 15:45:06.055623916 +0200
f09e2e
+++ openssh-6.3p1/ssh-keygen.c	2013-10-24 15:45:36.906478986 +0200
f09e2e
@@ -730,7 +730,7 @@ do_download(struct passwd *pw)
f09e2e
 	enum fp_type fptype;
f09e2e
 	char *fp, *ra;
f09e2e
 
f09e2e
-	fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
f09e2e
+	fptype = print_bubblebabble ? SSH_FP_SHA1 : (FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5);
f09e2e
 	rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
f09e2e
 
f09e2e
 	pkcs11_init(0);
f09e2e
@@ -740,7 +740,7 @@ do_download(struct passwd *pw)
f09e2e
 	for (i = 0; i < nkeys; i++) {
f09e2e
 		if (print_fingerprint) {
f09e2e
 			fp = key_fingerprint(keys[i], fptype, rep);
f09e2e
-			ra = key_fingerprint(keys[i], SSH_FP_MD5,
f09e2e
+			ra = key_fingerprint(keys[i], FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5,
f09e2e
 			    SSH_FP_RANDOMART);
f09e2e
 			printf("%u %s %s (PKCS11 key)\n", key_size(keys[i]),
f09e2e
 			    fp, key_type(keys[i]));
f09e2e
diff -up openssh-6.3p1/ssh.c.fips openssh-6.3p1/ssh.c
f09e2e
--- openssh-6.3p1/ssh.c.fips	2013-07-25 03:55:53.000000000 +0200
f09e2e
+++ openssh-6.3p1/ssh.c	2013-10-11 22:24:32.872031082 +0200
f09e2e
@@ -73,6 +73,8 @@
f09e2e
 
f09e2e
 #include <openssl/evp.h>
f09e2e
 #include <openssl/err.h>
f09e2e
+#include <openssl/fips.h>
f09e2e
+#include <fipscheck.h>
f09e2e
 #include "openbsd-compat/openssl-compat.h"
f09e2e
 #include "openbsd-compat/sys-queue.h"
f09e2e
 
f09e2e
@@ -253,6 +255,13 @@ main(int ac, char **av)
f09e2e
 	sanitise_stdfd();
f09e2e
 
f09e2e
 	__progname = ssh_get_progname(av[0]);
f09e2e
+        SSLeay_add_all_algorithms();
f09e2e
+	if (access("/etc/system-fips", F_OK) == 0)
f09e2e
+		if (! FIPSCHECK_verify(NULL, NULL))
f09e2e
+			if (FIPS_mode())
f09e2e
+				fatal("FIPS integrity verification test failed.");
f09e2e
+			else
f09e2e
+				logit("FIPS integrity verification test failed.");
f09e2e
 
f09e2e
 #ifndef HAVE_SETPROCTITLE
f09e2e
 	/* Prepare for later setproctitle emulation */
f09e2e
@@ -330,6 +339,9 @@ main(int ac, char **av)
f09e2e
 	    "ACD:E:F:I:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) {
f09e2e
 		switch (opt) {
f09e2e
 		case '1':
f09e2e
+			if (FIPS_mode()) {
f09e2e
+				fatal("Protocol 1 not allowed in the FIPS mode.");
f09e2e
+			}
f09e2e
 			options.protocol = SSH_PROTO_1;
f09e2e
 			break;
f09e2e
 		case '2':
f09e2e
@@ -647,7 +659,6 @@ main(int ac, char **av)
f09e2e
 	if (!host)
f09e2e
 		usage();
f09e2e
 
f09e2e
-	OpenSSL_add_all_algorithms();
f09e2e
 	ERR_load_crypto_strings();
f09e2e
 
f09e2e
 	/* Initialize the command to execute on remote host. */
f09e2e
@@ -748,6 +759,10 @@ main(int ac, char **av)
f09e2e
 
f09e2e
 	seed_rng();
f09e2e
 
f09e2e
+	if (FIPS_mode()) {
f09e2e
+		logit("FIPS mode initialized");
f09e2e
+	}
f09e2e
+
f09e2e
 	if (options.user == NULL)
f09e2e
 		options.user = xstrdup(pw->pw_name);
f09e2e
 
f09e2e
@@ -816,6 +831,12 @@ main(int ac, char **av)
f09e2e
 
f09e2e
 	timeout_ms = options.connection_timeout * 1000;
f09e2e
 
f09e2e
+	if (FIPS_mode()) {
f09e2e
+		options.protocol &= SSH_PROTO_2;
f09e2e
+		if (options.protocol == 0)
f09e2e
+			fatal("Protocol 2 disabled by configuration but required in the FIPS mode.");
f09e2e
+	}
f09e2e
+
f09e2e
 	/* Open a connection to the remote host. */
f09e2e
 	if (ssh_connect(host, &hostaddr, options.port,
f09e2e
 	    options.address_family, options.connection_attempts, &timeout_ms,
f09e2e
diff -up openssh-6.3p1/sshconnect2.c.fips openssh-6.3p1/sshconnect2.c
f09e2e
--- openssh-6.3p1/sshconnect2.c.fips	2013-10-11 22:24:32.810031374 +0200
f09e2e
+++ openssh-6.3p1/sshconnect2.c	2013-10-11 22:24:32.873031077 +0200
f09e2e
@@ -44,6 +44,8 @@
f09e2e
 #include <vis.h>
f09e2e
 #endif
f09e2e
 
f09e2e
+#include <openssl/fips.h>
f09e2e
+
f09e2e
 #include "openbsd-compat/sys-queue.h"
f09e2e
 
f09e2e
 #include "xmalloc.h"
f09e2e
@@ -170,6 +172,10 @@ ssh_kex2(char *host, struct sockaddr *ho
f09e2e
 	if (options.ciphers != NULL) {
f09e2e
 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
f09e2e
 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
f09e2e
+	} else if (FIPS_mode()) {
f09e2e
+		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
f09e2e
+		myproposal[PROPOSAL_ENC_ALGS_STOC] = KEX_FIPS_ENCRYPT;
f09e2e
+
f09e2e
 	}
f09e2e
 	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
f09e2e
 	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
f09e2e
@@ -185,7 +191,11 @@ ssh_kex2(char *host, struct sockaddr *ho
f09e2e
 	if (options.macs != NULL) {
f09e2e
 		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
f09e2e
 		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
f09e2e
+	} else if (FIPS_mode()) {
f09e2e
+		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
f09e2e
+		myproposal[PROPOSAL_MAC_ALGS_STOC] = KEX_FIPS_MAC;
f09e2e
 	}
f09e2e
+
f09e2e
 	if (options.hostkeyalgorithms != NULL)
f09e2e
 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
f09e2e
 		    options.hostkeyalgorithms;
f09e2e
diff -up openssh-6.3p1/sshd.c.fips openssh-6.3p1/sshd.c
f09e2e
--- openssh-6.3p1/sshd.c.fips	2013-10-11 22:24:32.842031223 +0200
f09e2e
+++ openssh-6.3p1/sshd.c	2013-10-11 22:24:32.873031077 +0200
f09e2e
@@ -76,6 +76,8 @@
f09e2e
 #include <openssl/bn.h>
f09e2e
 #include <openssl/md5.h>
f09e2e
 #include <openssl/rand.h>
f09e2e
+#include <openssl/fips.h>
f09e2e
+#include <fipscheck.h>
f09e2e
 #include "openbsd-compat/openssl-compat.h"
f09e2e
 
f09e2e
 #ifdef HAVE_SECUREWARE
f09e2e
@@ -1450,6 +1452,14 @@ main(int ac, char **av)
f09e2e
 #endif
f09e2e
 	__progname = ssh_get_progname(av[0]);
f09e2e
 
f09e2e
+        SSLeay_add_all_algorithms();
f09e2e
+	if (access("/etc/system-fips", F_OK) == 0)
f09e2e
+		if (! FIPSCHECK_verify(NULL, NULL))
f09e2e
+			if (FIPS_mode())
f09e2e
+				fatal("FIPS integrity verification test failed.");
f09e2e
+			else
f09e2e
+				logit("FIPS integrity verification test failed.");
f09e2e
+
f09e2e
 	/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
f09e2e
 	saved_argc = ac;
f09e2e
 	rexec_argc = ac;
f09e2e
@@ -1601,8 +1611,6 @@ main(int ac, char **av)
f09e2e
 	else
f09e2e
 		closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
f09e2e
 
f09e2e
-	OpenSSL_add_all_algorithms();
f09e2e
-
f09e2e
 	/* If requested, redirect the logs to the specified logfile. */
f09e2e
 	if (logfile != NULL) {
f09e2e
 		log_redirect_stderr_to(logfile);
f09e2e
@@ -1773,6 +1781,10 @@ main(int ac, char **av)
f09e2e
 		debug("private host key: #%d type %d %s", i, keytype,
f09e2e
 		    key_type(key ? key : pubkey));
f09e2e
 	}
f09e2e
+	if ((options.protocol & SSH_PROTO_1) && FIPS_mode()) {
f09e2e
+		logit("Disabling protocol version 1. Not allowed in the FIPS mode.");
f09e2e
+		options.protocol &= ~SSH_PROTO_1;
f09e2e
+	}
f09e2e
 	if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
f09e2e
 		logit("Disabling protocol version 1. Could not load host key");
f09e2e
 		options.protocol &= ~SSH_PROTO_1;
f09e2e
@@ -1936,6 +1948,10 @@ main(int ac, char **av)
f09e2e
 	/* Initialize the random number generator. */
f09e2e
 	arc4random_stir();
f09e2e
 
f09e2e
+	if (FIPS_mode()) {
f09e2e
+		logit("FIPS mode initialized");
f09e2e
+	}
f09e2e
+
f09e2e
 	/* Chdir to the root directory so that the current disk can be
f09e2e
 	   unmounted if desired. */
f09e2e
 	if (chdir("/") == -1)
f09e2e
@@ -2498,6 +2514,9 @@ do_ssh2_kex(void)
f09e2e
 	if (options.ciphers != NULL) {
f09e2e
 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
f09e2e
 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
f09e2e
+	} else if (FIPS_mode()) {
f09e2e
+		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
f09e2e
+		myproposal[PROPOSAL_ENC_ALGS_STOC] = KEX_FIPS_ENCRYPT;
f09e2e
 	}
f09e2e
 	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
f09e2e
 	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
f09e2e
@@ -2507,6 +2526,9 @@ do_ssh2_kex(void)
f09e2e
 	if (options.macs != NULL) {
f09e2e
 		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
f09e2e
 		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
f09e2e
+	} else if (FIPS_mode()) {
f09e2e
+		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
f09e2e
+		myproposal[PROPOSAL_MAC_ALGS_STOC] = KEX_FIPS_MAC;
f09e2e
 	}
f09e2e
 	if (options.compression == COMP_NONE) {
f09e2e
 		myproposal[PROPOSAL_COMP_ALGS_CTOS] =