kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
Zoltan Fridrich 585620
diff --color -rup a/compat.c b/compat.c
Zoltan Fridrich 585620
--- a/compat.c	2021-08-20 06:03:49.000000000 +0200
Zoltan Fridrich 9697ee
+++ b/compat.c	2022-07-14 17:39:23.770268440 +0200
Zoltan Fridrich 585620
@@ -157,11 +157,12 @@ compat_banner(struct ssh *ssh, const cha
Zoltan Fridrich 585620
 	debug_f("no match: %s", version);
Zoltan Fridrich 585620
 }
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
+/* Always returns pointer to allocated memory, caller must free. */
Zoltan Fridrich 585620
 char *
Zoltan Fridrich 585620
 compat_cipher_proposal(struct ssh *ssh, char *cipher_prop)
Zoltan Fridrich 585620
 {
Zoltan Fridrich 585620
 	if (!(ssh->compat & SSH_BUG_BIGENDIANAES))
Zoltan Fridrich 585620
-		return cipher_prop;
Zoltan Fridrich 585620
+		return xstrdup(cipher_prop);
Zoltan Fridrich 585620
 	debug2_f("original cipher proposal: %s", cipher_prop);
Zoltan Fridrich 585620
 	if ((cipher_prop = match_filter_denylist(cipher_prop, "aes*")) == NULL)
Zoltan Fridrich 585620
 		fatal("match_filter_denylist failed");
Zoltan Fridrich 585620
@@ -171,11 +172,12 @@ compat_cipher_proposal(struct ssh *ssh,
Zoltan Fridrich 585620
 	return cipher_prop;
Zoltan Fridrich 585620
 }
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
+/* Always returns pointer to allocated memory, caller must free. */
Zoltan Fridrich 585620
 char *
Zoltan Fridrich 585620
 compat_pkalg_proposal(struct ssh *ssh, char *pkalg_prop)
Zoltan Fridrich 585620
 {
Zoltan Fridrich 585620
 	if (!(ssh->compat & SSH_BUG_RSASIGMD5))
Zoltan Fridrich 585620
-		return pkalg_prop;
Zoltan Fridrich 585620
+		return xstrdup(pkalg_prop);
Zoltan Fridrich 585620
 	debug2_f("original public key proposal: %s", pkalg_prop);
Zoltan Fridrich 585620
 	if ((pkalg_prop = match_filter_denylist(pkalg_prop, "ssh-rsa")) == NULL)
Zoltan Fridrich 585620
 		fatal("match_filter_denylist failed");
Zoltan Fridrich 585620
@@ -185,21 +187,26 @@ compat_pkalg_proposal(struct ssh *ssh, c
Zoltan Fridrich 585620
 	return pkalg_prop;
Zoltan Fridrich 585620
 }
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
+/* Always returns pointer to allocated memory, caller must free. */
Zoltan Fridrich 585620
 char *
Zoltan Fridrich 585620
 compat_kex_proposal(struct ssh *ssh, char *p)
Zoltan Fridrich 585620
 {
Zoltan Fridrich 585620
+	char *cp = NULL;
Zoltan Fridrich 585620
+
Zoltan Fridrich 585620
 	if ((ssh->compat & (SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX)) == 0)
Zoltan Fridrich 585620
-		return p;
Zoltan Fridrich 585620
+		return xstrdup(p);
Zoltan Fridrich 585620
 	debug2_f("original KEX proposal: %s", p);
Zoltan Fridrich 585620
 	if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0)
Zoltan Fridrich 585620
 		if ((p = match_filter_denylist(p,
Zoltan Fridrich 585620
 		    "curve25519-sha256@libssh.org")) == NULL)
Zoltan Fridrich 585620
 			fatal("match_filter_denylist failed");
Zoltan Fridrich 585620
 	if ((ssh->compat & SSH_OLD_DHGEX) != 0) {
Zoltan Fridrich 585620
+		cp = p;
Zoltan Fridrich 585620
 		if ((p = match_filter_denylist(p,
Zoltan Fridrich 585620
 		    "diffie-hellman-group-exchange-sha256,"
Zoltan Fridrich 585620
 		    "diffie-hellman-group-exchange-sha1")) == NULL)
Zoltan Fridrich 585620
 			fatal("match_filter_denylist failed");
Zoltan Fridrich 585620
+		free(cp);
Zoltan Fridrich 585620
 	}
Zoltan Fridrich 585620
 	debug2_f("compat KEX proposal: %s", p);
Zoltan Fridrich 585620
 	if (*p == '\0')
Zoltan Fridrich 585620
diff --color -rup a/sshconnect2.c b/sshconnect2.c
Zoltan Fridrich 9697ee
--- a/sshconnect2.c	2022-07-14 17:38:43.241496549 +0200
Zoltan Fridrich 9697ee
+++ b/sshconnect2.c	2022-07-14 17:39:23.772268479 +0200
Zoltan Fridrich 9697ee
@@ -222,6 +222,7 @@ ssh_kex2(struct ssh *ssh, char *host, st
Zoltan Fridrich 585620
 {
Zoltan Fridrich 585620
 	char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
Zoltan Fridrich 585620
 	char *s, *all_key;
Zoltan Fridrich 585620
+	char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
Zoltan Fridrich 585620
 	int r, use_known_hosts_order = 0;
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
 #if defined(GSSAPI) && defined(WITH_OPENSSL)
Zoltan Fridrich 9697ee
@@ -252,10 +253,9 @@ ssh_kex2(struct ssh *ssh, char *host, st
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
 	if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
Zoltan Fridrich 585620
 		fatal_f("kex_names_cat");
Zoltan Fridrich 585620
-	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh, s);
Zoltan Fridrich 585620
+	myproposal[PROPOSAL_KEX_ALGS] = prop_kex = compat_kex_proposal(ssh, s);
Zoltan Fridrich 585620
 	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
Zoltan Fridrich 585620
-	    compat_cipher_proposal(ssh, options.ciphers);
Zoltan Fridrich 585620
-	myproposal[PROPOSAL_ENC_ALGS_STOC] =
Zoltan Fridrich 585620
+	    myproposal[PROPOSAL_ENC_ALGS_STOC] = prop_enc =
Zoltan Fridrich 585620
 	    compat_cipher_proposal(ssh, options.ciphers);
Zoltan Fridrich 585620
 	myproposal[PROPOSAL_COMP_ALGS_CTOS] =
Zoltan Fridrich 585620
 	    myproposal[PROPOSAL_COMP_ALGS_STOC] =
Zoltan Fridrich 9697ee
@@ -264,12 +264,12 @@ ssh_kex2(struct ssh *ssh, char *host, st
Zoltan Fridrich 585620
 	    myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
Zoltan Fridrich 585620
 	if (use_known_hosts_order) {
Zoltan Fridrich 585620
 		/* Query known_hosts and prefer algorithms that appear there */
Zoltan Fridrich 585620
-		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
Zoltan Fridrich 585620
+		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
Zoltan Fridrich 585620
 		    compat_pkalg_proposal(ssh,
Zoltan Fridrich 585620
 		    order_hostkeyalgs(host, hostaddr, port, cinfo));
Zoltan Fridrich 585620
 	} else {
Zoltan Fridrich 585620
 		/* Use specified HostkeyAlgorithms exactly */
Zoltan Fridrich 585620
-		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
Zoltan Fridrich 585620
+		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
Zoltan Fridrich 585620
 		    compat_pkalg_proposal(ssh, options.hostkeyalgorithms);
Zoltan Fridrich 585620
 	}
Zoltan Fridrich 585620
 
Zoltan Fridrich 9697ee
@@ -383,6 +383,10 @@ ssh_kex2(struct ssh *ssh, char *host, st
Zoltan Fridrich 585620
 	    (r = ssh_packet_write_wait(ssh)) != 0)
Zoltan Fridrich 585620
 		fatal_fr(r, "send packet");
Zoltan Fridrich 585620
 #endif
Zoltan Fridrich 585620
+	/* Free only parts of proposal that were dynamically allocated here. */
Zoltan Fridrich 585620
+	free(prop_kex);
Zoltan Fridrich 585620
+	free(prop_enc);
Zoltan Fridrich 585620
+	free(prop_hostkey);
Zoltan Fridrich 585620
 }
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
 /*
Zoltan Fridrich 585620
diff --color -rup a/sshd.c b/sshd.c
Zoltan Fridrich 9697ee
--- a/sshd.c	2022-07-14 17:38:43.242496568 +0200
Zoltan Fridrich 9697ee
+++ b/sshd.c	2022-07-14 17:42:07.616388978 +0200
Zoltan Fridrich 9697ee
@@ -2493,14 +2493,15 @@ do_ssh2_kex(struct ssh *ssh)
Zoltan Fridrich 585620
 {
Zoltan Fridrich 585620
 	char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
Zoltan Fridrich 585620
 	struct kex *kex;
Zoltan Fridrich 9697ee
+	char *hostkey_types = NULL;
Zoltan Fridrich 585620
+	char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
Zoltan Fridrich 585620
 	int r;
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
-	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh,
Zoltan Fridrich 585620
+	myproposal[PROPOSAL_KEX_ALGS] = prop_kex = compat_kex_proposal(ssh,
Zoltan Fridrich 585620
 	    options.kex_algorithms);
Zoltan Fridrich 585620
-	myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal(ssh,
Zoltan Fridrich 585620
-	    options.ciphers);
Zoltan Fridrich 585620
-	myproposal[PROPOSAL_ENC_ALGS_STOC] = compat_cipher_proposal(ssh,
Zoltan Fridrich 585620
-	    options.ciphers);
Zoltan Fridrich 585620
+	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
Zoltan Fridrich 585620
+	    myproposal[PROPOSAL_ENC_ALGS_STOC] = prop_enc =
Zoltan Fridrich 585620
+	    compat_cipher_proposal(ssh, options.ciphers);
Zoltan Fridrich 585620
 	myproposal[PROPOSAL_MAC_ALGS_CTOS] =
Zoltan Fridrich 585620
 	    myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
Zoltan Fridrich 585620
 
Zoltan Fridrich 9697ee
@@ -2513,8 +2514,10 @@ do_ssh2_kex(struct ssh *ssh)
Zoltan Fridrich 585620
 		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
Zoltan Fridrich 585620
 		    options.rekey_interval);
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
-	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
Zoltan Fridrich 585620
-	    ssh, list_hostkey_types());
Zoltan Fridrich 9697ee
+	hostkey_types = list_hostkey_types();
Zoltan Fridrich 585620
+	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
Zoltan Fridrich 9697ee
+	    compat_pkalg_proposal(ssh, hostkey_types);
Zoltan Fridrich 9697ee
+	free(hostkey_types);
Zoltan Fridrich 585620
 
Zoltan Fridrich 585620
 #if defined(GSSAPI) && defined(WITH_OPENSSL)
Zoltan Fridrich 585620
 	{
Zoltan Fridrich 9697ee
@@ -2606,6 +2609,9 @@ do_ssh2_kex(struct ssh *ssh)
Zoltan Fridrich 585620
 	    (r = ssh_packet_write_wait(ssh)) != 0)
Zoltan Fridrich 585620
 		fatal_fr(r, "send test");
Zoltan Fridrich 585620
 #endif
Zoltan Fridrich 585620
+	free(prop_kex);
Zoltan Fridrich 585620
+	free(prop_enc);
Zoltan Fridrich 585620
+	free(prop_hostkey);
Zoltan Fridrich 585620
 	debug("KEX done");
Zoltan Fridrich 585620
 }
Zoltan Fridrich 585620