diff --git a/SOURCES/libssh-0.7.1-fix_agent_bigendian.patch b/SOURCES/libssh-0.7.1-fix_agent_bigendian.patch new file mode 100644 index 0000000..e773525 --- /dev/null +++ b/SOURCES/libssh-0.7.1-fix_agent_bigendian.patch @@ -0,0 +1,109 @@ +--- a/libssh-0.7.2-fix_agent_bigendian.patch ++++ a/libssh-0.7.2-fix_agent_bigendian.patch +@@ -0,0 +1,105 @@ ++From 0425ac9ad0f8f1cefa12b448d31a400ced3e89b9 Mon Sep 17 00:00:00 2001 ++From: Andreas Schneider ++Date: Wed, 14 Oct 2015 20:45:49 +0200 ++Subject: [PATCH] agent: Fix agent auth on big endian machines ++ ++BUG: https://red.libssh.org/issues/204 ++ ++Signed-off-by: Andreas Schneider ++--- ++ ConfigureChecks.cmake | 1 + ++ include/libssh/priv.h | 10 ++++++++++ ++ src/agent.c | 17 +++++++++++++---- ++ 3 files changed, 24 insertions(+), 4 deletions(-) ++ ++diff --git a/ConfigureChecks.cmake b/ConfigureChecks.cmake ++index c0326c2..3587b07 100644 ++--- a/ConfigureChecks.cmake +++++ b/ConfigureChecks.cmake ++@@ -56,6 +56,7 @@ check_include_file(libutil.h HAVE_LIBUTIL_H) ++ check_include_file(sys/time.h HAVE_SYS_TIME_H) ++ check_include_file(sys/param.h HAVE_SYS_PARAM_H) ++ check_include_file(arpa/inet.h HAVE_ARPA_INET_H) +++check_include_file(byteswap.h HAVE_BYTESWAP_H) ++ ++ if (WIN32) ++ check_include_files("winsock2.h;ws2tcpip.h;wspiapi.h" HAVE_WSPIAPI_H) ++diff --git a/include/libssh/priv.h b/include/libssh/priv.h ++index 95a22c6..b7a80fe 100644 ++--- a/include/libssh/priv.h +++++ b/include/libssh/priv.h ++@@ -43,6 +43,16 @@ ++ # endif ++ #endif /* !defined(HAVE_STRTOULL) */ ++ +++#ifdef HAVE_BYTESWAP_H +++#include +++#endif +++ +++#ifndef bswap_32 +++#define bswap_32(x) \ +++ ((((x) & 0xff000000) >> 24) | (((x) & 0x00ff0000) >> 8) | \ +++ (((x) & 0x0000ff00) << 8) | (((x) & 0x000000ff) << 24)) +++#endif +++ ++ #ifdef _WIN32 ++ ++ /* Imitate define of inttypes.h */ ++diff --git a/src/agent.c b/src/agent.c ++index 922d753..e520773 100644 ++--- a/src/agent.c +++++ b/src/agent.c ++@@ -382,6 +382,9 @@ int ssh_agent_get_ident_count(struct ssh_session_struct *session) { ++ ssh_buffer_free(reply); ++ return -1; ++ } +++#ifdef WORDS_BIGENDIAN +++ type = bswap_32(type); +++#endif ++ ++ SSH_LOG(SSH_LOG_WARN, ++ "Answer type: %d, expected answer: %d", ++@@ -392,7 +395,7 @@ int ssh_agent_get_ident_count(struct ssh_session_struct *session) { ++ return 0; ++ } else if (type != c2) { ++ ssh_set_error(session, SSH_FATAL, ++- "Bad authentication reply message type: %d", type); +++ "Bad authentication reply message type: %u", type); ++ ssh_buffer_free(reply); ++ return -1; ++ } ++@@ -507,8 +510,8 @@ ssh_string ssh_agent_sign_data(ssh_session session, ++ ssh_buffer reply; ++ ssh_string key_blob; ++ ssh_string sig_blob; ++- int type = SSH2_AGENT_FAILURE; ++- int flags = 0; +++ unsigned int type = 0; +++ unsigned int flags = 0; ++ uint32_t dlen; ++ int rc; ++ ++@@ -572,13 +575,19 @@ ssh_string ssh_agent_sign_data(ssh_session session, ++ ssh_buffer_free(reply); ++ return NULL; ++ } +++#ifdef WORDS_BIGENDIAN +++ type = bswap_32(type); +++#endif ++ ++ if (agent_failed(type)) { ++ SSH_LOG(SSH_LOG_WARN, "Agent reports failure in signing the key"); ++ ssh_buffer_free(reply); ++ return NULL; ++ } else if (type != SSH2_AGENT_SIGN_RESPONSE) { ++- ssh_set_error(session, SSH_FATAL, "Bad authentication response: %d", type); +++ ssh_set_error(session, +++ SSH_FATAL, +++ "Bad authentication response: %u", +++ type); ++ ssh_buffer_free(reply); ++ return NULL; ++ } ++-- ++2.5.0 ++ + diff --git a/SPECS/libssh.spec b/SPECS/libssh.spec index f8e7090..2457def 100644 --- a/SPECS/libssh.spec +++ b/SPECS/libssh.spec @@ -2,7 +2,7 @@ Name: libssh Version: 0.7.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A library implementing the SSH protocol License: LGPLv2+ URL: http://www.libssh.org @@ -12,6 +12,7 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Source0: https://red.libssh.org/attachments/download/154/libssh-0.7.1.tar.xz Patch1: libssh-CVE-2016-0739.patch +Patch2: libssh-0.7.1-fix_agent_bigendian.patch BuildRequires: cmake BuildRequires: doxygen @@ -41,6 +42,7 @@ applications that use %{name}. %prep %setup -q %patch1 -p1 +%patch2 -p1 -b .libssh-0.7.2-fix_agent_bigendian.patch # Remove examples, they are not packaged and do not build on EPEL 5 sed -i -e 's|add_subdirectory(examples)||g' CMakeLists.txt @@ -95,6 +97,9 @@ rm -rf %{buildroot} %{_libdir}/libssh_threads.so %changelog +* Wed Mar 22 2017 - Dominik Perpeet - 0.7.1-3 +- Fix agent auth on big endian machines + * Mon Feb 22 2016 - Stef Walter - 0.7.1-2 - Security fix for CVE-2016-0739 rhbz#1305971