>Number: 163095
>Category: bin
>Synopsis: Add WITH_OPENSSH_NONE_CIPHER src.conf(5) knob
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: update
>Submitter-Id: current-users
>Arrival-Date: Tue Dec 06 18:10:07 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator: Jeremy Chadwick
>Release: FreeBSD 8.2-STABLE amd64
>Organization:
>Environment:
System: FreeBSD icarus.home.lan 8.2-STABLE FreeBSD 8.2-STABLE #0: Thu Dec 1
04:37:29 PST 2011
r...@icarus.home.lan:/usr/obj/usr/src/sys/X7SBA_RELENG_8_amd64 amd64
>Description:
The recently-committed addition of the HPN patches to the base
system OpenSSH introduced the ability to make use of the "None"
cipher:
http://www.freebsd.org/cgi/cvsweb.cgi/src/crypto/openssh/README.hpn
However, enabling use of it requires a somewhat "hackish"
addition to /etc/make.conf like the following:
.if ${.CURDIR:M/usr/src/secure/*}
CFLAGS+=-DNONE_CIPHER_ENABLED
.endif
The below patch adds the ability to enable this cipher by simply
adding WITH_OPENSSH_NONE_CIPHER to one's /etc/src.conf.
The below patch was tested on RELENG_8 (with buildworld); may
require minor adjustments for application to the 9.x source.
Patch and situation itself was initially discussed with bz@ and
brooks@ privately. Desire for this is also justified via the
user community:
http://lists.freebsd.org/pipermail/freebsd-stable/2011-December/064727.html
>How-To-Repeat:
n/a
>Fix:
Apply the below patch. Patch will also be available for download
at the below URL, once I get a PR number.
http://jdc.parodius.com/freebsd/{prnum}/
Committer should be aware that the src.conf.5 man page will need
to be rebuilt prior to commit. I believe
src/tools/build/options/makeman is for this purpose.
diff -ruN /origsrc/secure/lib/libssh/Makefile src/secure/lib/libssh/Makefile
--- /origsrc/secure/lib/libssh/Makefile 2010-04-20 23:33:10.000000000 -0700
+++ src/secure/lib/libssh/Makefile 2011-12-06 09:38:15.976388562 -0800
@@ -39,6 +39,10 @@
LDADD+= -lgssapi -lkrb5 -lhx509 -lasn1 -lcom_err -lmd -lroken
.endif
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
NO_LINT=
DPADD+= ${LIBCRYPTO} ${LIBCRYPT}
diff -ruN /origsrc/secure/usr.bin/ssh/Makefile src/secure/usr.bin/ssh/Makefile
--- /origsrc/secure/usr.bin/ssh/Makefile 2010-04-20 23:33:10.000000000
-0700
+++ src/secure/usr.bin/ssh/Makefile 2011-12-06 09:38:24.173485693 -0800
@@ -25,6 +25,10 @@
LDADD+= -lgssapi
.endif
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
.if defined(X11BASE) || defined(LOCALBASE)
# Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org
# 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/
diff -ruN /origsrc/secure/usr.sbin/sshd/Makefile
src/secure/usr.sbin/sshd/Makefile
--- /origsrc/secure/usr.sbin/sshd/Makefile 2010-04-20 23:33:10.000000000
-0700
+++ src/secure/usr.sbin/sshd/Makefile 2011-12-06 09:37:56.833786139 -0800
@@ -38,6 +38,10 @@
LDADD+= -lgssapi_krb5 -lgssapi -lkrb5 -lasn1
.endif
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
.if defined(X11BASE)
# Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org
# 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/
diff -ruN /origsrc/share/mk/bsd.own.mk src/share/mk/bsd.own.mk
--- /origsrc/share/mk/bsd.own.mk 2010-05-25 13:16:36.000000000 -0700
+++ src/share/mk/bsd.own.mk 2011-12-06 09:38:46.729274164 -0800
@@ -408,7 +408,8 @@
BIND_SIGCHASE \
BIND_XML \
HESIOD \
- IDEA
+ IDEA \
+ OPENSSH_NONE_CIPHER
.if defined(WITH_${var}) && defined(WITHOUT_${var})
.error WITH_${var} and WITHOUT_${var} can't both be set.
.endif
diff -ruN /origsrc/tools/build/options/WITH_OPENSSH_NONE_CIPHER
src/tools/build/options/WITH_OPENSSH_NONE_CIPHER
--- /origsrc/tools/build/options/WITH_OPENSSH_NONE_CIPHER 1969-12-31
16:00:00.000000000 -0800
+++ src/tools/build/options/WITH_OPENSSH_NONE_CIPHER 2011-12-06
09:39:30.929282637 -0800
@@ -0,0 +1,8 @@
+.\" $FreeBSD: $
+Set to include the "None" cipher into OpenSSH and its libraries.
+Additional adjustments may need to be done to system configuration
+files, such as
+.Xr sshd_config 5 ,
+to enable this cipher. Please see
+.Pa /usr/src/crypto/openssh/README.hpn
+for full details.
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
