08f9072513
- Update of the underlying OpenSSH to 6.5p1
- Update to 6.5p1
Features since 6.4p1:
* ssh(1), sshd(8): support for key exchange using ECDH in
Daniel Bernstein's Curve25519; default when both the client
and server support it.
* ssh(1), sshd(8): support for Ed25519 as a public key type fo
rboth server and client. Ed25519 is an EC signature offering
better security than ECDSA and DSA and good performance.
* Add a new private key format that uses a bcrypt KDF to better
protect keys at rest. Used unconditionally for Ed25519 keys,
on demand for other key types via the -o ssh-keygen(1)
option. Intended to become default in the near future.
Details documented in PROTOCOL.key.
* ssh(1), sshd(8): new transport cipher
"chacha20-poly1305@openssh.com" combining Daniel Bernstein's
ChaCha20 stream cipher and Poly1305 MAC to build an
authenticated encryption mode. Details documented
PROTOCOL.chacha20poly1305.
* ssh(1), sshd(8): refuse RSA keys from old proprietary clients
and servers that use the obsolete RSA+MD5 signature scheme.
It will still be possible to connect with these
clients/servers but only DSA keys will be accepted, and
OpenSSH will refuse connection entirely in a future release.
* ssh(1), sshd(8): refuse old proprietary clients and servers
that use a weaker key exchange hash calculation.
* ssh(1): increase the size of the Diffie-Hellman groups
requested for each symmetric key size. New values from NIST
Special Publication 800-57 with the upper limit specified by
OBS-URL: https://build.opensuse.org/request/show/222365
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=63
33 lines
1.2 KiB
Diff
33 lines
1.2 KiB
Diff
# disable run-time check for OpenSSL ABI by version number as that is not a
|
|
# reliable indicator of ABI changes and doesn't make much sense in a
|
|
# distribution package
|
|
|
|
diff --git a/openssh-6.5p1/entropy.c b/openssh-6.5p1/entropy.c
|
|
--- a/openssh-6.5p1/entropy.c
|
|
+++ b/openssh-6.5p1/entropy.c
|
|
@@ -212,22 +212,23 @@ seed_rng(void)
|
|
#endif
|
|
/*
|
|
* OpenSSL version numbers: MNNFFPPS: major minor fix patch status
|
|
* We match major, minor, fix and status (not patch) for <1.0.0.
|
|
* After that, we acceptable compatible fix versions (so we
|
|
* allow 1.0.1 to work with 1.0.0). Going backwards is only allowed
|
|
* within a patch series.
|
|
*/
|
|
+#if 0
|
|
u_long version_mask = SSLeay() >= 0x1000000f ? ~0xffff0L : ~0xff0L;
|
|
if (((SSLeay() ^ OPENSSL_VERSION_NUMBER) & version_mask) ||
|
|
(SSLeay() >> 12) < (OPENSSL_VERSION_NUMBER >> 12))
|
|
fatal("OpenSSL version mismatch. Built against %lx, you "
|
|
"have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
|
|
-
|
|
+#endif
|
|
#ifndef OPENSSL_PRNG_ONLY
|
|
if (RAND_status() == 1) {
|
|
debug3("RNG is ready, skipping seeding");
|
|
return;
|
|
}
|
|
|
|
if (seed_from_prngd(buf, sizeof(buf)) == -1)
|
|
fatal("Could not obtain seed from PRNGd");
|