Call for testing: OpenSSH 6.7

[Kevin Brott]

Another missing ec.h failure ... AIX openssl 0.9.8k and RH 1.0.0-fips
              gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized
-Wsign-compare -Wformat-security -Wno-pointer-sign -fno-strict-aliasing
-D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-all
-fPIE  -I. -I.  -DSSHDIR=\"/usr/local/etc\"
-D_PATH_SSH_PROGRAM=\"/usr/local/bin/ssh\"
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/local/libexec/ssh-askpass\"
-D_PATH_SFTP_SERVER=\"/usr/local/libexec/sftp-server\"
-D_PATH_SSH_KEY_SIGN=\"/usr/local/libexec/ssh-keysign\"
-D_PATH_SSH_PKCS11_HELPER=\"/usr/local/libexec/ssh-pkcs11-helper\"
-D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\"
-DHAVE_CONFIG_H -c sshbuf-getput-crypto.c -o sshbuf-getput-crypto.o
              sshbuf-getput-crypto.c:27:24: error: openssl/ec.h: No such
file or directory
              gmake: *** [sshbuf-getput-crypto.o] Error 1



On Thu, Aug 21, 2014 at 8:22 AM, Kevin Brott <kevin.brott at gmail.com> wrote:

>
> Example ...
>
> Using openssh-SNAP-20140822.tar.gz ... on Centos 2.1 ..
>
> $ openssl version
> OpenSSL 0.9.6b [engine] 9 Jul 2001
>
> $ ./configure
> ...
> checking OpenSSL header version... 90602f (OpenSSL 0.9.6b [engine] 9 Jul
> 2001)
> checking OpenSSL library version... 90602f (OpenSSL 0.9.6b [engine] 9 Jul
> 2001)
> checking whether OpenSSL's headers match the library... yes
> checking if programs using OpenSSL functions will link... yes
> checking whether OpenSSL has crippled AES support... yes
> checking whether OpenSSL has AES CTR via EVP... no
> checking whether OpenSSL has AES GCM via EVP... no
> checking whether OpenSSL has NID_X9_62_prime256v1... no
> checking whether OpenSSL has NID_secp384r1... no
> checking whether OpenSSL has NID_secp521r1... no
> checking whether OpenSSL's PRNG is internally seeded... yes
> ...
>               Host: i686-pc-linux-gnu
>           Compiler: gcc
>     Compiler flags: -g -O2 -Wall -Wpointer-arith -Wuninitialized
> -Wsign-compare -Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2
> -fno-builtin-memset -std=gnu99
> Preprocessor flags:
>       Linker flags:  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
>          Libraries: -lresolv -lcrypto -lrt -ldl -lutil -lz -lnsl  -lcrypt
>
> $ gmake
> ...
> gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
> -Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2
> -fno-builtin-memset -std=gnu99  -I. -I.. -I. -I./..  -DHAVE_CONFIG_H -c
> openssl-compat.c
> In file included from openssl-compat.c:32:
> openssl-compat.h:28:2: #error OpenSSL 0.9.8f or greater is required
> gmake[1]: *** [openssl-compat.o] Error 1
> gmake[1]: Leaving directory `/usr/src/openssh/openbsd-compat'
> gmake: *** [openbsd-compat/libopenbsd-compat.a] Error 2
>
> This happens on all the Red Hat based systems where openssl < 1.0.0-fips
>
>
>
> On Wed, Aug 20, 2014 at 5:47 PM, Damien Miller <djm at mindrot.org> wrote:
>
>> On Wed, 20 Aug 2014, Kevin Brott wrote:
>>
>> > FAIL*1 - configure completes without errors ...
>> >    make[1]: Entering directory `/usr/src/openssh/openbsd-compat'
>> >    gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
>> > -Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2
>> > -fno-builtin-memset -std=gnu99  -I. -I.. -I. -I./..  -DHAVE_CONFIG_H -c
>> > openssl-compat.c
>> >    In file included from openssl-compat.c:32:
>> >    openssl-compat.h:28:2: #error OpenSSL 0.9.8f or greater is required
>>
>> that's strange - you aren't cross-compiling? The test in configure.ac
>> won't work for x-compiles.
>>
>> If not, what does configure report your OpenSSL version as? e.g.
>>
>> checking OpenSSL header version... 1000106f (OpenSSL 1.0.1f 6 Jan 2014)
>> checking OpenSSL library version... 1000106f (OpenSSL 1.0.1f 6 Jan 2014)
>>
>> >    make[1]: Leaving directory `/usr/src/openssh/openbsd-compat'
>> >    make: *** [openbsd-compat/libopenbsd-compat.a] Error 2
>> >
>> > FAIL*2 - port-aix.c still fails to compile on RHEL and AIX where ec.h
>> isn't
>> > part of openssl ...
>> >    gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
>> > -Wformat-security -Wno-pointer-sign -fno-strict-aliasing
>> -D_FORTIFY_SOURCE=2
>> > -ftrapv -fno-builtin-memset -fstack-protector-all -fPIE  -I. -I.. -I.
>> > -I./..  -DHAVE_CONFIG_H -c port-aix.c
>> >    In file included from port-aix.c:31:
>> >    ../key.h:85: warning: type defaults to ?int? in declaration of
>> ?EC_GROUP?
>> >    ../key.h:85: error: expected ?;?, ?,? or ?)? before ?*? token
>> >    ../key.h:86: warning: type defaults to ?int? in declaration of
>> ?EC_KEY?
>> >    ../key.h:86: error: expected ?;?, ?,? or ?)? before ?*? token
>>
>> another missing check for no-ECC OpenSSL:
>>
>> Index: key.h
>> ===================================================================
>> RCS file: /var/cvs/openssh/key.h,v
>> retrieving revision 1.45
>> diff -u -p -r1.45 key.h
>> --- key.h       2 Jul 2014 05:28:03 -0000       1.45
>> +++ key.h       21 Aug 2014 00:46:48 -0000
>> @@ -81,10 +81,10 @@ int  key_cert_check_authority(const Key
>>             const char **);
>>  char   *key_alg_list(int, int);
>>
>> -#ifdef WITH_OPENSSL
>> +#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
>>  int     key_ec_validate_public(const EC_GROUP *, const EC_POINT *);
>>  int     key_ec_validate_private(const EC_KEY *);
>> -#endif /* WITH_OPENSSL */
>> +#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */
>>
>>  Key    *key_from_blob(const u_char *, u_int);
>>  int     key_to_blob(const Key *, u_char **, u_int *);
>>
>
>
>
> --
> # include <stddisclaimer.h>
> /* Kevin  Brott <Kevin.Brott at gmail.com> */
>
>


-- 
# include <stddisclaimer.h>
/* Kevin  Brott <Kevin.Brott at gmail.com> */