Call for testing: OpenSSH 6.8

[Michael Felt]

As far as va_copy is concerned - I believe the default compiler should be
xlc rather than cc.

These are the default settings from the vac.cfg.53 file
* -qlanglvl=extc99 C compiler with common extensions, UNIX headers
xlc:    use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    =
-qlanglvl=extc99,-qcpluscmt,-qkeyword=inline,-qalias=ansi

* ANSI C compiler, UNIX header files (V6 compatibility version)
xlc_v6: use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    = -qalias=ansi

* C compiler, extended mode
cc:     use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    = -qlanglvl=extended,-qnoro,-qnoroconst

* Strict ANSI compiler, ANSI headers
c89:    use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    =
-D_ANSI_C_SOURCE,-qalias=ansi,-qnolonglong,-qstrict_induction

* Strict ANSI compiler, ANSI headers
c99:    use        = DEFLT_C
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        libraries  = -L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-lc
        proflibs   = -L/lib/profiled,-L/usr/lib/profiled
        options    =
-qlanglvl=stdc99,-D_ANSI_C_SOURCE,-D_ISOC99_SOURCE,-qalias=ansi,-qstrict_induction

If you look at my example above you will see that when -qlanglvl=extc99
va_copy gets 'transferred' to the _builtin_va_copy. I do not recall finding
va_copy in one of the libraries.

My question would be - are you still building against c89 standard (I
assume not). And as far as IBM C compatibility with gcc - xlc comes much
closer - with
* C++ compiler
xlc++:  use        = DEFLT_CPP
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        xlC        = /usr/vacpp/bin/xlC
        libraries2 =
-L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-L/usr/vacpp/lib,-lC,-lm,-lc
        proflibs   =
-L/usr/vacpp/lib/profiled,-L/lib/profiled,-L/usr/lib/profiled
        hdlibs     = -L/usr/vac/lib,-lhC,-lhmd
        options    = -qalias=ansi

* C++ compiler
xlC:    use        = DEFLT_CPP
        crt        = /lib/crt0.o
        mcrt       = /lib/mcrt0.o
        gcrt       = /lib/gcrt0.o
        xlC        = /usr/vacpp/bin/xlC
        libraries2 =
-L/usr/vac/lib,-lxlopt,-lxlipa,-lxl,-L/usr/vacpp/lib,-lC,-lm,-lc
        proflibs   =
-L/usr/vacpp/lib/profiled,-L/lib/profiled,-L/usr/lib/profiled
        hdlibs     = -L/usr/vac/lib,-lhC,-lhmd
        options    = -qalias=ansi
 being the 'natural' C++ co-compilers.

As a packager - I can resolve this myself by setting CC=xlc. So, please do
not see this as a bug or an error in the package - just as a FYI - where
you could provide a warning when plain "cc" is being used (e.g., I really
dislike the -qnoro option).

All in all - I am quite happy with how it is working - all tests seem to be
passing - and I shall be working on my next blog (google SecuringAIX should
find it - I dare not give the URL as being too pushy).

On Fri, Feb 27, 2015 at 7:12 PM, Darren Tucker <dtucker at zip.com.au> wrote:

> On Fri, Feb 27, 2015 at 7:12 AM, Michael Felt <aixtools at gmail.com> wrote:
>>
>> ld: 0711-317 ERROR: Undefined symbol: .va_copy
>> ld: 0711-317 ERROR: Undefined symbol: .EC_KEY_free
>>
>
> Which object files contain references to those symbols?  (running each
> through "nm" should show you).
>
>
>> ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more
>> information.
>>
>> The error above is a bit unusual.
>> 1) It has been seen before that with -qlanglvl=extc89 that va_copy is not
>> found. This is clear, I think, from the stdarg.h file:
>>
>>    +88  #ifdef _ISOC99_SOURCE
>>    +89  #define va_copy(__list1,__list2) ((void)(__list1 = __list2))
>>    +90  #endif
>>    +91
>>    +92  #endif /* _ANSI_C_SOURCE */
>>
>
> There's a definition of va_copy in defines.h which should be activated
> when the platform doesn't have it:
>
> #ifndef HAVE_VA_COPY
> # ifdef HAVE___VA_COPY
> #  define va_copy(dest, src) __va_copy(dest, src)
> # else
> #  define va_copy(dest, src) (dest) = (src)
> # endif
> #endif
>
> I suspect there's a file which should have includes.h at the top but
> doesn't.
>
> I think the EC_KEY_free should be fixed by this:
>
> diff --git a/kex.c b/kex.c
> index 2618e22..cf04574 100644
> --- a/kex.c
> +++ b/kex.c
> @@ -432,8 +432,10 @@ kex_free(struct kex *kex)
>  #ifdef WITH_OPENSSL
>         if (kex->dh)
>                 DH_free(kex->dh);
> +# ifdef OPENSSL_HAS_ECC
>         if (kex->ec_client_key)
>                 EC_KEY_free(kex->ec_client_key);
>
> I should be able to reproduce the problem by building against the exact
> openssl version you have.
>
> --
> Darren Tucker (dtucker at zip.com.au)
> GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.
>