openssh unix dev - Feb 2015 - SAP-2015-3-1 issues

BSD/OS issues

with 1.0.2a dev

make tests

[ -d `pwd`/regress ] || mkdir -p `pwd`/regress
[ -d `pwd`/regress/unittests ] || mkdir -p `pwd`/regress/unittests
[ -d `pwd`/regress/unittests/test_helper ] ||  mkdir -p
`pwd`/regress/unittests/test_helper
[ -d `pwd`/regress/unittests/sshbuf ] ||  mkdir -p
`pwd`/regress/unittests/sshbuf
[ -d `pwd`/regress/unittests/sshkey ] ||  mkdir -p
`pwd`/regress/unittests/sshkey
[ -d `pwd`/regress/unittests/bitmap ] ||  mkdir -p
`pwd`/regress/unittests/bitmap
[ -d `pwd`/regress/unittests/hostkeys ] ||  mkdir -p
`pwd`/regress/unittests/hostkeys
[ -d `pwd`/regress/unittests/kex ] ||  mkdir -p `pwd`/regress/unittests/kex
[ -f `pwd`/regress/Makefile ] ||  ln -s `cd . && pwd`/regress/Makefile
`pwd`/regress/Makefile
(cd openbsd-compat && make)
/usr/bin/ar rv libssh.a ssh_api.o  ssherr.o  sshbuf.o  sshkey.o 
sshbuf-getput-basic.o  sshbuf-misc.o  sshbuf-getput-crypto.o  krl.o  bitmap.o 
authfd.o authfile.o bufaux.o bufbn.o bufec.o buffer.o  canohost.o channels.o
cipher.o cipher-aes.o cipher-aesctr.o  cipher-bf1.o cipher-ctr.o cipher-3des1.o
cleanup.o  compat.o crc32.o deattack.o fatal.o hostfile.o  log.o match.o
md-sha256.o moduli.o nchan.o packet.o opacket.o  readpass.o rsa.o ttymodes.o
xmalloc.o addrmatch.o  atomicio.o key.o dispatch.o mac.o uidswap.o uuencode.o
misc.o  monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o  msg.o
progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o  ssh-pkcs11.o
smult_curve25519_ref.o  poly1305.o chacha.o cipher-chachapoly.o  ssh-ed25519.o
digest-openssl.o digest-libc.o hmac.o  sc25519.o ge25519.o fe25519.o ed25519.o
verify.o hash.o blocks.o  kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o  kexdhc.o
kexgexc.o kexecdhc.o kexc25519c.o  kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o
r - ssh_api.o
r - ssherr.o
r - sshbuf.o
r - sshkey.o
r - sshbuf-getput-basic.o
r - sshbuf-misc.o
r - sshbuf-getput-crypto.o
r - krl.o
r - bitmap.o
r - authfd.o
r - authfile.o
r - bufaux.o
r - bufbn.o
r - bufec.o
r - buffer.o
r - canohost.o
r - channels.o
r - cipher.o
r - cipher-aes.o
r - cipher-aesctr.o
r - cipher-bf1.o
r - cipher-ctr.o
r - cipher-3des1.o
r - cleanup.o
r - compat.o
r - crc32.o
r - deattack.o
r - fatal.o
r - hostfile.o
r - log.o
r - match.o
r - md-sha256.o
r - moduli.o
r - nchan.o
r - packet.o
r - opacket.o
r - readpass.o
r - rsa.o
r - ttymodes.o
r - xmalloc.o
r - addrmatch.o
r - atomicio.o
r - key.o
r - dispatch.o
r - mac.o
r - uidswap.o
r - uuencode.o
r - misc.o
r - monitor_fdpass.o
r - rijndael.o
r - ssh-dss.o
r - ssh-ecdsa.o
r - ssh-rsa.o
r - dh.o
r - msg.o
r - progressmeter.o
r - dns.o
r - entropy.o
r - gss-genr.o
r - umac.o
r - umac128.o
r - ssh-pkcs11.o
r - smult_curve25519_ref.o
r - poly1305.o
r - chacha.o
r - cipher-chachapoly.o
r - ssh-ed25519.o
r - digest-openssl.o
r - digest-libc.o
r - hmac.o
r - sc25519.o
r - ge25519.o
r - fe25519.o
r - ed25519.o
r - verify.o
r - hash.o
r - blocks.o
r - kex.o
r - kexdh.o
r - kexgex.o
r - kexecdh.o
r - kexc25519.o
r - kexdhc.o
r - kexgexc.o
r - kexecdhc.o
r - kexc25519c.o
r - kexdhs.o
r - kexgexs.o
r - kexecdhs.o
r - kexc25519s.o
ranlib libssh.a
/usr/bin/gcc -o ssh ssh.o readconf.o clientloop.o sshtty.o  sshconnect.o
sshconnect1.o sshconnect2.o mux.o  roaming_common.o roaming_client.o -L.
-Lopenbsd-compat/ -L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib 
-Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -lssh -lopenbsd-compat  -lcrypto -ldl
-lutil -lz
/usr/bin/gcc -o sshd sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o
audit.o audit-bsm.o audit-linux.o platform.o  sshpty.o sshlogin.o servconf.o
serverloop.o  auth.o auth1.o auth2.o auth-options.o session.o  auth-chall.o
auth2-chall.o groupaccess.o  auth-skey.o auth-bsdauth.o auth2-hostbased.o
auth2-kbdint.o  auth2-none.o auth2-passwd.o auth2-pubkey.o  monitor_mm.o
monitor.o monitor_wrap.o auth-krb5.o  auth2-gss.o gss-serv.o gss-serv-krb5.o 
loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o  sftp-server.o
sftp-common.o  roaming_common.o roaming_serv.o  sandbox-null.o sandbox-rlimit.o
sandbox-systrace.o sandbox-darwin.o  sandbox-seccomp-filter.o sandbox-capsicum.o
-L. -Lopenbsd-compat/ -L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib 
-Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -lssh -lopenbsd-compat  -lcrypto -ldl
-lutil -lz
/usr/bin/gcc -o ssh-add ssh-add.o -L. -Lopenbsd-compat/ -L/usr/contrib//lib -L
/usr/lib -L /usr/contrib/lib  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -lssh
-lopenbsd-compat -lcrypto -ldl -lutil -lz
/usr/bin/gcc -o ssh-keygen ssh-keygen.o -L. -Lopenbsd-compat/
-L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib  -Wl,-z,relro -Wl,-z,now
-Wl,-z,noexecstack -lssh -lopenbsd-compat -lcrypto -ldl -lutil -lz
/usr/bin/gcc -o ssh-keyscan ssh-keyscan.o roaming_dummy.o -L. -Lopenbsd-compat/
-L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib  -Wl,-z,relro -Wl,-z,now
-Wl,-z,noexecstack -lssh -lopenbsd-compat -lssh -lcrypto -ldl -lutil -lz
/usr/bin/gcc -o ssh-keysign ssh-keysign.o readconf.o roaming_dummy.o -L.
-Lopenbsd-compat/ -L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib 
-Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -lssh -lopenbsd-compat -lcrypto -ldl
-lutil -lz
/usr/bin/gcc -o ssh-pkcs11-helper ssh-pkcs11-helper.o ssh-pkcs11.o -L.
-Lopenbsd-compat/ -L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib 
-Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -lssh -lopenbsd-compat -lssh
-lopenbsd-compat -lcrypto -ldl -lutil -lz
/usr/bin/gcc -o ssh-agent ssh-agent.o ssh-pkcs11-client.o -L. -Lopenbsd-compat/
-L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib  -Wl,-z,relro -Wl,-z,now
-Wl,-z,noexecstack -lssh -lopenbsd-compat -lcrypto -ldl -lutil -lz
/usr/bin/gcc -o scp scp.o progressmeter.o bufaux.o -L. -Lopenbsd-compat/
-L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib  -Wl,-z,relro -Wl,-z,now
-Wl,-z,noexecstack -lssh -lopenbsd-compat -lcrypto -ldl -lutil -lz
/usr/bin/gcc -o sftp-server sftp-server.o sftp-common.o sftp-server-main.o -L.
-Lopenbsd-compat/ -L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib 
-Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -lssh -lopenbsd-compat -lcrypto -ldl
-lutil -lz
/usr/bin/gcc -o sftp progressmeter.o sftp.o sftp-client.o sftp-common.o
sftp-glob.o -L. -Lopenbsd-compat/ -L/usr/contrib//lib -L /usr/lib -L
/usr/contrib/lib  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -lssh
-lopenbsd-compat -lcrypto -ldl -lutil -lz
/usr/bin/gcc -g -O2 -Wall  -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
-Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv
-fno-builtin-memset -I. -I. -I/usr/contrib//include  -DSSHDIR=\"/etc\"
-D_PATH_SSH_PROGRAM=\"/usr/contrib/bin/ssh\" 
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/contrib/libexec/ssh-askpass\" 
-D_PATH_SFTP_SERVER=\"/usr/contrib/libexec/sftp-server\" 
-D_PATH_SSH_KEY_SIGN=\"/usr/contrib/libexec/ssh-keysign\" 
-D_PATH_SSH_PKCS11_HELPER=\"/usr/contrib/libexec/ssh-pkcs11-helper\" 
-D_PATH_SSH_PIDDIR=\"/var/run\" 
-D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -o
regress/modpipe ./regress/modpipe.c  -L. -Lopenbsd-compat/ -L/usr/contrib//lib
-L /usr/lib -L /usr/contrib/lib  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
-lssh -lopenbsd-compat -lssh -lopenbsd-compat -lcrypto -ldl -lutil -lz
/usr/bin/gcc -g -O2 -Wall  -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
-Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv
-fno-builtin-memset -I. -I. -I/usr/contrib//include  -DSSHDIR=\"/etc\"
-D_PATH_SSH_PROGRAM=\"/usr/contrib/bin/ssh\" 
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/contrib/libexec/ssh-askpass\" 
-D_PATH_SFTP_SERVER=\"/usr/contrib/libexec/sftp-server\" 
-D_PATH_SSH_KEY_SIGN=\"/usr/contrib/libexec/ssh-keysign\" 
-D_PATH_SSH_PKCS11_HELPER=\"/usr/contrib/libexec/ssh-pkcs11-helper\" 
-D_PATH_SSH_PIDDIR=\"/var/run\" 
-D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -o
regress/setuid-allowed ./regress/setuid-allowed.c  -L. -Lopenbsd-compat/
-L/usr/contrib//lib -L /usr/lib -L /usr/contrib/lib  -Wl,-z,relro -Wl,-z,now
-Wl,-z,noexecstack -lssh -lopenbsd-compat -lssh -lopenbsd-compat -lcrypto -ldl
-lutil -lz
/usr/bin/gcc -g -O2 -Wall  -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
-Wformat-security -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv
-fno-builtin-memset -I. -I. -I/usr/contrib//include  -DSSHDIR=\"/etc\"
-D_PATH_SSH_PROGRAM=\"/usr/contrib/bin/ssh\" 
-D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/contrib/libexec/ssh-askpass\" 
-D_PATH_SFTP_SERVER=\"/usr/contrib/libexec/sftp-server\" 
-D_PATH_SSH_KEY_SIGN=\"/usr/contrib/libexec/ssh-keysign\" 
-D_PATH_SSH_PKCS11_HELPER=\"/usr/contrib/libexec/ssh-pkcs11-helper\" 
-D_PATH_SSH_PIDDIR=\"/var/run\" 
-D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -o
regress/netcat ./regress/netcat.c  -L. -Lopenbsd-compat/ -L/usr/contrib//lib -L
/usr/lib -L /usr/contrib/lib  -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -lssh
-lopenbsd-compat -lssh -lopenbsd-compat -lcrypto -ldl -lutil -lz
regress/netcat.c: In function `main':
regress/netcat.c:272: warning: null format string
regress/netcat.c:345: warning: implicit declaration of function `strlcpy'
regress/netcat.c:407: warning: null format string
regress/netcat.c: In function `unix_bind':
regress/netcat.c:555: warning: comparison between signed and unsigned
regress/netcat.c: In function `unix_connect':
regress/netcat.c:591: warning: comparison between signed and unsigned
regress/netcat.c: In function `remote_connect':
regress/netcat.c:656: `on' undeclared (first use in this function)
regress/netcat.c:656: (Each undeclared identifier is reported only once
regress/netcat.c:656: for each function it appears in.)
regress/netcat.c: In function `local_listen':
regress/netcat.c:765: warning: null format string
regress/netcat.c: In function `build_ports':
regress/netcat.c:1140: warning: null format string
regress/netcat.c:1163: warning: null format string
regress/netcat.c: In function `set_common_sockopts':
regress/netcat.c:1201: warning: null format string
regress/netcat.c: In function `decode_addrport':
regress/netcat.c:1423: warning: comparison between signed and unsigned
*** Error code 1

Stop.

I did briefly install this and got on Tera Term

Unexpected SSH2 message(80) on current stage (6) .

FYI

I might test this later on FreeBSD 10.1 amd64 using curent openssl 1.0.2a dev


-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
God,Queen and country!Never Satan President Republic!Beware AntiChrist rising! 
http://www.fullyfollow.me/rootnl2k  Look at Psalms 14 and 53 on Atheism
The body says what words cannot.  -Martha Graham

On Sat, 28 Feb 2015, The Doctor wrote:
> BSD/OS issues
> 
> with 1.0.2a dev
Thanks for testing.
> make tests
> 
> regress/netcat.c:656: `on' undeclared (first use in this function)
> regress/netcat.c:656: (Each undeclared identifier is reported only once
> regress/netcat.c:656: for each function it appears in.)
> regress/netcat.c: In function `local_listen':
> regress/netcat.c:765: warning: null format string
> regress/netcat.c: In function `build_ports':
> regress/netcat.c:1140: warning: null format string
> regress/netcat.c:1163: warning: null format string
I've fixed these (see diff below)
> I did briefly install this and got on Tera Term
> 
> Unexpected SSH2 message(80) on current stage (6) .
Is this an error that breaks the connection or a warning?

-d

On Sun, 1 Mar 2015, Damien Miller wrote:
> I've fixed these (see diff below)
The actual diff:


diff --git regress/netcat.c regress/netcat.c
index 29e85bf..f8fc7ee 100644
--- regress/netcat.c
+++ regress/netcat.c
@@ -269,7 +269,7 @@ main(int argc, char *argv[])
 		case 'x':
 			xflag = 1;
 			if ((proxy = strdup(optarg)) == NULL)
-				err(1, NULL);
+				errx(1, "strdup");
 			break;
 		case 'z':
 			zflag = 1;
@@ -404,7 +404,7 @@ main(int argc, char *argv[])
 			if (family != AF_UNIX)
 				s = local_listen(host, uport, hints);
 			if (s < 0)
-				err(1, NULL);
+				err(1, "local_listen");
 			/*
 			 * For UDP and -k, don't connect the socket, let it
 			 * receive datagrams from multiple socket pairs.
@@ -629,7 +629,7 @@ remote_connect(const char *host, const char *port, struct
addrinfo hints)
 {
 	struct addrinfo *res, *res0;
 	int s, error;
-#ifdef SO_RTABLE
+#if defined(SO_RTABLE) || defined(SO_BINDANY)
 	int on = 1;
 #endif
 
@@ -762,7 +762,7 @@ local_listen(char *host, char *port, struct addrinfo hints)
 #ifdef SO_REUSEPORT
 		ret = setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &x, sizeof(x));
 		if (ret == -1)
-			err(1, NULL);
+			err(1, "setsockopt");
 #endif
 		set_common_sockopts(s);
 
@@ -1137,7 +1137,7 @@ build_ports(char *p)
 		for (cp = lo; cp <= hi; cp++) {
 			portlist[x] = calloc(1, PORT_MAX_LEN);
 			if (portlist[x] == NULL)
-				err(1, NULL);
+				errx(1, "calloc");
 			snprintf(portlist[x], PORT_MAX_LEN, "%d", cp);
 			x++;
 		}
@@ -1160,7 +1160,7 @@ build_ports(char *p)
 			errx(1, "port number %s: %s", errstr, p);
 		portlist[0] = strdup(p);
 		if (portlist[0] == NULL)
-			err(1, NULL);
+			errx(1, "strdup");
 	}
 }
 
@@ -1192,13 +1192,13 @@ set_common_sockopts(int s)
 	if (Sflag) {
 		if (setsockopt(s, IPPROTO_TCP, TCP_MD5SIG,
 			&x, sizeof(x)) == -1)
-			err(1, NULL);
+			err(1, "setsockopt");
 	}
 #endif
 	if (Dflag) {
 		if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
 			&x, sizeof(x)) == -1)
-			err(1, NULL);
+			err(1, "setsockopt");
 	}
 	if (Tflag != -1) {
 		if (setsockopt(s, IPPROTO_IP, IP_TOS,

On Sun, Mar 01, 2015 at 03:23:04AM +1100, Damien Miller
wrote:
> 
> 
> On Sat, 28 Feb 2015, The Doctor wrote:
> 
> > BSD/OS issues
> > 
> > with 1.0.2a dev
> 
> Thanks for testing.
> 
You are welcome.
> > make tests
> > 
> > regress/netcat.c:656: `on' undeclared (first use in this function)
> > regress/netcat.c:656: (Each undeclared identifier is reported only
once
> > regress/netcat.c:656: for each function it appears in.)
> > regress/netcat.c: In function `local_listen':
> > regress/netcat.c:765: warning: null format string
> > regress/netcat.c: In function `build_ports':
> > regress/netcat.c:1140: warning: null format string
> > regress/netcat.c:1163: warning: null format string
> 
> I've fixed these (see diff below)
>
When will it be added in?
 
> > I did briefly install this and got on Tera Term
> > 
> > Unexpected SSH2 message(80) on current stage (6) .
> 
> Is this an error that breaks the connection or a warning?
Break the connection; in this case Tera Type.
> 
> -d
-- 
Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
God,Queen and country!Never Satan President Republic!Beware AntiChrist rising! 
http://www.fullyfollow.me/rootnl2k  Look at Psalms 14 and 53 on Atheism
The body says what words cannot.  -Martha Graham