From b45c19b8f6802a82335790d0d7b973dae769e422 Mon Sep 17 00:00:00 2001 From: Michael Forney Date: Thu, 14 Nov 2019 01:42:22 -0800 Subject: openssh, libfido2: Update to latest git This enables support for ed25519-sk keys. Support for building in sk provider is now in upstream openssh. --- pkg/libfido2/gen.lua | 10 ++-- pkg/libfido2/src | 2 +- pkg/libfido2/ver | 2 +- pkg/openssh/README.md | 6 +- pkg/openssh/config.h | 1 + pkg/openssh/gen.lua | 10 ++-- ...llow-security-key-provider-to-be-built-in.patch | 64 ---------------------- pkg/openssh/src | 2 +- pkg/openssh/ver | 2 +- 9 files changed, 20 insertions(+), 79 deletions(-) delete mode 100644 pkg/openssh/patch/0002-Allow-security-key-provider-to-be-built-in.patch (limited to 'pkg') diff --git a/pkg/libfido2/gen.lua b/pkg/libfido2/gen.lua index cced1a40..bc9801a2 100644 --- a/pkg/libfido2/gen.lua +++ b/pkg/libfido2/gen.lua @@ -7,6 +7,11 @@ cflags{ '-I pkg/openbsd/include', } +pkg.hdrs = copy('$outdir/include', '$srcdir/src', { + 'fido.h', + 'fido/err.h', + 'fido/param.h', +}) pkg.deps = { 'pkg/libcbor/headers', 'pkg/libressl/headers', @@ -43,9 +48,4 @@ lib('libfido2.a', [[ $builddir/pkg/libcbor/libcbor.a ]]) -lib('libsk-libfido2.a', { - 'tools/sk-libfido2.c', - 'libfido2.a.d', -}) - fetch 'git' diff --git a/pkg/libfido2/src b/pkg/libfido2/src index 6a628b3d..12099171 160000 --- a/pkg/libfido2/src +++ b/pkg/libfido2/src @@ -1 +1 @@ -Subproject commit 6a628b3d3a9d62a58f94d48340ef9eeca2d672b9 +Subproject commit 12099171ba5ae230aa7d114115a5d1a10cf5975b diff --git a/pkg/libfido2/ver b/pkg/libfido2/ver index 6b655c30..c24ad255 100644 --- a/pkg/libfido2/ver +++ b/pkg/libfido2/ver @@ -1 +1 @@ -1.2.0-55-g6a628b3 r0 +1.2.0-74-g1209917 r0 diff --git a/pkg/openssh/README.md b/pkg/openssh/README.md index 3d2517fa..7ce33b98 100644 --- a/pkg/openssh/README.md +++ b/pkg/openssh/README.md @@ -4,10 +4,12 @@ Generated with ./configure \ + --disable-pkcs11 \ --disable-wtmp \ + --enable-security-key \ --without-pie \ - CPPFLAGS='-I/src/oasis/out/pkg/zlib/include' \ - LDFLAGS='-L/src/oasis/out/pkg/libressl -L/src/oasis/out/pkg/openbsd -L/src/oasis/out/pkg/zlib' \ + CPPFLAGS='-I/src/oasis/pkg/openbsd/include -I/src/oasis/out/pkg/libfido2/include -I/src/oasis/out/pkg/zlib/include' \ + LDFLAGS='-L/src/oasis/out/pkg/libressl -L/src/oasis/out/pkg/openbsd -L/src/oasis/out/pkg/libfido2 -L/src/oasis/out/pkg/libcbor -L/src/oasis/out/pkg/zlib' \ LIBS='-lcrypto -lbsd' Several changes were made: diff --git a/pkg/openssh/config.h b/pkg/openssh/config.h index 7583dde6..a0379016 100644 --- a/pkg/openssh/config.h +++ b/pkg/openssh/config.h @@ -55,6 +55,7 @@ #define DISABLE_WTMPX 1 /* #undef ENABLE_PKCS11 */ #define ENABLE_SK /**/ +#define ENABLE_SK_INTERNAL /**/ /* #undef FFLUSH_NULL_BUG */ /* #undef FILESYSTEM_NO_BACKSLASH */ /* #undef FSID_HAS_VAL */ diff --git a/pkg/openssh/gen.lua b/pkg/openssh/gen.lua index 5e1dc907..981f38e0 100644 --- a/pkg/openssh/gen.lua +++ b/pkg/openssh/gen.lua @@ -10,12 +10,14 @@ cflags{ '-I $dir', '-I $srcdir', '-I pkg/openbsd/include', + '-I $builddir/pkg/libfido2/include', '-I $builddir/pkg/libressl/include', '-I $builddir/pkg/zlib/include', '-idirafter $srcdir/openbsd-compat', } pkg.deps = { + 'pkg/libfido2/headers', 'pkg/libressl/headers', 'pkg/zlib/headers', } @@ -69,19 +71,19 @@ lib('libssh.a', [[ readpass.c ttymodes.c xmalloc.c addrmatch.c atomicio.c dispatch.c mac.c misc.c utf8.c monitor_fdpass.c rijndael.c ssh-dss.c ssh-ecdsa.c ssh-ecdsa-sk.c - ssh-rsa.c dh.c + ssh-ed25519-sk.c ssh-rsa.c dh.c msg.c progressmeter.c dns.c entropy.c gss-genr.c umac.c umac128.c ssh-pkcs11.c smult_curve25519_ref.c poly1305.c chacha.c cipher-chachapoly.c - ssh-ed25519.c ssh-sk.c digest-openssl.c digest-libc.c hmac.c - sc25519.c ge25519.c fe25519.c ed25519.c verify.c hash.c + ssh-ed25519.c ssh-sk.c sk-usbhid.c digest-openssl.c digest-libc.c + hmac.c sc25519.c ge25519.c fe25519.c ed25519.c verify.c hash.c kex.c kexdh.c kexgex.c kexecdh.c kexc25519.c kexgexc.c kexgexs.c sntrup4591761.c kexsntrup4591761x25519.c kexgen.c sftp-realpath.c platform-pledge.c platform-tracing.c platform-misc.c libopenbsd-compat.a $builddir/pkg/(libressl/libcrypto.a.d zlib/libz.a) - $builddir/pkg/(libfido2/libsk-libfido2.a.d) + $builddir/pkg/(libfido2/libfido2.a.d) ]]) exe('ssh', [[ diff --git a/pkg/openssh/patch/0002-Allow-security-key-provider-to-be-built-in.patch b/pkg/openssh/patch/0002-Allow-security-key-provider-to-be-built-in.patch deleted file mode 100644 index 9be4b535..00000000 --- a/pkg/openssh/patch/0002-Allow-security-key-provider-to-be-built-in.patch +++ /dev/null @@ -1,64 +0,0 @@ -From fc95498df16315eac1ebe62db51ea33b96ce6b52 Mon Sep 17 00:00:00 2001 -From: Michael Forney -Date: Sun, 3 Nov 2019 11:24:13 -0800 -Subject: [PATCH] Allow security key provider to be built-in - ---- - ssh-sk.c | 30 ++++++++++++++++++------------ - 1 file changed, 18 insertions(+), 12 deletions(-) - -diff --git a/ssh-sk.c b/ssh-sk.c -index 122a1e2b..ca16a187 100644 ---- a/ssh-sk.c -+++ b/ssh-sk.c -@@ -84,16 +84,22 @@ sshsk_open(const char *path) - error("%s: strdup failed", __func__); - goto fail; - } -- if ((ret->dlhandle = dlopen(path, RTLD_NOW)) == NULL) { -- error("Security key provider %s dlopen failed: %s", -- path, dlerror()); -- goto fail; -- } -- if ((ret->sk_api_version = dlsym(ret->dlhandle, -- "sk_api_version")) == NULL) { -- error("Security key provider %s dlsym(sk_api_version) " -- "failed: %s", path, dlerror()); -- goto fail; -+ if (strcmp(path, "builtin") == 0) { -+ ret->sk_api_version = sk_api_version; -+ ret->sk_enroll = sk_enroll; -+ ret->sk_sign = sk_sign; -+ } else { -+ if ((ret->dlhandle = dlopen(path, RTLD_NOW)) == NULL) { -+ error("Security key provider %s dlopen failed: %s", -+ path, dlerror()); -+ goto fail; -+ } -+ if ((ret->sk_api_version = dlsym(ret->dlhandle, -+ "sk_api_version")) == NULL) { -+ error("Security key provider %s dlsym(sk_api_version) " -+ "failed: %s", path, dlerror()); -+ goto fail; -+ } - } - version = ret->sk_api_version(); - debug("%s: provider %s implements version 0x%08lx", __func__, -@@ -104,12 +110,12 @@ sshsk_open(const char *path) - (u_long)SSH_SK_VERSION_MAJOR); - goto fail; - } -- if ((ret->sk_enroll = dlsym(ret->dlhandle, "sk_enroll")) == NULL) { -+ if (ret->dlhandle && (ret->sk_enroll = dlsym(ret->dlhandle, "sk_enroll")) == NULL) { - error("Security key provider %s dlsym(sk_enroll) " - "failed: %s", path, dlerror()); - goto fail; - } -- if ((ret->sk_sign = dlsym(ret->dlhandle, "sk_sign")) == NULL) { -+ if (ret->dlhandle && (ret->sk_sign = dlsym(ret->dlhandle, "sk_sign")) == NULL) { - error("Security key provider %s dlsym(sk_sign) failed: %s", - path, dlerror()); - goto fail; --- -2.23.0 - diff --git a/pkg/openssh/src b/pkg/openssh/src index b236b27d..c63fba5e 160000 --- a/pkg/openssh/src +++ b/pkg/openssh/src @@ -1 +1 @@ -Subproject commit b236b27d6dada7f0542214003632b4e9b7aa1380 +Subproject commit c63fba5e3472307167850bbd84187186af7fa9f0 diff --git a/pkg/openssh/ver b/pkg/openssh/ver index 96cb19c4..4515e1ca 100644 --- a/pkg/openssh/ver +++ b/pkg/openssh/ver @@ -1 +1 @@ -8.1p1-60-gb236b27d r0 +8.1p1-117-gc63fba5e r0 -- cgit v1.2.3