summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--debian/changelog3
-rwxr-xr-xdebian/rules2
-rw-r--r--debian/tests/.cvsignore4
-rw-r--r--debian/tests/Makefile11
-rw-r--r--debian/tests/getpid.c39
-rwxr-xr-xdebian/tests/keygen-test12
6 files changed, 71 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog
index c2ab8971c..635e573f9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -15,6 +15,9 @@ openssh (1:4.7p1-11) UNRELEASED; urgency=low
15 - Update Vietnamese (thanks, Clytie Siddall; closes: #481876). 15 - Update Vietnamese (thanks, Clytie Siddall; closes: #481876).
16 * Check RSA1 keys without the need for a separate blacklist. Thanks to 16 * Check RSA1 keys without the need for a separate blacklist. Thanks to
17 Simon Tatham for the idea. 17 Simon Tatham for the idea.
18 * Generate two keys with the PID forced to the same value and test that
19 they differ, to defend against recurrences of the recent Debian OpenSSL
20 vulnerability.
18 21
19 -- Colin Watson <cjwatson@debian.org> Sat, 17 May 2008 08:48:45 +0200 22 -- Colin Watson <cjwatson@debian.org> Sat, 17 May 2008 08:48:45 +0200
20 23
diff --git a/debian/rules b/debian/rules
index 2136c2ec8..58eb3a41f 100755
--- a/debian/rules
+++ b/debian/rules
@@ -124,6 +124,7 @@ endif
124 124
125 $(MAKE) -C build-deb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass' 125 $(MAKE) -C build-deb -j 2 ASKPASS_PROGRAM='/usr/bin/ssh-askpass'
126 $(MAKE) -C contrib gnome-ssh-askpass2 CC='gcc $(OPTFLAGS) -g -Wall' 126 $(MAKE) -C contrib gnome-ssh-askpass2 CC='gcc $(OPTFLAGS) -g -Wall'
127 $(MAKE) -C debian/tests
127 128
128 touch build-deb-stamp 129 touch build-deb-stamp
129 130
@@ -144,6 +145,7 @@ clean:
144 dh_testdir 145 dh_testdir
145 rm -f build-deb-stamp build-udeb-stamp 146 rm -f build-deb-stamp build-udeb-stamp
146 rm -rf build-deb build-udeb 147 rm -rf build-deb build-udeb
148 $(MAKE) -C debian/tests clean
147 $(MAKE) -C contrib clean 149 $(MAKE) -C contrib clean
148 rm -f config.log 150 rm -f config.log
149 rm -f debian/ssh-askpass-gnome.png 151 rm -f debian/ssh-askpass-gnome.png
diff --git a/debian/tests/.cvsignore b/debian/tests/.cvsignore
new file mode 100644
index 000000000..d0383c1d3
--- /dev/null
+++ b/debian/tests/.cvsignore
@@ -0,0 +1,4 @@
1key1
2key1.pub
3key2
4key2.pub
diff --git a/debian/tests/Makefile b/debian/tests/Makefile
new file mode 100644
index 000000000..16d9840ac
--- /dev/null
+++ b/debian/tests/Makefile
@@ -0,0 +1,11 @@
1test: getpid.so
2 ./keygen-test
3
4getpid.o: getpid.c
5 gcc -fPIC -c $< -o $@
6
7getpid.so: getpid.o
8 gcc -shared -o $@ $<
9
10clean:
11 rm -f getpid.o getpid.so key1 key1.pub key2 key2.pub
diff --git a/debian/tests/getpid.c b/debian/tests/getpid.c
new file mode 100644
index 000000000..c9e35b87e
--- /dev/null
+++ b/debian/tests/getpid.c
@@ -0,0 +1,39 @@
1/*
2 * Compile:
3
4gcc -fPIC -c getpid.c -o getpid.o
5gcc -shared -o getpid.so getpid.o
6
7 * Use:
8
9FORCE_PID=1234 LD_PRELOAD=./getpid.so bash
10
11#
12# Copyright (C) 2001-2008 Kees Cook
13# kees@outflux.net, http://outflux.net/
14#
15# This program is free software; you can redistribute it and/or
16# modify it under the terms of the GNU General Public License
17# as published by the Free Software Foundation; either version 2
18# of the License, or (at your option) any later version.
19#
20# This program is distributed in the hope that it will be useful,
21# but WITHOUT ANY WARRANTY; without even the implied warranty of
22# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23# GNU General Public License for more details.
24#
25# You should have received a copy of the GNU General Public License
26# along with this program; if not, write to the Free Software
27# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
28# http://www.gnu.org/copyleft/gpl.html
29
30*/
31
32#include <sys/types.h>
33#include <unistd.h>
34#include <stdlib.h>
35
36pid_t getpid(void)
37{
38 return atoi(getenv("FORCE_PID"));
39}
diff --git a/debian/tests/keygen-test b/debian/tests/keygen-test
new file mode 100755
index 000000000..02b7c761a
--- /dev/null
+++ b/debian/tests/keygen-test
@@ -0,0 +1,12 @@
1#! /bin/sh
2
3rm -f key1 key1.pub key2 key2.pub
4LD_PRELOAD="$(pwd)/getpid.so" FORCE_PID=1234 \
5 ../../build-deb/ssh-keygen -N '' -f key1 >/dev/null
6LD_PRELOAD="$(pwd)/getpid.so" FORCE_PID=1234 \
7 ../../build-deb/ssh-keygen -N '' -f key2 >/dev/null
8if cmp -s key1 key2; then
9 echo "Generated two identical keys!" >&2
10 exit 1
11fi
12exit 0