File openssh-7.2p2-fips.patch of Package openssh.29886
From b8822f35bb98fca8ece0c42b9480b1d79cc1552e Mon Sep 17 00:00:00 2001
From: Old openssh patches <pcerny@suse.com>
Date: Tue, 25 Oct 2022 18:53:31 +0200
Subject: [PATCH] openssh-7.2p2-fips
# HG changeset patch
# Parent 5f2b8faa3b60de28124d9d4a44ffa2635d67f601
FIPS 140-2 compliance. Perform selftests on start and use only FIPS approved
algorithms.
---
Makefile.in | 2 +
auth-rsa.c | 33 ++++---
cipher-ctr.c | 4 +
cipher.c | 68 +++++++++++++--
dh.h | 1 +
fips.c | 237 ++++++++++++++++++++++++++++++++++++++++++++++++++
fips.h | 45 ++++++++++
hmac.c | 2 +-
kex.c | 52 +++++++++--
kexgexc.c | 5 +-
kexgexs.c | 7 +-
mac.c | 44 +++++++++-
myproposal.h | 2 +
readconf.c | 26 +++++-
readconf.h | 1 +
servconf.c | 69 +++++++++++++--
ssh-keygen.c | 32 ++++++-
ssh.c | 10 +++
ssh_config.0 | 5 ++
ssh_config.5 | 5 ++
sshd.c | 6 ++
sshd_config.0 | 5 ++
sshd_config.5 | 5 ++
23 files changed, 617 insertions(+), 49 deletions(-)
create mode 100644 fips.c
create mode 100644 fips.h
diff --git a/Makefile.in b/Makefile.in
index d401787d..5d0d06de 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -94,6 +94,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o \
platform-pledge.o
+LIBSSH_OBJS += fips.o
+
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
sshconnect.o sshconnect1.o sshconnect2.o mux.o
diff --git a/auth-rsa.c b/auth-rsa.c
index cbd971be..e7b831fd 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -51,6 +51,8 @@
#include "digest.h"
+#include "fips.h"
+
/* import */
extern ServerOptions options;
@@ -91,11 +93,14 @@ auth_rsa_generate_challenge(Key *key)
}
int
-auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16])
+auth_rsa_verify_response(Key *key, BIGNUM *challenge,
+ u_char response[SSH_DIGEST_MAX_LENGTH])
{
- u_char buf[32], mdbuf[16];
+ u_char buf[2 * SSH_DIGEST_MAX_LENGTH], mdbuf[SSH_DIGEST_MAX_LENGTH];
struct ssh_digest_ctx *md;
int len;
+ int dgst;
+ size_t dgst_len;
/* don't allow short keys */
if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
@@ -105,21 +110,25 @@ auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16])
return (0);
}
- /* The response is MD5 of decrypted challenge plus session id. */
+ dgst = fips_correct_dgst(SSH_DIGEST_MD5);
+ dgst_len = ssh_digest_bytes(dgst);
+
+ /* The response is a hash of decrypted challenge plus session id.
+ * Normally this is MD5, in FIPS mode a stronger function is used. */
len = BN_num_bytes(challenge);
- if (len <= 0 || len > 32)
+ if (len <= 0 || (unsigned int)len > (2 * dgst_len))
fatal("%s: bad challenge length %d", __func__, len);
- memset(buf, 0, 32);
- BN_bn2bin(challenge, buf + 32 - len);
- if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL ||
- ssh_digest_update(md, buf, 32) < 0 ||
- ssh_digest_update(md, session_id, 16) < 0 ||
+ memset(buf, 0, sizeof(buf));
+ BN_bn2bin(challenge, buf + 2 * dgst_len - len);
+ if ((md = ssh_digest_start(dgst)) == NULL ||
+ ssh_digest_update(md, buf, 2 * dgst_len) < 0 ||
+ ssh_digest_update(md, session_id, dgst_len) < 0 ||
ssh_digest_final(md, mdbuf, sizeof(mdbuf)) < 0)
fatal("%s: md5 failed", __func__);
ssh_digest_free(md);
/* Verify that the response is the original challenge. */
- if (timingsafe_bcmp(response, mdbuf, 16) != 0) {
+ if (timingsafe_bcmp(response, mdbuf, dgst_len) != 0) {
/* Wrong answer. */
return (0);
}
@@ -137,7 +146,7 @@ int
auth_rsa_challenge_dialog(Key *key)
{
BIGNUM *challenge, *encrypted_challenge;
- u_char response[16];
+ u_char response[SSH_DIGEST_MAX_LENGTH];
int i, success;
if ((encrypted_challenge = BN_new()) == NULL)
@@ -158,7 +167,7 @@ auth_rsa_challenge_dialog(Key *key)
/* Wait for a response. */
packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE);
- for (i = 0; i < 16; i++)
+ for (i = 0; i < ssh_digest_bytes(fips_dgst_min()); i++)
response[i] = (u_char)packet_get_char();
packet_check_eom();
diff --git a/cipher-ctr.c b/cipher-ctr.c
index 32771f28..b66f92f5 100644
--- a/cipher-ctr.c
+++ b/cipher-ctr.c
@@ -27,6 +27,8 @@
#include "xmalloc.h"
#include "log.h"
+#include "fips.h"
+
/* compatibility with old or broken OpenSSL versions */
#include "openbsd-compat/openssl-compat.h"
@@ -139,6 +141,8 @@ evp_aes_128_ctr(void)
#ifndef SSH_OLD_EVP
aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
+ if (fips_mode())
+ aes_ctr.flags |= EVP_CIPH_FLAG_FIPS;
#endif
return (&aes_ctr);
}
diff --git a/cipher.c b/cipher.c
index 13847e5b..18ccb4e1 100644
--- a/cipher.c
+++ b/cipher.c
@@ -51,6 +51,9 @@
#include "openbsd-compat/openssl-compat.h"
+#include "fips.h"
+#include "log.h"
+
#ifdef WITH_SSH1
extern const EVP_CIPHER *evp_ssh1_bf(void);
extern const EVP_CIPHER *evp_ssh1_3des(void);
@@ -77,7 +80,7 @@ struct sshcipher {
#endif
};
-static const struct sshcipher ciphers[] = {
+static const struct sshcipher ciphers_all[] = {
#ifdef WITH_SSH1
{ "des", SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
{ "3des", SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
@@ -119,8 +122,56 @@ static const struct sshcipher ciphers[] = {
{ NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
};
+static const struct sshcipher ciphers_fips140_2[] = {
+#ifdef WITH_SSH1
+ { "3des", SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
+#endif /* WITH_SSH1 */
+#ifdef WITH_OPENSSL
+ { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+ { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
+ { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
+ { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
+ { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
+ { "rijndael-cbc@lysator.liu.se",
+ SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
+ { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
+ { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },
+ { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },
+# ifdef OPENSSL_HAVE_EVPGCM
+ { "aes128-gcm@openssh.com",
+ SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
+ { "aes256-gcm@openssh.com",
+ SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
+# endif /* OPENSSL_HAVE_EVPGCM */
+#else /* WITH_OPENSSL */
+ { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, CFLAG_AESCTR, NULL },
+ { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, CFLAG_AESCTR, NULL },
+ { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, CFLAG_AESCTR, NULL },
+ { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, CFLAG_NONE, NULL },
+#endif /* WITH_OPENSSL */
+ { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
+};
+
/*--*/
+/* Returns array of ciphers available depending on selected FIPS mode */
+static const struct sshcipher *
+fips_select_ciphers(void)
+{
+ int fips = fips_mode();
+ switch (fips) {
+ case 0:
+ return ciphers_all;
+ case 1:
+ return ciphers_fips140_2;
+ default:
+ /* should not be reached */
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
+ fips, __FILE__, __LINE__);
+ return NULL;
+ }
+}
+
/* Returns a comma-separated list of supported ciphers. */
char *
cipher_alg_list(char sep, int auth_only)
@@ -129,7 +180,7 @@ cipher_alg_list(char sep, int auth_only)
size_t nlen, rlen = 0;
const struct sshcipher *c;
- for (c = ciphers; c->name != NULL; c++) {
+ for (c = fips_select_ciphers(); c->name != NULL; c++) {
if (c->number != SSH_CIPHER_SSH2)
continue;
if (auth_only && c->auth_len == 0)
@@ -213,7 +264,7 @@ const struct sshcipher *
cipher_by_name(const char *name)
{
const struct sshcipher *c;
- for (c = ciphers; c->name != NULL; c++)
+ for (c = fips_select_ciphers(); c->name != NULL; c++)
if (strcmp(c->name, name) == 0)
return c;
return NULL;
@@ -223,7 +274,7 @@ const struct sshcipher *
cipher_by_number(int id)
{
const struct sshcipher *c;
- for (c = ciphers; c->name != NULL; c++)
+ for (c = fips_select_ciphers(); c->name != NULL; c++)
if (c->number == id)
return c;
return NULL;
@@ -264,7 +315,7 @@ cipher_number(const char *name)
const struct sshcipher *c;
if (name == NULL)
return -1;
- for (c = ciphers; c->name != NULL; c++)
+ for (c = fips_select_ciphers(); c->name != NULL; c++)
if (strcasecmp(c->name, name) == 0)
return c->number;
return -1;
@@ -482,15 +533,16 @@ int
cipher_set_key_string(struct sshcipher_ctx *cc, const struct sshcipher *cipher,
const char *passphrase, int do_encrypt)
{
- u_char digest[16];
+ u_char digest[SSH_DIGEST_MAX_LENGTH];
+ int dgst = fips_correct_dgst(SSH_DIGEST_MD5);
int r = SSH_ERR_INTERNAL_ERROR;
- if ((r = ssh_digest_memory(SSH_DIGEST_MD5,
+ if ((r = ssh_digest_memory(dgst,
passphrase, strlen(passphrase),
digest, sizeof(digest))) != 0)
goto out;
- r = cipher_init(cc, cipher, digest, 16, NULL, 0, do_encrypt);
+ r = cipher_init(cc, cipher, digest, ssh_digest_bytes(dgst), NULL, 0, do_encrypt);
out:
explicit_bzero(digest, sizeof(digest));
return r;
diff --git a/dh.h b/dh.h
index c65f0c45..36419b5f 100644
--- a/dh.h
+++ b/dh.h
@@ -50,6 +50,7 @@ u_int dh_estimate(int);
*/
#define DH_GRP_MIN_RFC 1024
#define DH_GRP_MIN 2048
+#define DH_GRP_MIN_FIPS 2048
#define DH_GRP_MAX 8192
/*
diff --git a/fips.c b/fips.c
new file mode 100644
index 00000000..87be40dc
--- /dev/null
+++ b/fips.c
@@ -0,0 +1,237 @@
+/*
+ * Copyright (c) 2012 Petr Cerny. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+
+#include "fips.h"
+
+#include "cipher.h"
+#include "dh.h"
+#include "digest.h"
+#include "kex.h"
+#include "key.h"
+#include "mac.h"
+#include "log.h"
+#include "xmalloc.h"
+
+#include <string.h>
+#include <openssl/crypto.h>
+
+/* import from dh.c */
+extern int dh_grp_min;
+
+static int fips_state = -1;
+
+static int
+fips_check_required_env(void)
+{
+ int fips_required = 0;
+ char *env = getenv(SSH_FORCE_FIPS_ENV);
+
+ if (env) {
+ errno = 0;
+ fips_required = strtol(env, NULL, 10);
+ if (errno) {
+ debug("bogus value in the %s environment variable, ignoring\n"
+ , SSH_FORCE_FIPS_ENV);
+ fips_required = 0;
+ } else
+ fips_required = 1;
+ }
+ return fips_required;
+}
+
+int
+fips_mode(void)
+{
+ if (-1 == fips_state) {
+ fips_state = FIPS_mode();
+ if (fips_state)
+ debug("FIPS mode initialized");
+ else {
+ if (fips_check_required_env()) {
+ debug("FIPS mode requested through the environment variable '%s'"
+ , SSH_FORCE_FIPS_ENV);
+ if (!FIPS_mode_set(1))
+ fatal("Unable to enter FIPS mode as requested through the environment variable '%s'"
+ , SSH_FORCE_FIPS_ENV);
+ fips_state = 1;
+ }
+ }
+ }
+ return fips_state;
+}
+
+int
+fips_correct_dgst(int digest)
+{
+ int fips;
+ int rv = -1;
+
+ fips = fips_mode();
+ switch (fips) {
+ case 0:
+ rv = digest;
+ break;
+ case 1:
+ switch (digest) {
+ case SSH_DIGEST_MD5:
+ case SSH_DIGEST_RIPEMD160:
+ debug("MD5/RIPEMD160 digests not allowed in FIPS 140-2 mode"
+ "using SHA-256 instead.");
+ rv = SSH_DIGEST_SHA256;
+ break;
+ default:
+ rv = digest;
+ break;
+ }
+ break;
+ default:
+ /* should not be reached */
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
+ fips, __FILE__, __LINE__);
+ }
+
+ return rv;
+}
+
+/*
+ * filter out FIPS disallowed algorithms
+ * *crypto MUST be free()-able - it is assigned newly allocated memory and
+ * the previous one is freed
+ *
+ * returns zero if all algorithms were rejected, non-zero otherwise
+ */
+int
+fips_filter_crypto(char **crypto, fips_filters filter)
+{
+ char *token, *tmp, *tmp_sav, *new;
+ int plus = 0;
+ int valid;
+ int comma = 0;
+ int empty = 1;
+ size_t len;
+
+ tmp = tmp_sav = xstrdup(*crypto);
+
+ len = strlen(tmp) + 1;
+ new = xcalloc(1, len);
+
+ if ('+' == *tmp) {
+ plus = 1;
+ tmp++;
+ }
+
+ while ((token = strsep(&tmp, ",")) != NULL) {
+ switch(filter) {
+ case FIPS_FILTER_CIPHERS:
+ valid = ciphers_valid(token);
+ if (!valid)
+ debug("Cipher '%s' is not allowed in FIPS mode",
+ token);
+ break;
+ case FIPS_FILTER_MACS:
+ valid = mac_valid(token);
+ if (!valid)
+ debug("MAC '%s' is not allowed in FIPS mode",
+ token);
+ break;
+ case FIPS_FILTER_KEX_ALGS:
+ valid = kex_names_valid(token);
+ if (!valid)
+ debug("KEX '%s' is not allowed in FIPS mode",
+ token);
+ break;
+ default:
+ /* should not be reached */
+ fatal("Fatal error: incorrect FIPS filter '%i' requested at %s:%u",
+ filter, __FILE__, __LINE__);
+ }
+
+ if (valid) {
+ empty = 0;
+ if (plus) {
+ strlcat(new, "+", len);
+ plus = 0;
+ }
+ if (comma)
+ strlcat(new, ",", len);
+ else
+ comma = 1;
+ strlcat(new, token, len);
+ }
+ }
+
+ /* free tmp and re-allocate shorter buffer for result if necessary */
+ free(tmp_sav);
+ free(*crypto);
+ *crypto = new;
+
+ return (!empty);
+}
+
+int
+fips_dgst_min(void)
+{
+ int fips;
+ int dgst;
+
+ fips = fips_mode();
+ switch (fips) {
+ case 0:
+ dgst = SSH_DIGEST_MD5;
+ break;
+ case 1:
+ dgst = SSH_DIGEST_SHA1;
+ break;
+ default:
+ /* should not be reached */
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
+ fips, __FILE__, __LINE__);
+ }
+ return dgst;
+}
+
+int
+fips_dh_grp_min(void)
+{
+ int fips;
+ int dh;
+
+ fips = fips_mode();
+ switch (fips) {
+ case 0:
+ dh = dh_grp_min;
+ break;
+ case 1:
+ dh = DH_GRP_MIN_FIPS;
+ break;
+ default:
+ /* should not be reached */
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
+ fips, __FILE__, __LINE__);
+ }
+ return dh;
+}
+
diff --git a/fips.h b/fips.h
new file mode 100644
index 00000000..dd3627a7
--- /dev/null
+++ b/fips.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2012 Petr Cerny. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef FIPS_H
+#define FIPS_H
+
+#include "key.h"
+
+#define SSH_FORCE_FIPS_ENV "SSH_FORCE_FIPS"
+
+typedef enum {
+ FIPS_FILTER_CIPHERS,
+ FIPS_FILTER_MACS,
+ FIPS_FILTER_KEX_ALGS
+} fips_filters;
+
+int fips_mode(void);
+int fips_correct_dgst(int);
+int fips_dgst_min(void);
+int fips_dh_grp_min(void);
+enum fp_type fips_correct_fp_type(enum fp_type);
+int fips_filter_crypto(char **, fips_filters);
+
+#endif
+
diff --git a/hmac.c b/hmac.c
index 1c879640..b48acbd0 100644
--- a/hmac.c
+++ b/hmac.c
@@ -144,7 +144,7 @@ hmac_test(void *key, size_t klen, void *m, size_t mlen, u_char *e, size_t elen)
size_t i;
u_char digest[16];
- if ((ctx = ssh_hmac_start(SSH_DIGEST_MD5)) == NULL)
+ if ((ctx = ssh_hmac_start(fips_correct_dgst(SSH_DIGEST_MD5))) == NULL)
printf("ssh_hmac_start failed");
if (ssh_hmac_init(ctx, key, klen) < 0 ||
ssh_hmac_update(ctx, m, mlen) < 0 ||
diff --git a/kex.c b/kex.c
index d371f47c..1fadba48 100644
--- a/kex.c
+++ b/kex.c
@@ -54,6 +54,8 @@
#include "sshbuf.h"
#include "digest.h"
+#include "fips.h"
+
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
# if defined(HAVE_EVP_SHA256)
# define evp_ssh_sha256 EVP_sha256
@@ -85,7 +87,7 @@ struct kexalg {
int ec_nid;
int hash_alg;
};
-static const struct kexalg kexalgs[] = {
+static const struct kexalg kexalgs_all[] = {
#ifdef WITH_OPENSSL
{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
{ KEX_DH14, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
@@ -110,6 +112,44 @@ static const struct kexalg kexalgs[] = {
{ NULL, -1, -1, -1},
};
+static const struct kexalg kexalgs_fips140_2[] = {
+#ifdef WITH_OPENSSL
+ { KEX_DH14, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
+ { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
+#ifdef HAVE_EVP_SHA256
+ { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
+#endif /* HAVE_EVP_SHA256 */
+#ifdef OPENSSL_HAS_ECC
+ { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,
+ NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
+ { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1,
+ SSH_DIGEST_SHA384 },
+# ifdef OPENSSL_HAS_NISTP521
+ { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
+ SSH_DIGEST_SHA512 },
+# endif /* OPENSSL_HAS_NISTP521 */
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ { NULL, -1, -1, -1},
+};
+
+/* Returns array of macs available depending on selected FIPS mode */
+static const struct kexalg *
+fips_select_kexalgs(void)
+{
+ int fips = fips_mode();
+ switch (fips) {
+ case 0:
+ return kexalgs_all;
+ case 1:
+ return kexalgs_fips140_2;
+ default:
+ /* should not be reached */
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
+ fips, __FILE__, __LINE__);
+ }
+}
+
char *
kex_alg_list(char sep)
{
@@ -117,7 +157,7 @@ kex_alg_list(char sep)
size_t nlen, rlen = 0;
const struct kexalg *k;
- for (k = kexalgs; k->name != NULL; k++) {
+ for (k = fips_select_kexalgs(); k->name != NULL; k++) {
if (ret != NULL)
ret[rlen++] = sep;
nlen = strlen(k->name);
@@ -137,7 +177,7 @@ kex_alg_by_name(const char *name)
{
const struct kexalg *k;
- for (k = kexalgs; k->name != NULL; k++) {
+ for (k = fips_select_kexalgs(); k->name != NULL; k++) {
if (strcmp(k->name, name) == 0)
return k;
}
@@ -972,6 +1012,7 @@ derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
struct ssh_digest_ctx *hashctx = NULL;
size_t hlen, slen;
int r;
+ int digest;
hlen = BN_num_bytes(host_modulus);
slen = BN_num_bytes(server_modulus);
@@ -983,7 +1024,8 @@ derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
r = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
}
- if ((hashctx = ssh_digest_start(SSH_DIGEST_MD5)) == NULL) {
+ digest = fips_correct_dgst(SSH_DIGEST_MD5);
+ if ((hashctx = ssh_digest_start(digest)) == NULL) {
r = SSH_ERR_ALLOC_FAIL;
goto out;
}
@@ -994,7 +1036,7 @@ derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
r = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
}
- memcpy(id, obuf, ssh_digest_bytes(SSH_DIGEST_MD5));
+ memcpy(id, obuf, ssh_digest_bytes(digest));
r = 0;
out:
ssh_digest_free(hashctx);
diff --git a/kexgexc.c b/kexgexc.c
index c35215b8..de3d6dd5 100644
--- a/kexgexc.c
+++ b/kexgexc.c
@@ -51,8 +51,7 @@
#include "ssherr.h"
#include "sshbuf.h"
-/* import from dh.c */
-extern int dh_grp_min;
+#include "fips.h"
static int input_kex_dh_gex_group(int, u_int32_t, void *);
static int input_kex_dh_gex_reply(int, u_int32_t, void *);
@@ -66,7 +65,7 @@ kexgex_client(struct ssh *ssh)
nbits = dh_estimate(kex->dh_need * 8);
- kex->min = dh_grp_min;
+ kex->min = fips_dh_grp_min();
kex->max = DH_GRP_MAX;
kex->nbits = nbits;
if (datafellows & SSH_BUG_DHGEX_LARGE)
diff --git a/kexgexs.c b/kexgexs.c
index 4bfcd74a..f40bb3b2 100644
--- a/kexgexs.c
+++ b/kexgexs.c
@@ -54,8 +54,7 @@
#include "ssherr.h"
#include "sshbuf.h"
-/* import from dh.c */
-extern int dh_grp_min;
+#include "fips.h"
static int input_kex_dh_gex_request(int, u_int32_t, void *);
static int input_kex_dh_gex_init(int, u_int32_t, void *);
@@ -86,9 +85,9 @@ input_kex_dh_gex_request(int type, u_int32_t seq, void *ctxt)
kex->nbits = nbits;
kex->min = min;
kex->max = max;
- min = MAX(dh_grp_min, min);
+ min = MAX(fips_dh_grp_min(), min);
max = MIN(DH_GRP_MAX, max);
- nbits = MAX(dh_grp_min, nbits);
+ nbits = MAX(fips_dh_grp_min(), nbits);
nbits = MIN(DH_GRP_MAX, nbits);
if (kex->max < kex->min || kex->nbits < kex->min ||
diff --git a/mac.c b/mac.c
index f63fbff0..a39274f5 100644
--- a/mac.c
+++ b/mac.c
@@ -40,6 +40,9 @@
#include "openbsd-compat/openssl-compat.h"
+#include "fips.h"
+#include "log.h"
+
#define SSH_DIGEST 1 /* SSH_DIGEST_XXX */
#define SSH_UMAC 2 /* UMAC (not integrated with OpenSSL) */
#define SSH_UMAC128 3
@@ -54,7 +57,7 @@ struct macalg {
int etm; /* Encrypt-then-MAC */
};
-static const struct macalg macs[] = {
+static const struct macalg macs_all[] = {
/* Encrypt-and-MAC (encrypt-and-authenticate) variants */
{ "hmac-sha1", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },
{ "hmac-sha1-96", SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 0 },
@@ -85,6 +88,41 @@ static const struct macalg macs[] = {
{ NULL, 0, 0, 0, 0, 0, 0 }
};
+static const struct macalg macs_fips140_2[] = {
+ /* Encrypt-and-MAC (encrypt-and-authenticate) variants */
+ { "hmac-sha1", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },
+#ifdef HAVE_EVP_SHA256
+ { "hmac-sha2-256", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 0 },
+ { "hmac-sha2-512", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 0 },
+#endif
+
+ /* Encrypt-then-MAC variants */
+ { "hmac-sha1-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 1 },
+#ifdef HAVE_EVP_SHA256
+ { "hmac-sha2-256-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 1 },
+ { "hmac-sha2-512-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 1 },
+#endif
+
+ { NULL, 0, 0, 0, 0, 0, 0 }
+};
+
+/* Returns array of macs available depending on selected FIPS mode */
+static const struct macalg *
+fips_select_macs(void)
+{
+ int fips = fips_mode();
+ switch (fips) {
+ case 0:
+ return macs_all;
+ case 1:
+ return macs_fips140_2;
+ default:
+ /* should not be reached */
+ fatal("Fatal error: incorrect FIPS mode '%i' at %s:%u",
+ fips, __FILE__, __LINE__);
+ }
+}
+
/* Returns a list of supported MACs separated by the specified char. */
char *
mac_alg_list(char sep)
@@ -93,7 +131,7 @@ mac_alg_list(char sep)
size_t nlen, rlen = 0;
const struct macalg *m;
- for (m = macs; m->name != NULL; m++) {
+ for (m = fips_select_macs(); m->name != NULL; m++) {
if (ret != NULL)
ret[rlen++] = sep;
nlen = strlen(m->name);
@@ -132,7 +170,7 @@ mac_setup(struct sshmac *mac, char *name)
{
const struct macalg *m;
- for (m = macs; m->name != NULL; m++) {
+ for (m = fips_select_macs(); m->name != NULL; m++) {
if (strcmp(name, m->name) != 0)
continue;
if (mac != NULL)
diff --git a/myproposal.h b/myproposal.h
index 7b158971..26bd9af6 100644
--- a/myproposal.h
+++ b/myproposal.h
@@ -133,6 +133,8 @@
#else /* WITH_OPENSSL */
+#error "OpenSSL support is needed for FIPS mode to compile"
+
#define KEX_SERVER_KEX \
"curve25519-sha256@libssh.org"
#define KEX_DEFAULT_PK_ALG \
diff --git a/readconf.c b/readconf.c
index 3f6d28b0..61eabf5f 100644
--- a/readconf.c
+++ b/readconf.c
@@ -62,6 +62,7 @@
#include "myproposal.h"
#include "digest.h"
#include "dh.h"
+#include "fips.h"
/* Format of the configuration file:
@@ -1633,6 +1634,23 @@ option_clear_or_none(const char *o)
return o == NULL || strcasecmp(o, "none") == 0;
}
+/* remove algorithms not approved for use in FIPS mode, when running in FIPS
+ * mode
+ */
+void
+filter_fips_algorithms(Options *o)
+{
+ if (fips_mode()) {
+ if (!fips_filter_crypto(&o->ciphers, FIPS_FILTER_CIPHERS))
+ fatal("None of selected ciphers can be used in FIPS mode");
+ if (!fips_filter_crypto(&o->macs, FIPS_FILTER_MACS))
+ fatal("None of selected MAC algorithms can be used in FIPS mode");
+ if (!fips_filter_crypto(&o->kex_algorithms, FIPS_FILTER_KEX_ALGS))
+ fatal("None of selected KEX algorithms can be used in FIPS mode");
+ }
+ return;
+}
+
/*
* Initializes options to special values that indicate that they have not yet
* been set. Read_config_file will only set options with this value. Options
@@ -1822,9 +1840,10 @@ fill_default_options(Options * options)
if (options->cipher == -1)
options->cipher = SSH_CIPHER_NOT_SET;
if (options->kex_dhmin == -1)
- options->kex_dhmin = DH_GRP_MIN_RFC;
+ options->kex_dhmin = fips_dh_grp_min();
else {
- options->kex_dhmin = MAX(options->kex_dhmin, DH_GRP_MIN_RFC);
+ options->kex_dhmin = MAX(options->kex_dhmin,
+ fips_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN_RFC);
options->kex_dhmin = MIN(options->kex_dhmin, DH_GRP_MAX);
}
dh_grp_min = options->kex_dhmin;
@@ -1919,6 +1938,8 @@ fill_default_options(Options * options)
options->canonicalize_hostname = SSH_CANONICALISE_NO;
if (options->fingerprint_hash == -1)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
+ options->fingerprint_hash =
+ fips_correct_dgst(options->fingerprint_hash);
if (options->update_hostkeys == -1)
options->update_hostkeys = 0;
if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
@@ -1929,6 +1950,7 @@ fill_default_options(Options * options)
kex_assemble_names(KEX_DEFAULT_PK_ALG,
&options->pubkey_key_types) != 0)
fatal("%s: kex_assemble_names failed", __func__);
+ filter_fips_algorithms(options);
#define CLEAR_ON_NONE(v) \
do { \
diff --git a/readconf.h b/readconf.h
index 68de7768..ebe197b3 100644
--- a/readconf.h
+++ b/readconf.h
@@ -185,6 +185,7 @@ typedef struct {
#define SSH_UPDATE_HOSTKEYS_YES 1
#define SSH_UPDATE_HOSTKEYS_ASK 2
+void filter_fips_algorithms(Options *o);
void initialize_options(Options *);
void fill_default_options(Options *);
void fill_default_options_for_canonicalization(Options *);
diff --git a/servconf.c b/servconf.c
index c88918f4..d704b694 100644
--- a/servconf.c
+++ b/servconf.c
@@ -58,6 +58,7 @@
#include "myproposal.h"
#include "digest.h"
#include "dh.h"
+#include "fips.h"
/* import from dh.c */
extern int dh_grp_min;
@@ -184,6 +185,23 @@ option_clear_or_none(const char *o)
return o == NULL || strcasecmp(o, "none") == 0;
}
+/* remove algorithms not approved for use in FIPS mode, when running in FIPS
+ * mode
+ */
+static void
+filter_fips_algorithms_s(ServerOptions *o)
+{
+ if (fips_mode()) {
+ if (!fips_filter_crypto(&o->ciphers, FIPS_FILTER_CIPHERS))
+ fatal("None of selected ciphers can be used in FIPS mode");
+ if (!fips_filter_crypto(&o->macs, FIPS_FILTER_MACS))
+ fatal("None of selected MAC algorithms can be used in FIPS mode");
+ if (!fips_filter_crypto(&o->kex_algorithms, FIPS_FILTER_KEX_ALGS))
+ fatal("None of selected KEX algorithms can be used in FIPS mode");
+ }
+ return;
+}
+
static void
assemble_algorithms(ServerOptions *o)
{
@@ -196,6 +214,8 @@ assemble_algorithms(ServerOptions *o)
&o->hostbased_key_types) != 0 ||
kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->pubkey_key_types) != 0)
fatal("kex_assemble_names failed");
+
+ filter_fips_algorithms_s(o);
}
void
@@ -210,9 +230,10 @@ fill_default_server_options(ServerOptions *options)
options->use_pam_check_locks = 0;
if (options->kex_dhmin == -1)
- options->kex_dhmin = DH_GRP_MIN_RFC;
+ options->kex_dhmin = fips_dh_grp_min();
else {
- options->kex_dhmin = MAX(options->kex_dhmin, DH_GRP_MIN_RFC);
+ options->kex_dhmin = MAX(options->kex_dhmin,
+ fips_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN_RFC);
options->kex_dhmin = MIN(options->kex_dhmin, DH_GRP_MAX);
}
dh_grp_min = options->kex_dhmin;
@@ -368,6 +389,8 @@ fill_default_server_options(ServerOptions *options)
options->fwd_opts.streamlocal_bind_unlink = 0;
if (options->fingerprint_hash == -1)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
+ options->fingerprint_hash =
+ fips_correct_dgst(options->fingerprint_hash);
assemble_algorithms(options);
@@ -985,7 +1008,7 @@ process_server_config_line(ServerOptions *options, char *line,
const char *filename, int linenum, int *activep,
struct connection_info *connectinfo)
{
- char *cp, **charptr, *arg, *p;
+ char *cp, **charptr, *arg, *p, *tmp;
int cmdline = 0, *intptr, value, value2, n, port;
SyslogFacility *log_facility_ptr;
LogLevel *log_level_ptr;
@@ -1470,22 +1493,40 @@ process_server_config_line(ServerOptions *options, char *line,
arg = strdelim(&cp);
if (!arg || *arg == '\0')
fatal("%s line %d: Missing argument.", filename, linenum);
- if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
+ tmp = xstrdup(arg);
+ if (fips_mode()) {
+ if(!fips_filter_crypto(&tmp, FIPS_FILTER_CIPHERS))
+ error("All ciphers were rejected "
+ "by the FIPS filter: '%s'.", arg);
+ }
+ if (!ciphers_valid(*tmp == '+' ? tmp + 1 : tmp))
fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (options->ciphers == NULL)
- options->ciphers = xstrdup(arg);
+ options->ciphers = tmp;
+ else
+ free(tmp);
break;
case sMacs:
arg = strdelim(&cp);
if (!arg || *arg == '\0')
fatal("%s line %d: Missing argument.", filename, linenum);
- if (!mac_valid(*arg == '+' ? arg + 1 : arg))
+ tmp = xstrdup(arg);
+ if (fips_mode()) {
+ if(!fips_filter_crypto(&tmp, FIPS_FILTER_MACS))
+ error("All ciphers were rejected "
+ "by the FIPS filter: '%s'.", arg);
+ }
+ if (!mac_valid(*tmp == '+' ? tmp + 1 : tmp))
+ /* print the original line including any algorithms
+ * dropped by the FIPS filter */
fatal("%s line %d: Bad SSH2 mac spec '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (options->macs == NULL)
- options->macs = xstrdup(arg);
+ options->macs = tmp;
+ else
+ free(tmp);
break;
case sKexAlgorithms:
@@ -1493,11 +1534,21 @@ process_server_config_line(ServerOptions *options, char *line,
if (!arg || *arg == '\0')
fatal("%s line %d: Missing argument.",
filename, linenum);
- if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
+ tmp = xstrdup(arg);
+ if (fips_mode()) {
+ if(!fips_filter_crypto(&tmp, FIPS_FILTER_KEX_ALGS))
+ error("All ciphers were rejected "
+ "by the FIPS filter: '%s'.", arg);
+ }
+ if (!kex_names_valid(*tmp == '+' ? tmp + 1 : tmp))
+ /* print the original line including any algorithms
+ * dropped by the FIPS filter */
fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
filename, linenum, arg ? arg : "<NONE>");
if (options->kex_algorithms == NULL)
- options->kex_algorithms = xstrdup(arg);
+ options->kex_algorithms = tmp;
+ else
+ free(tmp);
break;
case sKexDHMin:
diff --git a/ssh-keygen.c b/ssh-keygen.c
index 47852012..fc252d74 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -58,6 +58,8 @@
#include "krl.h"
#include "digest.h"
+#include "fips.h"
+
#ifdef WITH_OPENSSL
# define DEFAULT_KEY_TYPE_NAME "rsa"
#else
@@ -970,11 +972,13 @@ do_fingerprint(struct passwd *pw)
static void
do_gen_all_hostkeys(struct passwd *pw)
{
- struct {
+ struct Key_types {
char *key_type;
char *key_type_display;
char *path;
- } key_types[] = {
+ };
+
+ struct Key_types key_types_all[] = {
#ifdef WITH_OPENSSL
#ifdef WITH_SSH1
{ "rsa1", "RSA1", _PATH_HOST_KEY_FILE },
@@ -989,6 +993,17 @@ do_gen_all_hostkeys(struct passwd *pw)
{ NULL, NULL, NULL }
};
+ struct Key_types key_types_fips140_2[] = {
+#ifdef WITH_OPENSSL
+ { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
+#ifdef OPENSSL_HAS_ECC
+ { "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE },
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
+ { NULL, NULL, NULL }
+ };
+
+ struct Key_types *key_types;
int first = 0;
struct stat st;
struct sshkey *private, *public;
@@ -996,6 +1011,12 @@ do_gen_all_hostkeys(struct passwd *pw)
int i, type, fd, r;
FILE *f;
+ if (fips_mode()) {
+ key_types = key_types_fips140_2;
+ } else {
+ key_types = key_types_all;
+ }
+
for (i = 0; key_types[i].key_type; i++) {
if (stat(key_types[i].path, &st) == 0)
continue;
@@ -2615,6 +2636,13 @@ main(int argc, char **argv)
key_type_name = DEFAULT_KEY_TYPE_NAME;
type = sshkey_type_from_name(key_type_name);
+
+ /* protocol v1 is not allowed in FIPS mode, DSA is not acceptable because
+ * it has to be 1024 bit due to RFC 4253 using SHA-1 which implies 1024 bit
+ * keys due to FIPS-186 specification for DSS */
+ if (fips_mode() && (type == KEY_RSA1 || type == KEY_DSA))
+ fatal("Key type %s not alowed in FIPS mode", key_type_name);
+
type_bits_valid(type, key_type_name, &bits);
if (!quiet)
diff --git a/ssh.c b/ssh.c
index f9ff91f0..a113084d 100644
--- a/ssh.c
+++ b/ssh.c
@@ -109,6 +109,8 @@
#include "ssherr.h"
#include "myproposal.h"
+#include "fips.h"
+
#ifdef ENABLE_PKCS11
#include "ssh-pkcs11.h"
#endif
@@ -609,6 +611,8 @@ main(int ac, char **av)
"ACD:E:F:GI:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) {
switch (opt) {
case '1':
+ if (fips_mode())
+ fatal("Protocol 1 not allowed in the FIPS mode.");
options.protocol = SSH_PROTO_1;
break;
case '2':
@@ -1078,6 +1082,12 @@ main(int ac, char **av)
/* Fill configuration defaults. */
fill_default_options(&options);
+ if (fips_mode()) {
+ options.protocol &= SSH_PROTO_2;
+ if (options.protocol == 0)
+ fatal("Protocol 2 disabled by configuration but required in the FIPS mode");
+ }
+
if (options.port == 0)
options.port = default_ssh_port();
channel_set_af(options.address_family);
diff --git a/ssh_config.0 b/ssh_config.0
index f502c52a..3c0ffe78 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -381,6 +381,8 @@ DESCRIPTION
fingerprints. Valid options are: M-bM-^@M-^\md5M-bM-^@M-^] and M-bM-^@M-^\sha256M-bM-^@M-^]. The
default is M-bM-^@M-^\sha256M-bM-^@M-^].
+ In the FIPS mode the minimum of SHA-1 is enforced.
+
ForwardAgent
Specifies whether the connection to the authentication agent (if
any) will be forwarded to the remote machine. The argument must
@@ -628,6 +630,9 @@ DESCRIPTION
resort and all efforts should be made to fix the (broken)
counterparty.
+ In the FIPS mode the FIPS standard takes precedence over RFC and
+ forces the minimum to a higher value, currently 2048 bits.
+
LocalCommand
Specifies a command to execute on the local machine after
successfully connecting to the server. The command string
diff --git a/ssh_config.5 b/ssh_config.5
index ac3c4088..02399493 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -732,6 +732,8 @@ and
.Dq sha256 .
The default is
.Dq sha256 .
+.Pp
+In the FIPS mode the minimum of SHA-1 is enforced.
.It Cm ForwardAgent
Specifies whether the connection to the authentication agent (if any)
will be forwarded to the remote machine.
@@ -1113,6 +1115,9 @@ maximum backward compatibility, using it can severly impact
security and thus should be viewed as a temporary fix of last
resort and all efforts should be made to fix the (broken)
counterparty.
+.Pp
+In the FIPS mode the FIPS standard takes precedence over RFC and
+forces the minimum to a higher value, currently 2048 bits.
.It Cm LocalCommand
Specifies a command to execute on the local machine after successfully
connecting to the server.
diff --git a/sshd.c b/sshd.c
index 430569c4..907a1b8a 100644
--- a/sshd.c
+++ b/sshd.c
@@ -125,6 +125,8 @@
#include "version.h"
#include "ssherr.h"
+#include "fips.h"
+
#ifndef O_NOCTTY
#define O_NOCTTY 0
#endif
@@ -1829,6 +1831,10 @@ main(int ac, char **av)
sshkey_type(pubkey) : sshkey_ssh_name(pubkey), fp);
free(fp);
}
+ if ((options.protocol & SSH_PROTO_1) && fips_mode()) {
+ logit("Disabling protocol version 1. Not allowed in the FIPS mode.");
+ options.protocol &= ~SSH_PROTO_1;
+ }
if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
logit("Disabling protocol version 1. Could not load host key");
options.protocol &= ~SSH_PROTO_1;
diff --git a/sshd_config.0 b/sshd_config.0
index d77b993d..120a5cf3 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -349,6 +349,8 @@ DESCRIPTION
Specifies the hash algorithm used when logging key fingerprints.
Valid options are: M-bM-^@M-^\md5M-bM-^@M-^] and M-bM-^@M-^\sha256M-bM-^@M-^]. The default is M-bM-^@M-^\sha256M-bM-^@M-^].
+ In the FIPS mode the minimum of SHA-1 is enforced.
+
ForceCommand
Forces the execution of the command specified by ForceCommand,
ignoring any command supplied by the client and ~/.ssh/rc if
@@ -561,6 +563,9 @@ DESCRIPTION
resort and all efforts should be made to fix the (broken)
counterparty.
+ In the FIPS mode the FIPS standard takes precedence over RFC and
+ forces the minimum to a higher value, currently 2048 bits.
+
KeyRegenerationInterval
In protocol version 1, the ephemeral server key is automatically
regenerated after this many seconds (if it has been used). The
diff --git a/sshd_config.5 b/sshd_config.5
index bb9c0a5b..0dd23d4f 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -577,6 +577,8 @@ and
.Dq sha256 .
The default is
.Dq sha256 .
+.Pp
+In the FIPS mode the minimum of SHA-1 is enforced.
.It Cm ForceCommand
Forces the execution of the command specified by
.Cm ForceCommand ,
@@ -916,6 +918,9 @@ maximum backward compatibility, using it can severly impact
security and thus should be viewed as a temporary fix of last
resort and all efforts should be made to fix the (broken)
counterparty.
+.Pp
+In the FIPS mode the FIPS standard takes precedence over RFC and
+forces the minimum to a higher value, currently 2048 bits.
.It Cm KeyRegenerationInterval
In protocol version 1, the ephemeral server key is automatically regenerated
after this many seconds (if it has been used).
--
2.38.0
