From jdc@koitsu.dyndns.org  Tue Dec  6 18:05:45 2011
Return-Path: <jdc@koitsu.dyndns.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E862B1065678
	for <freebsd-gnats-submit@freebsd.org>; Tue,  6 Dec 2011 18:05:44 +0000 (UTC)
	(envelope-from jdc@koitsu.dyndns.org)
Received: from qmta04.westchester.pa.mail.comcast.net (qmta04.westchester.pa.mail.comcast.net [76.96.62.40])
	by mx1.freebsd.org (Postfix) with ESMTP id 8D1ED8FC08
	for <freebsd-gnats-submit@freebsd.org>; Tue,  6 Dec 2011 18:05:43 +0000 (UTC)
Received: from omta23.westchester.pa.mail.comcast.net ([76.96.62.74])
	by qmta04.westchester.pa.mail.comcast.net with comcast
	id 5sJd1i00S1c6gX854tsU0x; Tue, 06 Dec 2011 17:52:28 +0000
Received: from koitsu.dyndns.org ([67.180.84.87])
	by omta23.westchester.pa.mail.comcast.net with comcast
	id 5tsT1i00w1t3BNj3jtsTAK; Tue, 06 Dec 2011 17:52:28 +0000
Received: by icarus.home.lan (Postfix, from userid 1000)
	id 13E7D102C1D; Tue,  6 Dec 2011 09:52:26 -0800 (PST)
Message-Id: <20111206175226.13E7D102C1D@icarus.home.lan>
Date: Tue,  6 Dec 2011 09:52:26 -0800 (PST)
From: Jeremy Chadwick <freebsd@jdc.parodius.com>
Reply-To: Jeremy Chadwick <freebsd@jdc.parodius.com>
To: FreeBSD-gnats-submit@freebsd.org
Cc: bz@freebsd.org, brooks@freebsd.org
Subject: Add WITH_OPENSSH_NONE_CIPHER src.conf(5) knob
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         163095
>Category:       bin
>Synopsis:       Add WITH_OPENSSH_NONE_CIPHER src.conf(5) knob
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    gnn
>State:          patched
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Tue Dec 06 18:10:07 UTC 2011
>Closed-Date:    
>Last-Modified:  Sun May 18 04:59:38 UTC 2014
>Originator:     Jeremy Chadwick
>Release:        FreeBSD 8.2-STABLE amd64
>Organization:
>Environment:
System: FreeBSD icarus.home.lan 8.2-STABLE FreeBSD 8.2-STABLE #0: Thu Dec 1 04:37:29 PST 2011 root@icarus.home.lan:/usr/obj/usr/src/sys/X7SBA_RELENG_8_amd64 amd64
>Description:
	The recently-committed addition of the HPN patches to the base
	system OpenSSH introduced the ability to make use of the "None"
	cipher:

http://www.freebsd.org/cgi/cvsweb.cgi/src/crypto/openssh/README.hpn

	However, enabling use of it requires a somewhat "hackish"
	addition to /etc/make.conf like the following:

.if ${.CURDIR:M/usr/src/secure/*}
CFLAGS+=-DNONE_CIPHER_ENABLED
.endif

	The below patch adds the ability to enable this cipher by simply
	adding WITH_OPENSSH_NONE_CIPHER to one's /etc/src.conf.

	The below patch was tested on RELENG_8 (with buildworld); may
	require minor adjustments for application to the 9.x source.

	Patch and situation itself was initially discussed with bz@ and
	brooks@ privately.  Desire for this is also justified via the
	user community:

http://lists.freebsd.org/pipermail/freebsd-stable/2011-December/064727.html

>How-To-Repeat:
	n/a
>Fix:
	Apply the below patch.  Patch will also be available for download
	at the below URL, once I get a PR number.

http://jdc.parodius.com/freebsd/{prnum}/

	Committer should be aware that the src.conf.5 man page will need
	to be rebuilt prior to commit.  I believe
	src/tools/build/options/makeman is for this purpose.


diff -ruN /origsrc/secure/lib/libssh/Makefile src/secure/lib/libssh/Makefile
--- /origsrc/secure/lib/libssh/Makefile	2010-04-20 23:33:10.000000000 -0700
+++ src/secure/lib/libssh/Makefile	2011-12-06 09:38:15.976388562 -0800
@@ -39,6 +39,10 @@
 LDADD+=	-lgssapi -lkrb5 -lhx509 -lasn1 -lcom_err -lmd -lroken
 .endif
 
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
 NO_LINT=
 
 DPADD+=	${LIBCRYPTO} ${LIBCRYPT}
diff -ruN /origsrc/secure/usr.bin/ssh/Makefile src/secure/usr.bin/ssh/Makefile
--- /origsrc/secure/usr.bin/ssh/Makefile	2010-04-20 23:33:10.000000000 -0700
+++ src/secure/usr.bin/ssh/Makefile	2011-12-06 09:38:24.173485693 -0800
@@ -25,6 +25,10 @@
 LDADD+=	 -lgssapi
 .endif
 
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
 .if defined(X11BASE) || defined(LOCALBASE)
 # Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org
 # 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/
diff -ruN /origsrc/secure/usr.sbin/sshd/Makefile src/secure/usr.sbin/sshd/Makefile
--- /origsrc/secure/usr.sbin/sshd/Makefile	2010-04-20 23:33:10.000000000 -0700
+++ src/secure/usr.sbin/sshd/Makefile	2011-12-06 09:37:56.833786139 -0800
@@ -38,6 +38,10 @@
 LDADD+=	 -lgssapi_krb5 -lgssapi -lkrb5 -lasn1
 .endif
 
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
 .if defined(X11BASE)
 # Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org
 # 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/
diff -ruN /origsrc/share/mk/bsd.own.mk src/share/mk/bsd.own.mk
--- /origsrc/share/mk/bsd.own.mk	2010-05-25 13:16:36.000000000 -0700
+++ src/share/mk/bsd.own.mk	2011-12-06 09:38:46.729274164 -0800
@@ -408,7 +408,8 @@
     BIND_SIGCHASE \
     BIND_XML \
     HESIOD \
-    IDEA
+    IDEA \
+    OPENSSH_NONE_CIPHER
 .if defined(WITH_${var}) && defined(WITHOUT_${var})
 .error WITH_${var} and WITHOUT_${var} can't both be set.
 .endif
diff -ruN /origsrc/tools/build/options/WITH_OPENSSH_NONE_CIPHER src/tools/build/options/WITH_OPENSSH_NONE_CIPHER
--- /origsrc/tools/build/options/WITH_OPENSSH_NONE_CIPHER	1969-12-31 16:00:00.000000000 -0800
+++ src/tools/build/options/WITH_OPENSSH_NONE_CIPHER	2011-12-06 09:39:30.929282637 -0800
@@ -0,0 +1,8 @@
+.\" $FreeBSD: $
+Set to include the "None" cipher into OpenSSH and its libraries.
+Additional adjustments may need to be done to system configuration
+files, such as
+.Xr sshd_config 5 ,
+to enable this cipher. Please see
+.Pa /usr/src/crypto/openssh/README.hpn
+for full details.
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->brooks 
Responsible-Changed-By: brooks 
Responsible-Changed-When: Tue Dec 6 19:21:33 UTC 2011 
Responsible-Changed-Why:  
Grab this one since I committed the work it improves. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=163095 

From: Jeremy Chadwick <freebsd@jdc.parodius.com>
To: FreeBSD-gnats-submit@FreeBSD.org, freebsd-bugs@FreeBSD.org
Cc:  
Subject: Re: bin/163095: Add WITH_OPENSSH_NONE_CIPHER src.conf(5) knob
Date: Sun, 11 Mar 2012 01:51:26 -0800

 Brooks,
 
 Any word on this?  It's been over 3 months, patch is included.  Any
 political things going on which are blocking this being committed to
 HEAD, and then MFC'd (I absolutely need it MFC'd to RELENG_8, not to
 mention that's where I wrote it for -- I don't use RELENG_9).
 
 Thanks, and sorry for the bother!
State-Changed-From-To: open->patched 
State-Changed-By: bz 
State-Changed-When: Thu Jan 17 01:53:25 UTC 2013 
State-Changed-Why:  
Grab from brooks and update status; Committed to HEAD in r245527. 


Responsible-Changed-From-To: brooks->bz 
Responsible-Changed-By: bz 
Responsible-Changed-When: Thu Jan 17 01:53:25 UTC 2013 
Responsible-Changed-Why:  
Grab from brooks and update status; Committed to HEAD in r245527. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=163095 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/163095: commit references a PR
Date: Thu, 17 Jan 2013 01:51:18 +0000 (UTC)

 Author: bz
 Date: Thu Jan 17 01:51:04 2013
 New Revision: 245527
 URL: http://svnweb.freebsd.org/changeset/base/245527
 
 Log:
   Add a src.conf(5) option to allow users to compile in the "NONE cipher",
   which, only after authentication, disables crypto, and only for sessions
   without a terminal.
   
   Submitted by:	Jeremy Chadwick (freebsd jdc.parodius.com)
   PR:		bin/163095
   MFC after:	10 days
 
 Added:
   head/tools/build/options/WITH_OPENSSH_NONE_CIPHER   (contents, props changed)
 Modified:
   head/secure/lib/libssh/Makefile
   head/secure/usr.bin/ssh/Makefile
   head/secure/usr.sbin/sshd/Makefile
   head/share/mk/bsd.own.mk
 
 Modified: head/secure/lib/libssh/Makefile
 ==============================================================================
 --- head/secure/lib/libssh/Makefile	Thu Jan 17 01:28:55 2013	(r245526)
 +++ head/secure/lib/libssh/Makefile	Thu Jan 17 01:51:04 2013	(r245527)
 @@ -38,6 +38,10 @@ DPADD+=	${LIBGSSAPI} ${LIBKRB5} ${LIBHX5
  LDADD+=	-lgssapi -lkrb5 -lhx509 -lasn1 -lcom_err -lmd -lroken
  .endif
  
 +.if ${MK_OPENSSH_NONE_CIPHER} != "no"
 +CFLAGS+= -DNONE_CIPHER_ENABLED
 +.endif
 +
  NO_LINT=
  
  DPADD+=	${LIBCRYPTO} ${LIBCRYPT}
 
 Modified: head/secure/usr.bin/ssh/Makefile
 ==============================================================================
 --- head/secure/usr.bin/ssh/Makefile	Thu Jan 17 01:28:55 2013	(r245526)
 +++ head/secure/usr.bin/ssh/Makefile	Thu Jan 17 01:51:04 2013	(r245527)
 @@ -25,6 +25,10 @@ DPADD+=	 ${LIBGSSAPI}
  LDADD+=	 -lgssapi
  .endif
  
 +.if ${MK_OPENSSH_NONE_CIPHER} != "no"
 +CFLAGS+= -DNONE_CIPHER_ENABLED
 +.endif
 +
  DPADD+=	${LIBCRYPT} ${LIBCRYPTO}
  LDADD+=	-lcrypt -lcrypto
  
 
 Modified: head/secure/usr.sbin/sshd/Makefile
 ==============================================================================
 --- head/secure/usr.sbin/sshd/Makefile	Thu Jan 17 01:28:55 2013	(r245526)
 +++ head/secure/usr.sbin/sshd/Makefile	Thu Jan 17 01:51:04 2013	(r245527)
 @@ -40,6 +40,10 @@ DPADD+=	 ${LIBGSSAPI_KRB5} ${LIBGSSAPI} 
  LDADD+=	 -lgssapi_krb5 -lgssapi -lkrb5 -lasn1
  .endif
  
 +.if ${MK_OPENSSH_NONE_CIPHER} != "no"
 +CFLAGS+= -DNONE_CIPHER_ENABLED
 +.endif
 +
  DPADD+=	${LIBCRYPTO} ${LIBCRYPT}
  LDADD+=	-lcrypto -lcrypt
  
 
 Modified: head/share/mk/bsd.own.mk
 ==============================================================================
 --- head/share/mk/bsd.own.mk	Thu Jan 17 01:28:55 2013	(r245526)
 +++ head/share/mk/bsd.own.mk	Thu Jan 17 01:51:04 2013	(r245527)
 @@ -360,6 +360,7 @@ __DEFAULT_NO_OPTIONS = \
      NMTREE \
      NAND \
      OFED \
 +    OPENSSH_NONE_CIPHER \
      SHARED_TOOLCHAIN
  
  #
 
 Added: head/tools/build/options/WITH_OPENSSH_NONE_CIPHER
 ==============================================================================
 --- /dev/null	00:00:00 1970	(empty, because file is newly added)
 +++ head/tools/build/options/WITH_OPENSSH_NONE_CIPHER	Thu Jan 17 01:51:04 2013	(r245527)
 @@ -0,0 +1,9 @@
 +.\" $FreeBSD$
 +Set to include the "None" cipher support in OpenSSH and its libraries.
 +Additional adjustments may need to be done to system configuration
 +files, such as
 +.Xr sshd_config 5 ,
 +to enable this cipher.
 +Please see
 +.Pa /usr/src/crypto/openssh/README.hpn
 +for full details.
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/163095: commit references a PR
Date: Thu, 17 Jan 2013 09:34:08 +0000 (UTC)

 Author: bz
 Date: Thu Jan 17 09:34:00 2013
 New Revision: 245547
 URL: http://svnweb.freebsd.org/changeset/base/245547
 
 Log:
   Regen after adding WITH_OPENSSH_NONE_CIPHER in r245527.
   
   PR:		bin/163095
   MFC after:	10 days
 
 Modified:
   head/share/man/man5/src.conf.5
 
 Modified: head/share/man/man5/src.conf.5
 ==============================================================================
 --- head/share/man/man5/src.conf.5	Thu Jan 17 08:59:11 2013	(r245546)
 +++ head/share/man/man5/src.conf.5	Thu Jan 17 09:34:00 2013	(r245547)
 @@ -1,7 +1,7 @@
  .\" DO NOT EDIT-- this file is automatically generated.
  .\" from FreeBSD: head/tools/build/options/makeman 236279 2012-05-30 02:37:20Z gjb
  .\" $FreeBSD$
 -.Dd January 14, 2013
 +.Dd January 17, 2013
  .Dt SRC.CONF 5
  .Os
  .Sh NAME
 @@ -805,7 +805,7 @@ Set to not build NLS catalogs.
  Set to not build NLS catalog support for
  .Xr csh 1 .
  .It Va WITH_NMTREE
 -.\" from FreeBSD: head/tools/build/options/WITH_NMTREE 245241 2013-01-09 21:07:08Z brooks
 +.\" from FreeBSD: head/tools/build/options/WITH_NMTREE 245435 2013-01-14 20:38:32Z brooks
  Set to install
  .Xr nmtree 8
  as
 @@ -835,6 +835,16 @@ Infiniband software stack.
  .It Va WITHOUT_OPENSSH
  .\" from FreeBSD: head/tools/build/options/WITHOUT_OPENSSH 156932 2006-03-21 07:50:50Z ru
  Set to not build OpenSSH.
 +.It Va WITH_OPENSSH_NONE_CIPHER
 +.\" from FreeBSD: head/tools/build/options/WITH_OPENSSH_NONE_CIPHER 245527 2013-01-17 01:51:04Z bz
 +Set to include the "None" cipher support in OpenSSH and its libraries.
 +Additional adjustments may need to be done to system configuration
 +files, such as
 +.Xr sshd_config 5 ,
 +to enable this cipher.
 +Please see
 +.Pa /usr/src/crypto/openssh/README.hpn
 +for full details.
  .It Va WITHOUT_OPENSSL
  .\" from FreeBSD: head/tools/build/options/WITHOUT_OPENSSL 156932 2006-03-21 07:50:50Z ru
  Set to not build OpenSSL.
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
Responsible-Changed-From-To: bz->gnn 
Responsible-Changed-By: bz 
Responsible-Changed-When: Sun May 18 04:59:25 UTC 2014 
Responsible-Changed-Why:  
I shall not use bugzilla (at least until we will have a CLI). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=163095 
>Unformatted:
