~ubuntu-branches/debian/squeeze/erlang/squeeze : revision 18

1

Description: Patch fixes CVE-2011-0766 (cryptographic weakness) vulnerability

2

in Erlang SSH application. It is taken from upstream git repository

3

https://github.com/erlang/otp/commit/f228601de45c5

4

Author: Upstream

5

Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628456

6

Last-Updated: Tue, 03 Jan 2012 14:05:07 +0400

7

8

--- erlang-14.a-dfsg.orig/lib/crypto/c_src/crypto.c

9

+++ erlang-14.a-dfsg/lib/crypto/c_src/crypto.c

10

@@ -127,7 +127,9 @@

11

static ERL_NIF_TERM des_ede3_cbc_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

12

static ERL_NIF_TERM aes_cfb_128_crypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

13

static ERL_NIF_TERM rand_bytes_1(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

14

+static ERL_NIF_TERM strong_rand_bytes_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

15

static ERL_NIF_TERM rand_bytes_3(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

16

+static ERL_NIF_TERM strong_rand_mpint_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

17

static ERL_NIF_TERM rand_uniform_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

18

static ERL_NIF_TERM mod_exp_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

19

static ERL_NIF_TERM dss_verify(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);

20

@@ -195,7 +197,9 @@

21

{"des_ede3_cbc_crypt", 6, des_ede3_cbc_crypt},

22

{"aes_cfb_128_crypt", 4, aes_cfb_128_crypt},

23

{"rand_bytes", 1, rand_bytes_1},

24

+ {"strong_rand_bytes_nif", 1, strong_rand_bytes_nif},

25

{"rand_bytes", 3, rand_bytes_3},

26

+ {"strong_rand_mpint_nif", 3, strong_rand_mpint_nif},

27

{"rand_uniform_nif", 2, rand_uniform_nif},

28

{"mod_exp_nif", 3, mod_exp_nif},

29

{"dss_verify", 4, dss_verify},

30

@@ -667,6 +671,22 @@

31

ERL_VALGRIND_MAKE_MEM_DEFINED(data, bytes);

32

return ret;

33

}

34

+static ERL_NIF_TERM strong_rand_bytes_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])

35

+{/* (Bytes) */

36

+ unsigned bytes;

37

+ unsigned char* data;

38

+ ERL_NIF_TERM ret;

39

+ if (!enif_get_uint(env, argv[0], &bytes)) {

40

+ return enif_make_badarg(env);

41

+ }

42

+ data = enif_make_new_binary(env, bytes, &ret);

43

+ if ( RAND_bytes(data, bytes) != 1) {

44

+ return atom_false;

45

+ }

46

+ ERL_VALGRIND_MAKE_MEM_DEFINED(data, bytes);

47

+ return ret;

48

+}

49

+

50

static ERL_NIF_TERM rand_bytes_3(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])

51

{/* (Bytes, TopMask, BottomMask) */

52

unsigned bytes;

53

@@ -687,6 +707,47 @@

54

}

55

return ret;

56

}

57

+static ERL_NIF_TERM strong_rand_mpint_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])

58

+{/* (Bytes, TopMask, BottomMask) */

59

+ unsigned bits;

60

+ BIGNUM *bn_rand;

61

+ int top, bottom;

62

+ unsigned char* data;

63

+ unsigned dlen;

64

+ ERL_NIF_TERM ret;

65

+ if (!enif_get_uint(env, argv[0], &bits)

66

+ || !enif_get_int(env, argv[1], &top)

67

+ || !enif_get_int(env, argv[2], &bottom)) {

68

+ return enif_make_badarg(env);

69

+ }

70

+ if (! (top == -1 || top == 0 || top == 1) ) {

71

+ return enif_make_badarg(env);

72

+ }

73

+ if (! (bottom == 0 || bottom == 1) ) {

74

+ return enif_make_badarg(env);

75

+ }

76

+

77

+ bn_rand = BN_new();

78

+ if (! bn_rand ) {

79

+ return enif_make_badarg(env);

80

+ }

81

+

82

+ /* Get a (bits) bit random number */

83

+ if (!BN_rand(bn_rand, bits, top, bottom)) {

84

+ ret = atom_false;

85

+ }

86

+ else {

87

+ /* Copy the bignum into an erlang mpint binary. */

88

+ dlen = BN_num_bytes(bn_rand);

89

+ data = enif_make_new_binary(env, dlen+4, &ret);

90

+ put_int32(data, dlen);

91

+ BN_bn2bin(bn_rand, data+4);

92

+ ERL_VALGRIND_MAKE_MEM_DEFINED(data+4, dlen);

93

+ }

94

+ BN_free(bn_rand);

95

+

96

+ return ret;

97

+}

98

99

static int get_bn_from_mpint(ErlNifEnv* env, ERL_NIF_TERM term, BIGNUM** bnp)

100

{

101

--- erlang-14.a-dfsg.orig/lib/crypto/doc/src/crypto.xml

102

+++ erlang-14.a-dfsg/lib/crypto/doc/src/crypto.xml

103

@@ -587,6 +587,21 @@

104

</desc>

105

</func>

106

<func>

107

+ <name>strong_rand_bytes(N) -> binary()</name>

108

+ <fsummary>Generate a binary of random bytes</fsummary>

109

+ <type>

110

+ <v>N = integer()</v>

111

+ </type>

112

+ <desc>

113

+ Generates N bytes randomly uniform 0..255, and returns the

114

+ result in a binary. Uses a cryptographically secure prng seeded and

115

+ periodically mixed with operating system provided entropy. By default

116

+ this is the <c>RAND_bytes</c> method from OpenSSL.

117

+ May throw exception <c>low_entropy</c> in case the random generator

118

+ failed due to lack of secure "randomness".

119

+ </desc>

120

+ </func>

121

+ <func>

122

<name>rand_uniform(Lo, Hi) -> N</name>

123

<fsummary>Generate a random number</fsummary>

124

<type>

125

@@ -601,6 +616,31 @@

126

</desc>

127

</func>

128

<func>

129

+ <name>strong_rand_mpint(N, Top, Bottom) -> Mpint</name>

130

+ <fsummary>Generate an N bit random number</fsummary>

131

+ <type>

132

+ <v>N = non_neg_integer()</v>

133

+ <v>Top = -1 | 0 | 1</v>

134

+ <v>Bottom = 0 | 1</v>

135

+ <v>Mpint = binary()</v>

136

+ </type>

137

+ <desc>

138

+ Generate an N bit random number using OpenSSL's

139

+ cryptographically strong pseudo random number generator

140

+ <c>BN_rand</c>.

141

+ The parameter <c>Top</c> places constraints on the most

142

+ significant bits of the generated number. If <c>Top</c> is 1, then the

143

+ two most significant bits will be set to 1, if <c>Top</c> is 0, the

144

+ most significant bit will be 1, and if <c>Top</c> is -1 then no

145

+ constraints are applied and thus the generated number may be less than

146

+ N bits long.

147

+ If <c>Bottom</c> is 1, then the generated number is

148

+ constrained to be odd.

149

+ May throw exception <c>low_entropy</c> in case the random generator

150

+ failed due to lack of secure "randomness".

151

+ </desc>

152

+ </func>

153

+ <func>

154

<name>mod_exp(N, P, M) -> Result</name>

155

<fsummary>Perform N ^ P mod M</fsummary>

156

<type>

157

--- erlang-14.a-dfsg.orig/lib/crypto/src/crypto.erl

158

+++ erlang-14.a-dfsg/lib/crypto/src/crypto.erl

159

@@ -46,6 +46,7 @@

160

-export([rsa_private_encrypt/3, rsa_public_decrypt/3]).

161

-export([dh_generate_key/1, dh_generate_key/2, dh_compute_key/3]).

162

-export([rand_bytes/1, rand_bytes/3, rand_uniform/2]).

163

+-export([strong_rand_bytes/1, strong_rand_mpint/3]).

164

-export([mod_exp/3, mpint/1, erlint/1]).

165

%% -export([idea_cbc_encrypt/3, idea_cbc_decrypt/3]).

166

-export([aes_cbc_128_encrypt/3, aes_cbc_128_decrypt/3]).

167

@@ -67,6 +68,8 @@

168

des_ede3_cbc_encrypt, des_ede3_cbc_decrypt,

169

aes_cfb_128_encrypt, aes_cfb_128_decrypt,

170

rand_bytes,

171

+ strong_rand_bytes,

172

+ strong_rand_mpint,

173

rand_uniform,

174

mod_exp,

175

dss_verify,dss_sign,

176

@@ -340,12 +343,32 @@

177

%% RAND - pseudo random numbers using RN_ functions in crypto lib

178

%%

179

-spec rand_bytes(non_neg_integer()) -> binary().

180

+-spec strong_rand_bytes(non_neg_integer()) -> binary().

181

-spec rand_uniform(crypto_integer(), crypto_integer()) ->

182

crypto_integer().

183

+-spec strong_rand_mpint(Bits::non_neg_integer(),

184

+ Top::-1..1,

185

+ Bottom::0..1) -> binary().

186

187

rand_bytes(_Bytes) -> ?nif_stub.

188

+

189

+strong_rand_bytes(Bytes) ->

190

+ case strong_rand_bytes_nif(Bytes) of

191

+ false -> erlang:error(low_entropy);

192

+ Bin -> Bin

193

+ end.

194

+strong_rand_bytes_nif(_Bytes) -> ?nif_stub.

195

+

196

rand_bytes(_Bytes, _Topmask, _Bottommask) -> ?nif_stub.

197

198

+strong_rand_mpint(Bits, Top, Bottom) ->

199

+ case strong_rand_mpint_nif(Bits,Top,Bottom) of

200

+ false -> erlang:error(low_entropy);

201

+ Bin -> Bin

202

+ end.

203

+strong_rand_mpint_nif(_Bits, _Top, _Bottom) -> ?nif_stub.

204

+

205

+

206

rand_uniform(From,To) when is_binary(From), is_binary(To) ->

207

case rand_uniform_nif(From,To) of

208

<<Len:32/integer, MSB, Rest/binary>> when MSB > 127 ->

209

--- erlang-14.a-dfsg.orig/lib/ssh/src/ssh.appup.src

210

+++ erlang-14.a-dfsg/lib/ssh/src/ssh.appup.src

211

@@ -19,8 +19,40 @@

212

213

{"%VSN%",

214

[

215

+ {"2.0.3", [{load_module, ssh_bits, soft_purge, soft_purge, []},

216

+ {load_module, ssh_connection_handler, soft_purge, soft_purge, []},

217

+ {load_module, ssh_file, soft_purge, soft_purge, []},

218

+ {load_module, ssh, soft_purge, soft_purge, []},

219

+ {load_module, ssh_rsa, soft_purge, soft_purge, []},

220

+ {load_module, ssh_acceptor, soft_purge, soft_purge, []},

221

+ {load_module, ssh_transport, soft_purge, soft_purge, []},

222

+ {load_module, ssh_connection_manager, soft_purge, soft_purge, []}]},

223

+ {"2.0.2", [{load_module, ssh_bits, soft_purge, soft_purge, []},

224

+ {load_module, ssh_connection_handler, soft_purge, soft_purge, []},

225

+ {load_module, ssh_file, soft_purge, soft_purge, []},

226

+ {load_module, ssh, soft_purge, soft_purge, []},

227

+ {load_module, ssh_rsa, soft_purge, soft_purge, []},

228

+ {load_module, ssh_acceptor, soft_purge, soft_purge, []},

229

+ {load_module, ssh_transport, soft_purge, soft_purge, []},

230

+ {load_module, ssh_connection_manager, soft_purge, soft_purge, []}]}

231

],

232

[

233

+ {"2.0.3", [{load_module, ssh_bits, soft_purge, soft_purge, []},

234

+ {load_module, ssh_connection_handler, soft_purge, soft_purge, []},

235

+ {load_module, ssh_file, soft_purge, soft_purge, []},

236

+ {load_module, ssh, soft_purge, soft_purge, []},

237

+ {load_module, ssh_rsa, soft_purge, soft_purge, []},

238

+ {load_module, ssh_acceptor, soft_purge, soft_purge, []},

239

+ {load_module, ssh_transport, soft_purge, soft_purge, []},

240

+ {load_module, ssh_connection_manager, soft_purge, soft_purge, []}]},

241

+ {"2.0.2", [{load_module, ssh_bits, soft_purge, soft_purge, []},

242

+ {load_module, ssh_connection_handler, soft_purge, soft_purge, []},

243

+ {load_module, ssh_file, soft_purge, soft_purge, []},

244

+ {load_module, ssh, soft_purge, soft_purge, []},

245

+ {load_module, ssh_rsa, soft_purge, soft_purge, []},

246

+ {load_module, ssh_acceptor, soft_purge, soft_purge, []},

247

+ {load_module, ssh_transport, soft_purge, soft_purge, []},

248

+ {load_module, ssh_connection_manager, soft_purge, soft_purge, []}]}

249

]

250

}.

251

252

--- erlang-14.a-dfsg.orig/lib/ssh/src/ssh_bits.erl

253

+++ erlang-14.a-dfsg/lib/ssh/src/ssh_bits.erl

254

@@ -34,7 +34,7 @@

255

%% integer utils

256

-export([isize/1]).

257

-export([irandom/1, irandom/3]).

258

--export([random/1, random/3]).

259

+-export([random/1]).

260

-export([xor_bits/2, fill_bits/2]).

261

-export([i2bin/2, bin2i/1]).

262

263

@@ -401,9 +401,6 @@

264

irandom(Bits) ->

265

irandom(Bits, 1, 0).

266

267

-%% irandom_odd(Bits) ->

268

-%% irandom(Bits, 1, 1).

269

-

270

%%

271

%% irandom(N, Top, Bottom)

272

%%

273

@@ -414,57 +411,16 @@

274

%% Bot = 0 - do not set the least signifcant bit

275

%% Bot = 1 - set the least signifcant bit (i.e always odd)

276

%%

277

-irandom(0, _Top, _Bottom) ->

278

- 0;

279

-irandom(Bits, Top, Bottom) ->

280

- Bytes = (Bits+7) div 8,

281

- Skip = (8-(Bits rem 8)) rem 8,

282

- TMask = case Top of

283

- 0 -> 0;

284

- 1 -> 16#80;

285

- 2 -> 16#c0

286

- end,

287

- BMask = case Bottom of

288

- 0 -> 0;

289

- 1 -> (1 bsl Skip)

290

- end,

291

- <<X:Bits/big-unsigned-integer, _:Skip>> = random(Bytes, TMask, BMask),

292

- X.

293

+irandom(Bits, Top, Bottom) when is_integer(Top),

294

+ 0 =< Top, Top =< 2 ->

295

+ crypto:erlint(crypto:strong_rand_mpint(Bits, Top - 1, Bottom)).

296

297

%%

298

%% random/1

299

%% Generate N random bytes

300

%%

301

random(N) ->

302

- random(N, 0, 0).

303

-

304

-random(N, TMask, BMask) ->

305

- list_to_binary(rnd(N, TMask, BMask)).

306

-

307

-%% random/3

308

-%% random(Bytes, TopMask, BotMask)

309

-%% where

310

-%% Bytes is the number of bytes to generate

311

-%% TopMask is bitwised or'ed to the first byte

312

-%% BotMask is bitwised or'ed to the last byte

313

-%%

314

-rnd(0, _TMask, _BMask) ->

315

- [];

316

-rnd(1, TMask, BMask) ->

317

- [(rand8() bor TMask) bor BMask];

318

-rnd(N, TMask, BMask) ->

319

- [(rand8() bor TMask) | rnd_n(N-1, BMask)].

320

-

321

-rnd_n(1, BMask) ->

322

- [rand8() bor BMask];

323

-rnd_n(I, BMask) ->

324

- [rand8() | rnd_n(I-1, BMask)].

325

-

326

-rand8() ->

327

- (rand32() bsr 8) band 16#ff.

328

-

329

-rand32() ->

330

- random:uniform(16#100000000) -1.

331

+ crypto:strong_rand_bytes(N).

332

333

%%

334

%% Base 64 encode/decode

335

--- erlang-14.a-dfsg.orig/lib/ssh/src/ssh_connection_handler.erl

336

+++ erlang-14.a-dfsg/lib/ssh/src/ssh_connection_handler.erl

337

@@ -106,8 +106,6 @@

338

%% initialize.

339

%%--------------------------------------------------------------------

340

init([Role, Manager, Socket, SshOpts]) ->

341

- {A,B,C} = erlang:now(),

342

- random:seed(A, B, C),

343

{NumVsn, StrVsn} = ssh_transport:versions(Role, SshOpts),

344

ssh_bits:install_messages(ssh_transport:transport_messages(NumVsn)),

345

{Protocol, Callback, CloseTag} =