Only refuse to use OpenSSL 3.0.4 on x86_64.

The potential RCE only impacts x86_64, so only refuse to use it if we're
targetting a potentially impacted architecture.  ok djm@

diff --git a/configure.ac b/configure.ac
index 6ebdd06a2e19e7f897efdb7f673aec74589195b5..0c6a57ebc7ba25169606a4b6c54ac6dee0dfc5f6 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -2796,7 +2796,6 @@ if test "x$openssl" = "xyes" ; then
                                ;;
                        101*)   ;; # 1.1.x
                        200*)   ;; # LibreSSL
-                       3000004*) AC_MSG_ERROR([OpenSSL 3.0.4 has a potential RCE in its RSA implementation (CVE-2022-2274)]) ;;
                        300*)
                                # OpenSSL 3; we use the 1.1x API
                                CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=0x10100000L"
@@ -2820,6 +2819,15 @@ if test "x$openssl" = "xyes" ; then
                ]
        )
 
+       case "$host" in
+       x86_64-*)
+               case "$ssl_library_ver" in
+               3000004*)
+                       AC_MSG_ERROR([OpenSSL 3.0.4 has a potential RCE in its RSA implementation (CVE-2022-2274)])
+                       ;;
+               esac
+       esac
+
        # Sanity check OpenSSL headers
        AC_MSG_CHECKING([whether OpenSSL's headers match the library])
        AC_RUN_IFELSE(

diff --git a/regress/keyscan.sh b/regress/keyscan.sh
index 75a14ee0eecb2dca90a2fd7f72544b0a7416270d..0b8c33aa46edb4b5f6e08a0da3cb2be31d924380 100644 (file)
--- a/regress/keyscan.sh
+++ b/regress/keyscan.sh
@@ -23,3 +23,16 @@ for t in $SSH_KEYTYPES; do
                fail "ssh-keyscan -t $t failed with: $r"
        fi
 done
+
+stop_sshd
+sleep 1
+
+trace "keyscan banner length"
+banner=""
+for i in `seq 245 256`; do
+       trace "keyscan length $i"
+       banner=`perl -le "print 'A'x$i"`
+       (printf "SSH-2.0-${banner}" | ${NC} -N -l $PORT >/dev/null) &
+       ${SSHKEYSCAN} -p $PORT 127.0.0.1
+       sleep 3
+done

diff --git a/sftp-server-main.c b/sftp-server-main.c
index 06566d36ed8400d9a13470d055afabbd5abda1a7..2c70f89bc70b6f9823e4a700ee0efa2270261658 100644 (file)
--- a/sftp-server-main.c
+++ b/sftp-server-main.c
@@ -42,8 +42,6 @@ main(int argc, char **argv)
        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
        sanitise_stdfd();
 
-       seed_rng();
-
        if ((user_pw = getpwuid(getuid())) == NULL) {
                fprintf(stderr, "No user found for uid %lu\n",
                    (u_long)getuid());