bin/163095: Add WITH_OPENSSH_NONE_CIPHER src.conf(5) knob

[Jeremy Chadwick]

>Number:         163095
>Category:       bin
>Synopsis:       Add WITH_OPENSSH_NONE_CIPHER src.conf(5) knob
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Tue Dec 06 18:10:07 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Jeremy Chadwick
>Release:        FreeBSD 8.2-STABLE amd64
>Organization:
>Environment:
System: FreeBSD icarus.home.lan 8.2-STABLE FreeBSD 8.2-STABLE #0: Thu Dec 1 04:37:29 PST 2011 root at icarus.home.lan:/usr/obj/usr/src/sys/X7SBA_RELENG_8_amd64 amd64
>Description:
	The recently-committed addition of the HPN patches to the base
	system OpenSSH introduced the ability to make use of the "None"
	cipher:

http://www.freebsd.org/cgi/cvsweb.cgi/src/crypto/openssh/README.hpn

	However, enabling use of it requires a somewhat "hackish"
	addition to /etc/make.conf like the following:

.if ${.CURDIR:M/usr/src/secure/*}
CFLAGS+=-DNONE_CIPHER_ENABLED
.endif

	The below patch adds the ability to enable this cipher by simply
	adding WITH_OPENSSH_NONE_CIPHER to one's /etc/src.conf.

	The below patch was tested on RELENG_8 (with buildworld); may
	require minor adjustments for application to the 9.x source.

	Patch and situation itself was initially discussed with bz@ and
	brooks@ privately.  Desire for this is also justified via the
	user community:

http://lists.freebsd.org/pipermail/freebsd-stable/2011-December/064727.html

>How-To-Repeat:
	n/a
>Fix:
	Apply the below patch.  Patch will also be available for download
	at the below URL, once I get a PR number.

http://jdc.parodius.com/freebsd/{prnum}/

	Committer should be aware that the src.conf.5 man page will need
	to be rebuilt prior to commit.  I believe
	src/tools/build/options/makeman is for this purpose.


diff -ruN /origsrc/secure/lib/libssh/Makefile src/secure/lib/libssh/Makefile
--- /origsrc/secure/lib/libssh/Makefile	2010-04-20 23:33:10.000000000 -0700
+++ src/secure/lib/libssh/Makefile	2011-12-06 09:38:15.976388562 -0800
@@ -39,6 +39,10 @@
 LDADD+=	-lgssapi -lkrb5 -lhx509 -lasn1 -lcom_err -lmd -lroken
 .endif
 
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
 NO_LINT=
 
 DPADD+=	${LIBCRYPTO} ${LIBCRYPT}
diff -ruN /origsrc/secure/usr.bin/ssh/Makefile src/secure/usr.bin/ssh/Makefile
--- /origsrc/secure/usr.bin/ssh/Makefile	2010-04-20 23:33:10.000000000 -0700
+++ src/secure/usr.bin/ssh/Makefile	2011-12-06 09:38:24.173485693 -0800
@@ -25,6 +25,10 @@
 LDADD+=	 -lgssapi
 .endif
 
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
 .if defined(X11BASE) || defined(LOCALBASE)
 # Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org
 # 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/
diff -ruN /origsrc/secure/usr.sbin/sshd/Makefile src/secure/usr.sbin/sshd/Makefile
--- /origsrc/secure/usr.sbin/sshd/Makefile	2010-04-20 23:33:10.000000000 -0700
+++ src/secure/usr.sbin/sshd/Makefile	2011-12-06 09:37:56.833786139 -0800
@@ -38,6 +38,10 @@
 LDADD+=	 -lgssapi_krb5 -lgssapi -lkrb5 -lasn1
 .endif
 
+.if ${MK_OPENSSH_NONE_CIPHER} != "no"
+CFLAGS+= -DNONE_CIPHER_ENABLED
+.endif
+
 .if defined(X11BASE)
 # Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org
 # 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/
diff -ruN /origsrc/share/mk/bsd.own.mk src/share/mk/bsd.own.mk
--- /origsrc/share/mk/bsd.own.mk	2010-05-25 13:16:36.000000000 -0700
+++ src/share/mk/bsd.own.mk	2011-12-06 09:38:46.729274164 -0800
@@ -408,7 +408,8 @@
     BIND_SIGCHASE \
     BIND_XML \
     HESIOD \
-    IDEA
+    IDEA \
+    OPENSSH_NONE_CIPHER
 .if defined(WITH_${var}) && defined(WITHOUT_${var})
 .error WITH_${var} and WITHOUT_${var} can't both be set.
 .endif
diff -ruN /origsrc/tools/build/options/WITH_OPENSSH_NONE_CIPHER src/tools/build/options/WITH_OPENSSH_NONE_CIPHER
--- /origsrc/tools/build/options/WITH_OPENSSH_NONE_CIPHER	1969-12-31 16:00:00.000000000 -0800
+++ src/tools/build/options/WITH_OPENSSH_NONE_CIPHER	2011-12-06 09:39:30.929282637 -0800
@@ -0,0 +1,8 @@
+.\" $FreeBSD: $
+Set to include the "None" cipher into OpenSSH and its libraries.
+Additional adjustments may need to be done to system configuration
+files, such as
+.Xr sshd_config 5 ,
+to enable this cipher. Please see
+.Pa /usr/src/crypto/openssh/README.hpn
+for full details.
>Release-Note:
>Audit-Trail:
>Unformatted: