#

# Dynamically set FIPS mode, when underlying libcrypto is FIPS capable.

# Limit ciphers and MACs in algorithm negotiation proposal.

#

# This patch is unlikely to be accepted upstream.

#

diff -pur old/cipher.c new/cipher.c

--- old/cipher.c

+++ new/cipher.c

 #endif

 };

+#ifdef ENABLE_OPENSSL_FIPS

+/* in FIPS mode limit ciphers to FIPS compliant only */

+#define	ciphers (ssh_FIPS_mode() ? ciphers_fips : ciphers_dflt)

+

+static const struct sshcipher ciphers_fips[] = {

+	{ "none",	SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },

+	{ "3des-cbc",	SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },

+	{ "aes128-cbc",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },

+	{ "aes192-cbc",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },

+	{ "aes256-cbc",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },

+	{ "[email protected]",

+			SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },

+	{ "aes128-ctr",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },

+	{ "aes192-ctr",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },

+	{ "aes256-ctr",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },

+# ifdef OPENSSL_HAVE_EVPGCM

+	{ "[email protected]",

+			SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },

+	{ "[email protected]",

+			SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },

+# endif /* OPENSSL_HAVE_EVPGCM */

+	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }

+};

+

+static const struct sshcipher ciphers_dflt[] = {

+#else /* ENABLE_OPENSSL_FIPS */

 static const struct sshcipher ciphers[] = {

+#endif /* ENABLE_OPENSSL_FIPS */

 #ifdef WITH_SSH1

 	{ "des",	SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },

 	{ "3des",	SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },

diff -pur old/digest-openssl.c new/digest-openssl.c

--- old/digest-openssl.c

+++ new/digest-openssl.c

@@ -31,6 +31,7 @@

 #include "sshbuf.h"

 #include "digest.h"

 #include "ssherr.h"

+#include "misc.h"

 #ifndef HAVE_EVP_RIPEMD160

 # define EVP_ripemd160 NULL

@@ -53,8 +54,22 @@ struct ssh_digest {

 	const EVP_MD *(*mdfunc)(void);

 };

+#ifdef ENABLE_OPENSSL_FIPS

 /* NB. Indexed directly by algorithm number */

+const struct ssh_digest digests_fips[] = {

+	{ SSH_DIGEST_MD5,	"",	 	16,	NULL },

+	{ SSH_DIGEST_RIPEMD160,	"",		20,	NULL },

+	{ SSH_DIGEST_SHA1,	"SHA1",	 	20,	EVP_sha1 },

+	{ SSH_DIGEST_SHA256,	"SHA256", 	32,	EVP_sha256 },

+	{ SSH_DIGEST_SHA384,	"SHA384",	48,	EVP_sha384 },

+	{ SSH_DIGEST_SHA512,	"SHA512", 	64,	EVP_sha512 },

+	{ -1,			NULL,		0,	NULL },

+};

+/* NB. Indexed directly by algorithm number */

+const struct ssh_digest digests_dflt[] = {

+#else /* ENABLE_OPENSSL_FIPS */

 const struct ssh_digest digests[] = {

+#endif /* ENABLE_OPENSSL_FIPS */

 	{ SSH_DIGEST_MD5,	"MD5",	 	16,	EVP_md5 },

 	{ SSH_DIGEST_RIPEMD160,	"RIPEMD160",	20,	EVP_ripemd160 },

 	{ SSH_DIGEST_SHA1,	"SHA1",	 	20,	EVP_sha1 },

@@ -67,6 +82,9 @@ const struct ssh_digest digests[] = {

 static const struct ssh_digest *

 ssh_digest_by_alg(int alg)

 {

+#ifdef ENABLE_OPENSSL_FIPS

+	struct ssh_digest *digests = ssh_FIPS_mode() ? digests_fips : digests_dflt;

+#endif

 	if (alg < 0 || alg >= SSH_DIGEST_MAX)

 		return NULL;

 	if (digests[alg].id != alg) /* sanity */

@@ -79,6 +97,9 @@ ssh_digest_by_alg(int alg)

 int

 ssh_digest_alg_by_name(const char *name)

 {

+#ifdef ENABLE_OPENSSL_FIPS

+	struct ssh_digest *digests = ssh_FIPS_mode() ? digests_fips : digests_dflt;

+#endif

 	int alg;

 	for (alg = 0; digests[alg].id != -1; alg++) {

diff -pur old/gss-genr.c new/gss-genr.c

--- old/gss-genr.c

+++ new/gss-genr.c

 #include "cipher.h"

 #include "key.h"

 #include "kex.h"

+#include "misc.h"

 #include <openssl/evp.h>

 #include "ssh-gss.h"

 	char deroid[2];

 	const EVP_MD *evp_md = EVP_md5();

 	EVP_MD_CTX md;

+	int fips_mode;

 	if (gss_enc2oid != NULL) {

 		for (i = 0; gss_enc2oid[i].encoded != NULL; i++)

 	buffer_init(&buf);

+#ifdef ENABLE_OPENSSL_FIPS

+	fips_mode = ssh_FIPS_mode();

+	if (fips_mode) {

+		debug3("Temporarily unsetting FIPS mode to compute MD5 for "

+		    "GSS-API key exchange method names");

+		FIPS_mode_set(0);

+	}

+#endif

 	oidpos = 0;

 	for (i = 0; i < gss_supported->count; i++) {

 		if (gss_supported->elements[i].length < 128 &&

 			deroid[0] = SSH_GSS_OIDTYPE;

 			deroid[1] = gss_supported->elements[i].length;

-

 			EVP_DigestInit(&md, evp_md);

 			EVP_DigestUpdate(&md, deroid, 2);

 			EVP_DigestUpdate(&md,

 			oidpos++;

 		}

 	}

+#ifdef ENABLE_OPENSSL_FIPS

+	if (fips_mode) {

+		ssh_FIPS_mode_set_if_capable();

+		ssh_FIPS_check_status();

+	}

+#endif

 	gss_enc2oid[oidpos].oid = NULL;

 	gss_enc2oid[oidpos].encoded = NULL;

diff -pur old/kex.c new/kex.c

--- old/kex.c

+++ new/kex.c

 	int ec_nid;

 	int hash_alg;

 };

+

+#ifdef ENABLE_OPENSSL_FIPS

+/* in FIPS mode limit kexalgs to FIPS compliant only */

+#define        kexalgs (ssh_FIPS_mode() ? kexalgs_fips : kexalgs_dflt)

+static const struct kexalg kexalgs_fips[] = {

+#ifdef WITH_OPENSSL

+	{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },

+	{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },

+	{ KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },

+	{ KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },

+	{ KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512 },

+	{ KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },

+#ifdef HAVE_EVP_SHA256

+	{ KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },

+#endif /* HAVE_EVP_SHA256 */

+#ifdef OPENSSL_HAS_ECC

+	{ KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,

+	    NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },

+	{ KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1,

+	    SSH_DIGEST_SHA384 },

+# ifdef OPENSSL_HAS_NISTP521

+	{ KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,

+	    SSH_DIGEST_SHA512 },

+# endif /* OPENSSL_HAS_NISTP521 */

+#endif /* OPENSSL_HAS_ECC */

+#endif /* WITH_OPENSSL */

+#ifdef GSSAPI

+	{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },

+	{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },

+	{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },

+#endif

+	{ NULL, -1, -1, -1},

+};

+static const struct kexalg kexalgs_dflt[] = {

+#else

 static const struct kexalg kexalgs[] = {

+#endif 

 #ifdef WITH_OPENSSL

 	{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },

 	{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },

diff -pur old/mac.c new/mac.c

--- old/mac.c

+++ new/mac.c

@@ -53,8 +53,33 @@ struct macalg {

 	int		len;		/* just for UMAC */

 	int		etm;		/* Encrypt-then-MAC */

 };

+#ifdef ENABLE_OPENSSL_FIPS

+/* in FIPS mode limit macs to FIPS compliant only */

+#define	macs (ssh_FIPS_mode() ? macs_fips : macs_dflt)

+static const struct macalg macs_fips[] = {

+	/* Encrypt-and-MAC (encrypt-and-authenticate) variants */

+	{ "hmac-sha1",				SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },

+	{ "hmac-sha1-96",			SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 0 },

+#ifdef HAVE_EVP_SHA256

+	{ "hmac-sha2-256",			SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 0 },

+	{ "hmac-sha2-512",			SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 0 },

+#endif

+	/* Encrypt-then-MAC variants */

+	{ "[email protected]",		SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 1 },

+	{ "[email protected]",	SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 1 },

+#ifdef HAVE_EVP_SHA256

+	{ "[email protected]",	SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 1 },

+	{ "[email protected]",	SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 1 },

+#endif

+

+	{ NULL,					0, 0, 0, 0, 0, 0 }

+};

+

+static const struct macalg macs_dflt[] = {

+#else /* ENABLE_OPENSSL_FIPS */

 static const struct macalg macs[] = {

+#endif /* ENABLE_OPENSSL_FIPS */

 	/* Encrypt-and-MAC (encrypt-and-authenticate) variants */

 	{ "hmac-sha1",				SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },

 	{ "hmac-sha1-96",			SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 0 },

diff -pur old/misc.c new/misc.c

--- old/misc.c

+++ new/misc.c

@@ -39,12 +39,16 @@

 #include <string.h>

 #include <time.h>

 #include <unistd.h>

+#include <dlfcn.h>

 #include <netinet/in.h>

 #include <netinet/in_systm.h>

 #include <netinet/ip.h>

 #include <netinet/tcp.h>

+#include <openssl/crypto.h>

+#include <openssl/err.h>

+

 #include <ctype.h>

 #include <errno.h>

 #include <fcntl.h>

@@ -78,6 +82,60 @@ chop(char *s)

 }

+#ifdef ENABLE_OPENSSL_FIPS

+/* is OpenSSL FIPS mode set? */

+int

+ssh_FIPS_mode()

+{

+	return FIPS_mode();

+}

+

+/* store FIPS_mode_set() err code */

+static unsigned long ssh_FIPS_err_code = 0;

+

+#define	MSGBUFSIZ	1024 /* equals log.c:MSGBUFSIZ */

+

+/*

+ * Check and display FIPS mode status. 

+ * Called after ssh_FIPS_mode_set_if_capable() and when logging facility is

+ * available.

+ * If FIPS_mode_failed for FIPS capable libcrypto, exits with 255 code.

+ */

+void 

+ssh_FIPS_check_status()

+{

+	char ebuf[MSGBUFSIZ];

+

+	if (dlsym(RTLD_DEFAULT, "FIPS_module_mode_set") != NULL) {

+		if (ssh_FIPS_mode()) {

+			debug("Running in FIPS mode.");

+		} else {

+			ERR_error_string_n(ssh_FIPS_err_code, ebuf,

+			    sizeof (ebuf));

+			fatal("Setting FIPS mode failed! %s", ebuf);

+		}

+	} else {

+		debug3("Loaded libcrypto is not FIPS capable.");

+	}

+	

+}

+

+/* if underlying libcrypto is FIPS capable, set FIPS_mode to 1 */

+int

+ssh_FIPS_mode_set_if_capable()

+{

+	/* presence of FIPS_module_mode_set indicates FIPS capable OpenSSL */

+	if (dlsym(RTLD_DEFAULT, "FIPS_module_mode_set") != NULL) {

+		/* call the API function FIPS_mode_set*/

+		if (!FIPS_mode_set(1)) {

+			ssh_FIPS_err_code = ERR_get_error();

+			return 1;

+		}

+	}

+	return 0;

+}

+#endif

+

 /* set/unset filedescriptor to non-blocking */

 int

 set_nonblock(int fd)

diff -pur old/misc.h new/misc.h

--- old/misc.h

+++ new/misc.h

 char	*chop(char *);

 char	*strdelim(char **);

+#ifdef ENABLE_OPENSSL_FIPS

+int	 ssh_FIPS_mode();

+int	 ssh_FIPS_mode_set_if_capable();

+void     ssh_FIPS_check_status();

+#endif

 int	 set_nonblock(int);

 int	 unset_nonblock(int);

 void	 set_nodelay(int);

diff -pur old/myproposal.h new/myproposal.h

--- old/myproposal.h

+++ new/myproposal.h

 # else

 #  define KEX_CURVE25519_METHODS ""

 # endif

-#define KEX_COMMON_KEX \

+

+#define KEX_COMMON_KEX_DFLT \

 	KEX_CURVE25519_METHODS \

 	KEX_ECDH_METHODS \

 	KEX_SHA2_METHODS

-#define KEX_SERVER_KEX KEX_COMMON_KEX \

+#define KEX_SERVER_KEX_DFLT KEX_COMMON_KEX_DFLT \

 	KEX_SHA2_GROUP14 \

 	"diffie-hellman-group14-sha1" \

-#define KEX_CLIENT_KEX KEX_COMMON_KEX \

+#define KEX_CLIENT_KEX_DFLT KEX_COMMON_KEX_DFLT \

 	"diffie-hellman-group-exchange-sha1," \

 	KEX_SHA2_GROUP14 \

 	"diffie-hellman-group14-sha1"

-#define	KEX_DEFAULT_PK_ALG	\

+#define KEX_COMMON_KEX_FIPS \

+	KEX_ECDH_METHODS \

+	KEX_SHA2_METHODS

+

+#define KEX_SERVER_KEX_FIPS KEX_COMMON_KEX_FIPS \

+	"diffie-hellman-group14-sha1" \

+

+#define KEX_CLIENT_KEX_FIPS KEX_COMMON_KEX_FIPS \

+	"diffie-hellman-group-exchange-sha1," \

+	"diffie-hellman-group14-sha1"

+

+#define	KEX_DEFAULT_PK_ALG_DFLT	\

 	HOSTKEY_ECDSA_CERT_METHODS \

 	"[email protected]," \

 	"[email protected]," \

 	"rsa-sha2-256," \

 	"ssh-rsa"

+#define	KEX_DEFAULT_PK_ALG_FIPS	\

+	HOSTKEY_ECDSA_CERT_METHODS \

+	"[email protected]," \

+	HOSTKEY_ECDSA_METHODS \

+	"rsa-sha2-512," \

+	"rsa-sha2-256," \

+	"ssh-rsa"

+

 /* the actual algorithms */

-#define KEX_SERVER_ENCRYPT \

+#define KEX_SERVER_ENCRYPT_DFLT \

 	"[email protected]," \

 	"aes128-ctr,aes192-ctr,aes256-ctr" \

 	AESGCM_CIPHER_MODES

-#define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT "," \

+#define KEX_CLIENT_ENCRYPT_DFLT KEX_SERVER_ENCRYPT_DFLT "," \

+

+#define KEX_SERVER_ENCRYPT_FIPS \

+	"aes128-ctr,aes192-ctr,aes256-ctr" \

+	AESGCM_CIPHER_MODES

+

+#define KEX_CLIENT_ENCRYPT_FIPS KEX_SERVER_ENCRYPT_FIPS "," \

-#define KEX_SERVER_MAC \

+#define KEX_SERVER_MAC_DFLT \

 	"[email protected]," \

 	"[email protected]," \

 	"[email protected]," \

 	"hmac-sha2-512," \

 	"hmac-sha1"

-#define KEX_CLIENT_MAC KEX_SERVER_MAC

+#define KEX_CLIENT_MAC_DFLT KEX_SERVER_MAC_DFLT

+

+#define KEX_SERVER_MAC_FIPS \

+	"[email protected]," \

+	"[email protected]," \

+	"[email protected]," \

+	"hmac-sha2-256," \

+	"hmac-sha2-512," \

+	"hmac-sha1"

+

+#define KEX_CLIENT_MAC_FIPS KEX_SERVER_MAC_FIPS

+

+#ifdef ENABLE_OPENSSL_FIPS

+ #define KEX_SERVER_KEX \

+     (ssh_FIPS_mode() ? (KEX_SERVER_KEX_FIPS) : (KEX_SERVER_KEX_DFLT) )

+ #define KEX_CLIENT_KEX \

+     (ssh_FIPS_mode() ? (KEX_CLIENT_KEX_FIPS) : (KEX_CLIENT_KEX_DFLT) )

+ #define KEX_DEFAULT_PK_ALG \

+     (ssh_FIPS_mode() ? (KEX_DEFAULT_PK_ALG_FIPS) : (KEX_DEFAULT_PK_ALG_DFLT) )

+ #define KEX_SERVER_ENCRYPT \

+    (ssh_FIPS_mode() ? (KEX_SERVER_ENCRYPT_FIPS) : (KEX_SERVER_ENCRYPT_DFLT))

+ #define KEX_CLIENT_ENCRYPT \

+    (ssh_FIPS_mode() ? (KEX_CLIENT_ENCRYPT_FIPS) : (KEX_CLIENT_ENCRYPT_DFLT))

+ #define KEX_SERVER_MAC \

+    (ssh_FIPS_mode() ? (KEX_SERVER_MAC_FIPS) : (KEX_SERVER_MAC_DFLT) )

+ #define KEX_CLIENT_MAC \

+    (ssh_FIPS_mode() ? (KEX_CLIENT_MAC_FIPS) : (KEX_CLIENT_MAC_DFLT) )

+#else /* ENABLE_OPENSSL_FIPS */

+ #define KEX_SERVER_KEX KEX_SERVER_KEX_DFLT

+ #define KEX_CLIENT_KEX KEX_CLIENT_KEX_DFLT

+ #define KEX_DEFAULT_PK_ALG KEX_DEFAULT_PK_ALG_DFLT

+ #define KEX_SERVER_ENCRYPT KEX_SERVER_ENCRYPT_DFLT

+ #define KEX_CLIENT_ENCRYPT KEX_CLIENT_ENCRYPT_DFLT

+ #define KEX_SERVER_MAC KEX_SERVER_MAC_DFLT

+ #define KEX_CLIENT_MAC KEX_CLIENT_MAC_DFLT

+#endif /* ENABLE_OPENSSL_FIPS */

 #else /* WITH_OPENSSL */

diff -pur old/ssh-add.1 new/ssh-add.1

--- old/ssh-add.1

+++ new/ssh-add.1

@@ -116,6 +116,8 @@ and

 .Dq sha256 .

 The default is

 .Dq sha256 .

+If OpenSSL is running in FIPS-140 mode, the only supported option is

+.Dq sha256 .

 .It Fl e Ar pkcs11

 Remove keys provided by the PKCS#11 shared library

 .Ar pkcs11 .

diff -pur old/ssh-add.c new/ssh-add.c

--- old/ssh-add.c

+++ new/ssh-add.c

@@ -488,6 +488,12 @@ main(int argc, char **argv)

 	__progname = ssh_get_progname(argv[0]);

 	seed_rng();

+#ifdef ENABLE_OPENSSL_FIPS

+	if (ssh_FIPS_mode_set_if_capable()) {

+		fprintf(stderr, "Setting FIPS mode failed!");

+		exit(1);

+	}

+#endif

 #ifdef WITH_OPENSSL

 	OpenSSL_add_all_algorithms();

 #endif

diff -pur old/ssh-agent.1 new/ssh-agent.1

--- old/ssh-agent.1

+++ new/ssh-agent.1

 .Dq sha256 .

 The default is

 .Dq sha256 .

+If OpenSSL is running in FIPS-140 mode, the only supported option is

+.Dq sha256 .

 .It Fl k

 Kill the current agent (given by the

 .Ev SSH_AGENT_PID

diff -pur old/ssh-agent.c new/ssh-agent.c

--- old/ssh-agent.c

+++ new/ssh-agent.c

 	struct timeval *tvp = NULL;

 	size_t len;

 	mode_t prev_mask;

+	int fips_err;

 	ssh_malloc_init();	/* must be called before any mallocs */

 	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */

 	platform_disable_tracing(0);	/* strict=no */

+#ifdef ENABLE_OPENSSL_FIPS

+	fips_err = ssh_FIPS_mode_set_if_capable();

+#endif

 #ifdef WITH_OPENSSL

 	OpenSSL_add_all_algorithms();

 #endif

 		printf(format, SSH_AUTHSOCKET_ENV_NAME, socket_name,

 		    SSH_AUTHSOCKET_ENV_NAME);

 		printf("echo Agent pid %ld;\n", (long)parent_pid);

+#ifdef ENABLE_OPENSSL_FIPS