On 11/02/2016 11:33 PM, Damien Miller wrote:
On Wed, 2 Nov 2016, Stuart Henderson wrote:
On 2016-11-02, Jakub Jelen <jjelen@xxxxxxxxxx> wrote:
The current set of patches are rebased on current upstream is attached
with few more tweaks needed to build, pass testsuite and make it work.
The upstream review and insight would be helpful.
Since these are going to break things with LibreSSL, I doubt they'll be
acceptable as-is.
This is the nub of the problem: upstream (OpenBSD) OpenSSH targets
LibreSSL natively (it's also used by Apple for their OS X builds). If we
pick up the 1.1.0 patch, we'd probably have to do it in portable because
there's little point in patching OpenBSD for API that doesn't exist
there. I don't want to have to carry such a major divergence in just the
portable tree.
Thank you for the comments. I understand the upstream directions and
that the OpenSSL step is not ideal. The distros will probably have to
carry these patches until the changes will settle down a bit.
Other possible solution we were discussing here was implementation of
non-OpenSSL specific abstract layer for crypto operations, which would
allow implementation of cryto-library specific bits in separate file
(unlike current situation with calls all over the place) and would
possibly allow different crypto library providers, similar way how the
audit is handled at this moment. It would also abstract the code from
the changes in one or the other crypto library interface. Would
something like this be acceptable for OpenSSH upstream?
Kind regards,
--
Jakub Jelen
Software Engineer
Security Technologies
Red Hat
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
