wok rev 20313
linux, openssh: add tcp_stealth patch
| author | Pascal Bellard <pascal.bellard@slitaz.org> |
|---|---|
| date | Fri May 18 13:47:33 2018 +0200 (2018-05-18) |
| parents | f215c72530a6 |
| children | d5a889ec499e |
| files | linux/receipt linux/stuff/linux-tcp_stealth.u openssh-pam/receipt openssh/receipt openssh/stuff/knock.u tazlito/receipt |
line diff
1.1 --- a/linux/receipt Thu May 17 10:47:21 2018 +0200 1.2 +++ b/linux/receipt Fri May 18 13:47:33 2018 +0200 1.3 @@ -219,6 +219,7 @@ 1.4 $PACKAGE-freeinitrd.u 1.5 $PACKAGE-subroot.u 1.6 $PACKAGE-romfs.u 1.7 +$PACKAGE-tcp_stealth.u 1.8 aufs3-base.patch 1.9 aufs3-standalone.patch 1.10 aufs3-loopback.patch
2.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 2.2 +++ b/linux/stuff/linux-tcp_stealth.u Fri May 18 13:47:33 2018 +0200 2.3 @@ -0,0 +1,630 @@ 2.4 +From https://gnunet.org/knock : 2.5 +https://gnunet.org/sites/default/files/tcp_stealth_3.16_1.diff 2.6 +Signed-off-by: Julian Kirsch <kirschju@sec.in.tum.de> 2.7 +--- 2.8 +diff -Nurp linux-3.16/include/linux/tcp.h linux-3.16-knock/include/linux/tcp.h 2.9 +--- linux-3.16/include/linux/tcp.h 2014-08-03 18:25:02.000000000 -0400 2.10 ++++ linux-3.16-knock/include/linux/tcp.h 2014-08-19 06:15:42.329509665 -0400 2.11 +@@ -20,6 +20,7 @@ 2.12 + 2.13 + #include <linux/skbuff.h> 2.14 + #include <linux/dmaengine.h> 2.15 ++#include <linux/cryptohash.h> 2.16 + #include <net/sock.h> 2.17 + #include <net/inet_connection_sock.h> 2.18 + #include <net/inet_timewait_sock.h> 2.19 +@@ -325,6 +326,21 @@ struct tcp_sock { 2.20 + struct tcp_md5sig_info __rcu *md5sig_info; 2.21 + #endif 2.22 + 2.23 ++#ifdef CONFIG_TCP_STEALTH 2.24 ++/* Stealth TCP socket configuration */ 2.25 ++ struct { 2.26 ++ #define TCP_STEALTH_MODE_AUTH BIT(0) 2.27 ++ #define TCP_STEALTH_MODE_INTEGRITY BIT(1) 2.28 ++ #define TCP_STEALTH_MODE_INTEGRITY_LEN BIT(2) 2.29 ++ int mode; 2.30 ++ u8 secret[MD5_MESSAGE_BYTES]; 2.31 ++ int integrity_len; 2.32 ++ u16 integrity_hash; 2.33 ++ u32 tsval; 2.34 ++ bool saw_tsval; 2.35 ++ } stealth; 2.36 ++#endif 2.37 ++ 2.38 + /* TCP fastopen related information */ 2.39 + struct tcp_fastopen_request *fastopen_req; 2.40 + /* fastopen_rsk points to request_sock that resulted in this big 2.41 +diff -Nurp linux-3.16/include/net/secure_seq.h linux-3.16-knock/include/net/secure_seq.h 2.42 +--- linux-3.16/include/net/secure_seq.h 2014-08-03 18:25:02.000000000 -0400 2.43 ++++ linux-3.16-knock/include/net/secure_seq.h 2014-08-19 05:52:22.389447048 -0400 2.44 +@@ -14,5 +14,10 @@ u64 secure_dccp_sequence_number(__be32 s 2.45 + __be16 sport, __be16 dport); 2.46 + u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr, 2.47 + __be16 sport, __be16 dport); 2.48 ++#ifdef CONFIG_TCP_STEALTH 2.49 ++u32 tcp_stealth_do_auth(struct sock *sk, struct sk_buff *skb); 2.50 ++u32 tcp_stealth_sequence_number(struct sock *sk, __be32 *daddr, 2.51 ++ u32 daddr_size, __be16 dport); 2.52 ++#endif 2.53 + 2.54 + #endif /* _NET_SECURE_SEQ */ 2.55 +diff -Nurp linux-3.16/include/net/tcp.h linux-3.16-knock/include/net/tcp.h 2.56 +--- linux-3.16/include/net/tcp.h 2014-08-03 18:25:02.000000000 -0400 2.57 ++++ linux-3.16-knock/include/net/tcp.h 2014-08-11 07:16:15.968418122 -0400 2.58 +@@ -442,6 +442,12 @@ void tcp_parse_options(const struct sk_b 2.59 + struct tcp_options_received *opt_rx, 2.60 + int estab, struct tcp_fastopen_cookie *foc); 2.61 + const u8 *tcp_parse_md5sig_option(const struct tcphdr *th); 2.62 ++#ifdef CONFIG_TCP_STEALTH 2.63 ++const bool tcp_parse_tsval_option(u32 *tsval, const struct tcphdr *th); 2.64 ++int tcp_stealth_integrity(u16 *hash, u8 *secret, u8 *payload, int len); 2.65 ++#define be32_isn_to_be16_av(x) (((__be16 *)&x)[0]) 2.66 ++#define be32_isn_to_be16_ih(x) (((__be16 *)&x)[1]) 2.67 ++#endif 2.68 + 2.69 + /* 2.70 + * TCP v4 functions exported for the inet6 API 2.71 +diff -Nurp linux-3.16/include/uapi/linux/tcp.h linux-3.16-knock/include/uapi/linux/tcp.h 2.72 +--- linux-3.16/include/uapi/linux/tcp.h 2014-08-03 18:25:02.000000000 -0400 2.73 ++++ linux-3.16-knock/include/uapi/linux/tcp.h 2014-08-11 07:16:15.968418122 -0400 2.74 +@@ -112,6 +112,9 @@ enum { 2.75 + #define TCP_FASTOPEN 23 /* Enable FastOpen on listeners */ 2.76 + #define TCP_TIMESTAMP 24 2.77 + #define TCP_NOTSENT_LOWAT 25 /* limit number of unsent bytes in write queue */ 2.78 ++#define TCP_STEALTH 26 2.79 ++#define TCP_STEALTH_INTEGRITY 27 2.80 ++#define TCP_STEALTH_INTEGRITY_LEN 28 2.81 + 2.82 + struct tcp_repair_opt { 2.83 + __u32 opt_code; 2.84 +diff -Nurp linux-3.16/net/core/secure_seq.c linux-3.16-knock/net/core/secure_seq.c 2.85 +--- linux-3.16/net/core/secure_seq.c 2014-08-03 18:25:02.000000000 -0400 2.86 ++++ linux-3.16-knock/net/core/secure_seq.c 2014-08-19 06:19:31.241519904 -0400 2.87 +@@ -8,7 +8,11 @@ 2.88 + #include <linux/ktime.h> 2.89 + #include <linux/string.h> 2.90 + #include <linux/net.h> 2.91 ++#include <linux/socket.h> 2.92 ++#include <linux/ip.h> 2.93 ++#include <linux/ipv6.h> 2.94 + 2.95 ++#include <net/tcp.h> 2.96 + #include <net/secure_seq.h> 2.97 + 2.98 + #if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_INET) 2.99 +@@ -39,6 +43,102 @@ static u32 seq_scale(u32 seq) 2.100 + } 2.101 + #endif 2.102 + 2.103 ++#ifdef CONFIG_TCP_STEALTH 2.104 ++u32 tcp_stealth_sequence_number(struct sock *sk, __be32 *daddr, 2.105 ++ u32 daddr_size, __be16 dport) 2.106 ++{ 2.107 ++ struct tcp_sock *tp = tcp_sk(sk); 2.108 ++ struct tcp_md5sig_key *md5; 2.109 ++ 2.110 ++ __u32 sec[MD5_MESSAGE_BYTES / sizeof(__u32)]; 2.111 ++ __u32 i; 2.112 ++ __u32 tsval = 0; 2.113 ++ 2.114 ++ __be32 iv[MD5_DIGEST_WORDS] = { 0 }; 2.115 ++ __be32 isn; 2.116 ++ 2.117 ++ memcpy(iv, (const __u8 *)daddr, 2.118 ++ (daddr_size > sizeof(iv)) ? sizeof(iv) : daddr_size); 2.119 ++ 2.120 ++#ifdef CONFIG_TCP_MD5SIG 2.121 ++ md5 = tp->af_specific->md5_lookup(sk, sk); 2.122 ++#else 2.123 ++ md5 = NULL; 2.124 ++#endif 2.125 ++ if (likely(sysctl_tcp_timestamps && !md5) || tp->stealth.saw_tsval) 2.126 ++ tsval = tp->stealth.tsval; 2.127 ++ 2.128 ++ ((__be16 *)iv)[2] ^= cpu_to_be16(tp->stealth.integrity_hash); 2.129 ++ iv[2] ^= cpu_to_be32(tsval); 2.130 ++ ((__be16 *)iv)[6] ^= dport; 2.131 ++ 2.132 ++ for (i = 0; i < MD5_DIGEST_WORDS; i++) 2.133 ++ iv[i] = le32_to_cpu(iv[i]); 2.134 ++ for (i = 0; i < MD5_MESSAGE_BYTES / sizeof(__le32); i++) 2.135 ++ sec[i] = le32_to_cpu(((__le32 *)tp->stealth.secret)[i]); 2.136 ++ 2.137 ++ md5_transform(iv, sec); 2.138 ++ 2.139 ++ isn = cpu_to_be32(iv[0]) ^ cpu_to_be32(iv[1]) ^ 2.140 ++ cpu_to_be32(iv[2]) ^ cpu_to_be32(iv[3]); 2.141 ++ 2.142 ++ if (tp->stealth.mode & TCP_STEALTH_MODE_INTEGRITY) 2.143 ++ be32_isn_to_be16_ih(isn) = 2.144 ++ cpu_to_be16(tp->stealth.integrity_hash); 2.145 ++ 2.146 ++ return be32_to_cpu(isn); 2.147 ++} 2.148 ++EXPORT_SYMBOL(tcp_stealth_sequence_number); 2.149 ++ 2.150 ++u32 tcp_stealth_do_auth(struct sock *sk, struct sk_buff *skb) 2.151 ++{ 2.152 ++ struct tcp_sock *tp = tcp_sk(sk); 2.153 ++ struct tcphdr *th = tcp_hdr(skb); 2.154 ++ __be32 isn = th->seq; 2.155 ++ __be32 hash; 2.156 ++ __be32 *daddr; 2.157 ++ u32 daddr_size; 2.158 ++ 2.159 ++ tp->stealth.saw_tsval = tcp_parse_tsval_option(&tp->stealth.tsval, th); 2.160 ++ 2.161 ++ if (tp->stealth.mode & TCP_STEALTH_MODE_INTEGRITY_LEN) 2.162 ++ tp->stealth.integrity_hash = 2.163 ++ be16_to_cpu(be32_isn_to_be16_ih(isn)); 2.164 ++ 2.165 ++ switch (tp->inet_conn.icsk_inet.sk.sk_family) { 2.166 ++#if IS_ENABLED(CONFIG_IPV6) 2.167 ++ case PF_INET6: 2.168 ++ daddr_size = sizeof(ipv6_hdr(skb)->daddr.s6_addr32); 2.169 ++ daddr = ipv6_hdr(skb)->daddr.s6_addr32; 2.170 ++ break; 2.171 ++#endif 2.172 ++ case PF_INET: 2.173 ++ daddr_size = sizeof(ip_hdr(skb)->daddr); 2.174 ++ daddr = &ip_hdr(skb)->daddr; 2.175 ++ break; 2.176 ++ default: 2.177 ++ pr_err("TCP Stealth: Unknown network layer protocol, stop!\n"); 2.178 ++ return 1; 2.179 ++ } 2.180 ++ 2.181 ++ hash = tcp_stealth_sequence_number(sk, daddr, daddr_size, th->dest); 2.182 ++ cpu_to_be32s(&hash); 2.183 ++ 2.184 ++ if (tp->stealth.mode & TCP_STEALTH_MODE_AUTH && 2.185 ++ tp->stealth.mode & TCP_STEALTH_MODE_INTEGRITY_LEN && 2.186 ++ be32_isn_to_be16_av(isn) == be32_isn_to_be16_av(hash)) 2.187 ++ return 0; 2.188 ++ 2.189 ++ if (tp->stealth.mode & TCP_STEALTH_MODE_AUTH && 2.190 ++ !(tp->stealth.mode & TCP_STEALTH_MODE_INTEGRITY_LEN) && 2.191 ++ isn == hash) 2.192 ++ return 0; 2.193 ++ 2.194 ++ return 1; 2.195 ++} 2.196 ++EXPORT_SYMBOL(tcp_stealth_do_auth); 2.197 ++#endif 2.198 ++ 2.199 + #if IS_ENABLED(CONFIG_IPV6) 2.200 + __u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr, 2.201 + __be16 sport, __be16 dport) 2.202 +diff -Nurp linux-3.16/net/ipv4/Kconfig linux-3.16-knock/net/ipv4/Kconfig 2.203 +--- linux-3.16/net/ipv4/Kconfig 2014-08-03 18:25:02.000000000 -0400 2.204 ++++ linux-3.16-knock/net/ipv4/Kconfig 2014-08-11 07:16:15.968418122 -0400 2.205 +@@ -618,3 +618,13 @@ config TCP_MD5SIG 2.206 + on the Internet. 2.207 + 2.208 + If unsure, say N. 2.209 ++ 2.210 ++config TCP_STEALTH 2.211 ++ bool "TCP: Stealth TCP socket support" 2.212 ++ default n 2.213 ++ ---help--- 2.214 ++ This option enables support for stealth TCP sockets. If you do not 2.215 ++ know what this means, you do not need it. 2.216 ++ 2.217 ++ If unsure, say N. 2.218 ++ 2.219 +diff -Nurp linux-3.16/net/ipv4/tcp.c linux-3.16-knock/net/ipv4/tcp.c 2.220 +--- linux-3.16/net/ipv4/tcp.c 2014-08-03 18:25:02.000000000 -0400 2.221 ++++ linux-3.16-knock/net/ipv4/tcp.c 2014-08-19 06:17:19.497514011 -0400 2.222 +@@ -2443,6 +2443,43 @@ static int tcp_repair_options_est(struct 2.223 + return 0; 2.224 + } 2.225 + 2.226 ++#ifdef CONFIG_TCP_STEALTH 2.227 ++int tcp_stealth_integrity(__be16 *hash, u8 *secret, u8 *payload, int len) 2.228 ++{ 2.229 ++ struct scatterlist sg[2]; 2.230 ++ struct crypto_hash *tfm; 2.231 ++ struct hash_desc desc; 2.232 ++ __be16 h[MD5_DIGEST_WORDS * 2]; 2.233 ++ int i; 2.234 ++ int err = 0; 2.235 ++ 2.236 ++ tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); 2.237 ++ if (IS_ERR(tfm)) { 2.238 ++ err = -PTR_ERR(tfm); 2.239 ++ goto out; 2.240 ++ } 2.241 ++ desc.tfm = tfm; 2.242 ++ desc.flags = 0; 2.243 ++ 2.244 ++ sg_init_table(sg, 2); 2.245 ++ sg_set_buf(&sg[0], secret, MD5_MESSAGE_BYTES); 2.246 ++ sg_set_buf(&sg[1], payload, len); 2.247 ++ 2.248 ++ if (crypto_hash_digest(&desc, sg, MD5_MESSAGE_BYTES + len, (u8 *)h)) { 2.249 ++ err = -EFAULT; 2.250 ++ goto out; 2.251 ++ } 2.252 ++ 2.253 ++ *hash = be16_to_cpu(h[0]); 2.254 ++ for (i = 1; i < MD5_DIGEST_WORDS * 2; i++) 2.255 ++ *hash ^= be16_to_cpu(h[i]); 2.256 ++ 2.257 ++out: 2.258 ++ crypto_free_hash(tfm); 2.259 ++ return err; 2.260 ++} 2.261 ++#endif 2.262 ++ 2.263 + /* 2.264 + * Socket option code for TCP. 2.265 + */ 2.266 +@@ -2473,6 +2510,67 @@ static int do_tcp_setsockopt(struct sock 2.267 + release_sock(sk); 2.268 + return err; 2.269 + } 2.270 ++#ifdef CONFIG_TCP_STEALTH 2.271 ++ case TCP_STEALTH: { 2.272 ++ u8 secret[MD5_MESSAGE_BYTES]; 2.273 ++ 2.274 ++ if (optlen < MD5_MESSAGE_BYTES) 2.275 ++ return -EINVAL; 2.276 ++ 2.277 ++ val = copy_from_user(secret, optval, MD5_MESSAGE_BYTES); 2.278 ++ if (val != 0) 2.279 ++ return -EFAULT; 2.280 ++ 2.281 ++ lock_sock(sk); 2.282 ++ memcpy(tp->stealth.secret, secret, MD5_MESSAGE_BYTES); 2.283 ++ tp->stealth.mode = TCP_STEALTH_MODE_AUTH; 2.284 ++ tp->stealth.tsval = 0; 2.285 ++ tp->stealth.saw_tsval = false; 2.286 ++ release_sock(sk); 2.287 ++ return err; 2.288 ++ } 2.289 ++ case TCP_STEALTH_INTEGRITY: { 2.290 ++ u8 *payload; 2.291 ++ 2.292 ++ lock_sock(sk); 2.293 ++ 2.294 ++ if (!(tp->stealth.mode & TCP_STEALTH_MODE_AUTH)) { 2.295 ++ err = -EOPNOTSUPP; 2.296 ++ goto stealth_integrity_out_1; 2.297 ++ } 2.298 ++ 2.299 ++ if (optlen < 1 || optlen > USHRT_MAX) { 2.300 ++ err = -EINVAL; 2.301 ++ goto stealth_integrity_out_1; 2.302 ++ } 2.303 ++ 2.304 ++ payload = vmalloc(optlen); 2.305 ++ if (!payload) { 2.306 ++ err = -ENOMEM; 2.307 ++ goto stealth_integrity_out_1; 2.308 ++ } 2.309 ++ 2.310 ++ val = copy_from_user(payload, optval, optlen); 2.311 ++ if (val != 0) { 2.312 ++ err = -EFAULT; 2.313 ++ goto stealth_integrity_out_2; 2.314 ++ } 2.315 ++ 2.316 ++ err = tcp_stealth_integrity(&tp->stealth.integrity_hash, 2.317 ++ tp->stealth.secret, payload, 2.318 ++ optlen); 2.319 ++ if (err) 2.320 ++ goto stealth_integrity_out_2; 2.321 ++ 2.322 ++ tp->stealth.mode |= TCP_STEALTH_MODE_INTEGRITY; 2.323 ++ 2.324 ++stealth_integrity_out_2: 2.325 ++ vfree(payload); 2.326 ++stealth_integrity_out_1: 2.327 ++ release_sock(sk); 2.328 ++ return err; 2.329 ++ } 2.330 ++#endif 2.331 + default: 2.332 + /* fallthru */ 2.333 + break; 2.334 +@@ -2717,6 +2815,18 @@ static int do_tcp_setsockopt(struct sock 2.335 + tp->notsent_lowat = val; 2.336 + sk->sk_write_space(sk); 2.337 + break; 2.338 ++#ifdef CONFIG_TCP_STEALTH 2.339 ++ case TCP_STEALTH_INTEGRITY_LEN: 2.340 ++ if (!(tp->stealth.mode & TCP_STEALTH_MODE_AUTH)) { 2.341 ++ err = -EOPNOTSUPP; 2.342 ++ } else if (val < 1 || val > USHRT_MAX) { 2.343 ++ err = -EINVAL; 2.344 ++ } else { 2.345 ++ tp->stealth.integrity_len = val; 2.346 ++ tp->stealth.mode |= TCP_STEALTH_MODE_INTEGRITY_LEN; 2.347 ++ } 2.348 ++ break; 2.349 ++#endif 2.350 + default: 2.351 + err = -ENOPROTOOPT; 2.352 + break; 2.353 +diff -Nurp linux-3.16/net/ipv4/tcp_input.c linux-3.16-knock/net/ipv4/tcp_input.c 2.354 +--- linux-3.16/net/ipv4/tcp_input.c 2014-08-03 18:25:02.000000000 -0400 2.355 ++++ linux-3.16-knock/net/ipv4/tcp_input.c 2014-08-18 13:08:23.956054243 -0400 2.356 +@@ -76,6 +76,9 @@ 2.357 + #include <net/netdma.h> 2.358 + 2.359 + int sysctl_tcp_timestamps __read_mostly = 1; 2.360 ++#ifdef CONFIG_TCP_STEALTH 2.361 ++EXPORT_SYMBOL(sysctl_tcp_timestamps); 2.362 ++#endif 2.363 + int sysctl_tcp_window_scaling __read_mostly = 1; 2.364 + int sysctl_tcp_sack __read_mostly = 1; 2.365 + int sysctl_tcp_fack __read_mostly = 1; 2.366 +@@ -3666,6 +3669,47 @@ static bool tcp_fast_parse_options(const 2.367 + return true; 2.368 + } 2.369 + 2.370 ++#ifdef CONFIG_TCP_STEALTH 2.371 ++/* Parse only the TSVal field of the TCP Timestamp option header. 2.372 ++ */ 2.373 ++const bool tcp_parse_tsval_option(u32 *tsval, const struct tcphdr *th) 2.374 ++{ 2.375 ++ int length = (th->doff << 2) - sizeof(*th); 2.376 ++ const u8 *ptr = (const u8 *)(th + 1); 2.377 ++ 2.378 ++ /* If the TCP option is too short, we can short cut */ 2.379 ++ if (length < TCPOLEN_TIMESTAMP) 2.380 ++ return false; 2.381 ++ 2.382 ++ while (length > 0) { 2.383 ++ int opcode = *ptr++; 2.384 ++ int opsize; 2.385 ++ 2.386 ++ switch (opcode) { 2.387 ++ case TCPOPT_EOL: 2.388 ++ return false; 2.389 ++ case TCPOPT_NOP: 2.390 ++ length--; 2.391 ++ continue; 2.392 ++ case TCPOPT_TIMESTAMP: 2.393 ++ opsize = *ptr++; 2.394 ++ if (opsize != TCPOLEN_TIMESTAMP || opsize > length) 2.395 ++ return false; 2.396 ++ *tsval = get_unaligned_be32(ptr); 2.397 ++ return true; 2.398 ++ default: 2.399 ++ opsize = *ptr++; 2.400 ++ if (opsize < 2 || opsize > length) 2.401 ++ return false; 2.402 ++ } 2.403 ++ ptr += opsize - 2; 2.404 ++ length -= opsize; 2.405 ++ } 2.406 ++ return false; 2.407 ++} 2.408 ++EXPORT_SYMBOL(tcp_parse_tsval_option); 2.409 ++#endif 2.410 ++ 2.411 + #ifdef CONFIG_TCP_MD5SIG 2.412 + /* 2.413 + * Parse MD5 Signature option 2.414 +@@ -4337,6 +4381,31 @@ err: 2.415 + return -ENOMEM; 2.416 + } 2.417 + 2.418 ++#ifdef CONFIG_TCP_STEALTH 2.419 ++static int __tcp_stealth_integrity_check(struct sock *sk, struct sk_buff *skb) 2.420 ++{ 2.421 ++ struct tcphdr *th = tcp_hdr(skb); 2.422 ++ struct tcp_sock *tp = tcp_sk(sk); 2.423 ++ u16 hash; 2.424 ++ __be32 seq = cpu_to_be32(TCP_SKB_CB(skb)->seq - 1); 2.425 ++ char *data = skb->data + th->doff * 4; 2.426 ++ int len = skb->len - th->doff * 4; 2.427 ++ 2.428 ++ if (len < tp->stealth.integrity_len) 2.429 ++ return 1; 2.430 ++ 2.431 ++ if (tcp_stealth_integrity(&hash, tp->stealth.secret, data, 2.432 ++ tp->stealth.integrity_len)) 2.433 ++ return 1; 2.434 ++ 2.435 ++ if (be32_isn_to_be16_ih(seq) != cpu_to_be16(hash)) 2.436 ++ return 1; 2.437 ++ 2.438 ++ tp->stealth.mode &= ~TCP_STEALTH_MODE_INTEGRITY_LEN; 2.439 ++ return 0; 2.440 ++} 2.441 ++#endif 2.442 ++ 2.443 + static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) 2.444 + { 2.445 + const struct tcphdr *th = tcp_hdr(skb); 2.446 +@@ -4347,6 +4416,14 @@ static void tcp_data_queue(struct sock * 2.447 + if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) 2.448 + goto drop; 2.449 + 2.450 ++#ifdef CONFIG_TCP_STEALTH 2.451 ++ if (unlikely(tp->stealth.mode & TCP_STEALTH_MODE_INTEGRITY_LEN) && 2.452 ++ __tcp_stealth_integrity_check(sk, skb)) { 2.453 ++ tcp_reset(sk); 2.454 ++ goto drop; 2.455 ++ } 2.456 ++#endif 2.457 ++ 2.458 + skb_dst_drop(skb); 2.459 + __skb_pull(skb, th->doff * 4); 2.460 + 2.461 +@@ -5171,6 +5248,15 @@ void tcp_rcv_established(struct sock *sk 2.462 + int copied_early = 0; 2.463 + bool fragstolen = false; 2.464 + 2.465 ++#ifdef CONFIG_TCP_STEALTH 2.466 ++ if (unlikely(tp->stealth.mode & 2.467 ++ TCP_STEALTH_MODE_INTEGRITY_LEN) && 2.468 ++ __tcp_stealth_integrity_check(sk, skb)) { 2.469 ++ tcp_reset(sk); 2.470 ++ goto discard; 2.471 ++ } 2.472 ++#endif 2.473 ++ 2.474 + if (tp->copied_seq == tp->rcv_nxt && 2.475 + len - tcp_header_len <= tp->ucopy.len) { 2.476 + #ifdef CONFIG_NET_DMA 2.477 +diff -Nurp linux-3.16/net/ipv4/tcp_ipv4.c linux-3.16-knock/net/ipv4/tcp_ipv4.c 2.478 +--- linux-3.16/net/ipv4/tcp_ipv4.c 2014-08-03 18:25:02.000000000 -0400 2.479 ++++ linux-3.16-knock/net/ipv4/tcp_ipv4.c 2014-08-19 05:50:27.217441897 -0400 2.480 +@@ -76,6 +76,7 @@ 2.481 + #include <net/secure_seq.h> 2.482 + #include <net/tcp_memcontrol.h> 2.483 + #include <net/busy_poll.h> 2.484 ++#include <net/secure_seq.h> 2.485 + 2.486 + #include <linux/inet.h> 2.487 + #include <linux/ipv6.h> 2.488 +@@ -235,6 +236,21 @@ int tcp_v4_connect(struct sock *sk, stru 2.489 + sk->sk_gso_type = SKB_GSO_TCPV4; 2.490 + sk_setup_caps(sk, &rt->dst); 2.491 + 2.492 ++#ifdef CONFIG_TCP_STEALTH 2.493 ++ /* If CONFIG_TCP_STEALTH is defined, we need to know the timestamp as 2.494 ++ * early as possible and thus move taking the snapshot of tcp_time_stamp 2.495 ++ * here. 2.496 ++ */ 2.497 ++ tp->stealth.tsval = tcp_time_stamp; 2.498 ++ 2.499 ++ if (!tp->write_seq && likely(!tp->repair) && 2.500 ++ unlikely(tp->stealth.mode & TCP_STEALTH_MODE_AUTH)) 2.501 ++ tp->write_seq = tcp_stealth_sequence_number(sk, 2.502 ++ &inet->inet_daddr, 2.503 ++ sizeof(inet->inet_daddr), 2.504 ++ usin->sin_port); 2.505 ++#endif 2.506 ++ 2.507 + if (!tp->write_seq && likely(!tp->repair)) 2.508 + tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr, 2.509 + inet->inet_daddr, 2.510 +@@ -1546,6 +1562,8 @@ static struct sock *tcp_v4_hnd_req(struc 2.511 + */ 2.512 + int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) 2.513 + { 2.514 ++ struct tcp_sock *tp = tcp_sk(sk); 2.515 ++ struct tcphdr *th = tcp_hdr(skb); 2.516 + struct sock *rsk; 2.517 + #ifdef CONFIG_TCP_MD5SIG 2.518 + /* 2.519 +@@ -1576,6 +1594,15 @@ int tcp_v4_do_rcv(struct sock *sk, struc 2.520 + if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb)) 2.521 + goto csum_err; 2.522 + 2.523 ++#ifdef CONFIG_TCP_STEALTH 2.524 ++ if (sk->sk_state == TCP_LISTEN && th->syn && !th->fin && 2.525 ++ unlikely(tp->stealth.mode & TCP_STEALTH_MODE_AUTH) && 2.526 ++ tcp_stealth_do_auth(sk, skb)) { 2.527 ++ rsk = sk; 2.528 ++ goto reset; 2.529 ++ } 2.530 ++#endif 2.531 ++ 2.532 + if (sk->sk_state == TCP_LISTEN) { 2.533 + struct sock *nsk = tcp_v4_hnd_req(sk, skb); 2.534 + if (!nsk) 2.535 +diff -Nurp linux-3.16/net/ipv4/tcp_output.c linux-3.16-knock/net/ipv4/tcp_output.c 2.536 +--- linux-3.16/net/ipv4/tcp_output.c 2014-08-03 18:25:02.000000000 -0400 2.537 ++++ linux-3.16-knock/net/ipv4/tcp_output.c 2014-08-11 07:29:32.776405670 -0400 2.538 +@@ -2486,10 +2486,22 @@ int __tcp_retransmit_skb(struct sock *sk 2.539 + 2.540 + tcp_retrans_try_collapse(sk, skb, cur_mss); 2.541 + 2.542 ++#ifdef CONFIG_TCP_STEALTH 2.543 ++ if (unlikely(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN && 2.544 ++ tp->stealth.mode & TCP_STEALTH_MODE_AUTH)) { 2.545 ++ /* If TCP stealth is active, reuse the timestamp from the first 2.546 ++ * SYN. 2.547 ++ */ 2.548 ++ TCP_SKB_CB(skb)->when = tp->stealth.tsval; 2.549 ++ } else { 2.550 ++ TCP_SKB_CB(skb)->when = tcp_time_stamp; 2.551 ++ } 2.552 ++#else 2.553 + /* Make a copy, if the first transmission SKB clone we made 2.554 + * is still in somebody's hands, else make a clone. 2.555 + */ 2.556 + TCP_SKB_CB(skb)->when = tcp_time_stamp; 2.557 ++#endif 2.558 + 2.559 + /* make sure skb->data is aligned on arches that require it 2.560 + * and check if ack-trimming & collapsing extended the headroom 2.561 +@@ -3094,7 +3106,15 @@ int tcp_connect(struct sock *sk) 2.562 + return -ENOBUFS; 2.563 + 2.564 + tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN); 2.565 ++#ifdef CONFIG_TCP_STEALTH 2.566 ++ /* The timetamp was already set at the time the ISN was generated 2.567 ++ * as we need to know its value in the stealth_tcp_sequence_number() 2.568 ++ * function. 2.569 ++ */ 2.570 ++ tp->retrans_stamp = TCP_SKB_CB(buff)->when = tp->stealth.tsval; 2.571 ++#else 2.572 + tp->retrans_stamp = TCP_SKB_CB(buff)->when = tcp_time_stamp; 2.573 ++#endif 2.574 + tcp_connect_queue_skb(sk, buff); 2.575 + TCP_ECN_send_syn(sk, buff); 2.576 + 2.577 +diff -Nurp linux-3.16/net/ipv6/tcp_ipv6.c linux-3.16-knock/net/ipv6/tcp_ipv6.c 2.578 +--- linux-3.16/net/ipv6/tcp_ipv6.c 2014-08-03 18:25:02.000000000 -0400 2.579 ++++ linux-3.16-knock/net/ipv6/tcp_ipv6.c 2014-08-19 06:24:12.497532484 -0400 2.580 +@@ -64,6 +64,7 @@ 2.581 + #include <net/secure_seq.h> 2.582 + #include <net/tcp_memcontrol.h> 2.583 + #include <net/busy_poll.h> 2.584 ++#include <net/secure_seq.h> 2.585 + 2.586 + #include <linux/proc_fs.h> 2.587 + #include <linux/seq_file.h> 2.588 +@@ -294,6 +295,21 @@ static int tcp_v6_connect(struct sock *s 2.589 + if (err) 2.590 + goto late_failure; 2.591 + 2.592 ++#ifdef CONFIG_TCP_STEALTH 2.593 ++ /* If CONFIG_TCP_STEALTH is defined, we need to know the timestamp as 2.594 ++ * early as possible and thus move taking the snapshot of tcp_time_stamp 2.595 ++ * here. 2.596 ++ */ 2.597 ++ tp->stealth.tsval = tcp_time_stamp; 2.598 ++ 2.599 ++ if (!tp->write_seq && likely(!tp->repair) && 2.600 ++ unlikely(tp->stealth.mode & TCP_STEALTH_MODE_AUTH)) 2.601 ++ tp->write_seq = tcp_stealth_sequence_number(sk, 2.602 ++ sk->sk_v6_daddr.s6_addr32, 2.603 ++ sizeof(sk->sk_v6_daddr), 2.604 ++ inet->inet_dport); 2.605 ++#endif 2.606 ++ 2.607 + if (!tp->write_seq && likely(!tp->repair)) 2.608 + tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32, 2.609 + sk->sk_v6_daddr.s6_addr32, 2.610 +@@ -1343,7 +1359,8 @@ out: 2.611 + static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) 2.612 + { 2.613 + struct ipv6_pinfo *np = inet6_sk(sk); 2.614 +- struct tcp_sock *tp; 2.615 ++ struct tcp_sock *tp = tcp_sk(sk); 2.616 ++ struct tcphdr *th = tcp_hdr(skb); 2.617 + struct sk_buff *opt_skb = NULL; 2.618 + 2.619 + /* Imagine: socket is IPv6. IPv4 packet arrives, 2.620 +@@ -1407,6 +1424,13 @@ static int tcp_v6_do_rcv(struct sock *sk 2.621 + if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb)) 2.622 + goto csum_err; 2.623 + 2.624 ++#ifdef CONFIG_TCP_STEALTH 2.625 ++ if (sk->sk_state == TCP_LISTEN && th->syn && !th->fin && 2.626 ++ tp->stealth.mode & TCP_STEALTH_MODE_AUTH && 2.627 ++ tcp_stealth_do_auth(sk, skb)) 2.628 ++ goto reset; 2.629 ++#endif 2.630 ++ 2.631 + if (sk->sk_state == TCP_LISTEN) { 2.632 + struct sock *nsk = tcp_v6_hnd_req(sk, skb); 2.633 + if (!nsk)
3.1 --- a/openssh-pam/receipt Thu May 17 10:47:21 2018 +0200 3.2 +++ b/openssh-pam/receipt Fri May 18 13:47:33 2018 +0200 3.3 @@ -21,6 +21,7 @@ 3.4 # Rules to configure and make the package. 3.5 compile_rules() 3.6 { 3.7 + patch -p1 < ../$SOURCE/stuff/knock.u 3.8 unset LD # for cross compiling with --disable-strip 3.9 ./configure \ 3.10 --prefix=/usr \
4.1 --- a/openssh/receipt Thu May 17 10:47:21 2018 +0200 4.2 +++ b/openssh/receipt Fri May 18 13:47:33 2018 +0200 4.3 @@ -21,6 +21,7 @@ 4.4 # Rules to configure and make the package. 4.5 compile_rules() 4.6 { 4.7 + patch -p1 < $stuff/knock.u 4.8 unset LD # for cross compiling with --disable-strip 4.9 ./configure \ 4.10 --prefix=/usr \
5.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 5.2 +++ b/openssh/stuff/knock.u Fri May 18 13:47:33 2018 +0200 5.3 @@ -0,0 +1,504 @@ 5.4 +From https://gnunet.org/knock : 5.5 +https://gnunet.org/sites/default/files/openssh-linux-knock-patch.diff 5.6 +--- a/readconf.c 5.7 ++++ b/readconf.c 5.8 +@@ -172,6 +172,9 @@ 5.9 + oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys, 5.10 + oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes, 5.11 + oPubkeyAcceptedKeyTypes, oProxyJump, 5.12 ++#ifdef TCP_STEALTH 5.13 ++ oTCPStealthSecret, 5.14 ++#endif 5.15 + oIgnore, oIgnoredUnknownOption, oDeprecated, oUnsupported 5.16 + } OpCodes; 5.17 + 5.18 +@@ -305,6 +308,9 @@ 5.19 + { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes }, 5.20 + { "ignoreunknown", oIgnoreUnknown }, 5.21 + { "proxyjump", oProxyJump }, 5.22 ++#ifdef TCP_STEALTH 5.23 ++ { "tcpstealthsecret", oTCPStealthSecret }, 5.24 ++#endif 5.25 + 5.26 + { NULL, oBadOption } 5.27 + }; 5.28 +@@ -1669,6 +1675,23 @@ 5.29 + charptr = &options->identity_agent; 5.30 + goto parse_string; 5.31 + 5.32 ++#ifdef TCP_STEALTH 5.33 ++ case oTCPStealthSecret: 5.34 ++ charptr = &options->tcp_stealth_secret; 5.35 ++ 5.36 ++ arg = strdelim(&s); 5.37 ++ if (!arg || *arg == '\0') 5.38 ++ fatal("%.200s line %d: Missing argument.", 5.39 ++ filename, linenum); 5.40 ++ 5.41 ++ if (*activep && *charptr == NULL) { 5.42 ++ *charptr = xmalloc(TCP_STEALTH_SECRET_SIZE + 1); 5.43 ++ memset(*charptr, 0x00, TCP_STEALTH_SECRET_SIZE + 1); 5.44 ++ strncpy(*charptr, arg, TCP_STEALTH_SECRET_SIZE); 5.45 ++ } 5.46 ++ 5.47 ++ break; 5.48 ++#endif 5.49 + case oDeprecated: 5.50 + debug("%s line %d: Deprecated option \"%s\"", 5.51 + filename, linenum, keyword); 5.52 +@@ -1869,6 +1892,9 @@ 5.53 + options->update_hostkeys = -1; 5.54 + options->hostbased_key_types = NULL; 5.55 + options->pubkey_key_types = NULL; 5.56 ++#ifdef TCP_STEALTH 5.57 ++ options->tcp_stealth_secret = NULL; 5.58 ++#endif 5.59 + } 5.60 + 5.61 + /* 5.62 +--- a/readconf.h 5.63 ++++ b/readconf.h 5.64 +@@ -164,6 +164,10 @@ 5.65 + char *jump_extra; 5.66 + 5.67 + char *ignored_unknown; /* Pattern list of unknown tokens to ignore */ 5.68 ++ 5.69 ++#ifdef TCP_STEALTH 5.70 ++ char *tcp_stealth_secret; 5.71 ++#endif 5.72 + } Options; 5.73 + 5.74 + #define SSH_CANONICALISE_NO 0 5.75 +--- a/servconf.c 5.76 ++++ b/servconf.c 5.77 +@@ -165,6 +165,9 @@ 5.78 + options->fingerprint_hash = -1; 5.79 + options->disable_forwarding = -1; 5.80 + options->expose_userauth_info = -1; 5.81 ++#ifdef TCP_STEALTH 5.82 ++ options->tcp_stealth_secret = NULL; 5.83 ++#endif 5.84 + } 5.85 + 5.86 + /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ 5.87 +@@ -422,6 +425,9 @@ 5.88 + sStreamLocalBindMask, sStreamLocalBindUnlink, 5.89 + sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, 5.90 + sExposeAuthInfo, 5.91 ++#ifdef TCP_STEALTH 5.92 ++ sTCPStealthSecret, 5.93 ++#endif 5.94 + sDeprecated, sIgnore, sUnsupported 5.95 + } ServerOpCodes; 5.96 + 5.97 +@@ -566,6 +572,9 @@ 5.98 + { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL }, 5.99 + { "disableforwarding", sDisableForwarding, SSHCFG_ALL }, 5.100 + { "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL }, 5.101 ++#ifdef TCP_STEALTH 5.102 ++ { "tcpstealthsecret", sTCPStealthSecret }, 5.103 ++#endif 5.104 + { NULL, sBadOption, 0 } 5.105 + }; 5.106 + 5.107 +@@ -1883,6 +1892,23 @@ 5.108 + intptr = &options->expose_userauth_info; 5.109 + goto parse_flag; 5.110 + 5.111 ++#ifdef TCP_STEALTH 5.112 ++ case sTCPStealthSecret: 5.113 ++ charptr = &options->tcp_stealth_secret; 5.114 ++ 5.115 ++ arg = strdelim(&cp); 5.116 ++ if (!arg || *arg == '\0') 5.117 ++ fatal("%s line %d: Missing argument.", 5.118 ++ filename, linenum); 5.119 ++ 5.120 ++ if (*activep && *charptr == NULL) { 5.121 ++ *charptr = xmalloc(TCP_STEALTH_SECRET_SIZE + 1); 5.122 ++ memset(*charptr, 0x00, TCP_STEALTH_SECRET_SIZE + 1); 5.123 ++ strncpy(*charptr, arg, TCP_STEALTH_SECRET_SIZE); 5.124 ++ } 5.125 ++ 5.126 ++ break; 5.127 ++#endif 5.128 + case sDeprecated: 5.129 + case sIgnore: 5.130 + case sUnsupported: 5.131 +--- a/servconf.h 5.132 ++++ b/servconf.h 5.133 +@@ -198,6 +198,10 @@ 5.134 + 5.135 + int fingerprint_hash; 5.136 + int expose_userauth_info; 5.137 ++ 5.138 ++#ifdef TCP_STEALTH 5.139 ++ char *tcp_stealth_secret; 5.140 ++#endif 5.141 + } ServerOptions; 5.142 + 5.143 + /* Information about the incoming connection as used by Match */ 5.144 +@@ -219,6 +223,11 @@ 5.145 + * NB. an option must appear in servconf.c:copy_set_server_options() or 5.146 + * COPY_MATCH_STRING_OPTS here but never both. 5.147 + */ 5.148 ++#ifdef TCP_STEALTH 5.149 ++#define M_CP_STEALTHSCRT(X) M_CP_STROPT(X); 5.150 ++#else 5.151 ++#define M_CP_STEALTHSCRT(X) 5.152 ++#endif 5.153 + #define COPY_MATCH_STRING_OPTS() do { \ 5.154 + M_CP_STROPT(banner); \ 5.155 + M_CP_STROPT(trusted_user_ca_keys); \ 5.156 +@@ -238,6 +247,7 @@ 5.157 + M_CP_STRARRAYOPT(accept_env, num_accept_env); \ 5.158 + M_CP_STRARRAYOPT(auth_methods, num_auth_methods); \ 5.159 + M_CP_STRARRAYOPT_ALLOC(permitted_opens, num_permitted_opens); \ 5.160 ++ M_CP_STEALTHSCRT(tcp_stealth_secret); \ 5.161 + } while (0) 5.162 + 5.163 + struct connection_info *get_connection_info(int, int); 5.164 +--- a/ssh.c 5.165 ++++ b/ssh.c 5.166 +@@ -191,6 +191,14 @@ 5.167 + extern int muxserver_sock; 5.168 + extern u_int muxclient_command; 5.169 + 5.170 ++#ifdef TCP_STEALTH 5.171 ++#define OPT_STEALTH "[-z tcp_stealth_secret] " 5.172 ++#define GETOPT_STEALTH "z:" 5.173 ++#else 5.174 ++#define OPT_STEALTH "" 5.175 ++#define GETOPT_STEALTH "" 5.176 ++#endif 5.177 ++ 5.178 + /* Prints a help message to the user. This function never returns. */ 5.179 + 5.180 + static void 5.181 +@@ -203,7 +211,7 @@ 5.182 + " [-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]\n" 5.183 + " [-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]\n" 5.184 + " [-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]]\n" 5.185 +-" [user@]hostname [command]\n" 5.186 ++" " OPT_STEALTH "[user@]hostname [command]\n" 5.187 + ); 5.188 + exit(255); 5.189 + } 5.190 +@@ -612,7 +620,7 @@ 5.191 + 5.192 + again: 5.193 + while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx" 5.194 +- "ACD:E:F:GI:J:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) { 5.195 ++ "ACD:E:F:GI:J:KL:MNO:PQ:R:S:TVw:W:XYy" GETOPT_STEALTH)) != -1) { 5.196 + switch (opt) { 5.197 + case '1': 5.198 + fatal("SSH protocol v.1 is no longer supported"); 5.199 +@@ -921,6 +929,14 @@ 5.200 + case 'F': 5.201 + config = optarg; 5.202 + break; 5.203 ++#ifdef TCP_STEALTH 5.204 ++ case 'z': 5.205 ++ options.tcp_stealth_secret = 5.206 ++ xcalloc(TCP_STEALTH_SECRET_SIZE + 1, sizeof(u_int8_t)); 5.207 ++ strncpy(options.tcp_stealth_secret, optarg, 5.208 ++ TCP_STEALTH_SECRET_SIZE); 5.209 ++ break; 5.210 ++#endif 5.211 + default: 5.212 + usage(); 5.213 + } 5.214 +--- a/sshd.c 5.215 ++++ b/sshd.c 5.216 +@@ -896,6 +896,14 @@ 5.217 + return (r < p) ? 1 : 0; 5.218 + } 5.219 + 5.220 ++#ifdef TCP_STEALTH 5.221 ++#define OPT_STEALTH " [-z tcp_stealth_secret]" 5.222 ++#define GETOPT_STEALTH "z:" 5.223 ++#else 5.224 ++#define OPT_STEALTH "" 5.225 ++#define GETOPT_STEALTH "" 5.226 ++#endif 5.227 ++ 5.228 + static void 5.229 + usage(void) 5.230 + { 5.231 +@@ -911,6 +919,7 @@ 5.232 + "usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]\n" 5.233 + " [-E log_file] [-f config_file] [-g login_grace_time]\n" 5.234 + " [-h host_key_file] [-o option] [-p port] [-u len]\n" 5.235 ++" " OPT_STEALTH "\n" 5.236 + ); 5.237 + exit(1); 5.238 + } 5.239 +@@ -1057,6 +1066,15 @@ 5.240 + if (setsockopt(listen_sock, SOL_SOCKET, SO_REUSEADDR, 5.241 + &on, sizeof(on)) == -1) 5.242 + error("setsockopt SO_REUSEADDR: %s", strerror(errno)); 5.243 ++#ifdef TCP_STEALTH 5.244 ++ if (options.tcp_stealth_secret != NULL) { 5.245 ++ if (setsockopt(listen_sock, IPPROTO_TCP, TCP_STEALTH, 5.246 ++ options.tcp_stealth_secret, 5.247 ++ TCP_STEALTH_SECRET_SIZE) == -1) 5.248 ++ error("setsockopt TCP_STEALTH: %s", 5.249 ++ strerror(errno)); 5.250 ++ } 5.251 ++#endif 5.252 + 5.253 + /* Only communicate in IPv6 over AF_INET6 sockets. */ 5.254 + if (ai->ai_family == AF_INET6) 5.255 +@@ -1404,7 +1422,7 @@ 5.256 + 5.257 + /* Parse command-line arguments. */ 5.258 + while ((opt = getopt(ac, av, 5.259 +- "C:E:b:c:f:g:h:k:o:p:u:46DQRTdeiqrt")) != -1) { 5.260 ++ GETOPT_STEALTH "C:E:b:c:f:g:h:k:o:p:u:46DQRTdeiqrt")) != -1) { 5.261 + switch (opt) { 5.262 + case '4': 5.263 + options.address_family = AF_INET; 5.264 +@@ -1512,6 +1530,14 @@ 5.265 + exit(1); 5.266 + free(line); 5.267 + break; 5.268 ++#ifdef TCP_STEALTH 5.269 ++ case 'z': 5.270 ++ options.tcp_stealth_secret = 5.271 ++ xcalloc(TCP_STEALTH_SECRET_SIZE + 1, sizeof(u_int8_t)); 5.272 ++ strncpy(options.tcp_stealth_secret, optarg, 5.273 ++ TCP_STEALTH_SECRET_SIZE); 5.274 ++ break; 5.275 ++#endif 5.276 + case '?': 5.277 + default: 5.278 + usage(); 5.279 +--- a/ssh_config.5 5.280 ++++ b/ssh_config.5 5.281 +@@ -1509,6 +1509,15 @@ 5.282 + .Pp 5.283 + To disable TCP keepalive messages, the value should be set to 5.284 + .Cm no . 5.285 ++.It Cm TCPStealthSecret 5.286 ++Specifies the shared secret which is needed to connect to a stealth SSH TCP 5.287 ++Server. Any string specified will be truncated to or padded with zeroes to 64 5.288 ++bytes. This option needs kernel support and is therefore only available if the 5.289 ++required 5.290 ++.Xr setsockopt 2 5.291 ++call is available. 5.292 ++.Pp 5.293 ++See http://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ for details. 5.294 + .It Cm Tunnel 5.295 + Request 5.296 + .Xr tun 4 5.297 +--- a/sshd_config.5 5.298 ++++ b/sshd_config.5 5.299 +@@ -1444,6 +1444,18 @@ 5.300 + .Pp 5.301 + To disable TCP keepalive messages, the value should be set to 5.302 + .Cm no . 5.303 ++.It Cm TCPStealthSecret 5.304 ++Turns this SSH server into a stealth SSH TCP server. This configuration option 5.305 ++specifies the shared secret needed by the clients in order to be able to connect 5.306 ++to the port the SSH server is listening on. This means that port scanners will 5.307 ++receive a TCP RST and thus will not recognize this TCP port being open. Any 5.308 ++string specified will be truncated or padded with zeroes to 64 bytes. This 5.309 ++option needs kernel support and is therefore only available if the required 5.310 ++.Xr setsockopt 2 5.311 ++call is available. 5.312 ++.Pp 5.313 ++See http://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ for details. 5.314 ++ 5.315 + .It Cm TrustedUserCAKeys 5.316 + Specifies a file containing public keys of certificate authorities that are 5.317 + trusted to sign user certificates for authentication, or 5.318 +--- a/sshd.0 5.319 ++++ b/sshd.0 5.320 +@@ -7,6 +7,7 @@ 5.321 + sshd [-46DdeiqTt] [-C connection_spec] [-c host_certificate_file] 5.322 + [-E log_file] [-f config_file] [-g login_grace_time] 5.323 + [-h host_key_file] [-o option] [-p port] [-u len] 5.324 ++ [-z tcp_stealth_secret] 5.325 + 5.326 + DESCRIPTION 5.327 + sshd (OpenSSH Daemon) is the daemon program for ssh(1). Together these 5.328 +@@ -121,6 +122,20 @@ 5.329 + from="pattern-list" option in a key file. Configuration options 5.330 + that require DNS include using a USER@HOST pattern in AllowUsers 5.331 + or DenyUsers. 5.332 ++ -z tcp_stealth_secret 5.333 ++ Turns this SSH server into a Stealth SSH TCP Server. This option 5.334 ++ specifies the shared secret which is needed by the clients in order 5.335 ++ to be able to connect to the port the SSH server is listening on. 5.336 ++ Any string specified will be truncated or padded with zeroes to 64 5.337 ++ bytes. This option needs kernel support and is therefore only 5.338 ++ available if the required setsockopt() call is available. 5.339 ++ See http://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ 5.340 ++ for details. 5.341 ++ 5.342 ++ IMPORTANT: This option should only be used for the purpose of 5.343 ++ testing as other users could easily read out the secret from the 5.344 ++ command line arguments. The TCPStealthSecret configuration option 5.345 ++ is the preferred way of specifying the TCP Stealth secret. 5.346 + 5.347 + AUTHENTICATION 5.348 + The OpenSSH SSH daemon supports SSH protocol 2 only. Each host has a 5.349 +--- openssh-6.7p1/ssh.0 2014-10-05 23:39:37.000000000 -0400 5.350 ++++ openssh-6.7p1-knock/ssh.0 2014-11-05 20:35:44.216514377 -0500 5.351 +@@ -425,6 +425,20 @@ DESCRIPTION 5.352 + -y Send log information using the syslog(3) system module. By 5.353 + default this information is sent to stderr. 5.354 + 5.355 ++ -z tcp_stealth_secret 5.356 ++ Specifies the shared secret which is needed to connect to a stealth 5.357 ++ SSH TCP server. Any string specified will be truncated to or padded 5.358 ++ with zeroes to 64 bytes. This option needs kernel support and is 5.359 ++ therefore only available if the required setsockopt() call is 5.360 ++ available. 5.361 ++ See http://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ 5.362 ++ for details. 5.363 ++ 5.364 ++ IMPORTANT: This option should only be used for the purpose of 5.365 ++ testing as other users could easily read out the secret from the 5.366 ++ command line arguments. The TCPStealthSecret configuration option 5.367 ++ is the preferred way of specifying the TCP Stealth secret. 5.368 ++ 5.369 + ssh may additionally obtain configuration data from a per-user 5.370 + configuration file and a system-wide configuration file. The file format 5.371 + and configuration options are described in ssh_config(5). 5.372 +--- openssh-6.7p1/ssh.1 2014-07-29 22:32:28.000000000 -0400 5.373 ++++ openssh-6.7p1-knock/ssh.1 2014-11-07 13:56:02.022226289 -0500 5.374 +@@ -64,6 +64,7 @@ 5.375 + .Op Fl S Ar ctl_path 5.376 + .Op Fl W Ar host : Ns Ar port 5.377 + .Op Fl w Ar local_tun Ns Op : Ns Ar remote_tun 5.378 ++.Op Fl z Ar tcp_stealth_secret 5.379 + .Oo Ar user Ns @ Oc Ns Ar hostname 5.380 + .Op Ar command 5.381 + .Ek 5.382 +@@ -528,6 +529,7 @@ For full details of the options listed b 5.383 + .It StreamLocalBindUnlink 5.384 + .It StrictHostKeyChecking 5.385 + .It TCPKeepAlive 5.386 ++.It TCPStealthSecret 5.387 + .It Tunnel 5.388 + .It TunnelDevice 5.389 + .It UpdateHostKeys 5.390 +@@ -777,6 +779,21 @@ Send log information using the 5.391 + .Xr syslog 3 5.392 + system module. 5.393 + By default this information is sent to stderr. 5.394 ++.It Fl z Ar tcp_stealth_secret 5.395 ++Specifies the shared secret which is needed to connect to a stealth SSH TCP 5.396 ++server. Any string specified will be truncated to or padded with zeroes to 64 5.397 ++bytes. This option needs kernel support and is therefore only available if the 5.398 ++required 5.399 ++.Xr setsockopt 2 5.400 ++call is available. 5.401 ++.Pp 5.402 ++See http://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ for details. 5.403 ++.Pp 5.404 ++.Cm IMPORTANT: 5.405 ++This option should only be used for the purpose of testing as other users could 5.406 ++easily read out the secret from the command line arguments. The 5.407 ++.Cm TCPStealthSecret 5.408 ++configuration option is the preferred way of specifying the TCP Stealth secret. 5.409 + .El 5.410 + .Pp 5.411 + .Nm 5.412 +--- openssh-6.7p1/ssh_config.0 2014-10-05 23:39:38.000000000 -0400 5.413 ++++ openssh-6.7p1-knock/ssh_config.0 2014-11-05 20:48:17.064514377 -0500 5.414 +@@ -919,6 +919,15 @@ DESCRIPTION 5.415 + 5.416 + To disable TCP keepalive messages, the value should be set to no. 5.417 + 5.418 ++ TCPStealthSecret 5.419 ++ Specifies the shared secret which is needed to connect to a stealth 5.420 ++ SSH TCP Server. Any string specified will be truncated to or padded 5.421 ++ with zeroes to 64 bytes. This option needs kernel support and is 5.422 ++ therefore only available if the required setsockopt() call is 5.423 ++ available. 5.424 ++ See http://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ 5.425 ++ for details. 5.426 ++ 5.427 + Tunnel Request tun(4) device forwarding between the client and the 5.428 + server. The argument must be yes, point-to-point (layer 3), 5.429 + ethernet (layer 2), or no (the default). Specifying yes requests 5.430 +--- openssh-6.7p1/sshconnect.c 2014-07-18 00:11:26.000000000 -0400 5.431 ++++ openssh-6.7p1-knock/sshconnect.c 2014-11-07 14:07:11.342196835 -0500 5.432 +@@ -286,6 +286,18 @@ ssh_create_socket(int privileged, struct 5.433 + } 5.434 + fcntl(sock, F_SETFD, FD_CLOEXEC); 5.435 + 5.436 ++#ifdef TCP_STEALTH 5.437 ++ if (options.tcp_stealth_secret) { 5.438 ++ if (setsockopt(sock, IPPROTO_TCP, TCP_STEALTH, 5.439 ++ options.tcp_stealth_secret, 5.440 ++ TCP_STEALTH_SECRET_SIZE) == -1) { 5.441 ++ error("setsockopt TCP_STEALTH: %s", strerror(errno)); 5.442 ++ close(sock); 5.443 ++ return -1; 5.444 ++ } 5.445 ++ } 5.446 ++#endif 5.447 ++ 5.448 + /* Bind the socket to an alternative local IP address */ 5.449 + if (options.bind_address == NULL && !privileged) 5.450 + return sock; 5.451 +--- openssh-6.7p1/sshd.8 2014-07-03 19:00:04.000000000 -0400 5.452 ++++ openssh-6.7p1-knock/sshd.8 2014-11-07 14:00:14.506215178 -0500 5.453 +@@ -53,6 +53,7 @@ 5.454 + .Op Fl o Ar option 5.455 + .Op Fl p Ar port 5.456 + .Op Fl u Ar len 5.457 ++.Op Fl z Ar tcp_stealth_secret 5.458 + .Ek 5.459 + .Sh DESCRIPTION 5.460 + .Nm 5.461 +@@ -243,6 +244,24 @@ USER@HOST pattern in 5.462 + .Cm AllowUsers 5.463 + or 5.464 + .Cm DenyUsers . 5.465 ++.It Fl z Ar tcp_stealth_secret 5.466 ++Turns this SSH server into a stealth SSH TCP server. This option specifies the 5.467 ++shared secret which is needed by the clients in order to be able to connect to 5.468 ++the port the SSH server is listening on. Any string specified will be truncated 5.469 ++or padded with zeroes to 64 bytes. This option needs kernel support and is 5.470 ++therefore only available if the required 5.471 ++.Xr setsockopt 2 5.472 ++call is available. 5.473 ++.Pp 5.474 ++See http://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ for details. 5.475 ++ 5.476 ++.Cm IMPORTANT: 5.477 ++This option should only be used for the purpose of 5.478 ++testing as other users could easily read out the secret from the 5.479 ++command line arguments. The 5.480 ++.Cm TCPStealthSecret 5.481 ++configuration option 5.482 ++is the preferred way of specifying the TCP Stealth secret. 5.483 + .El 5.484 + .Sh AUTHENTICATION 5.485 + The OpenSSH SSH daemon supports SSH protocol 2 only. 5.486 +--- openssh-6.7p1/sshd_config.0 2014-10-05 23:39:38.000000000 -0400 5.487 ++++ openssh-6.7p1-knock/sshd_config.0 2014-11-07 14:01:07.530212845 -0500 5.488 +@@ -872,6 +872,19 @@ DESCRIPTION 5.489 + 5.490 + To disable TCP keepalive messages, the value should be set to no. 5.491 + 5.492 ++ TCPStealthSecret 5.493 ++ Turns this SSH server into a stealth SSH TCP server. This 5.494 ++ configuration option specifies the shared secret needed by the 5.495 ++ clients in order to be able to connect to the port the SSH server 5.496 ++ is listening on. This means that port scanners will receive a 5.497 ++ TCP RST and thus will not recognize this TCP port being open. 5.498 ++ 5.499 ++ Any string specified will be truncated or padded with zeroes to 64 5.500 ++ bytes. This option needs kernel support and is therefore only 5.501 ++ available if the required setsockopt() call is available. 5.502 ++ See http://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ 5.503 ++ for details. 5.504 ++ 5.505 + TrustedUserCAKeys 5.506 + Specifies a file containing public keys of certificate 5.507 + authorities that are trusted to sign user certificates for
6.1 --- a/tazlito/receipt Thu May 17 10:47:21 2018 +0200 6.2 +++ b/tazlito/receipt Fri May 18 13:47:33 2018 +0200 6.3 @@ -1,7 +1,7 @@ 6.4 # SliTaz package receipt. 6.5 6.6 PACKAGE="tazlito" 6.7 -VERSION="498" 6.8 +VERSION="500" 6.9 CATEGORY="base-system" 6.10 SHORT_DESC="SliTaz Live Tool." 6.11 MAINTAINER="pascal.bellard@slitaz.org"