aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-10-25cmake: Bump version to 0.9.1libssh-0.9.1Andreas Schneider3-2/+16
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-10-25cmake: Bump library versionAndreas Schneider3-2/+423
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-10-25cmake: Link compile database to source dir for clangdAndreas Schneider2-0/+7
See https://github.com/ycm-core/YouCompleteMe https://github.com/abingham/emacs-ycmd Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit d4328069652635a431e13db0d7c8cbe02af21082)
2019-10-25packet: On failure, do not use uninitialized cryptoJakub Jelen1-0/+4
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit e9e8292370ca1090fbb16a4c55d590c88c9d41dd)
2019-10-25packet_crypt: Avoid out of bounds access in debug functionsJakub Jelen1-2/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 5a0177def02d3810bc2745aa41d084ac5bdab1cd)
2019-10-25tests: Do not parse global config in torture_ssh_session()Anderson Toshiyuki Sasaki1-1/+8
Do not parse global config file in sessions created by torture_ssh_session(). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 8a50dbc6ba33cf1f2596a07927eec309edf809b3)
2019-10-25tests: Do not parse global configuration when testing serverAnderson Toshiyuki Sasaki1-51/+0
This removes the tests which uses external configuration files. This makes the tests no not change behaviour depending on the environment they are being executed. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 85239c8ea04b32ce84280508d6860f8032a55d83)
2019-10-25tests: Do not process server config during testsAnderson Toshiyuki Sasaki1-0/+8
In pkd tests, avoid processing the global server configuration file. This is to allow testing with algorithms not allowed in the global server configuration. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 040aa0edfeb47307f117bf1c5e4d66fc2d579cc2)
2019-10-25tests: Do not process config when reinitializing sessionAnderson Toshiyuki Sasaki1-0/+2
Do not process system-wide configuration when reinitializing a session during testing. This could lead to different settings set from the expected one (which was initialized during test setup). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit f97a8b4e3f60b2345e9e4b77c42d179435736338)
2019-10-25tests: Use temporary file for known_hostsAnderson Toshiyuki Sasaki2-75/+136
Previously, the tests were sharing the same file path to create the known_hosts file, which can create a race condition if the tests run in parallel. Such file was deleted between tests. By using different different files for each test, the risk of race conditions is eliminated. Moreover, it makes unnecessary to destroy the file between tests. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit d4fe8e1f62814287448bb0a042933e3fd3e07e0a)
2019-09-30pki_crypto: Support Ed25519 keys in PEM filesAnderson Toshiyuki Sasaki3-22/+229
This adds support for Ed25519 keys from files in PEM format when using OpenSSL with Ed25519 support. The default encoding for the PEM file is expected to be PKCS#8. Encrypted files are supported. For the lack of an API, it is not possible to export keys in PEM format, only in OpenSSH format. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit a3a0529b41e5ce4789cc8a5bd5e09b4ed15efe32)
2019-09-30cmake: Do not build internal ed25519 when unnecessaryAnderson Toshiyuki Sasaki1-8/+18
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 61e6b6cc59eb18ed2a226974eed2da9e51e9db88)
2019-09-30curve25519: Use OpenSSL X25519 implementationAnderson Toshiyuki Sasaki1-45/+208
If supported, use OpenSSL X25519 implementation for the curve25519 key exchange. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit d463f67abaa1a07f81cf1fdc041d9d38ed0a1962)
2019-09-30cmake: Detect OpenSSL X25519 supportAnderson Toshiyuki Sasaki2-0/+7
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 0b7f7d2cf7f2b3e1b6d0d9482670821e90dbd598)
2019-09-30pki: Remove unused function pki_signature_verify()Anderson Toshiyuki Sasaki12-157/+35
This removes unused function pki_signature_verify() from pki_{crypto, mbedcrypto, gcrypt}. The function was also removed from include/libssh/pki_priv.h. The function ssh_pki_signature_verify() was changed to receive a const unsigned char *input. All tests calling pki_signature_verify() were changed to call ssh_pki_signature_verify() instead. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 55cd04fbee7bf6c8157e2338695b03342615a261)
2019-09-30pki_crypto: Use OpenSSL for Ed25519 signaturesAnderson Toshiyuki Sasaki7-60/+343
Use OpenSSL to generate and verify Ed25519 signatures, if supported. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 2a2c1c98bf4129f4c70ec1fef6558c2e5af15e5d)
2019-09-30pki: Move common Ed25519 functions to pki_ed25519_common.cAnderson Toshiyuki Sasaki7-192/+236
This is a preparation to use the Ed25519 implementation from OpenSSL. The function pki_ed25519_sig_to_blob() was renamed to pki_ed25519_signature_to_blob() and pki_ed25519_sig_from_blob() was renamed to pki_signature_from_ed25519_blob() to follow the naming for other algorithms. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit bdcaf55b906bedb84df1cf0637137f674dd5ce64)
2019-09-30cmake: Detect OpenSSL support for Ed25519Anderson Toshiyuki Sasaki2-0/+7
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit a0b84a8cd541e1a5c9d9a1ab12cfa9e4b7f3aa9e)
2019-09-30pki_mbedcrypto: Do not treat Ed25519 as a special caseAnderson Toshiyuki Sasaki1-11/+35
Generate and verify Ed25519 signatures along with the other signature types. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 97adbfe0877e19253769d02edb5d673d21a4eb14)
2019-09-30pki_gcrypt: Do not treat Ed25519 as a special caseAnderson Toshiyuki Sasaki1-10/+37
Verify the Ed25519 signature in pki_verify_data_signature() along with the other signature types. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 38ede2e2257687c2ebc2ef06c8218eab38584613)
2019-09-30pki_crypto: Use EVP_DigestSign* and EVP_DigestVerify*Anderson Toshiyuki Sasaki3-25/+64
Use the newer APIs EVP_DigestSign{Init}() and EVP_DigestVerify{Init}() to generate and verify signatures instead of the older EVP_Sign{Init, Update, Final} and EVP_Verify{Init, Update, Final} if supported. Also use the single shot signature/verification if supported as all the input is provided at once. This is a preparation to use Ed25519 implementation from OpenSSL. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 90944a36513ba730774dc6ca562788391d64a306)
2019-09-30torture_pki_ed25519: Use public key to verify signaturesAnderson Toshiyuki Sasaki1-3/+7
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 7452f0ded89795d16f0c7e82eca84f6e2bd89b3f)
2019-09-30gitlab-ci: Move cmake from prep to build command in csbuildAnderson Toshiyuki Sasaki1-2/+1
This is required to avoid csbuild scan failures when a commit removes source files. The command prep is run only once before all the builds, making csbuild to try to compile the old files using the configuration files generated for the newest version. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 7ffa3c358d727a711dc26806f3c07c9add584e5c)
2019-09-30gitlab-ci: Turn DEBUG_CRYPTO on for standard crypto lib buildsAndreas Schneider1-2/+3
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 4799915a365972bffebc301193978d709500daec)
2019-09-30buffer: Simplify handling of the return codesJakub Jelen1-6/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit e72429f205bd1a17062ae95f8850b510d71b2964)
2019-09-30buffer: Avoid use of uninitialized valuesJakub Jelen1-6/+13
Fixes the following oss-fuzz bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17565 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit aff7c500d5721e35c998b1b3c78e450fe7ff986d)
2019-09-30dh-gex: Correctly free modulus and generator with opensslJakub Jelen1-6/+12
Fixes T176 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit aac682f60ea8d76b8555eff2e78025725c7630ea)
2019-09-30channels: Correctly reports failed channels openingJakub Jelen1-0/+5
Fixes T75 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 2f05243a4a7b4729c0e2d9a92b11c54d561551d2)
2019-09-30Reformat channel_open()Jakub Jelen1-57/+67
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 89a9eb8811da56095a56a82d7967e01fdbdc7d27)
2019-09-30channels: Do not use deprecated functions in the example codeJakub Jelen1-2/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 3cf2b41f5eafacc92ac8a04d887ca448af88fab2)
2019-09-30options: Do not attempt to expand percents in PKCS#11 URIsJakub Jelen1-0/+7
With the old token parser, the data was simply broken on the = sign even if the uri was in quotes and ignored. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 223cc9623992db8f30918abf310aaa7528f83f82)
2019-09-30tests: Verify the localuser match worksJakub Jelen2-5/+26
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 61b1e0e7e99ee7a0dc8b909368e2d618e58b8548)
2019-09-30config: Support match localuserJakub Jelen1-1/+23
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 6500134259c40c95d0b342278c42304b1067b85b)
2019-09-30config: Make the matching case sensitive as documented in ssh_config manual ↵Jakub Jelen1-4/+1
pages > note that keywords are case-insensitive and arguments are case-sensitive Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 9b8b312b88ee79009df40a07b90548f743df9f9f)
2019-09-30Skip the proxycommand test in case the netcat is not avaliableJakub Jelen1-1/+9
Fixes: T142 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 4900ab6ca9a016c66c3ba1a2edd27fe155170e06)
2019-09-30sftp: Improve the documentation of sftp_init() and sftp_new()Jakub Jelen1-2/+10
Fixes: T137 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 618b858e49ce48ad3b8a36d75215cf2635af8c16)
2019-09-30known_hosts: Avoid using deprecated functions (even from deprecated functions)Jakub Jelen1-6/+11
Fixes: T165 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 83fa060cec0f3c062117807b154a18f2db63ef06)
2019-08-08misc: Allow %% to escape a single % in paths.Richard W.M. Jones2-0/+16
For example "%d/config%%1" is expanded to "~/.ssh/config%1". Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 3737e5f0e75f355895bf0b46a33b1c1621477226)
2019-08-08dh: Add ssh_dh_debug_crypto()Andreas Schneider5-25/+48
We should call it where we have access to the crypto structure. Pair-Programmed-With: Jakub Jelen <jjelen@redhat.com> Signed-off-by: Jakub Jelen <jjelen@redhat.com> Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 92d3efec8184a22ed214ba95ba692041377bb93c)
2019-08-08bignum: Pass const to ssh_print_bignum()Andreas Schneider5-5/+8
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 4e25ee6124f23a727a9e430b738fad3124ae8ecc)
2019-08-08pki_mbedcrypto: Add missing misc.h header fileAndreas Schneider1-0/+1
For ssh_log_hexdump(). Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 89ab7b23f81589eb958676b352cba41b80a5a106)
2019-08-08tests: Skip testing 1024 bits key generation in FIPS modeAnderson Toshiyuki Sasaki1-13/+15
In torture_threads_pki_rsa, skip the test which generates 1024 bits RSA key pair when in FIPS mode. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 3a61cd34a90d758262d63ecb01a0cc65d0abe90e)
2019-08-08knownhosts: Use ssh_mkdirs() instead of ssh_mkdir()Anderson Toshiyuki Sasaki3-45/+107
Previously, if the path to known_hosts file set through SSH_OPTIONS_KNOWNHOSTS included missing directories, ssh_session_update_known_hosts() would fail. The added test case checks that this is not the case anymore. The logic of checking if the directory is accessible before creating it was replaced by creating the directory if opening the file failed. This is to minimize the risk of TOCTOU race conditions. Fixes: T166 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 5b18bcb0ac39c3c366dd769e893af381ddb5deb2)
2019-08-08misc: Introduce internal function ssh_mkdirs()Anderson Toshiyuki Sasaki3-5/+166
If the given path includes missing directories, ssh_mkdirs() tries to create them recursively. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 742918cb1cf99b711538dc9c21e3850fd487dfd6)
2019-08-08misc: Introduce internal function ssh_dir_writeable()Anderson Toshiyuki Sasaki3-0/+98
The introduced internal function checks if the provided path is for an existing directory which is accessible for writing. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 7857cd1aa5e8979175b2f68df8cbe70921156e18)
2019-08-08libcrypto: Avoid incompatible pointersJakub Jelen1-2/+6
Fixes: T164 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit e42d44e48a913a03e42d45063718fa5a77c58b8d)
2019-08-08pki_container_openssh: Avoid bogus newline in debug messageJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 683096ae7eb19cd02043222c700921cb6a0ec788)
2019-08-08pki_container_openssh: Reformat whitespaceJakub Jelen1-14/+14
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 3811c73f8f414247db81aa4a5337f8182329196c)
2019-08-08examples: Load ED25519 key when loading all keysJakub Jelen1-0/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit cc92e743094bca78a0167504e854e29060a3bc75)
2019-08-08Replace ssh_print_hexa() with ssh_log_hexdump()Anderson Toshiyuki Sasaki11-59/+59
Replace all occurrences of the deprecated function ssh_print_hexa() with the introduced ssh_log_hexdump(). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 68baebbd6222995ca5aceac1d9dac53fe0b8a7c0)
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-19 12:20:12 +0000