aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-11-07src: Add missing ABI fileslibssh-0.9.2Andreas Schneider2-1/+422
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2019-11-07Bump version to 0.9.2Andreas Schneider3-3/+8
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-11-07server: Use really the negotiated signature typeJakub Jelen12-29/+41
Generally, when the extension negotiation is enabled and client supports SHA2 algorithms for RSA, they are supposed to be prioritized against the old SHA1. If it is not (ssh-rsa is listed in front of rsa-sha2-* hostkey algorithms during negotiation), the server wrongly tries to provide the new typo of signature, ignoring the negotiated algirithm This commit propagates the digest algorithm from negotiation to the actual signature functions, which were previously responsible for decision about the hash algorithm based just on the negotiated extensions. Fixes T191 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 1ebf506913495a736322fc5a97ba336adff6e464)
2019-11-07gitlab-ci: Disable client testing as pam_wrapper is broken on TWAndreas Schneider1-5/+6
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit fbc2912ddeb22dfc901508467a23d6e9d41cd6a2)
2019-11-07cmake: Fix setting up cwrap for server testingAndreas Schneider1-6/+8
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit ea4f71721fc40651519942348c3d6f74e47af948)
2019-11-07cmake: Do not use cached LIBSSH_PUBLIC_INCLUDE_DIRSAndreas Schneider7-38/+24
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 4ab0fb2b48f3cfee6085e2189e6c121c64a78344)
2019-11-07cmake: Rename static libraryAndreas Schneider3-10/+13
This is only compiled for tests and fuzzers! Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 8c36a865f267ca99562238f61c34e3578cb05098)
2019-11-07cmake: Create ssh library directly as libsshAndreas Schneider6-243/+31
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 82c57c1f3656a1d501488174c14a03de5425cbbb)
2019-11-07cmake: Add option to build shared libsAndreas Schneider2-0/+2
See https://cmake.org/cmake/help/latest/variable/BUILD_SHARED_LIBS.html Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit c2c354539112eb89862ec4472af3ea5aeafa2824)
2019-11-07cmake: Remove WITH_STATIC_LIBAndreas Schneider3-17/+2
We will honor BUILD_SHARED_LIBS from cmake next. Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 729c92606c88b60e7c255d393756d1d3b7e30698)
2019-11-07cmake: Don't cache LIBSSH_LINK_LIBRARIESAndreas Schneider1-5/+0
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 498b63949ef7660dc82934890a276b1bcc738948)
2019-11-07cmake:pkd: Don't use LIBSSH_LINK_LIBRARIESAndreas Schneider1-1/+0
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 39f7ddaa06c5069e8317e9d7d1eab8deea53872b)
2019-11-07cmake: Remove libsocketAndreas Schneider1-7/+0
This is already part of LIBSSH_REQUIRED_LIBRARIES Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 2fcc15c5dcf7ac1dd725e2129d5cd92ab79bc75a)
2019-11-07cmake: Use target_include_directories()Andreas Schneider1-5/+4
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 5e2788d4c54de203e0fa5a6c9253e93c2836bd01)
2019-11-07cmake: Only use OpenSSL Ed25519 implementation when possibleAnderson Toshiyuki Sasaki1-1/+6
It is possible for OpenSSL to have the type EVP_PKEY_ED25519 in openssl/evp.h, but not the single shot functions EVP_DigestSign() and EVP_DigestVerify() which are required to generate Ed25519 signatures. Only switch to use OpenSSL Ed25519 implementation when OpenSSL have all required types and functions. Fixes: T197 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 21655e396c8dc60ca8fcbecc4fec2711f9b29bfd)
2019-11-04gitlab-ci: Mips is deadAndreas Schneider1-28/+0
Debian removed the cross compiling toolchain. So lets drop it. Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit d02c06268eae9c9c5253bd88410863a2e8c66587)
2019-11-04channel: Document ssh_channel_request_sftp()Andreas Schneider1-0/+12
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit e5767bf0b778be4e0948de0b8e32b86a3c85460a)
2019-11-04auth: Add missing include for explicit_bzero()Andreas Schneider1-0/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 4a113159b2f3f22f5e73d982c638c3288b24e821)
2019-10-25cpack: Ignore compule_database.json and clangd dirAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit a4b95268eef8283c7edaba69d6fe597cf2b754af)
2019-10-25cmake: Bump version to 0.9.1libssh-0.9.1Andreas Schneider3-2/+16
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-10-25cmake: Bump library versionAndreas Schneider3-2/+423
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-10-25cmake: Link compile database to source dir for clangdAndreas Schneider2-0/+7
See https://github.com/ycm-core/YouCompleteMe https://github.com/abingham/emacs-ycmd Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit d4328069652635a431e13db0d7c8cbe02af21082)
2019-10-25packet: On failure, do not use uninitialized cryptoJakub Jelen1-0/+4
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit e9e8292370ca1090fbb16a4c55d590c88c9d41dd)
2019-10-25packet_crypt: Avoid out of bounds access in debug functionsJakub Jelen1-2/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 5a0177def02d3810bc2745aa41d084ac5bdab1cd)
2019-10-25tests: Do not parse global config in torture_ssh_session()Anderson Toshiyuki Sasaki1-1/+8
Do not parse global config file in sessions created by torture_ssh_session(). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 8a50dbc6ba33cf1f2596a07927eec309edf809b3)
2019-10-25tests: Do not parse global configuration when testing serverAnderson Toshiyuki Sasaki1-51/+0
This removes the tests which uses external configuration files. This makes the tests no not change behaviour depending on the environment they are being executed. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 85239c8ea04b32ce84280508d6860f8032a55d83)
2019-10-25tests: Do not process server config during testsAnderson Toshiyuki Sasaki1-0/+8
In pkd tests, avoid processing the global server configuration file. This is to allow testing with algorithms not allowed in the global server configuration. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 040aa0edfeb47307f117bf1c5e4d66fc2d579cc2)
2019-10-25tests: Do not process config when reinitializing sessionAnderson Toshiyuki Sasaki1-0/+2
Do not process system-wide configuration when reinitializing a session during testing. This could lead to different settings set from the expected one (which was initialized during test setup). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit f97a8b4e3f60b2345e9e4b77c42d179435736338)
2019-10-25tests: Use temporary file for known_hostsAnderson Toshiyuki Sasaki2-75/+136
Previously, the tests were sharing the same file path to create the known_hosts file, which can create a race condition if the tests run in parallel. Such file was deleted between tests. By using different different files for each test, the risk of race conditions is eliminated. Moreover, it makes unnecessary to destroy the file between tests. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit d4fe8e1f62814287448bb0a042933e3fd3e07e0a)
2019-09-30pki_crypto: Support Ed25519 keys in PEM filesAnderson Toshiyuki Sasaki3-22/+229
This adds support for Ed25519 keys from files in PEM format when using OpenSSL with Ed25519 support. The default encoding for the PEM file is expected to be PKCS#8. Encrypted files are supported. For the lack of an API, it is not possible to export keys in PEM format, only in OpenSSH format. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit a3a0529b41e5ce4789cc8a5bd5e09b4ed15efe32)
2019-09-30cmake: Do not build internal ed25519 when unnecessaryAnderson Toshiyuki Sasaki1-8/+18
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 61e6b6cc59eb18ed2a226974eed2da9e51e9db88)
2019-09-30curve25519: Use OpenSSL X25519 implementationAnderson Toshiyuki Sasaki1-45/+208
If supported, use OpenSSL X25519 implementation for the curve25519 key exchange. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit d463f67abaa1a07f81cf1fdc041d9d38ed0a1962)
2019-09-30cmake: Detect OpenSSL X25519 supportAnderson Toshiyuki Sasaki2-0/+7
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 0b7f7d2cf7f2b3e1b6d0d9482670821e90dbd598)
2019-09-30pki: Remove unused function pki_signature_verify()Anderson Toshiyuki Sasaki12-157/+35
This removes unused function pki_signature_verify() from pki_{crypto, mbedcrypto, gcrypt}. The function was also removed from include/libssh/pki_priv.h. The function ssh_pki_signature_verify() was changed to receive a const unsigned char *input. All tests calling pki_signature_verify() were changed to call ssh_pki_signature_verify() instead. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 55cd04fbee7bf6c8157e2338695b03342615a261)
2019-09-30pki_crypto: Use OpenSSL for Ed25519 signaturesAnderson Toshiyuki Sasaki7-60/+343
Use OpenSSL to generate and verify Ed25519 signatures, if supported. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 2a2c1c98bf4129f4c70ec1fef6558c2e5af15e5d)
2019-09-30pki: Move common Ed25519 functions to pki_ed25519_common.cAnderson Toshiyuki Sasaki7-192/+236
This is a preparation to use the Ed25519 implementation from OpenSSL. The function pki_ed25519_sig_to_blob() was renamed to pki_ed25519_signature_to_blob() and pki_ed25519_sig_from_blob() was renamed to pki_signature_from_ed25519_blob() to follow the naming for other algorithms. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit bdcaf55b906bedb84df1cf0637137f674dd5ce64)
2019-09-30cmake: Detect OpenSSL support for Ed25519Anderson Toshiyuki Sasaki2-0/+7
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit a0b84a8cd541e1a5c9d9a1ab12cfa9e4b7f3aa9e)
2019-09-30pki_mbedcrypto: Do not treat Ed25519 as a special caseAnderson Toshiyuki Sasaki1-11/+35
Generate and verify Ed25519 signatures along with the other signature types. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 97adbfe0877e19253769d02edb5d673d21a4eb14)
2019-09-30pki_gcrypt: Do not treat Ed25519 as a special caseAnderson Toshiyuki Sasaki1-10/+37
Verify the Ed25519 signature in pki_verify_data_signature() along with the other signature types. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 38ede2e2257687c2ebc2ef06c8218eab38584613)
2019-09-30pki_crypto: Use EVP_DigestSign* and EVP_DigestVerify*Anderson Toshiyuki Sasaki3-25/+64
Use the newer APIs EVP_DigestSign{Init}() and EVP_DigestVerify{Init}() to generate and verify signatures instead of the older EVP_Sign{Init, Update, Final} and EVP_Verify{Init, Update, Final} if supported. Also use the single shot signature/verification if supported as all the input is provided at once. This is a preparation to use Ed25519 implementation from OpenSSL. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 90944a36513ba730774dc6ca562788391d64a306)
2019-09-30torture_pki_ed25519: Use public key to verify signaturesAnderson Toshiyuki Sasaki1-3/+7
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 7452f0ded89795d16f0c7e82eca84f6e2bd89b3f)
2019-09-30gitlab-ci: Move cmake from prep to build command in csbuildAnderson Toshiyuki Sasaki1-2/+1
This is required to avoid csbuild scan failures when a commit removes source files. The command prep is run only once before all the builds, making csbuild to try to compile the old files using the configuration files generated for the newest version. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 7ffa3c358d727a711dc26806f3c07c9add584e5c)
2019-09-30gitlab-ci: Turn DEBUG_CRYPTO on for standard crypto lib buildsAndreas Schneider1-2/+3
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 4799915a365972bffebc301193978d709500daec)
2019-09-30buffer: Simplify handling of the return codesJakub Jelen1-6/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit e72429f205bd1a17062ae95f8850b510d71b2964)
2019-09-30buffer: Avoid use of uninitialized valuesJakub Jelen1-6/+13
Fixes the following oss-fuzz bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17565 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit aff7c500d5721e35c998b1b3c78e450fe7ff986d)
2019-09-30dh-gex: Correctly free modulus and generator with opensslJakub Jelen1-6/+12
Fixes T176 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit aac682f60ea8d76b8555eff2e78025725c7630ea)
2019-09-30channels: Correctly reports failed channels openingJakub Jelen1-0/+5
Fixes T75 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 2f05243a4a7b4729c0e2d9a92b11c54d561551d2)
2019-09-30Reformat channel_open()Jakub Jelen1-57/+67
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 89a9eb8811da56095a56a82d7967e01fdbdc7d27)
2019-09-30channels: Do not use deprecated functions in the example codeJakub Jelen1-2/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 3cf2b41f5eafacc92ac8a04d887ca448af88fab2)
2019-09-30options: Do not attempt to expand percents in PKCS#11 URIsJakub Jelen1-0/+7
With the old token parser, the data was simply broken on the = sign even if the uri was in quotes and ignored. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 223cc9623992db8f30918abf310aaa7528f83f82)
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-20 08:56:34 +0000