aboutsummaryrefslogtreecommitdiff
path: root/src/bind.c
AgeCommit message (Collapse)AuthorFilesLines
2024-03-19feat: Handle hostkeys like OpenSSHGauravsingh Sisodia1-18/+19
fix: memory leak fix: add defaults after parsing fix: set defaults in ssh_bind_listen tests: add test for checking default hostkey paths remove: null check for hostkey paths, can't happen since we set defaults now examples: ssh_server remove "no default keys", default hostkeys set in ssh_bind_listen Signed-off-by: Gauravsingh Sisodia <xaerru@gmail.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2024-03-19reformat: bind.cGauravsingh Sisodia1-74/+93
reformat: remove unneeded free Signed-off-by: Gauravsingh Sisodia <xaerru@gmail.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2023-02-02Remove support for DSA KeysMohammad Shehar Yaar Tausif1-44/+1
Solving issue #110. The original work is at !231 Some changes were needed because the newly added features in master through time Signed-off-by: Mohammad Shehar Yaar Tausif <sheharyaar48@gmail.com> Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-11-02bind: Set socket connected after accepting connectionJakub Jelen1-1/+7
Also factor out the operation to the single place. Original patch drafted by Zekun Ni in the following issue: https://gitlab.com/libssh/libssh-mirror/-/issues/155 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-11-02Reformat and initialize pointersJakub Jelen1-1/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-10-07SSH_LOG_DEBUG: Recategorize loglevelsNorbert Pocs1-1/+1
Loglevel INFO is the default openssh configuration setting which does not print redundant information. On a system using openssh with loglevels set by the terms of openssh will cause unwanted log lines in the output. recategorized based on - SSH_LOG_DEBUG are informational debug logs (no error) Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-07-12bind.c: Add missing size constant to err_msgNorbert Pocs1-1/+1
Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-07-04Rewrite strerror to ssh_strerrorNorbert Pocs1-6/+10
Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-06-09bind: Return different error if accept was interruptedJakub Jelen1-3/+9
Fixes: https://gitlab.com/libssh/libssh-mirror/-/issues/13 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-05-12Allow limiting RSA Key size also for serverJakub Jelen1-0/+2
Thanks to Harry Sintonen from WithSecure for pointing this out. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-05-02Fix multiple spelling and grammar mistakesJunda Ai1-1/+1
Signed-off-by: Junda Ai <aijunda29@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2021-06-04add moduli file location as an ssh_bind optionAndrew Wiley1-2/+18
Signed-off-by: Andrew Wiley <wiley@outlook.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2020-04-15Reformat ssh_bind_accept()Jakub Jelen1-25/+28
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2019-11-18Use only one variable denoting the size of methods arraysJakub Jelen1-2/+2
Previously, there was non-consistent usage of constans SSH_KEX_METHODS, KEX_METHODS_SIZE and of magic number 10 to reference the arrays used for algorithm negotiation by peers. This commit settles down to the single constant and its usage throughout the whole codebase. Fixes T195 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-12options: Allow avoiding system-wide configurationAnderson Toshiyuki Sasaki1-9/+12
The added option SSH_BIND_OPTIONS_PROCESS_CONFIG allows to skip processing the system-wide configuration file. The global configuration file is processed automatically if this option is not set as false. This option will only be effective if set before any call to ssh_bind_options_parse_config(). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-06-12options: Add option to set server accepted pubkey typesAnderson Toshiyuki Sasaki1-0/+25
The added option SSH_BIND_OPTIONS_PUBKEY_ACCEPTED_KEY_TYPES allows restricting the allowed public key types accepted by the server for authentication. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-04-17libssh: deprecate SSH_KEYTYPE_ECDSABen Toews1-1/+1
This type is imprecise. We often need the ecdsa_nid in addition to the key type in order to do anything. We replace this singluar ECDSA type with one type per curve. Signed-off-by: Ben Toews <mastahyeti@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-04-01bind: Apply global configuration automaticallyAnderson Toshiyuki Sasaki1-9/+17
Apply the global bind configuration from the file pointed by BIND_GLOBAL_CONFIG when a bind_new() is called. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-04-01options: Add a bind option to set the config directoryAnderson Toshiyuki Sasaki1-0/+1
This adds the SSH_BIND_OPTIONS_CONFIG_DIR which allows to set the directory used to expand the escape character "%d" when passing a path to ssh_bind_options_parse_file(). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-04-01bind: Use calloc instead of mallocAnderson Toshiyuki Sasaki1-2/+1
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-01-15bind: Check for POLLRDHUP on the server if availableAndreas Schneider1-1/+8
This is a feature on modern Linux. Thanks to Ludovic Courtès <ludo@gnu.org> for the pointer. Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2019-01-15bind: Reformat ssh_bind_get_poll()Andreas Schneider1-5/+10
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-10-25socket: Undouble socket fdsSanne Raymaekers1-1/+1
Signed-off-by: Sanne Raymaekers <sraymaek@redhat.com>
2018-08-03Remove internal calls to ssh_initAnderson Toshiyuki Sasaki1-5/+0
Since the call is made automatically when the library is loaded, these calls are no longer required (if the library is not linked statically). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-08-01bind: Complete loading ed25519 in serverJakub Jelen1-4/+32
Previously, the support was only partial and if the ed25519 key was the only one, the internal checks were failing the tests. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-06-29Rest in Peace SSHv1Andreas Schneider1-3/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2017-12-28add mbedtls crypto supportJuraj Vijtiuk1-0/+4
Summary: This patch adds support for mbedTLS as a crypto backend for libssh. mbedTLS is an SSL/TLS library that has been designed to mainly be used in embedded systems. It is loosely coupled and has a low memory footprint. mbedTLS also provides a cryptography library (libmbedcrypto) that can be used without the TLS modules. The patch is unfortunately quite big, since several new files had to be added. DSA is disabled at compile time, since mbedTLS doesn't support DSA Patch review and feedback would be appreciated, and if any issues or suggestions appear, I'm willing to work on them. Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr> Test Plan: * The patch has been tested with a Debug and MinSizeRel build, with libssh unit tests, client tests and the pkd tests. * All the tests have been run with valgrind's memcheck, drd and helgrind tools. * The examples/samplessh client works when built with the patch. Reviewers: asn, aris Subscribers: simonsj Differential Revision: https://bugs.libssh.org/D1
2017-04-11server: Add option SSH_BIND_OPTIONS_IMPORT_KEY to serverAlfredo Mazzinghi1-6/+12
This sets the bind private key directly from an ssh_key struct instead of reading a file. Signed-off-by: Alfredo Mazzinghi <am2419@cl.cam.ac.uk> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2015-04-10bind: Correctly close sockets and invalidate them.Andreas Schneider1-13/+5
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2015-02-02server: Add support for ed25519 keys in the server.Aris Adamantiadis1-0/+11
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27style: be consistent when iterating over wanted_methodsLuka Perkov1-1/+1
Signed-off-by: Luka Perkov <luka.perkov@sartura.hr> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-12bind: only set bindfd after successful listenJon Simons1-1/+2
In 'ssh_bind_listen', move setting of 'sshbind->bindfd' to only happen after the listen call: otherwise 'bindfd' can be set to a bogus descriptor for the case that listen fails. Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-04security: fix for vulnerability CVE-2014-0017Aris Adamantiadis1-0/+2
When accepting a new connection, a forking server based on libssh forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique. This can cause several children to end up with same PRNG state which is a security issue.
2014-02-01server: allow custom server banners (bug #83)Aris Adamantiadis1-1/+2
2014-01-21Import keys during ssh_bind_accept_fdAlan Dunn1-1/+11
Signed-off-by: Alan Dunn <amdunn@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-01-21Separate out key import functionality from ssh_bind_listenAlan Dunn1-12/+23
Signed-off-by: Alan Dunn <amdunn@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-01-16bind: fix possible double-frees in ssh_bind_freeJon Simons1-0/+10
Make sure to explicitly set key pointers to NULL following the use of 'ssh_key_free' throughout bind.c. Before this change, a double free can happen via 'ssh_bind_free' as in this example callpath: // create an ssh_bind ssh_bind b = ssh_bind_new(); // provide a path to a wrong key-type ssh_bind_options_set(b, SSH_BIND_OPTIONS_DSAKEY, path_to_rsa_key); // initialize set key-type ssh_bind_listen(b); -> error path "The DSA host key has the wrong type: %d", ssh_key_free(sshbind->dsa) -> ssh_key_clean(key) // OK -> SAFE_FREE(key) // OK, but, sshbind->dsa is *not* set to NULL // ssh_bind_listen failed, so clean up ssh_bind ssh_bind_free(b); -> ssh_key_free(sshbind->dsa) // double-free here To fix, set pointers to NULL that have been free'd with 'ssh_key_free'. Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2013-12-09bind: Correctly free all memory in ssh_bind_free().Andreas Schneider1-3/+7
Thanks to Jacob Baines.
2013-10-24bind: fix leak in ssh_bind_accept error pathJon Simons1-2/+1
Use 'ssh_socket_free' to cleanup if 'ssh_bind_accept_fd' fails, to be sure to free the ssh_socket in/out buffers.
2013-07-14log: Implment new logging functions.Andreas Schneider1-1/+1
2013-07-13bind: ssh_pki functions also return SSH_EOF error codeAris Adamantiadis1-3/+3
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2012-12-03BUG 97: Remove obsolete hsterror().Andreas Schneider1-12/+1
This function is pretty much obsolete on most platforms. The standard errno should be used. If it is not enough on Windows we should use WSAGetLastError() in future.
2012-05-09bind: Fix build.Andreas Schneider1-1/+2
2012-05-08server: Add ecdsa hostkey support.Andreas Schneider1-1/+1
2012-02-19server: Add ecdsa hostkey support.Andreas Schneider1-1/+34
2012-02-05session: Use a struct for all options.Andreas Schneider1-6/+6
2011-11-09bind: Add more error messages.Andreas Schneider1-1/+9
2011-10-17bind: Fix ssh_bind_listen in normal case.Andreas Schneider1-5/+6
2011-10-13server: use app-provided bind socket when availableAris Adamantiadis1-17/+19
2011-10-13server: ssh_bind_accept_fdAris Adamantiadis1-52/+70
This function will not call accept() but use function parameter instead
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-18 23:25:33 +0000