aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
2018-03-02priv: Implement explicit_bzero as a function if not availableAndreas Schneider1-0/+11
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Alberto Aguirre <albaguirre@gmail.com>
2018-02-16pki: Use explicit_bzero() to wipe privkey in memoryAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-02-12src: Use explicit_bzero() if available on the platformAndreas Schneider14-31/+34
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-02-01Set channel as bound when accepting channel open requestMeng Tan1-0/+1
Signed-off-by: Meng Tan <mtan@wallix.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-18dh: Use calloc() instead of malloc()Andreas Schneider1-1/+1
2018-01-18pki_gcrypt: Use calloc() instead of malloc()Andreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-18threads: Use calloc() instead of malloc()Andreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-18sftpserver: Use calloc() instead of malloc()Andreas Schneider1-2/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-18server: Use calloc() instead of malloc()Andreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-18kex: Use calloc() instead of malloc()Andreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-18channels: Use calloc() instead of malloc()Andreas Schneider1-3/+3
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-18auth: Use calloc() instead of malloc()Andreas Schneider1-4/+2
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-10pki_crypto: Fix private key generation with passwordAndreas Schneider1-3/+3
We need to specify a cipher when we generate a key with a password. OpenSSH uses aes_128_cbc, so we should use the same. Thanks to Julian Lunz for the report. Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-10libgcrypt: Add missing config.h includeAndreas Schneider2-0/+4
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-01-02Happy new year!Andreas Schneider1-3/+5
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-28pki: Fix accidental ECC switch case fallthroughs into ed25119 cases when ↵jvijtiuk2-3/+5
built without ECC Summary: When ed25519 was introduced in commit 93c7b81b4ea1046bd2f65f4a510d5966786e8d3d, the ed25519 case was added after the ecdsa case in src/pki.c. The ecdsa case seems to have relied on falling through to report an error, when HAVE_ECC is not defined. If HAVE_ECC is not defined, but ecdsa keys are used, with for example, ssh_pki_import_pubkey_file, the code fallthroughs into the ed25519 case. Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr> Test Plan: Unit tests passed. No memory leaks found with valgrind. Reviewers: asn Differential Revision: https://bugs.libssh.org/D13 Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-28config: Avoid long -> int -> long casting for timeout configuration optionJakub Jelen1-5/+6
Fixes: T80 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-28add mbedtls crypto supportJuraj Vijtiuk18-1/+3017
Summary: This patch adds support for mbedTLS as a crypto backend for libssh. mbedTLS is an SSL/TLS library that has been designed to mainly be used in embedded systems. It is loosely coupled and has a low memory footprint. mbedTLS also provides a cryptography library (libmbedcrypto) that can be used without the TLS modules. The patch is unfortunately quite big, since several new files had to be added. DSA is disabled at compile time, since mbedTLS doesn't support DSA Patch review and feedback would be appreciated, and if any issues or suggestions appear, I'm willing to work on them. Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr> Test Plan: * The patch has been tested with a Debug and MinSizeRel build, with libssh unit tests, client tests and the pkd tests. * All the tests have been run with valgrind's memcheck, drd and helgrind tools. * The examples/samplessh client works when built with the patch. Reviewers: asn, aris Subscribers: simonsj Differential Revision: https://bugs.libssh.org/D1
2017-12-28options: Rewrite set() description to get()Jakub Jelen1-6/+2
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-21options: Move SSH_OPTIONS_ADD_IDENTITY to *set() function descriptionJakub Jelen1-14/+5
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-21config: Add CMake check for glob()Jakub Jelen1-1/+9
2017-12-21config: glob support for include with testNoName1151-1/+29
Signed-off-by: NoName115 <robert.kolcun@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-15config: support for MACsJakub Jelen1-0/+9
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-15config: Set global log level from configuration fileJakub Jelen1-5/+10
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-15options: Typo. The expand character is %dJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-15config: Remove MAC option (SSHv1)Jakub Jelen1-9/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-15config: Add configuration options from current OpenSSH 7.5 (and fix typos)Jakub Jelen1-13/+17
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-15options: Document SSH_OPTIONS_GLOBAL_KNOWNHOSTS and set default valueJakub Jelen1-1/+18
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-12-15Add new optionsAris Adamantiadis6-19/+300
Pair-Programmed-With: Jakub Jelen <jjelen@redhat.com> Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-11-16client: Add missing language tag in disconnect messageAndreas Schneider1-2/+3
Fixes T74 Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-11-09sftp: Check for NULL path and give correct errorAndreas Schneider1-0/+5
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-11-08pki_crypto: Avoid potential memory leakJakub Jelen1-1/+3
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-11-07pki_crypto: Avoid segfault with OpenSSL 1.1.0Jakub Jelen1-0/+4
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-10-29ecdh: fix build for old libgcryptJon Simons1-2/+2
Summary: Fix a typo for old libgcrypt builds `k_length` -> `k_len`. Signed-off-by: Jon Simons <jon@jonsimons.org> Test Plan: * Spotted this last-minute typo bug in local testing. Reviewers: asn Reviewed By: asn Differential Revision: https://bugs.libssh.org/D10
2017-10-29ecdh: fix build for old libgcryptJon Simons1-2/+2
Summary: Fix a typo for old libgcrypt builds `k_length` -> `k_len`. Signed-off-by: Jon Simons <jon@jonsimons.org> Test Plan: * Spotted this last-minute typo bug in local testing. Reviewers: asn Differential Revision: https://bugs.libssh.org/D10
2017-10-29dh: Don't use deprecated function with newer OpenSSLAndreas Schneider1-0/+7
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-10-29pki_crypto: Don't use deprecated function with newer OpenSSLAndreas Schneider1-0/+13
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-10-29server: expose 'ssh_server_init_kex' APIJon Simons1-6/+21
Expose an API 'ssh_server_init_kex' which allows one to change the set of key exchange, hostkey, ciphers, MACs, and compression algorithms currently configured for the ssh_session at hand, after having started the 'ssh_handle_key_exchange' process. One can use this API from the already-existing 'connect_status_function' callback to dynamically modify the set of algorithms used after having received the client banner, but before sending out the initial KEXINIT message. For example, one might want to prevent advertising the curve25519 key exchange algorithm for older OpenSSH clients due to interop bugs. Fixes T25 Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-10-28Fix config.h includesAndreas Schneider19-19/+38
We need stdlib.h and string.h in priv.h for free() and memset(). Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-09-11auth: fix double-free in ssh_userauth_agent_publickeyJon Simons1-0/+1
Fixes T72 Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-09-11config: fix memory leak with repeated opcodesJon Simons1-0/+1
Fix a memory leak in the path where parsing returns early due to seeing a repeated opcode. A testcase is added which demonstrates the leak and fix with valgrind. Resolves CID 1374267. Signed-off-by: Jon Simons <jon@jonsimons.org>
2017-08-25match: Add missing return statementAndreas Schneider1-0/+1
This makey the compiler happy. Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-08-25packet: Fix fallthrough compiler warningsAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-08-24ecdh: enable ecdh_sha2_nistp{384,521} kex methodsJon Simons8-10/+124
Summary: Based on Dirkjan's original patch series here: * https://www.libssh.org/archive/libssh/2015-08/0000029.html Here the changes are adapted for the current master branch, and expanded to include libgcrypt support. Co-Authored-By: Dirkjan Bussink <d.bussink@gmail.com> Signed-off-by: Jon Simons <jon@jonsimons.org> Test Plan: * Ran pkd tests for libcrypto and libgcrypt builds. * Ran client torture_algorithms.c tests for libcrypto and libgcrypt builds. * Tested across multiple libgcrypts ("1.6.3" and "1.7.6-beta"). Reviewers: aris, asn Reviewed By: asn Tags: #libssh Differential Revision: https://bugs.libssh.org/D7
2017-08-24ecdh: enable ecdh_sha2_nistp{384,521} kex methodsJon Simons8-10/+124
Summary: Based on Dirkjan's original patch series here: * https://www.libssh.org/archive/libssh/2015-08/0000029.html Here the changes are adapted for the current master branch, and expanded to include libgcrypt support. Co-Authored-By: Dirkjan Bussink <d.bussink@gmail.com> Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Test Plan: * Ran pkd tests for libcrypto and libgcrypt builds. * Ran client torture_algorithms.c tests for libcrypto and libgcrypt builds. * Tested across multiple libgcrypts ("1.6.3" and "1.7.6-beta"). Reviewers: aris, asn Tags: #libssh Differential Revision: https://bugs.libssh.org/D7
2017-08-24options: Use ssh_key_type_e in ssh_options_set_algo()Andreas Schneider1-14/+16
Review with 'git show -b' Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-08-24kex: Use ssh_kex_types_e in ssh_verify_existing_algo()Andreas Schneider1-2/+6
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2017-08-24ssh_options_set_algo: ensure we only set known algorithms internallyNikos Mavrogiannopoulos2-7/+80
That way, we will not fail later on key exchange phase when something unknown is negotiated. Fixes T37 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org>
2017-08-24config: add support for recursive including of filesNikos Mavrogiannopoulos1-2/+40
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2017-07-20libcrypto: add NULL-check for EVP_CIPHER_CTX_cleanupJon Simons1-1/+1
On OpenSSL versions prior to 1.1.0, `EVP_CIPHER_CTX_cleanup` will dereference its argument regardless of whether it is NULL. This is not a problem on OpenSSL at or beyond 1.1.0, where `EVP_CIPHER_CTX_cleanup` (macro to `EVP_CIPHER_CTX_reset`) returns early upon NULL input. Move the call to `EVP_CIPHER_CTX_cleanup` under the existing NULL check in `evp_cipher_cleanup` to avoid the problem. Introduced with this build-break fix: * e66f370682927ca8bd7ae0e7544754c6f4ac4969 Found in manual testing in an environment with an older OpenSSL. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
generated by cgit v1.2.1 (git 2.18.1) at 2021-01-24 16:30:15 +0000