aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
5 daysfeat: add option to read user-supplied key string in ssh_bind_options_set()Debanga Sarma1-70/+47
Signed-off-by: Debanga Sarma <deb737@proton.me> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
5 daysreformatDebanga Sarma1-185/+196
Signed-off-by: Debanga Sarma <deb737@proton.me> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
11 dayskex: Avoid trailing comma in cipher listJakub Jelen1-13/+10
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
11 daysAdd support for more options in ssh_options_get()Adam Kerrison1-13/+126
Signed-off-by: Adam Kerrison <adam_kerrison@bmc.com> Squashed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
11 daysFix mbedTLS issuesNoah Miller2-2/+2
Signed-off-by: Noah Miller <mike@stealthwing.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
11 dayssftp.c: call ssh_set_errorAjit Singh1-1/+4
Since sftp_init() returns 0 on success, < 0 on error with ssh error set. This change sets the appropriate ssh error when the SSH_FXP_VERSION packet cannot be unpacked and sftp_init() return with -1. Signed-off-by: Ajit Singh <ajeetsinghchahar2@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-03-24ecdh_crypto.c: free secret when error happensNorbert Pocs1-0/+1
Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-03-23Do not close socket passed through options on error conditionsJakub Jelen3-12/+19
Fixes: #244 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2024-03-23Reformat ssh_silent_disconnectJakub Jelen1-7/+9
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2024-03-19feat: Handle hostkeys like OpenSSHGauravsingh Sisodia1-18/+19
fix: memory leak fix: add defaults after parsing fix: set defaults in ssh_bind_listen tests: add test for checking default hostkey paths remove: null check for hostkey paths, can't happen since we set defaults now examples: ssh_server remove "no default keys", default hostkeys set in ssh_bind_listen Signed-off-by: Gauravsingh Sisodia <xaerru@gmail.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2024-03-19reformat: bind.cGauravsingh Sisodia1-74/+93
reformat: remove unneeded free Signed-off-by: Gauravsingh Sisodia <xaerru@gmail.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2024-03-08Rework the coverage buildJakub Jelen1-0/+7
This reworks it to avoid a need to special build type and adding the flags only to the targets that need it (skipping testing wrappers which break with them). It also updates the CodeCoverage module from the following URL: https://github.com/bilke/cmake-modules/blob/master/CodeCoverage.cmake Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2024-03-08Conditionalize TTY options that are not available on freebsdJakub Jelen1-0/+6
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2024-03-06Issue #157: Added authorDaniel Evers1-0/+1
Signed-off-by: Daniel Evers (daniel.evers@utimaco.com) Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-03-06Issue #157: Use the current TTY's settings by default.Daniel Evers3-3/+455
When opening a PTY on the server, try to use the current TTY's settings (i.e. based on STDIN). If that fails or STDIN isn't a TTY, use default modes that avoid any character translation. Don't rely on stdin to be a TTY (breaks CI). Instead, open a PTY and temporarily use that as "fake" stdin. Signed-off-by: Daniel Evers (daniel.evers@utimaco.com) Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-03-06Fix #157: Allow to set terminal modes for PTYsDaniel Evers2-5/+18
Added the new function `ssh_channel_request_pty_size_modes` which allows to pass additional encoded SSH terminal modes (see opcodes in RFC 4245). Signed-off-by: Daniel Evers (daniel.evers@utimaco.com) Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-02-22cmake: use imported targets for OpenSSL and zlibGregor Jasny1-20/+4
Imported targets are highly preferred over the individual variables for includes and libs because they will be used in a coherent way and any spelling mistakes or unavailability won't go unnoticed. Also it will prevent bugs like conan-io/conan-center-index#16900 or using mismatching header/libs combinations. Signed-off-by: Gregor Jasny <gjasny@googlemail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2024-02-13sftp: Handle read/write limits in the old low-level SFTP APIJakub Jelen1-5/+18
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2024-01-15misc.c: Initialize pointers and free itNorbert Pocs1-2/+4
Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-15Check any input username for validityNorbert Pocs3-2/+17
Check possible inputs of username for malicious code. Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-15misc: Add function to check username syntaxNorbert Pocs1-0/+32
Malicious code can be injected using the username with metacharacters, therefore the username must be validated before using it with any %u. Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-15sftp_aio.c, sftp.h: Add capping to sftp aio write APIEshan Kelkar1-5/+10
Signed-off-by: Eshan Kelkar <eshankelkar@galorithm.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-15sftp_aio.c, sftp.h: Add capping to the sftp aio read APIEshan Kelkar1-2/+7
Signed-off-by: Eshan Kelkar <eshankelkar@galorithm.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-15sftp.c, sftp.h: Store the limits in the sftp_sessionEshan Kelkar1-2/+111
In the sftp_init() call, the limits are stored in the sftp_sesssion. If the limits@openssh.com extension is supported the limits are retrieved from the server, else libssh uses the default limits. The sftp library functions that require the limits can access them using the sftp session. The library user can call sftp_limits() to get a copy of the limits stored in the sftp session. Since the limits were already retrieved from the server during sftp_init(), this sftp_limits() call requires no communication with the server. Signed-off-by: Eshan Kelkar <eshankelkar@galorithm.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-15sftp.c: Reformat sftp limits API accoding to the current coding styleEshan Kelkar1-6/+3
Signed-off-by: Eshan Kelkar <eshankelkar@galorithm.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-15sftp.c: Reformat sftp_init() according to the current coding styleEshan Kelkar1-78/+85
Signed-off-by: Eshan Kelkar <eshankelkar@galorithm.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-09Fix docstring for ssh_userauth_kbdint_getanswer()JamesWrigley1-1/+2
This incorrectly stated that it would return an integer value instead of a string. Signed-off-by: James Wrigley <james@puiterwijk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-09Happy new year 2024!Andreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-02Document that options set on a bind will be free'd by ssh_bind_freeJamesWrigley1-1/+2
Signed-off-by: James Wrigley <james@puiterwijk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2024-01-02Document that ssh_channel_read_nonblocking() will trigger callbacksJamesWrigley1-1/+1
Signed-off-by: James Wrigley <james@puiterwijk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <norbertpocs0@gmail.com>
2024-01-02Document that ssh_channel_read_nonblocking() may return SSH_EOFJamesWrigley1-4/+2
The current documentation incorrectly states that it will return 0 on EOF, but the function calls ssh_channel_poll() internally, which will return SSH_EOF, which will then be returned by ssh_channel_read_nonblocking(). Signed-off-by: James Wrigley <james@puiterwijk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <norbertpocs0@gmail.com>
2024-01-02pki: Rewrite default key format handling to improve readabilityJakub Jelen1-24/+20
... and make coerity happy avoiding dead code CID 1531320 CID 1531321 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <norbertpocs0@gmail.com>
2024-01-02session: Avoid memory leaksJakub Jelen1-2/+5
Thanks coverity CID 1531417 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <norbertpocs0@gmail.com>
2024-01-02Fix typos detected with new codespellJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2023-12-22Fix regression in IPv6 addresses in hostname parsingJakub Jelen3-15/+15
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-6918: kdf: Detect context init failuresJakub Jelen1-3/+15
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-6918: Systematically check return values when calculating digestsJakub Jelen5-116/+485
with all crypto backends Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-6918: Remove unused evp functions and typesJakub Jelen3-181/+0
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-6918: kdf: ReformatJakub Jelen1-9/+11
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-48795: Strip extensions from both kex lists for matchingJakub Jelen1-4/+12
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-48795: Server side mitigationsAris Adamantiadis2-11/+43
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-48795: client side mitigationAris Adamantiadis10-69/+118
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-6004: misc: Add ipv6 link-local check for an ip addressNorbert Pocs3-8/+41
Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-12-18CVE-2023-6004: config_parser: Check for valid syntax of a hostname if it is ↵Norbert Pocs1-1/+11
a domain name This prevents code injection. The domain name syntax checker is based on RFC1035. Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-12-18CVE-2023-6004: misc: Add function to check allowed characters of a hostnameNorbert Pocs1-0/+68
The hostname can be a domain name or an ip address. The colon has to be allowed because of IPv6 even it is prohibited in domain names. Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-12-18CVE-2023-6004: options: Simplify the hostname parsing in ssh_options_setNorbert Pocs1-24/+16
Using ssh_config_parse_uri can simplify the parsing of the host parsing inside the function of ssh_options_set Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-12-18CVE-2023-6004: config_parser: Allow multiple '@' in usernamesNorbert Pocs1-1/+1
Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-12-15pki: New API functions exporting (also ed25519 keys in different formats)Jakub Jelen7-161/+701
This also adds an fallback to OpenSSH file format in non-OpenSSL backends and OpenSSH-compatible private key export for writing OpenSSH private keys. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-15pki: Fix indentationJakub Jelen1-2/+3
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-15pki: Calculate missing CRT parameters when building RSA KeyJakub Jelen1-5/+79
The OpenSSL claims that these parameters are not mandatory and just speed up calculations. But in reality, if they are missing, we can not export this key into PEM files or if we export them, they are not readable/valid. This was discussed in the following OpenSSL issue even with some proposed fix, but it will take time before this will be implemented so in the meantime, we back down to calculating the parameters manually as done in OpenSSH. https://github.com/openssl/openssl/issues/21826 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-20 15:30:52 +0000