aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-06-28Bump version to 0.9.0stable-0.9Andreas Schneider3-4/+4
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-28tests: Added a check for unaccessible global known_hostsAnderson Toshiyuki Sasaki1-0/+9
Verify that the check process will not fail if the global known_hosts file is not accessible and the local known_hosts file contain the host. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 8e42ed82201f4c42dcbc0726a2304d8ab69179dc)
2019-06-28knownhosts: Fixed a typoAnderson Toshiyuki Sasaki1-1/+1
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 5617eaf0e200b6091088d299905d3319e2410247)
2019-06-28knownhosts: Do not fail if global known_hosts file is inaccessibleAnderson Toshiyuki Sasaki1-10/+26
Previously, if the global known_hosts file (default: /etc/ssh/ssh_known_hosts) was inaccessible, the check for known hosts failed. This makes the check to fail if both files are inaccessible. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 4adb13d9e31506e8bb36fedd9a81f3e70f8545cc)
2019-06-27connect: Code style formattingAnderson Toshiyuki Sasaki1-174/+196
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit da50b12051fba3c4099afb6b086315643e6131b2)
2019-06-27connect: Removed unused codeAnderson Toshiyuki Sasaki2-173/+0
The internal function ssh_connect_host() is not used. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit a82993b320da3a6e20cf9199c79446aa14e2a4a1)
2019-06-27packet: Check return value when sending unimplementedAnderson Toshiyuki Sasaki1-1/+5
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 6a9185636f4398ba51ba8586394244319826f61e)
2019-06-27packet: Reformat ssh_packet_process()Anderson Toshiyuki Sasaki1-31/+44
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit a1ee22eb6414bca7b3532fcef669d65a53929b2f)
2019-06-27auth: Do not print error message for SSH_AGAINAnderson Toshiyuki Sasaki1-1/+1
In non-blocking mode, it is expected SSH_AGAIN to be returned many times. Do not flood the log with error messages. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 1d54a3880d225333dc5184180b36d0e3c7302283)
2019-06-27examples: Check ssh_event_dopoll() return valueAnderson Toshiyuki Sasaki1-1/+6
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit b1ff11f416fd0a10e41c6d0b89e394ef8359cc06)
2019-06-27dh-gex: Check return code ssh_dh_keypair_get_keys()Anderson Toshiyuki Sasaki1-0/+5
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> (cherry picked from commit 25bb6eef964e680137c3167dc0e0f9dbf2aafb60)
2019-06-27gitlab-ci: Re-enable client tests in CentOS7Anderson Toshiyuki Sasaki1-2/+2
The tests were disabled because of failures in torture_auth. The server tests are not enabled because the pkd tests are failing. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit d00ff451db2c5842f236013acc8eaaa7455a1358)
2019-06-27pki: Add workarounds for old OpenSSHAnderson Toshiyuki Sasaki1-0/+28
When we are talking to old OpenSSH versions which does not support rsa-sha2-{256,512}-cert-v01@openssh.com or SHA2 in certificates, fallback to old supported values. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 4b7ce75e1fe4bec8d7d645516a1f9f31a4a31ba5)
2019-06-27tests/pkd: Fix elif without expressionAnderson Toshiyuki Sasaki1-1/+1
This was introduced during fixes to run pkd tests in FIPS mode. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit c8f49becfde6777aa73cea3c8aa58a752d2adce4)
2019-06-27tests: Add a server test case for unknown global requestAnderson Toshiyuki Sasaki1-0/+47
The test checks if the server handles unknown global requests properly. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit f64814b7be533080a7117cd174c3a81d859f4399)
2019-06-27tests: Introduce torture_client_global_requestsAnderson Toshiyuki Sasaki2-1/+154
Added a test case where invalid global requests are sent to the server which should reject them, but not stop working. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit abf571216062d30fa4ea6ba0eb74c09e833ca5b2)
2019-06-27messages: Reject tcpip-forward requests as clientAnderson Toshiyuki Sasaki1-2/+14
When the session is a client session, reject tcpip-forward requests. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 1aef599ab10aef044c2b51814e35f730a31e84e4)
2019-06-27messages: Consume unknown global requests messagesAnderson Toshiyuki Sasaki1-3/+26
When an unknown global request is received, consume the message to avoid sending UNIMPLEMENTED later. Only report the failure if the request wants a reply. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> (cherry picked from commit 3d7d3f303ed5f79c1df248abf5c8362443faf905)
2019-06-24Update ChangeLog to add FIPSAndreas Schneider1-0/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 220f1e143526aaa6a413386613dab0e80766105a)
2019-06-24tests: Skip 1k RSA key generation in FIPSJakub Jelen1-15/+17
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 17a531d2af35a0b6e7ee42c0b83b2f0289978233)
2019-06-24pki_crypto: Correct error checking after RSA key generationJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit a80547bdf99819d58bf8ca1f46d224a82b285ce3)
2019-06-24tests: Filter out bogus output from openssh in FIPS ModeJakub Jelen1-2/+2
The OpenSSH in RHEL 8 in FIPS Mode outputs information about this on start and it needs to be skipped for the version detection (and build) to pass: $ ssh -V FIPS mode initialized OpenSSH_8.0p1, OpenSSL 1.1.1c FIPS 28 May 2019 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit a4fa51454910f5d435e79248d5d0fd39703c4e28)
2019-06-24tests: Add reproducer for T76Jakub Jelen3-0/+115
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit d5095a55b99198d7fa2fc4b8f1a1ca587b50ce9a)
2019-06-24pki: Search for the PEM headers not only on the start of the key fileJakub Jelen1-7/+7
Fixes: T76 for gcrypt and mbedtls backends Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit d627cba47610f68afc4df54b683fc73d2b43a67a)
2019-06-24pki: Reformat pki_privatekey_type_from_string()Jakub Jelen1-4/+10
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 23c837f4d00a71c1737fa6038226c9d246bbed2f)
2019-06-24tests: Reproducer for proxy command with stderr output (T130)Jakub Jelen1-0/+25
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit bd69ac63ca455b08ffc5093be34b2dd232f3187a)
2019-06-24socket: Do not process stderr of proxy commands (Fixes T130)Jakub Jelen1-2/+9
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit 6c49c41c19157cbafb8f4b90276b83550da98da9)
2019-06-24socket: Reformat the rest of the fileJakub Jelen1-241/+274
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> (cherry picked from commit bd65568749a1da652ac15964347cc2f5835ee1fa)
2019-06-14Bump version to 0.8.91Andreas Schneider2-2/+2
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14Update ChangeLogAndreas Schneider1-0/+65
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14Bump SO version to 4.8.1Andreas Schneider4-2/+429
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2019-06-14include: Make sure ssh_session_get_known_hosts_entry is added to the APIAndreas Schneider1-3/+2
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2019-06-14callbacks: Add ssh_threads_get_default() to the callbacks.hDavid Wedderwille1-2/+13
Fixes: T154 Signed-off-by: David Wedderwille <davidwe@posteo.de> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14tests/torture_config: Replace long long with uint64_tAnderson Toshiyuki Sasaki1-1/+1
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14tests/torture_rekey: Replace long long with uint64_tAnderson Toshiyuki Sasaki1-2/+2
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14channels: Do not mix integer typesAnderson Toshiyuki Sasaki1-9/+9
Use uint32_t when expecting 32 bits unsigned int. Use PRIu32 macro to print correctly independently of the architecture. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14ed25519: Replace unsigned long long with uint64_tAnderson Toshiyuki Sasaki3-14/+14
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14config: Replace long long with int64_tAnderson Toshiyuki Sasaki1-1/+1
Do not use long long as equivalent as int64_t. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14sftp: Do not mix integer typesAnderson Toshiyuki Sasaki1-3/+3
Don't use long unsigned int as equivalent as uint32_t. Use macros to correctly print the values independently of the architecture. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14priv.h: Add macro definitions for PRIx32 and PRIx64Anderson Toshiyuki Sasaki1-0/+12
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14tests/torture_rekey: Do not mix integer typesAnderson Toshiyuki Sasaki1-1/+1
In torture_rekey_time(), "long long" was used instead of uint32_t. This makes the test to fail in some architectures where the sizes don't match. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14tests: Add more reproducers for valid and invalid Match exec blocksJakub Jelen1-0/+34
Fixes: T152 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-14config: Skip the rest of the line for Match execJakub Jelen1-0/+16
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13cmake: Bump API version to 4.8.0David Wedderwille4-2/+431
Fixes T153 Signed-off-by: David Wedderwille <davidwe@posteo.de> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13channels: Make ssh_message_channel_request_open_reply_accept_channel publicDavid Wedderwille3-2/+23
This also adds documentation for it. Fixes T144 Signed-off-by: David Wedderwille <davidwe@posteo.de> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13SSH_LOG: Adjust log level from SSH_LOG_WARNING to SSH_LOG_PROTOCOLDavid Wedderwille4-11/+11
Fixes T149 Signed-off-by: David Wedderwille <davidwe@posteo.de> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13tests: Fix the glob test on musl libcAndreas Schneider1-4/+4
Fixes #150 Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13session: OpenSSH is using SHA256 fingerprints nowJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13.gitlab-ci.yml: Add FIPS testsJakub Jelen1-0/+23
Added a build running in a Fedora image with crypto-policies set as FIPS and forcing OpenSSL FIPS mode through environment variable. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13tests/pkd: Fix OpenSSH version checkAnderson Toshiyuki Sasaki1-5/+9
When running in FIPS mode, the OpenSSH version is not the first string printed by "ssh -V". This makes the parser to find the first occurrence of the version ignoring anything printed before it. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-20 03:28:47 +0000