Commit Graph

2556 Commits

Author SHA1 Message Date
Jakub Jelen
0a9b5bcd45 gssapi: Free mic_buffer on all code paths (GHSL-2023-042)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
bb4e6ad1ee gssapi: Release output_token on error path (GHSL-2023-041)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
19ec009b7d gssapi: Release actual_mechs on exit (GHSL-2023-040)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
ccc87f5593 gssapi: Free output token on exit path (GHSL-2023-039)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
23ff6f9388 gssapi: Free mic_token_buffer on before return (GHSL-2023-038)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
5928d7962e gssapi: Release output_token (GHSL-2023-037)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
3334070f63 gssapi: Avoid memory leaks of selected OID (GHSL-2023-036)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
f691dbbaab gssapi: Release buffer on error path (GHSL-2023-035)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
bdabf25a5b gssapi: Free selected OID set on error paths (GHSL-2023-034)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Jakub Jelen
2b5bef9c03 gssapi: Free both_supported on error paths (GHSL-2023-033)
Thanks Phil Turnbull from GitHub

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04 11:51:17 +02:00
Ahsen Kamal
08a6996103 handle no-more-sessions in server
Signed-off-by: Ahsen Kamal <itsahsenkamal@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-28 10:58:11 +02:00
Ahsen Kamal
9741054422 add request no-more-sessions@openssh.com global request
Signed-off-by: Ahsen Kamal <itsahsenkamal@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-28 10:58:10 +02:00
Ran Park
d109b5bd5f Add tests for run ssh_execute_command
Signed-off-by: Ran Park <bagayonghuming@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-25 18:01:32 +02:00
Ran Park
9cd23fecac solve incorrect parsing of the ProxyCommand configuration option
Signed-off-by: Ran Park <bagayonghuming@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-25 18:01:31 +02:00
Eshan Kelkar
ef901829c1 Introduce the posix-rename@openssh.com extension handling
Changes done in sftp_rename such that it will use
posix-rename@openssh.com extension if supported
and send a SSH_FXP_EXTENDED request. If the
extension is not supported a normal SSH_FXP_RENAME
request will be sent.

Signed-off-by: Eshan Kelkar <eshankelkar@galorithm.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-25 12:13:18 +02:00
Eshan Kelkar
b067d7a123 Reformat of sftp_rename() to match the current coding style
Signed-off-by: Eshan Kelkar <eshankelkar@galorithm.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-25 12:13:17 +02:00
Eshan Kelkar
88335c8e07 Add support for hardlink@openssh.com
sftp_hardlink() has been introduced which when called
sends a SSH_FXP_EXTENDED request to server for creating
a hardlink.

Signed-off-by: Eshan Kelkar <eshankelkar@galorithm.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-24 10:29:12 +02:00
Adley Phu
2122fc3dcb Add callback to accept forwarded-tcpip requests
Signed-off-by: Adley Phu <aphu@janestreet.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-21 12:56:16 +02:00
Jakub Jelen
c3aa0cb182 options: Remove set-but-never read variable
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-04-14 19:11:24 +02:00
Jakub Jelen
fffdcfb373 ecdh: Avoid unused variable with OpenSSL 1.1.1
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-04-14 19:11:24 +02:00
Jakub Jelen
3058549bf7 cmake: Return back the DEFAULT_C_COMPILE_FLAGS
Accidentally removed in 1689b83d0f.

Reported in #185 by Peter Kästle

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-04-14 19:11:24 +02:00
Jakub Jelen
2c876464ab ecdh: Fix missing-prototype warning
Related to the accidental removal of compiler flags as reported in #185

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-04-14 19:11:24 +02:00
Jakub Jelen
e0011a1970 pki: Avoid freeing static groups/points on OpenSSL<3
Fixup commit 49490ac06d

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-04-14 17:09:28 +02:00
Tom Deseyn
6f029598c7 Emit channel_write_wontblock when remote window becomes non-zero.
Signed-off-by: Tom Deseyn <tom.deseyn@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-14 15:02:03 +02:00
roytak
49490ac06d pki_crypto: Fix memory leak
Fixed memory leak in pki_publickey_to_blob when using an EC type of
hostkey.

Signed-off-by: roytak <xjanot04@stud.fit.vutbr.cz>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-04-14 14:28:05 +02:00
khalid
f9147a3cf4 Remove zlib from the default compression methods and fips methods
Signed-off-by: Khalid Mamdouh <khalidmamdou7@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-03-28 11:36:44 +02:00
khalid
cb19677d2e Disabled preauth compression (zlib) by default
Removed it from the wanted methods list in the ssh_options_set function. Now users have to set the compression value to 'zlib' explicitly to enable it.
Updated unit tests to reflect removing zlib compression algo from the defaults compression algorithms.

Signed-off-by: Khalid Mamdouh <khalidmamdou7@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-03-28 11:36:44 +02:00
Norbert Pocs
7b12876f04 doc: Fix doxygen errors when QUIET=yes EXTRACT_ALL=yes
Signed-off-by: Norbert Pocs <npocs@redhat.com>
Reviewed-by: Sahana Prasad <sahana@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-03-15 10:21:31 +01:00
Ahsen Kamal
6d3e7e1c44 fix null dereference of error
The Coverity scan CID 1506418 found the null pointer dereferencing

Signed-off-by: Ahsen Kamal <itsahsenkamal@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-03-10 10:21:51 +01:00
Andreas Schneider
2ed0525f40 poll: Rename lock to lock_cnt and make it unsigned
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-03-09 10:23:46 +01:00
Jakub Jelen
30b5a2e33b poll: Change the lock to block only POLLIN events
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-03-09 10:23:37 +01:00
Jakub Jelen
e15f493d4a socket: Reformat
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-03-09 10:10:18 +01:00
Jakub Jelen
19c4de7350 Reformat ssh_packet_socket_callback
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-03-09 10:10:18 +01:00
Jakub Jelen
832b94a660 Reformat ssh_connector_fd_out_cb
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-03-09 10:10:18 +01:00
Jakub Jelen
5506aadf05 config: Fix indentation
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-03-09 10:10:18 +01:00
Jakub Jelen
258560da16 bignum: Avoid bogus newline in the log
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-03-09 10:10:18 +01:00
Ahsen Kamal
e364b1e793 free memory of peer_discon_msg
Signed-off-by: Ahsen Kamal <itsahsenkamal@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-03-06 19:02:03 +01:00
Ahsen Kamal
4a7a7e3186 assign peer_discon_msg
Signed-off-by: Ahsen Kamal <itsahsenkamal@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-03-06 19:02:03 +01:00
Ahsen Kamal
e2b89dec9d rename discon_msg to peer_discon_msg
Signed-off-by: Ahsen Kamal <itsahsenkamal@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-03-06 19:02:03 +01:00
Jakub Jelen
f8d7fee588 pki: Use preference hints when loading keys from store
to avoid the need to login every time.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-03-01 11:35:28 +01:00
Jakub Jelen
2539d72b7c Add support for PKCS#11 provider in OpenSSL 3.0
The engine API in OpenSSL 3.0 is deprecated so we are in the progress of working
on a PKCS#11 provider for OpenSSL. This commit introduces a conditional build
with the pkcs11-provider support (instead of engines) with all the changes
required for the provider to work with existing code and tests.

The CI modification is only temporary before we will have the real package in
Fedora or somewhere to use.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-03-01 11:35:28 +01:00
Mohammad Shehar Yaar Tausif
a3a13eb3a8 Remove support for DSA Keys
Solving issue #110. The original work is at !231
Some changes were needed because the newly added features in master through time

Signed-off-by: Mohammad Shehar Yaar Tausif <sheharyaar48@gmail.com>
Signed-off-by: Norbert Pocs <npocs@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-02-02 14:49:06 +01:00
Norbert Pocs
486df37a84 src/options.c: Add documentation for default LogLevel
Libssh defaults to QUIET or SSH_LOG_NONE regarding of loglevel. Have it
documented to not confuse the users.

Signed-off-by: Norbert Pocs <npocs@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-02-01 15:26:02 +01:00
Norbert Pocs
9931f158e0 server: Add documentation to some functions
Signed-off-by: Norbert Pocs <npocs@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-02-01 15:26:02 +01:00
Norbert Pocs
b7c1f792cc documentation: Fix Missing param doxygen warnings
Signed-off-by: Norbert Pocs <npocs@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-02-01 15:26:02 +01:00
Norbert Pocs
4fb5af1da5 src/pki_crypto.c: Fix errors introduced by EC rework
- The nid is unused in the new context
- The variable `params` is defined locally in the function, fixing redefinition

Signed-off-by: Norbert Pocs <npocs@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-02-01 15:25:54 +01:00
Jakub Jelen
bc2e99dc3f ecdh: Rewrite to use OSSL_PARAM_BLD
and improve debug logs and error checking. Thanks Norbert for the hints.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-01-25 16:53:19 +01:00
Jakub Jelen
1eb3df5254 Get rid of the deprecated OpenSSL API
It turns out there is a way to get the uncompressed format from the low-level
API, which is not (yet?) deprecated so this removes all of the TODO's for ECDSA
keys and moves the EC_KEY structure in the high-level EVP_PKEY.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-01-25 16:53:19 +01:00
Jakub Jelen
02fda2ef80 Remove needless ifdefs for Ed25519 support ...
... through bundled code with OpenSSL. These were needed with older OpenSSL
versions before 1.1.1.
After removal in 358ce46551 these were just static
ifdef so this will simplify the code.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-01-25 16:53:19 +01:00
Jakub Jelen
2187c3feae token: Avoid warnings with extraneous parentheses
The FreeBSD builder complains like this:

/home/gitlab-runner/builds/jtxr_hfi/0/jjelen/libssh-mirror/src/token.c:438:15: warning: equality comparison with extraneous parentheses [-Wparentheses-equality]
    if ((list == NULL)) {
         ~~~~~^~~~~~~
/home/gitlab-runner/builds/jtxr_hfi/0/jjelen/libssh-mirror/src/token.c:438:15: note: remove extraneous parentheses around the comparison to silence this warning
    if ((list == NULL)) {
        ~     ^      ~
/home/gitlab-runner/builds/jtxr_hfi/0/jjelen/libssh-mirror/src/token.c:438:15: note: use '=' to turn this equality comparison into an assignment
    if ((list == NULL)) {
              ^~
              =
1 warning generated.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-01-25 16:53:19 +01:00