Commit Graph

5077 Commits

Author SHA1 Message Date
Jakub Jelen
0cceefd49d Bump version to 0.9.5
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
libssh-0.9.5
2020-09-10 14:44:47 +02:00
Jakub Jelen
8af24251c1 Add a new location of sftp-server on Tumbleweed
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit ff599a9c53)
2020-09-02 17:14:54 +02:00
Jakub Jelen
645106a1ca tests: Enable all CASignatureAlgorithms as SHA1 certificates are now disabled in OpenSSH 8.2p1
This option is unknown to older OpenSSH versions (for example CentOS 7
with OpenSSH 7.4) so we can not add it everywhere.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 44de453b22)
2020-08-13 17:35:09 +02:00
Jakub Jelen
6672a457fb tests: Enable RSA SHA1 certs for testing against older OpenSSH
The OpenSSH 7.4 or 7.6 in Ubuntu and CentOS 7 does not support SHA2
RSA certificates and libssh automatically falls back to SHA1, which
is not allowed by default.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit db948bdac8)
2020-08-13 17:35:09 +02:00
Jakub Jelen
737ba4a680 CMakeLists: Shorten the keys lists passed to the ssh command
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit c106cd1f83)
2020-08-13 17:35:09 +02:00
Jakub Jelen
d4b07d1675 tests: Use the path to SSH executable consistently
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 2892b49a37)
2020-08-13 17:35:09 +02:00
Aris Adamantiadis
d462cc30c9 pkd client run user executable
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 9e7de14d59)
2020-08-13 17:35:09 +02:00
Aris Adamantiadis
c7f35f4d49 pkd: fix snprintf compiler warning
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit bba5fa18ed)
2020-08-13 17:35:09 +02:00
Aris Adamantiadis
6a1dc7df87 tests: use detected sshd path
The static sshd directory wasn't matching the detected sshd and prevented the testcases to be run against local OpenSSH builts

Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 1089948346)
2020-08-13 17:35:09 +02:00
Aris Adamantiadis
41e54ce042 tests: use OpenSSH-provided ciphers
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 7ec67011c5)
2020-08-13 17:35:09 +02:00
Aris Adamantiadis
a7c0ccd35e tests: search for netcat binary
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 177e76f753)
2020-08-13 17:35:09 +02:00
Aris Adamantiadis
9ec6923479 pkd: use detected OpenSSH supported key types
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 3d2570ff5f)
2020-08-13 17:35:09 +02:00
Aris Adamantiadis
d9e37c4e09 tests: detect OpenSSH supported ciphers
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 3063a57fc8)
2020-08-13 17:35:09 +02:00
Anderson Toshiyuki Sasaki
56ebe3c7d0 pki_crypto: Use temporary pointer when using i2d_*
These functions modify the provided pointer by advancing to the end of
if (point to the byte after the last written).  This makes the pointer
invalid, making necessary to use a temporary variable.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit fe18ef2798)
2020-08-13 17:32:15 +02:00
Anderson Toshiyuki Sasaki
e0c7d78a39 tests: Do not parse configuration file in torture_knownhosts
The test might fail if there is a local configuration file that changes
the location of the known_hosts file.  The test should not be affected
by configuration files present in the testing environment.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit f10d80047c)
2020-06-24 11:41:04 +02:00
Anderson Toshiyuki Sasaki
74e162c67f channel: Do not return error if the server closed the channel
If the server properly closed the channel, the client should not return
error if it finds the channel closed.

Fixes T231

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 750e4f3f9d)
2020-06-23 19:58:07 +02:00
Anderson Toshiyuki Sasaki
039054ea6e examples: Tolerate incomplete writes in exec example
Previously, the exec example would fail if it could not write the whole
read buffer to stdout.  With this changes, the exec example will be able
to write parts of the buffer until the whole buffer is written.

This makes the exec example to run when the stdout buffer is small.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit b0518552f1)
2020-06-23 19:57:55 +02:00
Anderson Toshiyuki Sasaki
1da78553dc tests: Add test for CVE-2019-14889
The test checks if a command appended to the file path is not executed.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 1694606e12)
2020-06-23 19:57:12 +02:00
Andreas Schneider
c5dfc2d5ce buffer: Add NULL check for 'buffer' argument
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 245ad744b5)
2020-06-08 09:15:26 +02:00
Andreas Schneider
f760781cb8 buffer: Reformat ssh_buffer_add_data()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 10b3ebbe61)
2020-06-08 09:15:24 +02:00
Andreas Schneider
8316bf1177 sftpserver: Add missing return check for ssh_buffer_add_data()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 2782cb0495)
2020-06-08 09:15:22 +02:00
Andreas Schneider
e631ebb3e2 sftpserver: Add missing NULL check for ssh_buffer_new()
Thanks to Ramin Farajpour Cami for spotting this.

Fixes T232

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 533d881b0f)
2020-06-08 09:15:20 +02:00
David Wedderwille
dcc0b9d7aa cmake: add _POSIX_SOURCE
Fixes T228

Signed-off-by: David Wedderwille <davidwe@posteo.de>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit 641a80be74)
2020-05-15 18:43:26 +02:00
Heiko Thiery
b1bbd20dfa cmake: Add autogenerated libssh_version.h
Set the cmake project verision to the autogenerated file to have a single
point to set the version. This will be included in the libssh.h file.

Pair-Programmed-With: Andreas Schneider <asn@cryptomilk.org>
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit bee8ed82ab)
2020-05-07 11:59:09 +02:00
Jakub Jelen
929a6b7d50 pki: Mark explicit fall through
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 7c20875891)
2020-05-05 14:33:32 +02:00
Jakub Jelen
88d676cf1a external: Do not confuse new gcc
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 0c7a772301)
2020-05-05 14:33:30 +02:00
Jakub Jelen
b93c9ae641 client: Properly indicate fall through
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit c45cfce166)
2020-05-05 14:33:27 +02:00
Heiko Thiery
a77d89d3ea session: add missing return value documentation
Add SSH_AGAIN as return value to ssh_handle_packets documentation.

Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit e76332bbd6)
2020-05-05 14:33:24 +02:00
Jakub Jelen
4276560680 channels: Avoid returning SSH_AGAIN from ssh_channel_poll_timeout()
This addresses a regression introduced in 3bad0607, partially fixed in 022409e9,
but the function was still able to return SSH_AGAIN, which was not expected by
callers.

Based on discussion in [1] and [2]

[1] https://gitlab.com/libssh/libssh-mirror/-/merge_requests/101
[2] https://www.libssh.org/archive/libssh/2020-03/0000029.html

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit 6417f5a3ca)
2020-05-05 14:33:01 +02:00
Jakub Jelen
a7ce241652 channels: reformat
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit fe0fcbbc67)
2020-05-05 14:32:59 +02:00
Jakub Jelen
1c7cfaba9c examples: Avoid unused parameter warnings and reformat
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit c2f64108a1)
2020-05-05 14:32:57 +02:00
Jakub Jelen
98c91e68fa examples: Add missing includes
Fixes: T225

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit 58d53f1397)
2020-05-05 14:32:31 +02:00
Jakub Jelen
078cb4c6f3 libcrypto-compat: Fix indentation and return value
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit eebb02fff5)
2020-05-05 14:32:27 +02:00
Rosen Penev
5972d7a98e libcrypto: remove deprecated API usage
EVP_CIPHER_CTX_init was replaced with _reset.

Removed EVP_CIPHER_CTX_cleanup. The successive _free call handles that.

Removed old SSLeay function usage.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit 54296787a7)
2020-05-05 14:32:23 +02:00
Rosen Penev
d35fdfbdb4 libcrypto-compat: add extra functions
Added extra functions. The next commit will switch to them.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit 70478619ce)
2020-05-05 14:32:15 +02:00
Laurent Bigonville
7ee7ff94ba Fix FTBFS on hurd-i386
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=933015

Signed-off-by: Laurent Bigonville <bigon@bigon.be>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit a881c318ac)
2020-05-05 14:32:09 +02:00
Laurent Bigonville
c42aab0122 Make the documentation reproducible
Signed-off-by: Laurent Bigonville <bigon@bigon.be>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 5f1d0c4795)
2020-05-05 14:32:07 +02:00
StefanBruens
69e97057c7 Correctly parse v4 subsecond timestamps
All subsecond timestamps are only in the packets if both the
SUBSECOND_TIMES flag and the timestamp flag, e.g. ATTR_ACCESSTIME
are set.

SUBSECOND_TIMES are not very common across server implementations
(e.g. openssh does not include it, nor does libssh's sftpserver
implementation), but this interpretation of the SFTP protocol draft
is used by WinSCP and lftp.

Fixes T219.

Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 1ff6dda616)
2020-05-05 14:32:04 +02:00
Anderson Toshiyuki Sasaki
3025eeace3 client: Check if the library is initialized in ssh_connect()
If the library is not initialized, SSH_ERROR is returned and the error
message is set properly.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit e3e3a27863)
2020-05-05 14:31:59 +02:00
Anderson Toshiyuki Sasaki
ffb0007768 client: Reformat ssh_connect()
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 0f33eecc01)
2020-05-05 14:31:58 +02:00
Anderson Toshiyuki Sasaki
a99b8a3979 init: Introduce internal is_ssh_initialized()
The introduced function returns whether the library is initialized or
not.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit dba2114ed7)
2020-05-05 14:31:53 +02:00
Anderson Toshiyuki Sasaki
0a450f0251 init: Clarify the need to call ssh_{init, finalize}()
When libssh is statically linked, it is necessary to explicitly call
ssh_init() before calling any other provided API.  It is also necessary
to call ssh_finalize() before exiting to free allocated resources.

Fixes T222

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit e3e52394c1)
2020-05-05 14:31:49 +02:00
Andreas Schneider
9e9df61244 Bump version to 0.9.4
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
libssh-0.9.4
2020-04-09 09:30:20 +02:00
Andreas Schneider
958afb1c6a CVE-2020-1730: Fix a possible segfault when zeroing AES-CTR key
Fixes T213

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit b36272eac1)
2020-04-09 09:30:00 +02:00
Anderson Toshiyuki Sasaki
e510de0315 kex: Add support for diffie-hellman-group14-sha256
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 9eb1ce88ae)
2020-04-06 11:36:35 +02:00
Andreas Schneider
34c596182d dh-gex: Check return value of ssh_get_random()
CID #1422162

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit d2f0d3270a)
2020-04-06 11:36:33 +02:00
Andreas Schneider
1a18d9cce2 cmake: Fix building with threading support on MinGW
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
(cherry picked from commit a9a7c2dc29)
2020-04-06 11:36:30 +02:00
Anderson Toshiyuki Sasaki
4c83d19c48 auth: Fix memory leak in ssh_userauth_publickey_auto()
When a key is rejected, free the allocated memory before returning.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
(cherry picked from commit 6bd2b93f43)
2020-03-29 09:59:52 +02:00
Andreas Schneider
673bf1ff09 doc: Fix a doxygen warning
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 46c54e5ddb)
2020-03-27 13:15:30 +01:00
Andreas Schneider
fe1fe49617 doc: Make sure we parse the server and sftp documentation
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit bbfce454de)
2020-03-27 13:15:28 +01:00