1
1
Граф коммитов

3075 Коммитов

Автор SHA1 Сообщение Дата
Andreas Schneider
c2ee63431b pki: Add missing semi-colon. 2014-05-07 09:30:29 +02:00
Jon Simons
9e4bc10525 kex: NULL checks for 'first_kex_packet_follows'
Add NULL checks to 'is_first_kex_packet_follows_guess_wrong'
to ensure that a 'strdup(NULL)' path can not be taken.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-05-06 09:04:07 +02:00
Alan Dunn
f37c844bf7 messages: Add missing ntohl on X11 request screen number
BUG: https://red.libssh.org/issues/160

Signed-off-by: Alan Dunn <amdunn@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-05-06 08:56:44 +02:00
Hani Benhabiles
2c7dfb02a8 Small documentation fix.
Signed-off-by: Hani Benhabiles <hani@linux.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-05-06 08:52:55 +02:00
Andreas Schneider
2884bbf5b1 pki: Correctly update the ECDSA keytype. 2014-04-23 11:16:28 +02:00
Andreas Schneider
f48a99b97c pki: Move ssh_pki_key_ecdsa_name() to the correct file. 2014-04-23 11:15:05 +02:00
Andreas Schneider
11cfb2903e pki: Make pki_key_ecdsa_nid_to_name() a shared function. 2014-04-23 11:12:08 +02:00
Dirkjan Bussink
c520d97dd9 Add tests for SHA2 HMAC algorithms
BUG: https://red.libssh.org/issues/91

Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-22 10:57:35 +02:00
Dirkjan Bussink
6c74d6f891 Add options support for setting and getting HMAC algorithms
BUG: https://red.libssh.org/issues/91

Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-22 10:57:18 +02:00
Dirkjan Bussink
262c82ac06 Add negotiation for SHA2 HMAC algorithms
BUG: https://red.libssh.org/issues/91

Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-22 10:57:00 +02:00
Dirkjan Bussink
164b8e99cc Add logic to support SHA2 HMAC algorithms
BUG: https://red.libssh.org/issues/91

Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-22 10:56:46 +02:00
Dirkjan Bussink
4a08902664 Add SHA2 algorithms for HMAC
BUG: https://red.libssh.org/issues/91

Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-22 10:55:59 +02:00
Gangadhar Sandrani
d6e6a453fc log: Fix log levels.
Signed-off-by: Gangadhar Sandrani <gangadhar.sandrani@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-22 09:35:33 +02:00
Jon Simons
eb86fd8cdf kex: server fix for first_kex_packet_follows
Ensure to honor the 'first_kex_packet_follow' field when processing
KEXINIT messages in the 'ssh_packet_kexinit' callback.  Until now
libssh would assume that this field is always unset (zero).  But
some clients may set this (dropbear at or beyond version 2013.57),
and it needs to be included when computing the session ID.

Also include logic for handling wrongly-guessed key exchange algorithms.
Save whether a client's guess is wrong in a new field in the session
struct: when set, the next KEX_DHINIT message to be processed will be
ignored per RFC 4253, 7.1.

While here, update both 'ssh_packet_kexinit' and 'make_sessionid' to
use softabs with a 4 space indent level throughout, and also convert
various error-checking to store intermediate values into an explicit
'rc'.

Patch adjusted from original to ensure that client tests remain passing
(ie 'torture_connect'): restrict the changes in 'ssh_packet_kexinit'
only for the 'server_kex' case.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-22 09:26:59 +02:00
Alan Dunn
099e2e8438 build: Do not link against libssl, only libcrypto
Signed-off-by: Alan Dunn <amdunn@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-22 09:24:54 +02:00
Andreas Schneider
291312c5e4 cmake: Install cmake config files to the correct directory. 2014-04-16 15:45:33 +02:00
Andreas Schneider
e2805abbf7 Revert "kex: server fix for first_kex_packet_follows"
The patch breaks the client with ECDSA.

This reverts commit 5865b9436f.
2014-04-15 09:49:25 +02:00
Andreas Schneider
79d51099ac examples: Fix a bad shift if ssh_get_fd() returns -1.
Found by Coverity.

CID: #1199454
2014-04-14 21:24:28 +02:00
Andreas Schneider
adf23533e0 doc: Improve docs for ssh_channel_get_exit_status().
BUG: https://red.libssh.org/issues/154
2014-04-10 08:54:11 +02:00
Andreas Schneider
927cd90dc1 channels: Fix exit-signal request.
BUG: https://red.libssh.org/issues/153
2014-04-10 08:54:11 +02:00
Andreas Schneider
b5efbe75cd session: Fix a memory leak with custom banner.
BUG: https://red.libssh.org/issues/152
2014-04-10 08:54:10 +02:00
Andreas Schneider
01311dd419 cmake: Fix doxygen. 2014-04-10 08:54:10 +02:00
Jon Simons
5865b9436f kex: server fix for first_kex_packet_follows
Ensure to honor the 'first_kex_packet_follow' field when processing
KEXINIT messages in the 'ssh_packet_kexinit' callback.  Until now
libssh would assume that this field is always unset (zero).  But
some clients may set this (dropbear at or beyond version 2013.57),
and it needs to be included when computing the session ID.

Also include logic for handling wrongly-guessed key exchange algorithms.
Save whether a client's guess is wrong in a new field in the session
struct: when set, the next KEX_DHINIT message to be processed will be
ignored per RFC 4253, 7.1.

While here, update both 'ssh_packet_kexinit' and 'make_sessionid' to
use softabs with a 4 space indent level throughout, and also convert
various error-checking to store intermediate values into an explicit
'rc'.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-10 08:54:10 +02:00
Andreas Schneider
ad1313c2e5 Revert "direct-tcpip and forwarded-tcpip callbacks"
This reverts commit efe785e711.

We need a Signed-off version. I didn't have the Certificate of Origin
yet.
2014-04-09 12:49:06 +02:00
Andreas Schneider
0cb9f792b8 cmake: Update doxygen module. 2014-04-09 11:21:29 +02:00
Loïc Michaux
efe785e711 direct-tcpip and forwarded-tcpip callbacks 2014-04-09 11:13:57 +02:00
Jon Simons
48aca98cd5 pki crypto: expose new ssh_pki_key_ecdsa_name API
Enable retrieving the "ecdsa-sha2-nistpNNN" name of ECDSA keys with a
new 'ssh_pki_key_ecdsa_name' API.  This gives more information than the
'ssh_key_type_to_char' API, which yields "ssh-ecdsa" for ECDSA keys.
The motivation is that this info is useful to have in a server context.

The torture_pki unit test is updated to include the new API, and a few
more passes are added to additionally test 384 and 521-bit keys.

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-09 11:01:11 +02:00
Petar Koretic
89e154f78c libsshpp: include required <string> header for std::string
Signed-off-by: Petar Koretic <petar.koretic@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-09 10:59:59 +02:00
Alan Dunn
491b407d17 examples: Update ssh_server_fork for new SSH_BIND_OPTIONS_HOSTKEY
Tested by

ssh_server_fork -k <an ecdsa key> -k <an rsa key> ...

and connection succeeded with OpenSSH clients both for ECDSA and RSA
(the latter forced via -o HostKeyAlgorithms=ssh-rsa and some known
hosts clearing was necessary).  Also

ssh_server_fork -k <an ecdsa key> -k <another ecdsa key> ...

caused the second key to be used, as expected.

Signed-off-by: Alan Dunn <amdunn@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-09 10:59:21 +02:00
Alan Dunn
2f4589b765 doc: Document new meaning of SSH_BIND_OPTIONS_HOSTKEY
Signed-off-by: Alan Dunn <amdunn@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-09 10:59:10 +02:00
Alan Dunn
acb7161c81 options: Repurpose SSH_BIND_OPTIONS_HOSTKEY to load host keys
SSH_BIND_OPTIONS_HOSTKEY will now load host keys of any supported type
rather than set the algorithms that the server permits (which seems
like an unhelpful option anyway; it seems you can always control this
by just loading the right keys).

This option has slightly different semantics than the
SSH_BIND_OPTIONS_<x>KEY options because it requires the key file to
exist immediately rather than on ssh_bind_listen or
ssh_bind_accept_fd.  The semantics of this option makes more sense to
me.

We also eliminate ssh_bind_options_set_algo, since it is no longer
used.

Signed-off-by: Alan Dunn <amdunn@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-04-09 10:57:16 +02:00
Andreas Schneider
437a39c798 cmake: Enable creation of the compile command database by default. 2014-04-04 10:03:43 +02:00
Andreas Schneider
b3e6d5df53 packet: Fix function name. 2014-03-27 11:26:27 +01:00
Luka Perkov
53644a14ac style: be consistent when iterating over wanted_methods
Signed-off-by: Luka Perkov <luka.perkov@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 11:23:34 +01:00
Jon Simons
aa05248ca8 packet: elide two buffer_prepend calls into one
In packet_send2, rather than issue two separate buffer_prepend_data calls
(each of which may entail realloc + memmove + memcpy), elide the prepend
work into a single buffer_prepend_data: the header information is computed
locally, and a single 5 byte prepend operation is now done instead of
prepending 1, then 4 bytes.

Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 11:19:50 +01:00
Andreas Schneider
04543c9dbc doc: Fix ssh_userauth_none() function signature.
Thanks to David Tibbe!

BUG: https://red.libssh.org/issues/151
2014-03-27 11:06:01 +01:00
Alan Dunn
d5aeebe323 socket: Fix style of ssh_socket_pollcallback
Signed-off-by: Alan Dunn <amdunn@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:54:55 +01:00
Alan Dunn
47bd0b6d1f doc: Improve and consolidate ssh_bind_options_set docs
Signed-off-by: Alan Dunn <amdunn@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:49:08 +01:00
Petar Koretic
8e2590b535 libssh: libhpp: overload read function to support timeout parameter
Signed-off-by: Petar Koretic <petar.koretic@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:48:13 +01:00
Petar Koretic
c51f42a566 libssh: libhpp: avoid unnecessary call to ssh_channel_read
ssh_channel_read is a wrapper for ssh_channel_read_timeout with timeout
-1 (infinite) so we call that directly.

Signed-off-by: Petar Koretic <petar.koretic@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:46:21 +01:00
Petar Koretic
00d4fbe753 libssh: libhpp: fix multiple definitions for acceptForward function
Defining a non inlined class function in a header will cause multiple
definitions when header is included in more that one file since for each
file function will get defined.

Signed-off-by: Petar Koretic <petar.koretic@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:45:54 +01:00
Jon Simons
dee8e5688b channel: check for closed state in waitwindow loops
Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:34:22 +01:00
Jon Simons
40d81bb7ca kex: enable more ECDSA hostkey algos
Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:28:06 +01:00
Jon Simons
10bc5ac203 pki_crypto: guard against NULL pubkey->rsa in signature extraction
Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:27:23 +01:00
Luka Perkov
8ba9402282 session: fix comment typo
Signed-off-by: Luka Perkov <luka.perkov@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:16:24 +01:00
Luka Perkov
a2fe341da5 messages: use predefined macro for clearing sensitive data
Signed-off-by: Luka Perkov <luka.perkov@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:16:14 +01:00
Luka Perkov
dbb2de272b client: fix corner case when sockets are manually created
If the sockets are created manually and passed to libssh the internal session
state is set to SSH_SESSION_STATE_SOCKET_CONNECTED. Result of this fix can be
verified by running torture_connect test (torture_connect_socket) with -vvvv
flags.

Signed-off-by: Luka Perkov <luka.perkov@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:15:54 +01:00
Luka Perkov
9423a3a065 tests: torture_connect: add test for user provided socket
Signed-off-by: Luka Perkov <luka.perkov@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:14:35 +01:00
Luka Perkov
0c5d4954a7 tests: torture_connect: fix coding style
Signed-off-by: Luka Perkov <luka.perkov@sartura.hr>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2014-03-27 10:13:57 +01:00
Petar Koretic
0b8d24f800 pki_crypto: Replace deprecated RSA_generate_key() with RSA_generate_key_ex()
On Mar 16, 09:41, Aris Adamantiadis wrote:
> Hi Petar,
> I agree with the principle, but I don't think this code can work...
> RSA_generate_key takes an RSA* as parameter and in our code we probably
> have key->rsa==NULL. (if we don't then the old code had a memory leak).
>
> Does the test case work ?
>
> Aris
>

Yes, you are right. This works, tested with tests/unittests/torture_pki

Signed-off-by: Petar Koretic <petar.koretic@sartura.hr>
2014-03-27 10:11:24 +01:00