Mailing List Archive: [openssh] 02/02: upstream commit

[openssh] 02/02: upstream commit

Jan 8, 2015, 5:46 AM

Post #1 of 15 (2209 views)

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit c4bfafcc2a9300d9cfb3c15e75572d3a7d74670d
Author: djm@openbsd.org <djm@openbsd.org>
Date: Thu Jan 8 13:10:58 2015 +0000

upstream commit

adjust for sshkey_load_file() API change
---
regress/unittests/sshkey/common.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/regress/unittests/sshkey/common.c b/regress/unittests/sshkey/common.c
index 0a4b3a9..b598f05 100644
--- a/regress/unittests/sshkey/common.c
+++ b/regress/unittests/sshkey/common.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: common.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */
+/* $OpenBSD: common.c,v 1.2 2015/01/08 13:10:58 djm Exp $ */
/*
* Helpers for key API tests
*
@@ -44,7 +44,7 @@ load_file(const char *name)

ASSERT_PTR_NE(ret = sshbuf_new(), NULL);
ASSERT_INT_NE(fd = open(test_data_file(name), O_RDONLY), -1);
- ASSERT_INT_EQ(sshkey_load_file(fd, name, ret), 0);
+ ASSERT_INT_EQ(sshkey_load_file(fd, ret), 0);
close(fd);
return ret;
}

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Jan 14, 2015, 1:43 AM

Post #2 of 15 (2205 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 128343bcdb0b60fc826f2733df8cf979ec1627b4
Author: markus@openbsd.org <markus@openbsd.org>
Date: Tue Jan 13 19:31:40 2015 +0000

upstream commit

adapt mac.c to ssherr.h return codes (de-fatal) and
simplify dependencies ok djm@
---
kex.h | 22 ++++----------
mac.c | 93 +++++++++++++++++++++++++++++-----------------------------
mac.h | 30 +++++++++++++++----
monitor_wrap.c | 4 +--
packet.c | 35 ++++++++++++++--------
5 files changed, 102 insertions(+), 82 deletions(-)

diff --git a/kex.h b/kex.h
index 4c40ec8..dbcc081 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.64 2014/05/02 03:27:54 djm Exp $ */
+/* $OpenBSD: kex.h,v 1.65 2015/01/13 19:31:40 markus Exp $ */

/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -26,10 +26,9 @@
#ifndef KEX_H
#define KEX_H

-#include <signal.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#ifdef OPENSSL_HAS_ECC
+#include "mac.h"
+
+#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
#include <openssl/ec.h>
#endif

@@ -82,8 +81,8 @@ enum kex_exchange {
#define KEX_INIT_SENT 0x0001

typedef struct Kex Kex;
-typedef struct Mac Mac;
typedef struct Comp Comp;
+typedef struct sshmac Mac;
typedef struct Enc Enc;
typedef struct Newkeys Newkeys;

@@ -97,17 +96,6 @@ struct Enc {
u_char *key;
u_char *iv;
};
-struct Mac {
- char *name;
- int enabled;
- u_int mac_len;
- u_char *key;
- u_int key_len;
- int type;
- int etm; /* Encrypt-then-MAC */
- struct ssh_hmac_ctx *hmac_ctx;
- struct umac_ctx *umac_ctx;
-};
struct Comp {
int type;
int enabled;
diff --git a/mac.c b/mac.c
index 402dc98..11c30a1 100644
--- a/mac.c
+++ b/mac.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mac.c,v 1.30 2014/04/30 19:07:48 naddy Exp $ */
+/* $OpenBSD: mac.c,v 1.31 2015/01/13 19:31:40 markus Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -27,22 +27,16 @@

#include <sys/types.h>

-#include <stdarg.h>
#include <string.h>
-#include <signal.h>
-
-#include "xmalloc.h"
-#include "log.h"
-#include "cipher.h"
-#include "buffer.h"
-#include "key.h"
-#include "kex.h"
-#include "mac.h"
-#include "misc.h"
+#include <stdio.h>

#include "digest.h"
#include "hmac.h"
#include "umac.h"
+#include "mac.h"
+#include "misc.h"
+#include "ssherr.h"
+#include "sshbuf.h"

#include "openbsd-compat/openssl-compat.h"

@@ -95,7 +89,7 @@ static const struct macalg macs[] = {
char *
mac_alg_list(char sep)
{
- char *ret = NULL;
+ char *ret = NULL, *tmp;
size_t nlen, rlen = 0;
const struct macalg *m;

@@ -103,20 +97,24 @@ mac_alg_list(char sep)
if (ret != NULL)
ret[rlen++] = sep;
nlen = strlen(m->name);
- ret = xrealloc(ret, 1, rlen + nlen + 2);
+ if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) {
+ free(ret);
+ return NULL;
+ }
+ ret = tmp;
memcpy(ret + rlen, m->name, nlen + 1);
rlen += nlen;
}
return ret;
}

-static void
-mac_setup_by_alg(Mac *mac, const struct macalg *macalg)
+static int
+mac_setup_by_alg(struct sshmac *mac, const struct macalg *macalg)
{
mac->type = macalg->type;
if (mac->type == SSH_DIGEST) {
if ((mac->hmac_ctx = ssh_hmac_start(macalg->alg)) == NULL)
- fatal("ssh_hmac_start(alg=%d) failed", macalg->alg);
+ return SSH_ERR_ALLOC_FAIL;
mac->key_len = mac->mac_len = ssh_hmac_bytes(macalg->alg);
} else {
mac->mac_len = macalg->len / 8;
@@ -126,61 +124,60 @@ mac_setup_by_alg(Mac *mac, const struct macalg *macalg)
if (macalg->truncatebits != 0)
mac->mac_len = macalg->truncatebits / 8;
mac->etm = macalg->etm;
+ return 0;
}

int
-mac_setup(Mac *mac, char *name)
+mac_setup(struct sshmac *mac, char *name)
{
const struct macalg *m;

for (m = macs; m->name != NULL; m++) {
if (strcmp(name, m->name) != 0)
continue;
- if (mac != NULL) {
- mac_setup_by_alg(mac, m);
- debug2("mac_setup: setup %s", name);
- }
- return (0);
+ if (mac != NULL)
+ return mac_setup_by_alg(mac, m);
+ return 0;
}
- debug2("mac_setup: unknown %s", name);
- return (-1);
+ return SSH_ERR_INVALID_ARGUMENT;
}

int
-mac_init(Mac *mac)
+mac_init(struct sshmac *mac)
{
if (mac->key == NULL)
- fatal("%s: no key", __func__);
+ return SSH_ERR_INVALID_ARGUMENT;
switch (mac->type) {
case SSH_DIGEST:
if (mac->hmac_ctx == NULL ||
ssh_hmac_init(mac->hmac_ctx, mac->key, mac->key_len) < 0)
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
return 0;
case SSH_UMAC:
- mac->umac_ctx = umac_new(mac->key);
+ if ((mac->umac_ctx = umac_new(mac->key)) == NULL)
+ return SSH_ERR_ALLOC_FAIL;
return 0;
case SSH_UMAC128:
mac->umac_ctx = umac128_new(mac->key);
return 0;
default:
- return -1;
+ return SSH_ERR_INVALID_ARGUMENT;
}
}

-u_char *
-mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
+int
+mac_compute(struct sshmac *mac, u_int32_t seqno, const u_char *data, int datalen,
+ u_char *digest, size_t dlen)
{
static union {
- u_char m[EVP_MAX_MD_SIZE];
+ u_char m[SSH_DIGEST_MAX_LENGTH];
u_int64_t for_align;
} u;
u_char b[4];
u_char nonce[8];

if (mac->mac_len > sizeof(u))
- fatal("mac_compute: mac too long %u %zu",
- mac->mac_len, sizeof(u));
+ return SSH_ERR_INTERNAL_ERROR;

switch (mac->type) {
case SSH_DIGEST:
@@ -190,10 +187,10 @@ mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
ssh_hmac_update(mac->hmac_ctx, b, sizeof(b)) < 0 ||
ssh_hmac_update(mac->hmac_ctx, data, datalen) < 0 ||
ssh_hmac_final(mac->hmac_ctx, u.m, sizeof(u.m)) < 0)
- fatal("ssh_hmac failed");
+ return SSH_ERR_LIBCRYPTO_ERROR;
break;
case SSH_UMAC:
- put_u64(nonce, seqno);
+ POKE_U64(nonce, seqno);
umac_update(mac->umac_ctx, data, datalen);
umac_final(mac->umac_ctx, u.m, nonce);
break;
@@ -203,13 +200,18 @@ mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
umac128_final(mac->umac_ctx, u.m, nonce);
break;
default:
- fatal("mac_compute: unknown MAC type");
+ return SSH_ERR_INVALID_ARGUMENT;
}
- return (u.m);
+ if (digest != NULL) {
+ if (dlen > mac->mac_len)
+ dlen = mac->mac_len;
+ memcpy(digest, u.m, dlen);
+ }
+ return 0;
}

void
-mac_clear(Mac *mac)
+mac_clear(struct sshmac *mac)
{
if (mac->type == SSH_UMAC) {
if (mac->umac_ctx != NULL)
@@ -231,17 +233,16 @@ mac_valid(const char *names)
char *maclist, *cp, *p;

if (names == NULL || strcmp(names, "") == 0)
- return (0);
- maclist = cp = xstrdup(names);
+ return 0;
+ if ((maclist = cp = strdup(names)) == NULL)
+ return 0;
for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0';
(p = strsep(&cp, MAC_SEP))) {
if (mac_setup(NULL, p) < 0) {
- debug("bad mac %s [%s]", p, names);
free(maclist);
- return (0);
+ return 0;
}
}
- debug3("macs ok: [%s]", names);
free(maclist);
- return (1);
+ return 1;
}
diff --git a/mac.h b/mac.h
index fbe18c4..e5f6b84 100644
--- a/mac.h
+++ b/mac.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: mac.h,v 1.8 2013/11/07 11:58:27 dtucker Exp $ */
+/* $OpenBSD: mac.h,v 1.9 2015/01/13 19:31:40 markus Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -23,9 +23,29 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

+#ifndef SSHMAC_H
+#define SSHMAC_H
+
+#include <sys/types.h>
+
+struct sshmac {
+ char *name;
+ int enabled;
+ u_int mac_len;
+ u_char *key;
+ u_int key_len;
+ int type;
+ int etm; /* Encrypt-then-MAC */
+ struct ssh_hmac_ctx *hmac_ctx;
+ struct umac_ctx *umac_ctx;
+};
+
int mac_valid(const char *);
char *mac_alg_list(char);
-int mac_setup(Mac *, char *);
-int mac_init(Mac *);
-u_char *mac_compute(Mac *, u_int32_t, u_char *, int);
-void mac_clear(Mac *);
+int mac_setup(struct sshmac *, char *);
+int mac_init(struct sshmac *);
+int mac_compute(struct sshmac *, u_int32_t, const u_char *, int,
+ u_char *, size_t);
+void mac_clear(struct sshmac *);
+
+#endif /* SSHMAC_H */
diff --git a/monitor_wrap.c b/monitor_wrap.c
index 45dc169..f4e11c9 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.80 2014/04/29 18:01:49 markus Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.81 2015/01/13 19:31:40 markus Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -506,7 +506,7 @@ mm_newkeys_from_blob(u_char *blob, int blen)
/* Mac structure */
if (cipher_authlen(enc->cipher) == 0) {
mac->name = buffer_get_string(&b, NULL);
- if (mac->name == NULL || mac_setup(mac, mac->name) == -1)
+ if (mac->name == NULL || mac_setup(mac, mac->name) != 0)
fatal("%s: can not setup mac %s", __func__, mac->name);
mac->enabled = buffer_get_int(&b);
mac->key = buffer_get_string(&b, &len);
diff --git a/packet.c b/packet.c
index 4674a20..6b326f3 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.199 2014/10/24 02:01:20 lteo Exp $ */
+/* $OpenBSD: packet.c,v 1.200 2015/01/13 19:31:40 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -72,6 +72,7 @@
#include "cipher.h"
#include "key.h"
#include "kex.h"
+#include "digest.h"
#include "mac.h"
#include "log.h"
#include "canohost.h"
@@ -275,7 +276,7 @@ packet_stop_discard(void)
(void) mac_compute(active_state->packet_discard_mac,
active_state->p_read.seqnr,
buffer_ptr(&active_state->incoming_packet),
- PACKET_MAX_SIZE);
+ PACKET_MAX_SIZE, NULL, 0);
}
logit("Finished discarding for %.200s", get_remote_ipaddr());
cleanup_exit(255);
@@ -863,7 +864,7 @@ packet_enable_delayed_compress(void)
static void
packet_send2_wrapped(void)
{
- u_char type, *cp, *macbuf = NULL;
+ u_char type, *cp, macbuf[SSH_DIGEST_MAX_LENGTH];
u_char padlen, pad = 0;
u_int i, len, authlen = 0, aadlen = 0;
u_int32_t rnd = 0;
@@ -871,6 +872,7 @@ packet_send2_wrapped(void)
Mac *mac = NULL;
Comp *comp = NULL;
int block_size;
+ int r;

if (active_state->newkeys[MODE_OUT] != NULL) {
enc = &active_state->newkeys[MODE_OUT]->enc;
@@ -953,8 +955,10 @@ packet_send2_wrapped(void)

/* compute MAC over seqnr and packet(length fields, payload, padding) */
if (mac && mac->enabled && !mac->etm) {
- macbuf = mac_compute(mac, active_state->p_send.seqnr,
- buffer_ptr(&active_state->outgoing_packet), len);
+ if ((r = mac_compute(mac, active_state->p_send.seqnr,
+ buffer_ptr(&active_state->outgoing_packet), len,
+ macbuf, sizeof(macbuf))) != 0)
+ fatal("%s: mac_compute: %s", __func__, ssh_err(r));
DBG(debug("done calc MAC out #%d", active_state->p_send.seqnr));
}
/* encrypt packet and append to output buffer. */
@@ -967,8 +971,10 @@ packet_send2_wrapped(void)
if (mac && mac->enabled) {
if (mac->etm) {
/* EtM: compute mac over aadlen + cipher text */
- macbuf = mac_compute(mac,
- active_state->p_send.seqnr, cp, len);
+ if ((r = mac_compute(mac,
+ active_state->p_send.seqnr, cp, len,
+ macbuf, sizeof(macbuf))) != 0)
+ fatal("%s: mac_compute: %s", __func__, ssh_err(r));
DBG(debug("done calc MAC(EtM) out #%d",
active_state->p_send.seqnr));
}
@@ -1272,8 +1278,9 @@ static int
packet_read_poll2(u_int32_t *seqnr_p)
{
u_int padlen, need;
- u_char *macbuf = NULL, *cp, type;
+ u_char type, *cp, macbuf[SSH_DIGEST_MAX_LENGTH];
u_int maclen, authlen = 0, aadlen = 0, block_size;
+ int r;
Enc *enc = NULL;
Mac *mac = NULL;
Comp *comp = NULL;
@@ -1373,8 +1380,10 @@ packet_read_poll2(u_int32_t *seqnr_p)
#endif
/* EtM: compute mac over encrypted input */
if (mac && mac->enabled && mac->etm)
- macbuf = mac_compute(mac, active_state->p_read.seqnr,
- buffer_ptr(&active_state->input), aadlen + need);
+ if ((r = mac_compute(mac, active_state->p_read.seqnr,
+ buffer_ptr(&active_state->input), aadlen + need,
+ macbuf, sizeof(macbuf))) != 0)
+ fatal("%s: mac_compute: %s", __func__, ssh_err(r));
cp = buffer_append_space(&active_state->incoming_packet, aadlen + need);
if (cipher_crypt(&active_state->receive_context,
active_state->p_read.seqnr, cp,
@@ -1387,9 +1396,11 @@ packet_read_poll2(u_int32_t *seqnr_p)
*/
if (mac && mac->enabled) {
if (!mac->etm)
- macbuf = mac_compute(mac, active_state->p_read.seqnr,
+ if ((r = mac_compute(mac, active_state->p_read.seqnr,
buffer_ptr(&active_state->incoming_packet),
- buffer_len(&active_state->incoming_packet));
+ buffer_len(&active_state->incoming_packet),
+ macbuf, sizeof(macbuf))) != 0)
+ fatal("%s: mac_compute: %s", __func__, ssh_err(r));
if (timingsafe_bcmp(macbuf, buffer_ptr(&active_state->input),
mac->mac_len) != 0) {
logit("Corrupted MAC on input.");

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Jan 19, 2015, 11:58 PM

Post #3 of 15 (2199 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 12b5f50777203e12575f1b08568281e447249ed3
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Jan 20 07:56:44 2015 +0000

upstream commit

make this compile with KERBEROS5 enabled
---
sshconnect2.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/sshconnect2.c b/sshconnect2.c
index e5802ab..03238ff 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.219 2015/01/19 20:16:15 markus Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.220 2015/01/20 07:56:44 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved.
@@ -729,7 +729,7 @@ process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
}

/* ARGSUSED */
-void
+int
input_gssapi_response(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -750,7 +750,7 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
free(oidv);
debug("Badly encoded mechanism OID received");
userauth(authctxt, NULL);
- return;
+ return 0;
}

if (!ssh_gssapi_check_oid(gssctxt, oidv + 2, oidlen - 2))
@@ -764,12 +764,13 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
/* Start again with next method on list */
debug("Trying to start again");
userauth(authctxt, NULL);
- return;
+ return 0;
}
+ return 0;
}

/* ARGSUSED */
-void
+int
input_gssapi_token(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -792,12 +793,13 @@ input_gssapi_token(int type, u_int32_t plen, void *ctxt)
if (GSS_ERROR(status)) {
/* Start again with the next method in the list */
userauth(authctxt, NULL);
- return;
+ return 0;
}
+ return 0;
}

/* ARGSUSED */
-void
+int
input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
{
Authctxt *authctxt = ctxt;
@@ -824,10 +826,11 @@ input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
gss_release_buffer(&ms, &send_tok);

/* Server will be returning a failed packet after this one */
+ return 0;
}

/* ARGSUSED */
-void
+int
input_gssapi_error(int type, u_int32_t plen, void *ctxt)
{
char *msg;
@@ -843,6 +846,7 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
debug("Server GSSAPI Error:\n%s", msg);
free(msg);
free(lang);
+ return 0;
}
#endif /* GSSAPI */

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Jan 27, 2015, 4:03 AM

Post #4 of 15 (2199 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit e56aa87502f22c5844918c10190e8b4f785f067b
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Jan 27 12:01:36 2015 +0000

upstream commit

use printf instead of echo -n to reduce diff against
-portable
---
regress/hostkey-agent.sh | 4 ++--
regress/keygen-knownhosts.sh | 18 +++++++++---------
2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/regress/hostkey-agent.sh b/regress/hostkey-agent.sh
index fddb041..c007d7a 100644
--- a/regress/hostkey-agent.sh
+++ b/regress/hostkey-agent.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: hostkey-agent.sh,v 1.3 2015/01/20 08:02:33 djm Exp $
+# $OpenBSD: hostkey-agent.sh,v 1.4 2015/01/27 12:01:36 djm Exp $
# Placed in the Public Domain.

tid="hostkey agent"
@@ -17,7 +17,7 @@ trace "load hostkeys"
for k in `${SSH} -Q key-plain` ; do
${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
(
- echo -n 'localhost-with-alias,127.0.0.1,::1 '
+ printf 'localhost-with-alias,127.0.0.1,::1 '
cat $OBJ/agent-key.$k.pub
) >> $OBJ/known_hosts.orig
${SSHADD} $OBJ/agent-key.$k >/dev/null 2>&1 || \
diff --git a/regress/keygen-knownhosts.sh b/regress/keygen-knownhosts.sh
index 35a5ea4..085aac6 100644
--- a/regress/keygen-knownhosts.sh
+++ b/regress/keygen-knownhosts.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: keygen-knownhosts.sh,v 1.1 2015/01/18 22:00:18 djm Exp $
+# $OpenBSD: keygen-knownhosts.sh,v 1.2 2015/01/27 12:01:36 djm Exp $
# Placed in the Public Domain.

tid="ssh-keygen known_hosts"
@@ -13,13 +13,13 @@ for x in host-a host-b host-c host-d host-e host-f host-a2 host-b2; do
echo "# $x" >> $OBJ/kh.hosts
(
case "$x" in
- host-a|host-b) echo -n "$x " ;;
- host-c) echo -n "@cert-authority $x " ;;
- host-d) echo -n "@revoked $x " ;;
- host-e) echo -n "host-e* " ;;
- host-f) echo -n "host-f,host-g,host-h " ;;
- host-a2) echo -n "host-a " ;;
- host-b2) echo -n "host-b " ;;
+ host-a|host-b) printf "$x " ;;
+ host-c) printf "@cert-authority $x " ;;
+ host-d) printf "@revoked $x " ;;
+ host-e) printf "host-e* " ;;
+ host-f) printf "host-f,host-g,host-h " ;;
+ host-a2) printf "host-a " ;;
+ host-b2) printf "host-b " ;;
esac
cat $OBJ/kh.${x}.pub
# Blank line should be preserved.
@@ -47,7 +47,7 @@ expect_key() {
test "x$_mark" = "xREVOKED" && _marker="@revoked "
test "x$_line" != "x" &&
echo "# Host $_host found: line $_line $_mark" >> $OBJ/kh.expect
- echo -n "${_marker}$_hosts " >> $OBJ/kh.expect
+ printf "${_marker}$_hosts " >> $OBJ/kh.expect
cat $OBJ/kh.${_key}.pub >> $OBJ/kh.expect ||
fatal "${_key}.pub missing"
}

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Jan 30, 2015, 3:47 AM

Post #5 of 15 (2180 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 46347ed5968f582661e8a70a45f448e0179ca0ab
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Jan 30 11:43:14 2015 +0000

upstream commit

Add a ssh_config HostbasedKeyType option to control which
host public key types are tried during hostbased authentication.

This may be used to prevent too many keys being sent to the server,
and blowing past its MaxAuthTries limit.

bz#2211 based on patch by Iain Morgan; ok markus@
---
readconf.c | 25 ++++-
readconf.h | 4 +-
scp.1 | 5 +-
sftp.1 | 5 +-
ssh.1 | 5 +-
ssh_config.5 | 15 ++-
sshconnect2.c | 304 +++++++++++++++++++++++++++++++++++++---------------------
7 files changed, 244 insertions(+), 119 deletions(-)

diff --git a/readconf.c b/readconf.c
index 401f343..dd78da5 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.229 2015/01/26 03:04:45 djm Exp $ */
+/* $OpenBSD: readconf.c,v 1.230 2015/01/30 11:43:14 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -156,7 +156,7 @@ typedef enum {
oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
- oFingerprintHash, oUpdateHostkeys,
+ oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
oIgnoredUnknownOption, oDeprecated, oUnsupported
} OpCodes;

@@ -274,6 +274,7 @@ static struct {
{ "revokedhostkeys", oRevokedHostKeys },
{ "fingerprinthash", oFingerprintHash },
{ "updatehostkeys", oUpdateHostkeys },
+ { "hostbasedkeytypes", oHostbasedKeyTypes },
{ "ignoreunknown", oIgnoreUnknown },

{ NULL, oBadOption }
@@ -1481,6 +1482,19 @@ parse_int:
intptr = &options->update_hostkeys;
goto parse_flag;

+ case oHostbasedKeyTypes:
+ charptr = &options->hostbased_key_types;
+ arg = strdelim(&s);
+ if (!arg || *arg == '\0')
+ fatal("%.200s line %d: Missing argument.",
+ filename, linenum);
+ if (!sshkey_names_valid2(arg, 1))
+ fatal("%s line %d: Bad key types '%s'.",
+ filename, linenum, arg ? arg : "<NONE>");
+ if (*activep && *charptr == NULL)
+ *charptr = xstrdup(arg);
+ break;
+
case oDeprecated:
debug("%s line %d: Deprecated option \"%s\"",
filename, linenum, keyword);
@@ -1660,6 +1674,7 @@ initialize_options(Options * options)
options->revoked_host_keys = NULL;
options->fingerprint_hash = -1;
options->update_hostkeys = -1;
+ options->hostbased_key_types = NULL;
}

/*
@@ -1841,6 +1856,8 @@ fill_default_options(Options * options)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
if (options->update_hostkeys == -1)
options->update_hostkeys = 1;
+ if (options->hostbased_key_types == NULL)
+ options->hostbased_key_types = xstrdup("*");

#define CLEAR_ON_NONE(v) \
do { \
@@ -2281,6 +2298,7 @@ dump_client_config(Options *o, const char *host)
dump_cfg_string(oControlPath, o->control_path);
dump_cfg_string(oHostKeyAlgorithms, o->hostkeyalgorithms ? o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
dump_cfg_string(oHostKeyAlias, o->host_key_alias);
+ dump_cfg_string(oHostbasedKeyTypes, o->hostbased_key_types);
dump_cfg_string(oKbdInteractiveDevices, o->kbd_interactive_devices);
dump_cfg_string(oKexAlgorithms, o->kex_algorithms ? o->kex_algorithms : KEX_CLIENT_KEX);
dump_cfg_string(oLocalCommand, o->local_command);
@@ -2289,9 +2307,10 @@ dump_client_config(Options *o, const char *host)
dump_cfg_string(oPKCS11Provider, o->pkcs11_provider);
dump_cfg_string(oPreferredAuthentications, o->preferred_authentications);
dump_cfg_string(oProxyCommand, o->proxy_command);
- dump_cfg_string(oXAuthLocation, o->xauth_location);
dump_cfg_string(oRevokedHostKeys, o->revoked_host_keys);
+ dump_cfg_string(oXAuthLocation, o->xauth_location);

+ /* Forwards */
dump_cfg_forwards(oDynamicForward, o->num_local_forwards, o->local_forwards);
dump_cfg_forwards(oLocalForward, o->num_local_forwards, o->local_forwards);
dump_cfg_forwards(oRemoteForward, o->num_remote_forwards, o->remote_forwards);
diff --git a/readconf.h b/readconf.h
index 7a8ae17..701b9c6 100644
--- a/readconf.h
+++ b/readconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.h,v 1.107 2015/01/26 03:04:45 djm Exp $ */
+/* $OpenBSD: readconf.h,v 1.108 2015/01/30 11:43:14 djm Exp $ */

/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -150,6 +150,8 @@ typedef struct {

int update_hostkeys;

+ char *hostbased_key_types;
+
char *ignored_unknown; /* Pattern list of unknown tokens to ignore */
} Options;

diff --git a/scp.1 b/scp.1
index b80ad8b..0e84780 100644
--- a/scp.1
+++ b/scp.1
@@ -8,9 +8,9 @@
.\"
.\" Created: Sun May 7 00:14:37 1995 ylo
.\"
-.\" $OpenBSD: scp.1,v 1.65 2015/01/26 13:55:29 jmc Exp $
+.\" $OpenBSD: scp.1,v 1.66 2015/01/30 11:43:14 djm Exp $
.\"
-.Dd $Mdocdate: January 26 2015 $
+.Dd $Mdocdate: January 30 2015 $
.Dt SCP 1
.Os
.Sh NAME
@@ -150,6 +150,7 @@ For full details of the options listed below, and their possible values, see
.It HashKnownHosts
.It Host
.It HostbasedAuthentication
+.It HostbasedKeyTypes
.It HostKeyAlgorithms
.It HostKeyAlias
.It HostName
diff --git a/sftp.1 b/sftp.1
index 9eed155..214f011 100644
--- a/sftp.1
+++ b/sftp.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp.1,v 1.100 2015/01/26 12:16:36 djm Exp $
+.\" $OpenBSD: sftp.1,v 1.101 2015/01/30 11:43:14 djm Exp $
.\"
.\" Copyright (c) 2001 Damien Miller. All rights reserved.
.\"
@@ -22,7 +22,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: January 26 2015 $
+.Dd $Mdocdate: January 30 2015 $
.Dt SFTP 1
.Os
.Sh NAME
@@ -215,6 +215,7 @@ For full details of the options listed below, and their possible values, see
.It HashKnownHosts
.It Host
.It HostbasedAuthentication
+.It HostbasedKeyTypes
.It HostKeyAlgorithms
.It HostKeyAlias
.It HostName
diff --git a/ssh.1 b/ssh.1
index 7e734ab..5649212 100644
--- a/ssh.1
+++ b/ssh.1
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh.1,v 1.354 2015/01/26 12:16:36 djm Exp $
-.Dd $Mdocdate: January 26 2015 $
+.\" $OpenBSD: ssh.1,v 1.355 2015/01/30 11:43:14 djm Exp $
+.Dd $Mdocdate: January 30 2015 $
.Dt SSH 1
.Os
.Sh NAME
@@ -445,6 +445,7 @@ For full details of the options listed below, and their possible values, see
.It HashKnownHosts
.It Host
.It HostbasedAuthentication
+.It HostbasedKeyTypes
.It HostKeyAlgorithms
.It HostKeyAlias
.It HostName
diff --git a/ssh_config.5 b/ssh_config.5
index 9c0b357..95b7bf6 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.201 2015/01/26 12:16:36 djm Exp $
-.Dd $Mdocdate: January 26 2015 $
+.\" $OpenBSD: ssh_config.5,v 1.202 2015/01/30 11:43:14 djm Exp $
+.Dd $Mdocdate: January 30 2015 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -777,6 +777,17 @@ The default is
This option applies to protocol version 2 only and
is similar to
.Cm RhostsRSAAuthentication .
+.It Cm HostbasedKeyTypes
+Specifies the key types that will be used for hostbased authentication
+as a comma-separated pattern list.
+The default
+.Dq *
+will allow all key types.
+The
+.Fl Q
+option of
+.Xr ssh 1
+may be used to list supported key types.
.It Cm HostKeyAlgorithms
Specifies the protocol version 2 host key algorithms
that the client wants to use in order of preference.
diff --git a/sshconnect2.c b/sshconnect2.c
index 48882e3..804194a 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.222 2015/01/28 22:36:00 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.223 2015/01/30 11:43:14 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved.
@@ -273,6 +273,8 @@ struct cauthctxt {
int agent_fd;
/* hostbased */
Sensitive *sensitive;
+ char *oktypes, *ktypes;
+ const char *active_ktype;
/* kbd-interactive */
int info_req_seen;
/* generic */
@@ -401,6 +403,7 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
authctxt.authlist = NULL;
authctxt.methoddata = NULL;
authctxt.sensitive = sensitive;
+ authctxt.active_ktype = authctxt.oktypes = authctxt.ktypes = NULL;
authctxt.info_req_seen = 0;
authctxt.agent_fd = -1;
if (authctxt.method == NULL)
@@ -1452,78 +1455,116 @@ input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
}

static int
-ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
- u_char *data, u_int datalen)
+ssh_keysign(struct sshkey *key, u_char **sigp, size_t *lenp,
+ const u_char *data, size_t datalen)
{
- Buffer b;
+ struct sshbuf *b;
struct stat st;
pid_t pid;
- int to[2], from[2], status, version = 2;
+ int i, r, to[2], from[2], status, sock = packet_get_connection_in();
+ u_char rversion = 0, version = 2;
+ void (*osigchld)(int);

- debug2("ssh_keysign called");
+ *sigp = NULL;
+ *lenp = 0;

if (stat(_PATH_SSH_KEY_SIGN, &st) < 0) {
- error("ssh_keysign: not installed: %s", strerror(errno));
+ error("%s: not installed: %s", __func__, strerror(errno));
+ return -1;
+ }
+ if (fflush(stdout) != 0) {
+ error("%s: fflush: %s", __func__, strerror(errno));
return -1;
}
- if (fflush(stdout) != 0)
- error("ssh_keysign: fflush: %s", strerror(errno));
if (pipe(to) < 0) {
- error("ssh_keysign: pipe: %s", strerror(errno));
+ error("%s: pipe: %s", __func__, strerror(errno));
return -1;
}
if (pipe(from) < 0) {
- error("ssh_keysign: pipe: %s", strerror(errno));
+ error("%s: pipe: %s", __func__, strerror(errno));
return -1;
}
if ((pid = fork()) < 0) {
- error("ssh_keysign: fork: %s", strerror(errno));
+ error("%s: fork: %s", __func__, strerror(errno));
return -1;
}
+ osigchld = signal(SIGCHLD, SIG_DFL);
if (pid == 0) {
/* keep the socket on exec */
- fcntl(packet_get_connection_in(), F_SETFD, 0);
+ fcntl(sock, F_SETFD, 0);
permanently_drop_suid(getuid());
close(from[0]);
if (dup2(from[1], STDOUT_FILENO) < 0)
- fatal("ssh_keysign: dup2: %s", strerror(errno));
+ fatal("%s: dup2: %s", __func__, strerror(errno));
close(to[1]);
if (dup2(to[0], STDIN_FILENO) < 0)
- fatal("ssh_keysign: dup2: %s", strerror(errno));
+ fatal("%s: dup2: %s", __func__, strerror(errno));
close(from[1]);
close(to[0]);
+ /* Close everything but stdio and the socket */
+ for (i = STDERR_FILENO + 1; i < sock; i++)
+ close(i);
+ closefrom(sock + 1);
+ debug3("%s: [child] pid=%ld, exec %s",
+ __func__, (long)getpid(), _PATH_SSH_KEY_SIGN);
execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *) 0);
- fatal("ssh_keysign: exec(%s): %s", _PATH_SSH_KEY_SIGN,
+ fatal("%s: exec(%s): %s", __func__, _PATH_SSH_KEY_SIGN,
strerror(errno));
}
close(from[1]);
close(to[0]);

- buffer_init(&b);
- buffer_put_int(&b, packet_get_connection_in()); /* send # of socket */
- buffer_put_string(&b, data, datalen);
- if (ssh_msg_send(to[1], version, &b) == -1)
- fatal("ssh_keysign: couldn't send request");
-
- if (ssh_msg_recv(from[0], &b) < 0) {
- error("ssh_keysign: no reply");
- buffer_free(&b);
- return -1;
- }
+ if ((b = sshbuf_new()) == NULL)
+ fatal("%s: sshbuf_new failed", __func__);
+ /* send # of sock, data to be signed */
+ if ((r = sshbuf_put_u32(b, sock) != 0) ||
+ (r = sshbuf_put_string(b, data, datalen)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ if (ssh_msg_send(to[1], version, b) == -1)
+ fatal("%s: couldn't send request", __func__);
+ sshbuf_reset(b);
+ r = ssh_msg_recv(from[0], b);
close(from[0]);
close(to[1]);
+ if (r < 0) {
+ error("%s: no reply", __func__);
+ goto fail;
+ }

- while (waitpid(pid, &status, 0) < 0)
- if (errno != EINTR)
- break;
-
- if (buffer_get_char(&b) != version) {
- error("ssh_keysign: bad version");
- buffer_free(&b);
+ errno = 0;
+ while (waitpid(pid, &status, 0) < 0) {
+ if (errno != EINTR) {
+ error("%s: waitpid %ld: %s",
+ __func__, (long)pid, strerror(errno));
+ goto fail;
+ }
+ }
+ if (!WIFEXITED(status)) {
+ error("%s: exited abnormally", __func__);
+ goto fail;
+ }
+ if (WEXITSTATUS(status) != 0) {
+ error("%s: exited with status %d",
+ __func__, WEXITSTATUS(status));
+ goto fail;
+ }
+ if ((r = sshbuf_get_u8(b, &rversion)) != 0) {
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ goto fail;
+ }
+ if (rversion != version) {
+ error("%s: bad version", __func__);
+ goto fail;
+ }
+ if ((r = sshbuf_get_string(b, sigp, lenp)) != 0) {
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ fail:
+ signal(SIGCHLD, osigchld);
+ sshbuf_free(b);
return -1;
}
- *sigp = buffer_get_string(&b, lenp);
- buffer_free(&b);
+ signal(SIGCHLD, osigchld);
+ sshbuf_free(b);

return 0;
}
@@ -1531,100 +1572,149 @@ ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
int
userauth_hostbased(Authctxt *authctxt)
{
- Key *private = NULL;
- Sensitive *sensitive = authctxt->sensitive;
- Buffer b;
- u_char *signature, *blob;
- char *chost, *pkalg, *p;
+ struct ssh *ssh = active_state;
+ struct sshkey *private = NULL;
+ struct sshbuf *b = NULL;
const char *service;
- u_int blen, slen;
- int ok, i, found = 0;
+ u_char *sig = NULL, *keyblob = NULL;
+ char *fp = NULL, *chost = NULL, *lname = NULL;
+ size_t siglen = 0, keylen = 0;
+ int i, r, success = 0;

- /* XXX provide some way to allow user to specify key types attempted */
+ if (authctxt->ktypes == NULL) {
+ authctxt->oktypes = xstrdup(options.hostbased_key_types);
+ authctxt->ktypes = authctxt->oktypes;
+ }

- /* check for a useful key */
- for (i = 0; i < sensitive->nkeys; i++) {
- private = sensitive->keys[i];
- if (private && private->type != KEY_RSA1) {
- found = 1;
+ /*
+ * Work through each listed type pattern in HostbasedKeyTypes,
+ * trying each hostkey that matches the type in turn.
+ */
+ for (;;) {
+ if (authctxt->active_ktype == NULL)
+ authctxt->active_ktype = strsep(&authctxt->ktypes, ",");
+ if (authctxt->active_ktype == NULL ||
+ *authctxt->active_ktype == '\0')
+ break;
+ debug3("%s: trying key type %s", __func__,
+ authctxt->active_ktype);
+
+ /* check for a useful key */
+ private = NULL;
+ for (i = 0; i < authctxt->sensitive->nkeys; i++) {
+ if (authctxt->sensitive->keys[i] == NULL ||
+ authctxt->sensitive->keys[i]->type == KEY_RSA1 ||
+ authctxt->sensitive->keys[i]->type == KEY_UNSPEC)
+ continue;
+ if (match_pattern_list(
+ sshkey_ssh_name(authctxt->sensitive->keys[i]),
+ authctxt->active_ktype,
+ strlen(authctxt->active_ktype), 0) != 1)
+ continue;
/* we take and free the key */
- sensitive->keys[i] = NULL;
+ private = authctxt->sensitive->keys[i];
+ authctxt->sensitive->keys[i] = NULL;
break;
}
+ /* Found one */
+ if (private != NULL)
+ break;
+ /* No more keys of this type; advance */
+ authctxt->active_ktype = NULL;
}
- if (!found) {
+ if (private == NULL) {
+ free(authctxt->oktypes);
+ authctxt->oktypes = authctxt->ktypes = NULL;
+ authctxt->active_ktype = NULL;
debug("No more client hostkeys for hostbased authentication.");
- return 0;
+ goto out;
}

- debug("%s: trying hostkey type %s", __func__, key_type(private));
-
- if (key_to_blob(private, &blob, &blen) == 0) {
- key_free(private);
- return 0;
+ if ((fp = sshkey_fingerprint(private, options.fingerprint_hash,
+ SSH_FP_DEFAULT)) == NULL) {
+ error("%s: sshkey_fingerprint failed", __func__);
+ goto out;
}
+ debug("%s: trying hostkey %s %s",
+ __func__, sshkey_ssh_name(private), fp);

/* figure out a name for the client host */
- p = get_local_name(packet_get_connection_in());
- if (p == NULL) {
- error("userauth_hostbased: cannot get local ipaddr/name");
- key_free(private);
- free(blob);
- return 0;
+ if ((lname = get_local_name(packet_get_connection_in())) == NULL) {
+ error("%s: cannot get local ipaddr/name", __func__);
+ goto out;
}
- xasprintf(&chost, "%s.", p);
- debug2("userauth_hostbased: chost %s", chost);
- free(p);
+
+ /* XXX sshbuf_put_stringf? */
+ xasprintf(&chost, "%s.", lname);
+ debug2("%s: chost %s", __func__, chost);

service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
authctxt->service;
- pkalg = xstrdup(key_ssh_name(private));
- buffer_init(&b);
+
/* construct data */
- buffer_put_string(&b, session_id2, session_id2_len);
- buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
- buffer_put_cstring(&b, authctxt->server_user);
- buffer_put_cstring(&b, service);
- buffer_put_cstring(&b, authctxt->method->name);
- buffer_put_cstring(&b, pkalg);
- buffer_put_string(&b, blob, blen);
- buffer_put_cstring(&b, chost);
- buffer_put_cstring(&b, authctxt->local_user);
+ if ((b = sshbuf_new()) == NULL) {
+ error("%s: sshbuf_new failed", __func__);
+ goto out;
+ }
+ if ((r = sshkey_to_blob(private, &keyblob, &keylen)) != 0) {
+ error("%s: sshkey_to_blob: %s", __func__, ssh_err(r));
+ goto out;
+ }
+ if ((r = sshbuf_put_string(b, session_id2, session_id2_len)) != 0 ||
+ (r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
+ (r = sshbuf_put_cstring(b, authctxt->server_user)) != 0 ||
+ (r = sshbuf_put_cstring(b, service)) != 0 ||
+ (r = sshbuf_put_cstring(b, authctxt->method->name)) != 0 ||
+ (r = sshbuf_put_cstring(b, key_ssh_name(private))) != 0 ||
+ (r = sshbuf_put_string(b, keyblob, keylen)) != 0 ||
+ (r = sshbuf_put_cstring(b, chost)) != 0 ||
+ (r = sshbuf_put_cstring(b, authctxt->local_user)) != 0) {
+ error("%s: buffer error: %s", __func__, ssh_err(r));
+ goto out;
+ }
+
#ifdef DEBUG_PK
- buffer_dump(&b);
+ sshbuf_dump(b, stderr);
#endif
- if (sensitive->external_keysign)
- ok = ssh_keysign(private, &signature, &slen,
- buffer_ptr(&b), buffer_len(&b));
- else
- ok = key_sign(private, &signature, &slen,
- buffer_ptr(&b), buffer_len(&b));
- key_free(private);
- buffer_free(&b);
- if (ok != 0) {
- error("key_sign failed");
- free(chost);
- free(pkalg);
- free(blob);
- return 0;
+ if (authctxt->sensitive->external_keysign)
+ r = ssh_keysign(private, &sig, &siglen,
+ sshbuf_ptr(b), sshbuf_len(b));
+ else if ((r = sshkey_sign(private, &sig, &siglen,
+ sshbuf_ptr(b), sshbuf_len(b), datafellows)) != 0)
+ debug("%s: sshkey_sign: %s", __func__, ssh_err(r));
+ if (r != 0) {
+ error("sign using hostkey %s %s failed",
+ sshkey_ssh_name(private), fp);
+ goto out;
}
- packet_start(SSH2_MSG_USERAUTH_REQUEST);
- packet_put_cstring(authctxt->server_user);
- packet_put_cstring(authctxt->service);
- packet_put_cstring(authctxt->method->name);
- packet_put_cstring(pkalg);
- packet_put_string(blob, blen);
- packet_put_cstring(chost);
- packet_put_cstring(authctxt->local_user);
- packet_put_string(signature, slen);
- explicit_bzero(signature, slen);
- free(signature);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, authctxt->server_user)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, authctxt->service)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, authctxt->method->name)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, key_ssh_name(private))) != 0 ||
+ (r = sshpkt_put_string(ssh, keyblob, keylen)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, chost)) != 0 ||
+ (r = sshpkt_put_cstring(ssh, authctxt->local_user)) != 0 ||
+ (r = sshpkt_put_string(ssh, sig, siglen)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0) {
+ error("%s: packet error: %s", __func__, ssh_err(r));
+ goto out;
+ }
+ success = 1;
+
+ out:
+ if (sig != NULL) {
+ explicit_bzero(sig, siglen);
+ free(sig);
+ }
+ free(keyblob);
+ free(lname);
+ free(fp);
free(chost);
- free(pkalg);
- free(blob);
+ sshkey_free(private);
+ sshbuf_free(b);

- packet_send();
- return 1;
+ return success;
}

/* find auth method */

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Feb 4, 2015, 12:43 PM

Post #6 of 15 (2176 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit ce4f59b2405845584f45e0b3214760eb0008c06c
Author: deraadt@openbsd.org <deraadt@openbsd.org>
Date: Tue Feb 3 08:07:20 2015 +0000

upstream commit

missing ; djm and mlarkin really having great
interactions recently
---
ssh-pkcs11.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index ddc89d5..c3a112f 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.16 2015/02/02 22:48:53 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.17 2015/02/03 08:07:20 deraadt Exp $ */
/*
* Copyright (c) 2010 Markus Friedl. All rights reserved.
*
@@ -368,7 +368,7 @@ pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin)
}
if (login_required && pin) {
rv = f->C_Login(session, CKU_USER,
- (u_char *)pin, strlen(pin))
+ (u_char *)pin, strlen(pin));
if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
error("C_Login failed: %lu", rv);
if ((rv = f->C_CloseSession(session)) != CKR_OK)

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Feb 10, 2015, 5:27 PM

Post #7 of 15 (2172 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit d4c0295d1afc342057ba358237acad6be8af480b
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Feb 11 01:20:38 2015 +0000

upstream commit

Some packet error messages show the address of the peer,
but might be generated after the socket to the peer has suffered a TCP reset.
In these cases, getpeername() won't work so cache the address earlier.

spotted in the wild via deraadt@ and tedu@
---
packet.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/packet.c b/packet.c
index 8b8ab0c..4667739 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.206 2015/02/09 23:22:37 jsg Exp $ */
+/* $OpenBSD: packet.c,v 1.207 2015/02/11 01:20:38 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -290,11 +290,15 @@ ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
(r = cipher_init(&state->receive_context, none,
(const u_char *)"", 0, NULL, 0, CIPHER_DECRYPT)) != 0) {
error("%s: cipher_init failed: %s", __func__, ssh_err(r));
- free(ssh);
return NULL;
}
state->newkeys[MODE_IN] = state->newkeys[MODE_OUT] = NULL;
deattack_init(&state->deattack);
+ /*
+ * Cache the IP address of the remote connection for use in error
+ * messages that might be generated after the connection has closed.
+ */
+ (void)ssh_remote_ipaddr(ssh);
return ssh;
}

@@ -1274,10 +1278,8 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
* Since we are blocking, ensure that all written packets have
* been sent.
*/
- if ((r = ssh_packet_write_wait(ssh)) != 0) {
- free(setp);
+ if ((r = ssh_packet_write_wait(ssh)) != 0)
return r;
- }

/* Stay in the loop until we have received a complete packet. */
for (;;) {

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Feb 20, 2015, 2:20 PM

Post #8 of 15 (2159 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 44732de06884238049f285f1455b2181baa7dc82
Author: djm@openbsd.org <djm@openbsd.org>
Date: Fri Feb 20 22:17:21 2015 +0000

upstream commit

UpdateHostKeys fixes:

I accidentally changed the format of the hostkeys@openssh.com messages
last week without changing the extension name, and this has been causing
connection failures for people who are running -current. First reported
by sthen@

s/hostkeys@openssh.com/hostkeys-00@openssh.com/
Change the name of the proof message too, and reorder it a little.

Also, UpdateHostKeys=ask is incompatible with ControlPersist (no TTY
available to read the response) so disable UpdateHostKeys if it is in
ask mode and ControlPersist is active (and document this)
---
PROTOCOL | 12 ++++++------
clientloop.c | 23 +++++++++++++----------
monitor.c | 8 ++++----
serverloop.c | 10 +++++-----
ssh.c | 8 +++++++-
ssh_config.5 | 7 +++++--
sshd.c | 4 ++--
7 files changed, 42 insertions(+), 30 deletions(-)

diff --git a/PROTOCOL b/PROTOCOL
index f956083..91bfe27 100644
--- a/PROTOCOL
+++ b/PROTOCOL
@@ -282,15 +282,15 @@ by the client cancel the forwarding of a Unix domain socket.
boolean FALSE
string socket path

-2.5. connection: hostkey update and rotation "hostkeys@openssh.com"
-and "hostkeys-prove@openssh.com"
+2.5. connection: hostkey update and rotation "hostkeys-00@openssh.com"
+and "hostkeys-prove-00@openssh.com"

OpenSSH supports a protocol extension allowing a server to inform
a client of all its protocol v.2 host keys after user-authentication
has completed.

byte SSH_MSG_GLOBAL_REQUEST
- string "hostkeys@openssh.com"
+ string "hostkeys-00@openssh.com"
string[] hostkeys

Upon receiving this message, a client should check which of the
@@ -300,15 +300,15 @@ to request the server prove ownership of the private half of the
key.

byte SSH_MSG_GLOBAL_REQUEST
- string "hostkeys-prove@openssh.com"
+ string "hostkeys-prove-00@openssh.com"
char 1 /* want-reply */
string[] hostkeys

When a server receives this message, it should generate a signature
using each requested key over the following:

+ string "hostkeys-prove-00@openssh.com"
string session identifier
- string "hostkeys-prove@openssh.com"
string hostkey

These signatures should be included in the reply, in the order matching
@@ -453,4 +453,4 @@ respond with a SSH_FXP_STATUS message.
This extension is advertised in the SSH_FXP_VERSION hello with version
"1".

-$OpenBSD: PROTOCOL,v 1.26 2015/02/16 22:13:32 djm Exp $
+$OpenBSD: PROTOCOL,v 1.27 2015/02/20 22:17:21 djm Exp $
diff --git a/clientloop.c b/clientloop.c
index a19d9d0..ca3a459 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.269 2015/02/16 22:13:32 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.270 2015/02/20 22:17:21 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2265,10 +2265,10 @@ client_global_hostkeys_private_confirm(int type, u_int32_t seq, void *_ctx)
continue;
/* Prepare data to be signed: session ID, unique string, key */
sshbuf_reset(signdata);
- if ((r = sshbuf_put_string(signdata, ssh->kex->session_id,
+ if ( (r = sshbuf_put_cstring(signdata,
+ "hostkeys-prove-00@openssh.com")) != 0 ||
+ (r = sshbuf_put_string(signdata, ssh->kex->session_id,
ssh->kex->session_id_len)) != 0 ||
- (r = sshbuf_put_cstring(signdata,
- "hostkeys-prove@openssh.com")) != 0 ||
(r = sshkey_puts(ctx->keys[i], signdata)) != 0)
fatal("%s: failed to prepare signature: %s",
__func__, ssh_err(r));
@@ -2300,7 +2300,7 @@ client_global_hostkeys_private_confirm(int type, u_int32_t seq, void *_ctx)
}

/*
- * Handle hostkeys@openssh.com global request to inform the client of all
+ * Handle hostkeys-00@openssh.com global request to inform the client of all
* the server's hostkeys. The keys are checked against the user's
* HostkeyAlgorithms preference before they are accepted.
*/
@@ -2335,8 +2335,10 @@ client_input_hostkeys(void)
__func__, ssh_err(r));
goto out;
}
- if ((r = sshkey_from_blob(blob, len, &key)) != 0)
- fatal("%s: parse key: %s", __func__, ssh_err(r));
+ if ((r = sshkey_from_blob(blob, len, &key)) != 0) {
+ error("%s: parse key: %s", __func__, ssh_err(r));
+ goto out;
+ }
fp = sshkey_fingerprint(key, options.fingerprint_hash,
SSH_FP_DEFAULT);
debug3("%s: received %s key %s", __func__,
@@ -2376,9 +2378,10 @@ client_input_hostkeys(void)
}

if (ctx->nkeys == 0) {
- error("%s: server sent no hostkeys", __func__);
+ debug("%s: server sent no hostkeys", __func__);
goto out;
}
+
if ((ctx->keys_seen = calloc(ctx->nkeys,
sizeof(*ctx->keys_seen))) == NULL)
fatal("%s: calloc failed", __func__);
@@ -2418,7 +2421,7 @@ client_input_hostkeys(void)
__func__, ctx->nnew);
if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 ||
(r = sshpkt_put_cstring(ssh,
- "hostkeys-prove@openssh.com")) != 0 ||
+ "hostkeys-prove-00@openssh.com")) != 0 ||
(r = sshpkt_put_u8(ssh, 1)) != 0) /* bool: want reply */
fatal("%s: cannot prepare packet: %s",
__func__, ssh_err(r));
@@ -2465,7 +2468,7 @@ client_input_global_request(int type, u_int32_t seq, void *ctxt)
want_reply = packet_get_char();
debug("client_input_global_request: rtype %s want_reply %d",
rtype, want_reply);
- if (strcmp(rtype, "hostkeys@openssh.com") == 0)
+ if (strcmp(rtype, "hostkeys-00@openssh.com") == 0)
success = client_input_hostkeys();
if (want_reply) {
packet_start(success ?
diff --git a/monitor.c b/monitor.c
index bc4f039..8f5ab72 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.144 2015/02/16 22:13:32 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.145 2015/02/20 22:17:21 djm Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -693,7 +693,7 @@ mm_answer_sign(int sock, Buffer *m)
u_char *signature;
size_t datlen, siglen;
int r, keyid, is_proof = 0;
- const char proof_req[] = "hostkeys-prove@openssh.com";
+ const char proof_req[] = "hostkeys-prove-00@openssh.com";

debug3("%s", __func__);

@@ -723,9 +723,9 @@ mm_answer_sign(int sock, Buffer *m)
fatal("%s: no hostkey for index %d", __func__, keyid);
if ((sigbuf = sshbuf_new()) == NULL)
fatal("%s: sshbuf_new", __func__);
- if ((r = sshbuf_put_string(sigbuf, session_id2,
+ if ((r = sshbuf_put_cstring(sigbuf, proof_req)) != 0 ||
+ (r = sshbuf_put_string(sigbuf, session_id2,
session_id2_len) != 0) ||
- (r = sshbuf_put_cstring(sigbuf, proof_req)) != 0 ||
(r = sshkey_puts(key, sigbuf)) != 0)
fatal("%s: couldn't prepare private key "
"proof buffer: %s", __func__, ssh_err(r));
diff --git a/serverloop.c b/serverloop.c
index 5633ceb..306ac36 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: serverloop.c,v 1.177 2015/02/16 22:13:32 djm Exp $ */
+/* $OpenBSD: serverloop.c,v 1.178 2015/02/20 22:17:21 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1195,10 +1195,10 @@ server_input_hostkeys_prove(struct sshbuf **respp)
sshbuf_reset(sigbuf);
free(sig);
sig = NULL;
- if ((r = sshbuf_put_string(sigbuf,
+ if ((r = sshbuf_put_cstring(sigbuf,
+ "hostkeys-prove-00@openssh.com")) != 0 ||
+ (r = sshbuf_put_string(sigbuf,
ssh->kex->session_id, ssh->kex->session_id_len)) != 0 ||
- (r = sshbuf_put_cstring(sigbuf,
- "hostkeys-prove@openssh.com")) != 0 ||
(r = sshkey_puts(key, sigbuf)) != 0 ||
(r = ssh->kex->sign(key_prv, key_pub, &sig, &slen,
sshbuf_ptr(sigbuf), sshbuf_len(sigbuf), 0)) != 0 ||
@@ -1310,7 +1310,7 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
} else if (strcmp(rtype, "no-more-sessions@openssh.com") == 0) {
no_more_sessions = 1;
success = 1;
- } else if (strcmp(rtype, "hostkeys-prove@openssh.com") == 0) {
+ } else if (strcmp(rtype, "hostkeys-prove-00@openssh.com") == 0) {
success = server_input_hostkeys_prove(&resp);
}
if (want_reply) {
diff --git a/ssh.c b/ssh.c
index 430773c..57b53fb 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.414 2015/01/20 23:14:00 deraadt Exp $ */
+/* $OpenBSD: ssh.c,v 1.415 2015/02/20 22:17:21 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1072,6 +1072,12 @@ main(int ac, char **av)
strcmp(options.proxy_command, "-") == 0 &&
options.proxy_use_fdpass)
fatal("ProxyCommand=- and ProxyUseFDPass are incompatible");
+ if (options.control_persist &&
+ options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK) {
+ debug("UpdateHostKeys=ask is incompatible with ControlPersist; "
+ "disabling");
+ options.update_hostkeys = 0;
+ }
#ifndef HAVE_CYGWIN
if (original_effective_uid != 0)
options.use_privileged_port = 0;
diff --git a/ssh_config.5 b/ssh_config.5
index fa59c51..140d0ba 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.204 2015/02/16 22:13:32 djm Exp $
-.Dd $Mdocdate: February 16 2015 $
+.\" $OpenBSD: ssh_config.5,v 1.205 2015/02/20 22:17:21 djm Exp $
+.Dd $Mdocdate: February 20 2015 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -1524,6 +1524,9 @@ If
is set to
.Dq ask ,
then the user is asked to confirm the modifications to the known_hosts file.
+Confirmation is currently incompatible with
+.Cm ControlPersist ,
+and will be disabled if it is enabled.
.Pp
Presently, only
.Xr sshd 8
diff --git a/sshd.c b/sshd.c
index 2919efb..312dcd8 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.443 2015/02/16 22:30:03 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.444 2015/02/20 22:17:21 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -942,7 +942,7 @@ notify_hostkeys(struct ssh *ssh)
free(fp);
if (nkeys == 0) {
packet_start(SSH2_MSG_GLOBAL_REQUEST);
- packet_put_cstring("hostkeys@openssh.com");
+ packet_put_cstring("hostkeys-00@openssh.com");
packet_put_char(0); /* want-reply */
}
sshbuf_reset(buf);

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Feb 23, 2015, 8:59 AM

Post #9 of 15 (2149 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 5248429b5ec524d0a65507cff0cdd6e0cb99effd
Author: djm@openbsd.org <djm@openbsd.org>
Date: Mon Feb 23 16:55:51 2015 +0000

upstream commit

add an XXX to remind me to improve sshkey_load_public
---
authfile.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/authfile.c b/authfile.c
index 7d7f45e..3a81786 100644
--- a/authfile.c
+++ b/authfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.110 2015/01/20 23:14:00 deraadt Exp $ */
+/* $OpenBSD: authfile.c,v 1.111 2015/02/23 16:55:51 djm Exp $ */
/*
* Copyright (c) 2000, 2013 Markus Friedl. All rights reserved.
*
@@ -343,6 +343,8 @@ sshkey_load_public(const char *filename, struct sshkey **keyp, char **commentp)
if (commentp != NULL)
*commentp = NULL;

+ /* XXX should load file once and attempt to parse each format */
+
if ((fd = open(filename, O_RDONLY)) < 0)
goto skip;
#ifdef WITH_SSH1
@@ -394,6 +396,7 @@ sshkey_load_public(const char *filename, struct sshkey **keyp, char **commentp)
return 0;
}
sshkey_free(pub);
+
return r;
}

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Feb 25, 2015, 9:32 AM

Post #10 of 15 (2164 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 6f621603f9cff2a5d6016a404c96cb2f8ac2dec0
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Feb 25 17:29:38 2015 +0000

upstream commit

don't leak validity of user in "too many authentication
failures" disconnect message; reported by Sebastian Reitenbach
---
auth.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/auth.c b/auth.c
index facc962..f9b7673 100644
--- a/auth.c
+++ b/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.109 2015/01/20 23:14:00 deraadt Exp $ */
+/* $OpenBSD: auth.c,v 1.110 2015/02/25 17:29:38 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -331,13 +331,14 @@ auth_log(Authctxt *authctxt, int authenticated, int partial,
void
auth_maxtries_exceeded(Authctxt *authctxt)
{
- packet_disconnect("Too many authentication failures for "
+ error("maximum authentication attempts exceeded for "
"%s%.100s from %.200s port %d %s",
authctxt->valid ? "" : "invalid user ",
authctxt->user,
get_remote_ipaddr(),
get_remote_port(),
compat20 ? "ssh2" : "ssh1");
+ packet_disconnect("Too many authentication failures");
/* NOTREACHED */
}

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Feb 25, 2015, 3:10 PM

Post #11 of 15 (2144 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 6e6458b476ec854db33e3e68ebf4f489d0ab3df8
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Feb 25 23:05:47 2015 +0000

upstream commit

zero cmsgbuf before use; we initialise the bits we use
but valgrind still spams warning on it
---
monitor_fdpass.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/monitor_fdpass.c b/monitor_fdpass.c
index 100fa56..2ddd807 100644
--- a/monitor_fdpass.c
+++ b/monitor_fdpass.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_fdpass.c,v 1.19 2010/01/12 00:58:25 djm Exp $ */
+/* $OpenBSD: monitor_fdpass.c,v 1.20 2015/02/25 23:05:47 djm Exp $ */
/*
* Copyright 2001 Niels Provos <provos@citi.umich.edu>
* All rights reserved.
@@ -70,6 +70,7 @@ mm_send_fd(int sock, int fd)
msg.msg_accrights = (caddr_t)&fd;
msg.msg_accrightslen = sizeof(fd);
#else
+ memset(&cmsgbuf, 0, sizeof(cmsgbuf));
msg.msg_control = (caddr_t)&cmsgbuf.buf;
msg.msg_controllen = sizeof(cmsgbuf.buf);
cmsg = CMSG_FIRSTHDR(&msg);
@@ -136,6 +137,7 @@ mm_receive_fd(int sock)
msg.msg_accrights = (caddr_t)&fd;
msg.msg_accrightslen = sizeof(fd);
#else
+ memset(&cmsgbuf, 0, sizeof(cmsgbuf));
msg.msg_control = &cmsgbuf.buf;
msg.msg_controllen = sizeof(cmsgbuf.buf);
#endif

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Mar 3, 2015, 9:54 AM

Post #12 of 15 (2127 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit d608a51daad4f14ad6ab43d7cf74ef4801cc3fe9
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Mar 3 17:53:40 2015 +0000

upstream commit

reorder logic for better portability; patch from Roumen
Petrov
---
regress/hostkey-rotate.sh | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/regress/hostkey-rotate.sh b/regress/hostkey-rotate.sh
index d964b35..b5d542d 100644
--- a/regress/hostkey-rotate.sh
+++ b/regress/hostkey-rotate.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: hostkey-rotate.sh,v 1.1 2015/01/26 06:12:18 djm Exp $
+# $OpenBSD: hostkey-rotate.sh,v 1.2 2015/03/03 17:53:40 djm Exp $
# Placed in the Public Domain.

tid="hostkey rotate"
@@ -38,11 +38,10 @@ expect_nkeys() {
check_key_present() {
_type=$1
_kfile=$2
- _prog='print $2 " " $3'
test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub"
- _ktext=`awk "/ $_type / { $_prog }" < $OBJ/known_hosts` || \
+ _kpub=`awk "/$_type /"' { print $2 }' < $_kfile` || \
fatal "awk failed"
- grep -q "$_ktext" $_kfile
+ fgrep "$_kpub" $OBJ/known_hosts > /dev/null
}

cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
@@ -110,7 +109,7 @@ dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
expect_nkeys 1 "learn hostkeys"
check_key_present ssh-rsa || fail "didn't learn changed key"

-# $OpenBSD: hostkey-rotate.sh,v 1.1 2015/01/26 06:12:18 djm Exp $
+# $OpenBSD: hostkey-rotate.sh,v 1.2 2015/03/03 17:53:40 djm Exp $
# Placed in the Public Domain.

tid="hostkey rotate"

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Mar 3, 2015, 12:59 PM

Post #13 of 15 (2119 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 3f7f5e6c5d2aa3f6710289c1a30119e534e56c5c
Author: djm@openbsd.org <djm@openbsd.org>
Date: Tue Mar 3 20:42:49 2015 +0000

upstream commit

expand __unused to full __attribute__ for better portability
---
regress/unittests/test_helper/fuzz.c | 4 ++--
regress/unittests/test_helper/test_helper.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/regress/unittests/test_helper/fuzz.c b/regress/unittests/test_helper/fuzz.c
index 06fb247..99f1d03 100644
--- a/regress/unittests/test_helper/fuzz.c
+++ b/regress/unittests/test_helper/fuzz.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: fuzz.c,v 1.7 2015/01/18 19:52:44 djm Exp $ */
+/* $OpenBSD: fuzz.c,v 1.8 2015/03/03 20:42:49 djm Exp $ */
/*
* Copyright (c) 2011 Damien Miller <djm@mindrot.org>
*
@@ -200,7 +200,7 @@ fuzz_dump(struct fuzz *fuzz)
static struct fuzz *last_fuzz;

static void
-siginfo(int unused __unused)
+siginfo(int unused __attribute__((__unused__)))
{
char buf[256];

diff --git a/regress/unittests/test_helper/test_helper.c b/regress/unittests/test_helper/test_helper.c
index 034af93..26ca26b 100644
--- a/regress/unittests/test_helper/test_helper.c
+++ b/regress/unittests/test_helper/test_helper.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: test_helper.c,v 1.5 2015/02/16 22:20:50 djm Exp $ */
+/* $OpenBSD: test_helper.c,v 1.6 2015/03/03 20:42:49 djm Exp $ */
/*
* Copyright (c) 2011 Damien Miller <djm@mindrot.org>
*
@@ -193,7 +193,7 @@ test_info(char *s, size_t len)

#ifdef SIGINFO
static void
-siginfo(int unused __unused)
+siginfo(int unused __attribute__((__unused__)))
{
char buf[256];

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Mar 4, 2015, 11:00 AM

Post #14 of 15 (2126 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit dad2b1892b4c1b7e58df483a8c5b983c4454e099
Author: markus@openbsd.org <markus@openbsd.org>
Date: Tue Mar 3 22:35:19 2015 +0000

upstream commit

make it possible to run tests w/o ssh1 support; ok djm@
---
regress/agent-timeout.sh | 4 ++--
regress/agent.sh | 8 ++++----
regress/broken-pipe.sh | 4 ++--
regress/cfgmatch.sh | 23 ++++++++++++-----------
regress/cipher-speed.sh | 8 ++++++--
regress/connect-privsep.sh | 8 ++++----
regress/connect.sh | 4 ++--
regress/dynamic-forward.sh | 4 ++--
regress/exit-status.sh | 4 ++--
regress/forcecommand.sh | 26 ++++++++++++++------------
regress/forward-control.sh | 6 +++---
regress/forwarding.sh | 13 ++++++++-----
regress/host-expand.sh | 4 ++--
regress/key-options.sh | 10 +++++-----
regress/keygen-change.sh | 9 +++++++--
regress/keyscan.sh | 9 +++++++--
regress/localcommand.sh | 4 ++--
regress/proto-mismatch.sh | 6 ++++--
regress/proto-version.sh | 10 ++++++----
regress/proxy-connect.sh | 6 +++---
regress/reconfigure.sh | 6 +++---
regress/reexec.sh | 4 ++--
regress/stderr-data.sh | 4 ++--
regress/test-exec.sh | 29 +++++++++++++++++++++++++----
regress/transfer.sh | 4 ++--
regress/try-ciphers.sh | 8 ++++++--
regress/yes-head.sh | 4 ++--
27 files changed, 139 insertions(+), 90 deletions(-)

diff --git a/regress/agent-timeout.sh b/regress/agent-timeout.sh
index 6882659..9598c20 100644
--- a/regress/agent-timeout.sh
+++ b/regress/agent-timeout.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: agent-timeout.sh,v 1.2 2013/05/17 01:16:09 dtucker Exp $
+# $OpenBSD: agent-timeout.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="agent timeout test"
@@ -12,7 +12,7 @@ if [ $r -ne 0 ]; then
fail "could not start ssh-agent: exit code $r"
else
trace "add keys with timeout"
- for t in rsa rsa1; do
+ for t in ${SSH_KEYTYPES}; do
${SSHADD} -t ${SSHAGENT_TIMEOUT} $OBJ/$t > /dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh-add did succeed exit code 0"
diff --git a/regress/agent.sh b/regress/agent.sh
index caad3c8..c5e2794 100644
--- a/regress/agent.sh
+++ b/regress/agent.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: agent.sh,v 1.10 2014/02/27 21:21:25 djm Exp $
+# $OpenBSD: agent.sh,v 1.11 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="simple agent test"
@@ -20,7 +20,7 @@ else
fi
trace "overwrite authorized keys"
printf '' > $OBJ/authorized_keys_$USER
- for t in ed25519 rsa rsa1; do
+ for t in ${SSH_KEYTYPES}; do
# generate user key for agent
rm -f $OBJ/$t-agent
${SSHKEYGEN} -q -N '' -t $t -f $OBJ/$t-agent ||\
@@ -46,7 +46,7 @@ else
fi

trace "simple connect via agent"
- for p in 1 2; do
+ for p in ${SSH_PROTOCOLS}; do
${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p
r=$?
if [ $r -ne 5$p ]; then
@@ -55,7 +55,7 @@ else
done

trace "agent forwarding"
- for p in 1 2; do
+ for p in ${SSH_PROTOCOLS}; do
${SSH} -A -$p -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
diff --git a/regress/broken-pipe.sh b/regress/broken-pipe.sh
index c08c849..a416f7a 100644
--- a/regress/broken-pipe.sh
+++ b/regress/broken-pipe.sh
@@ -1,9 +1,9 @@
-# $OpenBSD: broken-pipe.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
+# $OpenBSD: broken-pipe.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="broken pipe test"

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "protocol $p"
for i in 1 2 3 4; do
${SSH} -$p -F $OBJ/ssh_config_config nexthost echo $i 2> /dev/null | true
diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
index 80cf229..0562963 100644
--- a/regress/cfgmatch.sh
+++ b/regress/cfgmatch.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: cfgmatch.sh,v 1.8 2013/05/17 00:37:40 dtucker Exp $
+# $OpenBSD: cfgmatch.sh,v 1.9 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="sshd_config match"
@@ -56,7 +56,7 @@ start_sshd
#set -x

# Test Match + PermitOpen in sshd_config. This should be permitted
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "match permitopen localhost proto $p"
start_client -F $OBJ/ssh_config
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
@@ -65,7 +65,7 @@ for p in 1 2; do
done

# Same but from different source. This should not be permitted
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "match permitopen proxy proto $p"
start_client -F $OBJ/ssh_proxy
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
@@ -74,11 +74,12 @@ for p in 1 2; do
done

# Retry previous with key option, should also be denied.
-printf 'permitopen="127.0.0.1:'$PORT'" ' >$OBJ/authorized_keys_$USER
-cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
-printf 'permitopen="127.0.0.1:'$PORT'" ' >>$OBJ/authorized_keys_$USER
-cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
-for p in 1 2; do
+cp /dev/null $OBJ/authorized_keys_$USER
+for t in ${SSH_KEYTYPES}; do
+ printf 'permitopen="127.0.0.1:'$PORT'" ' >> $OBJ/authorized_keys_$USER
+ cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
+done
+for p in ${SSH_PROTOCOLS}; do
trace "match permitopen proxy w/key opts proto $p"
start_client -F $OBJ/ssh_proxy
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
@@ -88,7 +89,7 @@ done

# Test both sshd_config and key options permitting the same dst/port pair.
# Should be permitted.
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "match permitopen localhost proto $p"
start_client -F $OBJ/ssh_config
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
@@ -102,7 +103,7 @@ echo "Match User $USER" >>$OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy

# Test that a Match overrides a PermitOpen in the global section
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "match permitopen proxy w/key opts proto $p"
start_client -F $OBJ/ssh_proxy
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
@@ -117,7 +118,7 @@ echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy

# Test that a rule that doesn't match doesn't override, plus test a
# PermitOpen entry that's not at the start of the list
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "nomatch permitopen proxy w/key opts proto $p"
start_client -F $OBJ/ssh_proxy
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
index a6d53a7..ad2f9b9 100644
--- a/regress/cipher-speed.sh
+++ b/regress/cipher-speed.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: cipher-speed.sh,v 1.11 2013/11/21 03:18:51 djm Exp $
+# $OpenBSD: cipher-speed.sh,v 1.12 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="cipher speed"
@@ -31,7 +31,11 @@ for c in `${SSH} -Q cipher`; do n=0; for m in `${SSH} -Q mac`; do
n=`expr $n + 1`
done; done

-ciphers="3des blowfish"
+if ssh_version 1; then
+ ciphers="3des blowfish"
+else
+ ciphers=""
+fi
for c in $ciphers; do
trace "proto 1 cipher $c"
for x in $tries; do
diff --git a/regress/connect-privsep.sh b/regress/connect-privsep.sh
index 41cb7af..9a51f56 100644
--- a/regress/connect-privsep.sh
+++ b/regress/connect-privsep.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: connect-privsep.sh,v 1.5 2014/05/04 10:40:59 logan Exp $
+# $OpenBSD: connect-privsep.sh,v 1.6 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="proxy connect with privsep"
@@ -6,7 +6,7 @@ tid="proxy connect with privsep"
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
echo 'UsePrivilegeSeparation yes' >> $OBJ/sshd_proxy

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
if [ $? -ne 0 ]; then
fail "ssh privsep+proxyconnect protocol $p failed"
@@ -16,7 +16,7 @@ done
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
echo 'UsePrivilegeSeparation sandbox' >> $OBJ/sshd_proxy

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
if [ $? -ne 0 ]; then
# XXX replace this with fail once sandbox has stabilised
@@ -27,7 +27,7 @@ done
# Because sandbox is sensitive to changes in libc, especially malloc, retest
# with every malloc.conf option (and none).
for m in '' A F G H J P R S X '<' '>'; do
- for p in 1 2; do
+ for p in ${SSH_PROTOCOLS}; do
env MALLOC_OPTIONS="$m" ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
if [ $? -ne 0 ]; then
fail "ssh privsep/sandbox+proxyconnect protocol $p mopt '$m' failed"
diff --git a/regress/connect.sh b/regress/connect.sh
index 2186fa6..f0d55d3 100644
--- a/regress/connect.sh
+++ b/regress/connect.sh
@@ -1,11 +1,11 @@
-# $OpenBSD: connect.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
+# $OpenBSD: connect.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="simple connect"

start_sshd

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
if [ $? -ne 0 ]; then
fail "ssh connect with protocol $p failed"
diff --git a/regress/dynamic-forward.sh b/regress/dynamic-forward.sh
index 42fa8ac..dd67c96 100644
--- a/regress/dynamic-forward.sh
+++ b/regress/dynamic-forward.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: dynamic-forward.sh,v 1.10 2013/05/17 04:29:14 dtucker Exp $
+# $OpenBSD: dynamic-forward.sh,v 1.11 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="dynamic forwarding"
@@ -17,7 +17,7 @@ trace "will use ProxyCommand $proxycmd"

start_sshd

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
n=0
error="1"
trace "start dynamic forwarding, fork to background"
diff --git a/regress/exit-status.sh b/regress/exit-status.sh
index 56b78a6..397d8d7 100644
--- a/regress/exit-status.sh
+++ b/regress/exit-status.sh
@@ -1,9 +1,9 @@
-# $OpenBSD: exit-status.sh,v 1.6 2002/03/15 13:08:56 markus Exp $
+# $OpenBSD: exit-status.sh,v 1.7 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="remote exit status"

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
for s in 0 1 4 5 44; do
trace "proto $p status $s"
verbose "test $tid: proto $p status $s"
diff --git a/regress/forcecommand.sh b/regress/forcecommand.sh
index 44d2b7f..8a9b090 100644
--- a/regress/forcecommand.sh
+++ b/regress/forcecommand.sh
@@ -1,30 +1,32 @@
-# $OpenBSD: forcecommand.sh,v 1.2 2013/05/17 00:37:40 dtucker Exp $
+# $OpenBSD: forcecommand.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="forced command"

cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak

-printf 'command="true" ' >$OBJ/authorized_keys_$USER
-cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
-printf 'command="true" ' >>$OBJ/authorized_keys_$USER
-cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
+cp /dev/null $OBJ/authorized_keys_$USER
+for t in ${SSH_KEYTYPES}; do
+ printf 'command="true" ' >>$OBJ/authorized_keys_$USER
+ cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
+done

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "forced command in key option proto $p"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"
done

-printf 'command="false" ' >$OBJ/authorized_keys_$USER
-cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
-printf 'command="false" ' >>$OBJ/authorized_keys_$USER
-cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
+cp /dev/null $OBJ/authorized_keys_$USER
+for t in ${SSH_KEYTYPES}; do
+ printf 'command="false" ' >> $OBJ/authorized_keys_$USER
+ cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
+done

cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "ForceCommand true" >> $OBJ/sshd_proxy

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "forced command in sshd_config overrides key option proto $p"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"
@@ -35,7 +37,7 @@ echo "ForceCommand false" >> $OBJ/sshd_proxy
echo "Match User $USER" >> $OBJ/sshd_proxy
echo " ForceCommand true" >> $OBJ/sshd_proxy

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "forced command with match proto $p"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"
diff --git a/regress/forward-control.sh b/regress/forward-control.sh
index 7f7d105..9195709 100644
--- a/regress/forward-control.sh
+++ b/regress/forward-control.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: forward-control.sh,v 1.2 2013/11/18 05:09:32 naddy Exp $
+# $OpenBSD: forward-control.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="sshd control of local and remote forwarding"
@@ -99,7 +99,7 @@ cp ${OBJ}/sshd_proxy ${OBJ}/sshd_proxy.bak
cp ${OBJ}/authorized_keys_${USER} ${OBJ}/authorized_keys_${USER}.bak

# Sanity check: ensure the default config allows forwarding
-for p in 1 2 ; do
+for p in ${SSH_PROTOCOLS} ; do
check_lfwd $p Y "proto $p, default configuration"
check_rfwd $p Y "proto $p, default configuration"
done
@@ -115,7 +115,7 @@ all_tests() {
_permit_rfwd=$7
_badfwd=127.0.0.1:22
_goodfwd=127.0.0.1:${PORT}
- for _proto in 1 2 ; do
+ for _proto in ${SSH_PROTOCOLS} ; do
cp ${OBJ}/authorized_keys_${USER}.bak \
${OBJ}/authorized_keys_${USER}
_prefix="proto $_proto, AllowTcpForwarding=$_tcpfwd"
diff --git a/regress/forwarding.sh b/regress/forwarding.sh
index 0eee317..fb4f35a 100644
--- a/regress/forwarding.sh
+++ b/regress/forwarding.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: forwarding.sh,v 1.14 2015/02/23 20:32:15 djm Exp $
+# $OpenBSD: forwarding.sh,v 1.15 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="local and remote forwarding"
@@ -23,8 +23,11 @@ for j in 0 1 2; do
last=$a
done
done
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
q=`expr 3 - $p`
+ if ! ssh_version $q; then
+ q=$p
+ fi
trace "start forwarding, fork to background"
${SSH} -$p -F $OBJ/ssh_config -f $fwd somehost sleep 10

@@ -37,7 +40,7 @@ for p in 1 2; do
sleep 10
done

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
for d in L R; do
trace "exit on -$d forward failure, proto $p"

@@ -67,7 +70,7 @@ for d in L R; do
done
done

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "simple clear forwarding proto $p"
${SSH} -$p -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true

@@ -110,7 +113,7 @@ done

echo "LocalForward ${base}01 127.0.0.1:$PORT" >> $OBJ/ssh_config
echo "RemoteForward ${base}02 127.0.0.1:${base}01" >> $OBJ/ssh_config
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
trace "config file: start forwarding, fork to background"
${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f somehost sleep 10

diff --git a/regress/host-expand.sh b/regress/host-expand.sh
index 6cc0e60..2a95bfe 100644
--- a/regress/host-expand.sh
+++ b/regress/host-expand.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: host-expand.sh,v 1.3 2014/02/27 23:17:41 djm Exp $
+# $OpenBSD: host-expand.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="expand %h and %n"
@@ -11,7 +11,7 @@ somehost
127.0.0.1
EOE

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
verbose "test $tid: proto $p"
${SSH} -F $OBJ/ssh_proxy -$p somehost true >$OBJ/actual
diff $OBJ/expect $OBJ/actual || fail "$tid proto $p"
diff --git a/regress/key-options.sh b/regress/key-options.sh
index f98d78b..7a68ad3 100644
--- a/regress/key-options.sh
+++ b/regress/key-options.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: key-options.sh,v 1.2 2008/06/30 08:07:34 djm Exp $
+# $OpenBSD: key-options.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="key options"
@@ -8,7 +8,7 @@ authkeys="$OBJ/authorized_keys_${USER}"
cp $authkeys $origkeys

# Test command= forced command
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
sed "s/.*/$c &/" $origkeys >$authkeys
verbose "key option proto $p $c"
@@ -24,7 +24,7 @@ done

# Test no-pty
sed 's/.*/no-pty &/' $origkeys >$authkeys
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
verbose "key option proto $p no-pty"
r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost tty`
if [ -f "$r" ]; then
@@ -35,7 +35,7 @@ done
# Test environment=
echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy
sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
verbose "key option proto $p environment"
r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo $FOO'`
if [ "$r" != "bar" ]; then
@@ -45,7 +45,7 @@ done

# Test from= restriction
start_sshd
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
for f in 127.0.0.1 '127.0.0.0\/8'; do
cat $origkeys >$authkeys
${SSH} -$p -q -F $OBJ/ssh_proxy somehost true
diff --git a/regress/keygen-change.sh b/regress/keygen-change.sh
index 04a0d54..e561850 100644
--- a/regress/keygen-change.sh
+++ b/regress/keygen-change.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: keygen-change.sh,v 1.4 2015/01/13 08:23:26 djm Exp $
+# $OpenBSD: keygen-change.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="change passphrase for key"
@@ -6,7 +6,12 @@ tid="change passphrase for key"
S1="secret1"
S2="2secret"

-for t in `${SSH} -Q key-plain` ; do
+KEYTYPES=`${SSH} -Q key-plain`
+if ssh_version 1; then
+ KEYTYPES="${KEYTYPES} rsa1"
+fi
+
+for t in $KEYTYPES; do
# generate user key for agent
trace "generating $t key"
rm -f $OBJ/$t-key
diff --git a/regress/keyscan.sh b/regress/keyscan.sh
index 33f14f0..886f329 100644
--- a/regress/keyscan.sh
+++ b/regress/keyscan.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: keyscan.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
+# $OpenBSD: keyscan.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="keyscan"
@@ -8,7 +8,12 @@ rm -f ${OBJ}/host.dsa

start_sshd

-for t in rsa1 rsa dsa; do
+KEYTYPES="rsa dsa"
+if ssh_version 1; then
+ KEYTYPES="${KEYTYPES} rsa1"
+fi
+
+for t in $KEYTYPES; do
trace "keyscan type $t"
${SSHKEYSCAN} -t $t -p $PORT 127.0.0.1 127.0.0.1 127.0.0.1 \
> /dev/null 2>&1
diff --git a/regress/localcommand.sh b/regress/localcommand.sh
index 8a9b569..220f19a 100644
--- a/regress/localcommand.sh
+++ b/regress/localcommand.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: localcommand.sh,v 1.2 2013/05/17 10:24:48 dtucker Exp $
+# $OpenBSD: localcommand.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="localcommand"
@@ -6,7 +6,7 @@ tid="localcommand"
echo 'PermitLocalCommand yes' >> $OBJ/ssh_proxy
echo 'LocalCommand echo foo' >> $OBJ/ssh_proxy

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
verbose "test $tid: proto $p localcommand"
a=`${SSH} -F $OBJ/ssh_proxy -$p somehost true`
if [ "$a" != "foo" ] ; then
diff --git a/regress/proto-mismatch.sh b/regress/proto-mismatch.sh
index fb521f2..9e8024b 100644
--- a/regress/proto-mismatch.sh
+++ b/regress/proto-mismatch.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: proto-mismatch.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
+# $OpenBSD: proto-mismatch.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="protocol version mismatch"
@@ -16,4 +16,6 @@ mismatch ()
}

mismatch 2 SSH-1.5-HALLO
-mismatch 1 SSH-2.0-HALLO
+if ssh_version 1; then
+ mismatch 1 SSH-2.0-HALLO
+fi
diff --git a/regress/proto-version.sh b/regress/proto-version.sh
index b876dd7..cf49461 100644
--- a/regress/proto-version.sh
+++ b/regress/proto-version.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: proto-version.sh,v 1.4 2013/05/17 00:37:40 dtucker Exp $
+# $OpenBSD: proto-version.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="sshd version with different protocol combinations"
@@ -28,7 +28,9 @@ check_version ()
fi
}

-check_version 2,1 199
-check_version 1,2 199
check_version 2 20
-check_version 1 15
+if ssh_version 1; then
+ check_version 2,1 199
+ check_version 1,2 199
+ check_version 1 15
+fi
diff --git a/regress/proxy-connect.sh b/regress/proxy-connect.sh
index 023ba73..f816962 100644
--- a/regress/proxy-connect.sh
+++ b/regress/proxy-connect.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: proxy-connect.sh,v 1.7 2014/05/03 18:46:14 dtucker Exp $
+# $OpenBSD: proxy-connect.sh,v 1.8 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="proxy connect"
@@ -9,7 +9,7 @@ for ps in no yes; do
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy

- for p in 1 2; do
+ for p in ${SSH_PROTOCOLS}; do
for c in no yes; do
verbose "plain username protocol $p privsep=$ps comp=$c"
opts="-$p -oCompression=$c -F $OBJ/ssh_proxy"
@@ -24,7 +24,7 @@ for ps in no yes; do
done
done

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
verbose "username with style protocol $p"
${SSH} -$p -F $OBJ/ssh_proxy ${USER}:style@999.999.999.999 true || \
fail "ssh proxyconnect protocol $p failed"
diff --git a/regress/reconfigure.sh b/regress/reconfigure.sh
index e6af9ea..eecddd3 100644
--- a/regress/reconfigure.sh
+++ b/regress/reconfigure.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: reconfigure.sh,v 1.4 2015/01/14 09:58:21 markus Exp $
+# $OpenBSD: reconfigure.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="simple connect after reconfigure"
@@ -18,7 +18,7 @@ fi
start_sshd

trace "connect before restart"
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS} ; do
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
if [ $? -ne 0 ]; then
fail "ssh connect with protocol $p failed before reconfigure"
@@ -39,7 +39,7 @@ done
test -f $PIDFILE || fatal "sshd did not restart"

trace "connect after restart"
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS} ; do
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
if [ $? -ne 0 ]; then
fail "ssh connect with protocol $p failed after reconfigure"
diff --git a/regress/reexec.sh b/regress/reexec.sh
index 433573f..5c0a7b4 100644
--- a/regress/reexec.sh
+++ b/regress/reexec.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: reexec.sh,v 1.7 2013/05/17 10:23:52 dtucker Exp $
+# $OpenBSD: reexec.sh,v 1.8 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="reexec tests"
@@ -19,7 +19,7 @@ start_sshd_copy ()
copy_tests ()
{
rm -f ${COPY}
- for p in 1 2; do
+ for p in ${SSH_PROTOCOLS} ; do
verbose "$tid: proto $p"
${SSH} -nqo "Protocol=$p" -F $OBJ/ssh_config somehost \
cat ${DATA} > ${COPY}
diff --git a/regress/stderr-data.sh b/regress/stderr-data.sh
index b0bd235..8c8149a 100644
--- a/regress/stderr-data.sh
+++ b/regress/stderr-data.sh
@@ -1,10 +1,10 @@
-# $OpenBSD: stderr-data.sh,v 1.3 2013/05/17 04:29:14 dtucker Exp $
+# $OpenBSD: stderr-data.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="stderr data transfer"

for n in '' -n; do
-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
verbose "test $tid: proto $p ($n)"
${SSH} $n -$p -F $OBJ/ssh_proxy otherhost \
exec sh -c \'"exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index ff0768a..12ba094 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: test-exec.sh,v 1.48 2014/07/06 07:42:03 djm Exp $
+# $OpenBSD: test-exec.sh,v 1.51 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

#SUDO=sudo
@@ -130,6 +130,11 @@ if [ "x$TEST_SSH_CONCH" != "x" ]; then
esac
fi

+SSH_PROTOCOLS=`$SSH -Q protocol-version`
+if [ "x$TEST_SSH_PROTOCOLS" != "x" ]; then
+ SSH_PROTOCOLS="${TEST_SSH_PROTOCOLS}"
+fi
+
# Path to sshd must be absolute for rexec
case "$SSHD" in
/*) ;;
@@ -374,16 +379,27 @@ fatal ()
exit $RESULT
}

+ssh_version ()
+{
+ echo ${SSH_PROTOCOLS} | grep -q "$1"
+}
+
RESULT=0
PIDFILE=$OBJ/pidfile

trap fatal 3 2

+if ssh_version 1; then
+ PROTO="2,1"
+else
+ PROTO="2"
+fi
+
# create server config
cat << EOF > $OBJ/sshd_config
StrictModes no
Port $PORT
- Protocol 2,1
+ Protocol $PROTO
AddressFamily inet
ListenAddress 127.0.0.1
#ListenAddress ::1
@@ -409,7 +425,7 @@ echo 'StrictModes no' >> $OBJ/sshd_proxy
# create client config
cat << EOF > $OBJ/ssh_config
Host *
- Protocol 2,1
+ Protocol $PROTO
Hostname 127.0.0.1
HostKeyAlias localhost-with-alias
Port $PORT
@@ -434,8 +450,13 @@ fi

rm -f $OBJ/known_hosts $OBJ/authorized_keys_$USER

+if ssh_version 1; then
+ SSH_KEYTYPES="rsa rsa1"
+else
+ SSH_KEYTYPES="rsa ed25519"
+fi
trace "generate keys"
-for t in rsa rsa1; do
+for t in ${SSH_KEYTYPES}; do
# generate user key
if [ ! -f $OBJ/$t ] || [ ${SSHKEYGEN_BIN} -nt $OBJ/$t ]; then
rm -f $OBJ/$t
diff --git a/regress/transfer.sh b/regress/transfer.sh
index 1ae3ef5..36c1463 100644
--- a/regress/transfer.sh
+++ b/regress/transfer.sh
@@ -1,9 +1,9 @@
-# $OpenBSD: transfer.sh,v 1.2 2013/05/17 04:29:14 dtucker Exp $
+# $OpenBSD: transfer.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="transfer data"

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
verbose "$tid: proto $p"
rm -f ${COPY}
${SSH} -n -q -$p -F $OBJ/ssh_proxy somehost cat ${DATA} > ${COPY}
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index 2881ce1..4165c7b 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: try-ciphers.sh,v 1.23 2014/04/21 22:15:37 djm Exp $
+# $OpenBSD: try-ciphers.sh,v 1.24 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="try ciphers"
@@ -26,7 +26,11 @@ for c in `${SSH} -Q cipher`; do
done
done

-ciphers="3des blowfish"
+if ssh_version 1; then
+ ciphers="3des blowfish"
+else
+ ciphers=""
+fi
for c in $ciphers; do
trace "proto 1 cipher $c"
verbose "test $tid: proto 1 cipher $c"
diff --git a/regress/yes-head.sh b/regress/yes-head.sh
index a8e6bc8..1fc7542 100644
--- a/regress/yes-head.sh
+++ b/regress/yes-head.sh
@@ -1,9 +1,9 @@
-# $OpenBSD: yes-head.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
+# $OpenBSD: yes-head.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.

tid="yes pipe head"

-for p in 1 2; do
+for p in ${SSH_PROTOCOLS}; do
lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)`
if [ $? -ne 0 ]; then
fail "yes|head test failed"

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits

[openssh] 02/02: upstream commit [ In reply to ]

git+noreply at mindrot

Mar 4, 2015, 3:27 PM

Post #15 of 15 (2117 views)

Permalink

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit ac5e8acefa253eb5e5ba186e34236c0e8007afdc
Author: djm@openbsd.org <djm@openbsd.org>
Date: Wed Mar 4 23:22:35 2015 +0000

upstream commit

make these work with !SSH1; ok markus@ deraadt@
---
regress/unittests/hostkeys/test_iterate.c | 19 +++++++++++++++----
regress/unittests/sshkey/test_file.c | 4 +++-
regress/unittests/sshkey/test_fuzz.c | 4 +++-
3 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/regress/unittests/hostkeys/test_iterate.c b/regress/unittests/hostkeys/test_iterate.c
index 68a7061..fc095ea 100644
--- a/regress/unittests/hostkeys/test_iterate.c
+++ b/regress/unittests/hostkeys/test_iterate.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: test_iterate.c,v 1.1 2015/02/16 22:18:34 djm Exp $ */
+/* $OpenBSD: test_iterate.c,v 1.2 2015/03/04 23:22:35 djm Exp $ */
/*
* Regress test for hostfile.h hostkeys_foreach()
*
@@ -54,7 +54,7 @@ check(struct hostkey_foreach_line *l, void *_ctx)
{
struct cbctx *ctx = (struct cbctx *)_ctx;
const struct expected *expected;
- const int parse_key = (ctx->flags & HKF_WANT_PARSE_KEY) != 0;
+ int parse_key = (ctx->flags & HKF_WANT_PARSE_KEY) != 0;
const int matching = (ctx->flags & HKF_WANT_MATCH) != 0;
u_int expected_status, expected_match;
int expected_keytype;
@@ -87,12 +87,21 @@ check(struct hostkey_foreach_line *l, void *_ctx)
expected_status = HKF_STATUS_MATCHED; \
} \
} while (0)
+ expected_keytype = (parse_key || expected->no_parse_keytype < 0) ?
+ expected->l.keytype : expected->no_parse_keytype;
+
+#ifndef WITH_SSH1
+ if (expected->l.keytype == KEY_RSA1 ||
+ expected->no_parse_keytype == KEY_RSA1) {
+ expected_status = HKF_STATUS_INVALID;
+ expected_keytype = KEY_UNSPEC;
+ parse_key = 0;
+ }
+#endif
UPDATE_MATCH_STATUS(match_host_p);
UPDATE_MATCH_STATUS(match_host_s);
UPDATE_MATCH_STATUS(match_ipv4);
UPDATE_MATCH_STATUS(match_ipv6);
- expected_keytype = (parse_key || expected->no_parse_keytype < 0) ?
- expected->l.keytype : expected->no_parse_keytype;

ASSERT_PTR_NE(l->path, NULL); /* Don't care about path */
ASSERT_LONG_LONG_EQ(l->linenum, expected->l.linenum);
@@ -132,6 +141,8 @@ prepare_expected(struct expected *expected, size_t n)
for (i = 0; i < n; i++) {
if (expected[i].key_file == NULL)
continue;
+ if (expected[i].l.keytype == KEY_RSA1)
+ continue;
ASSERT_INT_EQ(sshkey_load_public(
test_data_file(expected[i].key_file), &expected[i].l.key,
NULL), 0);
diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c
index 9c38a7c..fa95212 100644
--- a/regress/unittests/sshkey/test_file.c
+++ b/regress/unittests/sshkey/test_file.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: test_file.c,v 1.2 2014/12/22 02:15:52 djm Exp $ */
+/* $OpenBSD: test_file.c,v 1.3 2015/03/04 23:22:35 djm Exp $ */
/*
* Regress test for sshkey.h key management API
*
@@ -51,6 +51,7 @@ sshkey_file_tests(void)
pw = load_text_file("pw");
TEST_DONE();

+#ifdef WITH_SSH1
TEST_START("parse RSA1 from private");
buf = load_file("rsa1_1");
ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "rsa1_1",
@@ -99,6 +100,7 @@ sshkey_file_tests(void)
TEST_DONE();

sshkey_free(k1);
+#endif

TEST_START("parse RSA from private");
buf = load_file("rsa_1");
diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
index 14518ce..1f08a2e 100644
--- a/regress/unittests/sshkey/test_fuzz.c
+++ b/regress/unittests/sshkey/test_fuzz.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: test_fuzz.c,v 1.3 2015/01/26 06:11:28 djm Exp $ */
+/* $OpenBSD: test_fuzz.c,v 1.4 2015/03/04 23:22:35 djm Exp $ */
/*
* Fuzz tests for key parsing
*
@@ -104,6 +104,7 @@ sshkey_fuzz_tests(void)
struct fuzz *fuzz;
int r;

+#ifdef WITH_SSH1
TEST_START("fuzz RSA1 private");
buf = load_file("rsa1_1");
fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP |
@@ -147,6 +148,7 @@ sshkey_fuzz_tests(void)
sshbuf_free(fuzzed);
fuzz_cleanup(fuzz);
TEST_DONE();
+#endif

TEST_START("fuzz RSA private");
buf = load_file("rsa_1");

--
To stop receiving notification emails like this one, please contact
djm@mindrot.org.
_______________________________________________
openssh-commits mailing list
openssh-commits@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-commits