From 9403d0e805c77a5741ea8c3281bbe92558c2f125 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 16 Apr 2021 18:14:25 +1000 Subject: [PATCH 001/578] Add fbsd13 target. --- .github/workflows/selfhosted.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 1cf6b5da0..09a1fa7b5 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -16,7 +16,17 @@ jobs: # We use a matrix in two parts: firstly all of the VMs are tested with the # default config. "vm" corresponds to a label associated with the worker. matrix: - os: [bbone, dfly30, dfly48, dfly58, fbsd6, fbsd7, fbsd12, sol10, sol11] + os: + - bbone + - dfly30 + - dfly48 + - dfly58 + - fbsd6 + - fbsd7 + - fbsd12 + - fbsd13 + - sol10 + - sol11 configs: - default # Then we include any extra configs we want to test for specific VMs. @@ -27,6 +37,7 @@ jobs: - { os: fbsd6, configs: pam } - { os: fbsd7, configs: pam } - { os: fbsd12, configs: pam } + - { os: fbsd13, configs: pam } - { os: sol10, configs: pam } - { os: sol11, configs: pam } - { os: sol11, configs: sol64 } From bd4fba22e14da2fa196009010aabec5a8ba9dd42 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Sat, 17 Apr 2021 09:55:47 +1000 Subject: [PATCH 002/578] Add obsd51 target. --- .github/workflows/selfhosted.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 09a1fa7b5..8d6579da1 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -25,6 +25,7 @@ jobs: - fbsd7 - fbsd12 - fbsd13 + - obsd51 - sol10 - sol11 configs: From 4457837238072836b2fa3107d603aac809624983 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Tue, 20 Apr 2021 23:31:29 +1000 Subject: [PATCH 003/578] Add nbsd8 test target. --- .github/workflows/selfhosted.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 8d6579da1..7eedffcff 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -25,6 +25,7 @@ jobs: - fbsd7 - fbsd12 - fbsd13 + - nbsd8 - obsd51 - sol10 - sol11 @@ -39,6 +40,7 @@ jobs: - { os: fbsd7, configs: pam } - { os: fbsd12, configs: pam } - { os: fbsd13, configs: pam } + - { os: nbsd8, configs: pam } - { os: sol10, configs: pam } - { os: sol11, configs: pam } - { os: sol11, configs: sol64 } From cb4ff640d79b3c736879582139778f016bbb2cd7 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Wed, 21 Apr 2021 01:08:04 +1000 Subject: [PATCH 004/578] Add win10 test target. --- .github/configs | 4 ++++ .github/workflows/selfhosted.yml | 1 + 2 files changed, 5 insertions(+) diff --git a/.github/configs b/.github/configs index c47f1a523..2eff0deae 100755 --- a/.github/configs +++ b/.github/configs @@ -109,6 +109,10 @@ case "${TARGET_HOST}" in # sol11 has 4 test configs so skip unit tests to speed up. TEST_TARGET="tests SKIP_UNIT=1" ;; + win10) + # No sudo on Windows. + SUDO="" + ;; esac # If we have a local openssl/libressl, use that. diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 7eedffcff..55ba435e6 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -29,6 +29,7 @@ jobs: - obsd51 - sol10 - sol11 + - win10 configs: - default # Then we include any extra configs we want to test for specific VMs. From e428f29402fb6ac140b52f8f12e06ece7bb104a0 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Thu, 22 Apr 2021 22:26:08 +1000 Subject: [PATCH 005/578] Remove now-unused 2nd arg to configs. --- .github/run_test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/run_test.sh b/.github/run_test.sh index 66fd52603..1d1ecbf35 100755 --- a/.github/run_test.sh +++ b/.github/run_test.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash -. .github/configs $1 $2 +. .github/configs $1 [ -z "${SUDO}" ] || ${SUDO} mkdir -p /var/empty From f57fbfe5eb02df1a91f1a237c4d27165afd87c13 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Thu, 22 Apr 2021 22:27:26 +1000 Subject: [PATCH 006/578] Don't always set SUDO. Rely on sourcing configs to set as appropriate. --- .github/workflows/c-cpp.yml | 1 - .github/workflows/selfhosted.yml | 1 - 2 files changed, 2 deletions(-) diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index c4ae28434..c2825a30f 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -52,7 +52,6 @@ jobs: - name: make tests run: ./.github/run_test.sh ${{ matrix.configs }} env: - SUDO: sudo TEST_SSH_UNSAFE_PERMISSIONS: 1 - name: save logs if: failure() diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 55ba435e6..ec91ebda5 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -10,7 +10,6 @@ jobs: runs-on: ${{ matrix.os }} env: TARGET_HOST: ${{ matrix.os }} - SUDO: sudo strategy: fail-fast: false # We use a matrix in two parts: firstly all of the VMs are tested with the From 3fe7e73b025c07eda46d78049f1da8ed7dfc0c69 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 23 Apr 2021 10:26:35 +1000 Subject: [PATCH 007/578] Test krb5 on Solaris 11 too. --- .github/configs | 4 ++++ .github/workflows/selfhosted.yml | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/configs b/.github/configs index 2eff0deae..b24de4dd1 100755 --- a/.github/configs +++ b/.github/configs @@ -36,6 +36,10 @@ case "$config" in libedit) CONFIGFLAGS="--with-libedit" ;; + pam-krb5) + CONFIGFLAGS="--with-pam --with-kerberos5" + SSHD_CONFOPTS="UsePam yes" + ;; *pam) CONFIGFLAGS="--with-pam" SSHD_CONFOPTS="UsePam yes" diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index ec91ebda5..a9144b426 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -42,7 +42,7 @@ jobs: - { os: fbsd13, configs: pam } - { os: nbsd8, configs: pam } - { os: sol10, configs: pam } - - { os: sol11, configs: pam } + - { os: sol11, configs: pam-krb5 } - { os: sol11, configs: sol64 } # - { os: sol11, configs: sol64-pam } steps: From a6db3a47b56adb76870d59225ffb90a65bc4daf2 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 23 Apr 2021 10:28:28 +1000 Subject: [PATCH 008/578] Add openindiana test target. --- .github/workflows/selfhosted.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index a9144b426..e85a5054a 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -26,6 +26,7 @@ jobs: - fbsd13 - nbsd8 - obsd51 + - openindiana - sol10 - sol11 - win10 @@ -41,6 +42,7 @@ jobs: - { os: fbsd12, configs: pam } - { os: fbsd13, configs: pam } - { os: nbsd8, configs: pam } + - { os: openindiana, configs: pam } - { os: sol10, configs: pam } - { os: sol11, configs: pam-krb5 } - { os: sol11, configs: sol64 } From c039a6bf79192fe1daa9ddcc7c87dd98e258ae7c Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 23 Apr 2021 11:08:23 +1000 Subject: [PATCH 009/578] Re-add macos-11.0 test target. --- .github/workflows/c-cpp.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index c2825a30f..2b6d98900 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -13,7 +13,7 @@ jobs: fail-fast: false matrix: # First we test all OSes in the default configuration. - os: [ubuntu-20.04, ubuntu-18.04, ubuntu-16.04, macos-10.15] + os: [ubuntu-20.04, ubuntu-18.04, ubuntu-16.04, macos-10.15, macos-11.0] configs: [default] # Then we include any extra configs we want to test for specific VMs. # Valgrind slows things down quite a bit, so start them first. @@ -38,6 +38,7 @@ jobs: - { os: ubuntu-16.04, configs: pam } - { os: ubuntu-16.04, configs: kitchensink } - { os: macos-10.15, configs: pam } + - { os: macos-11.0, configs: pam } runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v2 From db1f9ab8feb838aee9f5b99c6fd3f211355dfdcf Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 23 Apr 2021 14:41:13 +1000 Subject: [PATCH 010/578] Add obsd67 test target. --- .github/workflows/selfhosted.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index e85a5054a..4abdfa245 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -26,6 +26,7 @@ jobs: - fbsd13 - nbsd8 - obsd51 + - obsd67 - openindiana - sol10 - sol11 From e3ba6574ed69e8b7af725cf5e8a9edaac04ff077 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 23 Apr 2021 14:53:32 +1000 Subject: [PATCH 011/578] Remove dependency on bash. --- .github/run_test.sh | 2 +- .github/setup_ci.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/run_test.sh b/.github/run_test.sh index 1d1ecbf35..7ef17697f 100755 --- a/.github/run_test.sh +++ b/.github/run_test.sh @@ -1,4 +1,4 @@ -#!/usr/bin/env bash +#!/bin/sh . .github/configs $1 diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 6240ef06e..61fd9725d 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -1,4 +1,4 @@ -#!/usr/bin/env bash +#!/bin/sh case $(./config.guess) in *-darwin*) From 196bf2a9bb771f45d9b0429cee7d325962233c44 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 23 Apr 2021 14:54:10 +1000 Subject: [PATCH 012/578] Add obsd68 test target. --- .github/workflows/selfhosted.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 4abdfa245..77cb295b5 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -27,6 +27,7 @@ jobs: - nbsd8 - obsd51 - obsd67 + - obsd68 - openindiana - sol10 - sol11 From a116b6f5be17a1dd345b7d54bf8aa3779a28a0df Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 23 Apr 2021 16:34:48 +1000 Subject: [PATCH 013/578] Add nbsd2 test target. --- .github/workflows/selfhosted.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 77cb295b5..3eae0fd8d 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -24,6 +24,7 @@ jobs: - fbsd7 - fbsd12 - fbsd13 + - nbsd2 - nbsd8 - obsd51 - obsd67 From 3737c9f66ee590255546c4b637b6d2be669a11eb Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Fri, 23 Apr 2021 19:49:46 +1000 Subject: [PATCH 014/578] Replace "==" (a bashism) with "=". --- .github/setup_ci.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 61fd9725d..468321288 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -62,7 +62,7 @@ for TARGET in $TARGETS; do esac done -if [ "yes" == "$INSTALL_FIDO_PPA" ]; then +if [ "yes" = "$INSTALL_FIDO_PPA" ]; then sudo apt update -qq sudo apt install software-properties-common sudo apt-add-repository ppa:yubico/stable From a6b4ec94e5bd5a8a18cd2c9942d829d2e5698837 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Sat, 24 Apr 2021 17:52:24 +1000 Subject: [PATCH 015/578] Add OPENBSD ORIGINAL marker. --- openbsd-compat/memmem.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openbsd-compat/memmem.c b/openbsd-compat/memmem.c index ad330d1a8..2637401d7 100644 --- a/openbsd-compat/memmem.c +++ b/openbsd-compat/memmem.c @@ -23,6 +23,8 @@ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ +/* OPENBSD ORIGINAL: lib/libc/string/memmem.c */ + #include "includes.h" #ifndef HAVE_MEMMEM From d1aed05bd2e4ae70f359a394dc60a2d96b88f78c Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Sat, 24 Apr 2021 22:03:46 +1000 Subject: [PATCH 016/578] Comment out nbsd2 test target for now. --- .github/workflows/selfhosted.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 3eae0fd8d..5d5abe7b3 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -24,7 +24,7 @@ jobs: - fbsd7 - fbsd12 - fbsd13 - - nbsd2 + # - nbsd2 - nbsd8 - obsd51 - obsd67 From 6a5d39305649da5dff1934ee54292ee0cebd579d Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Sun, 25 Apr 2021 13:01:34 +1000 Subject: [PATCH 017/578] Add nbsd3, nbsd4 and nbsd9 test targets. --- .github/workflows/selfhosted.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 5d5abe7b3..0b1dac172 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -25,7 +25,10 @@ jobs: - fbsd12 - fbsd13 # - nbsd2 + - nbsd3 + - nbsd4 - nbsd8 + - nbsd9 - obsd51 - obsd67 - obsd68 @@ -45,6 +48,7 @@ jobs: - { os: fbsd12, configs: pam } - { os: fbsd13, configs: pam } - { os: nbsd8, configs: pam } + - { os: nbsd9, configs: pam } - { os: openindiana, configs: pam } - { os: sol10, configs: pam } - { os: sol11, configs: pam-krb5 } From 2c805f16b24ea37cc051c6018fcb05defab6e57a Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Sun, 25 Apr 2021 14:15:02 +1000 Subject: [PATCH 018/578] Disable compiler hardening on nbsd4. The system compiler supports -fstack-protector-all, but using it will result in an internal compiler error on some files. --- .github/configs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/configs b/.github/configs index b24de4dd1..7a1572590 100755 --- a/.github/configs +++ b/.github/configs @@ -108,6 +108,10 @@ case "$config" in esac case "${TARGET_HOST}" in + nbsd4) + # System compiler will ICE on some files with fstack-protector + CONFIGFLAGS="${CONFIGFLAGS} --without-hardening" + ;; sol10|sol11) # sol10 VM is 32bit and the unit tests are slow. # sol11 has 4 test configs so skip unit tests to speed up. From b16082aa110fa7128ece2a9037ff420c4a285317 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Mon, 26 Apr 2021 13:35:44 +1000 Subject: [PATCH 019/578] Add fbsd10 test target. --- .github/workflows/selfhosted.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 0b1dac172..0c0e707a9 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -22,6 +22,7 @@ jobs: - dfly58 - fbsd6 - fbsd7 + - fbsd10 - fbsd12 - fbsd13 # - nbsd2 @@ -45,6 +46,7 @@ jobs: - { os: dfly58, configs: pam } - { os: fbsd6, configs: pam } - { os: fbsd7, configs: pam } + - { os: fbsd10, configs: pam } - { os: fbsd12, configs: pam } - { os: fbsd13, configs: pam } - { os: nbsd8, configs: pam } From 095b0307a77be8803768857cc6c0963fa52ed85b Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Mon, 26 Apr 2021 14:02:03 +1000 Subject: [PATCH 020/578] Support testing against arbitary libcrytpo vers. Add tests against various LibreSSL and OpenSSL versions. --- .github/configs | 8 ++++---- .github/setup_ci.sh | 26 ++++++++++++++++++-------- .github/workflows/c-cpp.yml | 14 ++++++++++++-- 3 files changed, 34 insertions(+), 14 deletions(-) diff --git a/.github/configs b/.github/configs index 7a1572590..df7ae28c4 100755 --- a/.github/configs +++ b/.github/configs @@ -44,11 +44,11 @@ case "$config" in CONFIGFLAGS="--with-pam" SSHD_CONFOPTS="UsePam yes" ;; - libressl-head) - LIBCRYPTOFLAGS="--with-ssl-dir=/opt/libressl/head --with-rpath=-Wl,-rpath," + libressl-*) + LIBCRYPTOFLAGS="--with-ssl-dir=/opt/libressl --with-rpath=-Wl,-rpath," ;; - openssl-head) - LIBCRYPTOFLAGS="--with-ssl-dir=/opt/openssl/head --with-rpath=-Wl,-rpath," + openssl-*) + LIBCRYPTOFLAGS="--with-ssl-dir=/opt/openssl --with-rpath=-Wl,-rpath," ;; selinux) CONFIGFLAGS="--with-selinux" diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 468321288..569502527 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -47,11 +47,19 @@ for TARGET in $TARGETS; do hardenedmalloc) INSTALL_HARDENED_MALLOC=yes ;; - openssl-head) - INSTALL_OPENSSL_HEAD=yes + openssl-*) + INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-) + case ${INSTALL_OPENSSL} in + 1.*) INSTALL_OPENSSL="OpenSSL_$(echo ${INSTALL_OPENSSL} | tr . _)" ;; + 3.*) INSTALL_OPENSSL="openssl-${INSTALL_OPENSSL}" ;; + esac ;; - libressl-head) - INSTALL_LIBRESSL_HEAD=yes + libressl-*) + INSTALL_LIBRESSL=$(echo ${TARGET} | cut -f2 -d-) + case ${INSTALL_LIBRESSL} in + master) ;; + *) INSTALL_LIBRESSL="v$(echo ${TARGET} | cut -f2 -d-)" ;; + esac ;; valgrind*) PACKAGES="$PACKAGES valgrind" @@ -80,7 +88,7 @@ if [ "${INSTALL_HARDENED_MALLOC}" = "yes" ]; then make -j2 && sudo cp libhardened_malloc.so /usr/lib/) fi -if [ "${INSTALL_OPENSSL_HEAD}" = "yes" ];then +if [ ! -z "${INSTALL_OPENSSL}" ]; then (cd ${HOME} && git clone https://github.com/openssl/openssl.git && cd ${HOME}/openssl && @@ -88,10 +96,12 @@ if [ "${INSTALL_OPENSSL_HEAD}" = "yes" ];then make -j2 && sudo make install_sw) fi -if [ "${INSTALL_LIBRESSL_HEAD}" = "yes" ];then +if [ ! -z "${INSTALL_LIBRESSL}" ]; then (mkdir -p ${HOME}/libressl && cd ${HOME}/libressl && git clone https://github.com/libressl-portable/portable.git && - cd ${HOME}/libressl/portable && sh update.sh && sh autogen.sh && + cd ${HOME}/libressl/portable && + git checkout ${INSTALL_LIBRESSL} && + sh update.sh && sh autogen.sh && ./configure --prefix=/opt/libressl/head && - make -j2 && sudo make install_sw) + make -j2 && sudo make install) fi diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index 2b6d98900..c0a0ac812 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -26,8 +26,18 @@ jobs: - { os: ubuntu-20.04, configs: pam } - { os: ubuntu-20.04, configs: kitchensink } - { os: ubuntu-20.04, configs: hardenedmalloc } - - { os: ubuntu-20.04, configs: libressl-head } - - { os: ubuntu-20.04, configs: openssl-head } + - { os: ubuntu-20.04, configs: libressl-master } + - { os: ubuntu-20.04, configs: libressl-2.2.9 } + - { os: ubuntu-20.04, configs: libressl-2.8.3 } + - { os: ubuntu-20.04, configs: libressl-3.0.2 } + - { os: ubuntu-20.04, configs: libressl-3.2.5 } + - { os: ubuntu-20.04, configs: openssl-master } + - { os: ubuntu-20.04, configs: openssl-1.0.1 } + - { os: ubuntu-20.04, configs: openssl-1.0.1u } + - { os: ubuntu-20.04, configs: openssl-1.0.2u } + - { os: ubuntu-20.04, configs: openssl-1.1.0g } + - { os: ubuntu-20.04, configs: openssl-1.1.1 } + - { os: ubuntu-20.04, configs: openssl-1.1.1k } - { os: ubuntu-18.04, configs: pam } - { os: ubuntu-18.04, configs: kerberos5 } - { os: ubuntu-18.04, configs: libedit } From a38016d369d21df5d35f761f2b67e175e132ba22 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Mon, 26 Apr 2021 14:29:03 +1000 Subject: [PATCH 021/578] Interop test agains PuTTY. --- .github/configs | 5 +++++ .github/setup_ci.sh | 2 ++ 2 files changed, 7 insertions(+) diff --git a/.github/configs b/.github/configs index df7ae28c4..44b607a37 100755 --- a/.github/configs +++ b/.github/configs @@ -135,4 +135,9 @@ fi CONFIGFLAGS="${CONFIGFLAGS} ${LIBCRYPTOFLAGS}" +if [ -x "$(which plink 2>/dev/null)" ]; then + REGRESS_INTEROP_PUTTY=yes + export REGRESS_INTEROP_PUTTY +fi + export LTESTS SUDO TEST_TARGET TEST_SSH_UNSAFE_PERMISSIONS diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 569502527..72b545ce5 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -53,6 +53,7 @@ for TARGET in $TARGETS; do 1.*) INSTALL_OPENSSL="OpenSSL_$(echo ${INSTALL_OPENSSL} | tr . _)" ;; 3.*) INSTALL_OPENSSL="openssl-${INSTALL_OPENSSL}" ;; esac + PACKAGES="${PACKAGES} putty-tools" ;; libressl-*) INSTALL_LIBRESSL=$(echo ${TARGET} | cut -f2 -d-) @@ -60,6 +61,7 @@ for TARGET in $TARGETS; do master) ;; *) INSTALL_LIBRESSL="v$(echo ${TARGET} | cut -f2 -d-)" ;; esac + PACKAGES="${PACKAGES} putty-tools" ;; valgrind*) PACKAGES="$PACKAGES valgrind" From 29e194a752359ebf85bf7fce100f23a0477fc4de Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Mon, 26 Apr 2021 14:49:59 +1000 Subject: [PATCH 022/578] Ensure we can still build with C89. --- .github/configs | 6 ++++++ .github/workflows/c-cpp.yml | 1 + 2 files changed, 7 insertions(+) diff --git a/.github/configs b/.github/configs index 44b607a37..f6d39ed62 100755 --- a/.github/configs +++ b/.github/configs @@ -22,6 +22,12 @@ LIBCRYPTOFLAGS="" case "$config" in default|sol64) ;; + c89) + CC="gcc" + CFLAGS="-Wall -std=c89 -pedantic -Werror=vla" + CONFIGFLAGS="--without-openssl --without-zlib" + TEST_TARGET=t-exec + ;; kitchensink) CONFIGFLAGS="--with-kerberos5 --with-libedit --with-pam" CONFIGFLAGS="${CONFIGFLAGS} --with-security-key-builtin --with-selinux" diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index c0a0ac812..0dab607ed 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -23,6 +23,7 @@ jobs: - { os: ubuntu-20.04, configs: valgrind-3 } - { os: ubuntu-20.04, configs: valgrind-4 } - { os: ubuntu-20.04, configs: valgrind-unit } + - { os: ubuntu-20.04, configs: c89 } - { os: ubuntu-20.04, configs: pam } - { os: ubuntu-20.04, configs: kitchensink } - { os: ubuntu-20.04, configs: hardenedmalloc } From da9d59f526fce58e11cba49cd8eb011dc0bf5677 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Mon, 26 Apr 2021 15:34:23 +1000 Subject: [PATCH 023/578] Add test against OpenSSL w/out ECC. --- .github/setup_ci.sh | 7 ++++++- .github/workflows/c-cpp.yml | 1 + 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 72b545ce5..4c7a90196 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -47,6 +47,10 @@ for TARGET in $TARGETS; do hardenedmalloc) INSTALL_HARDENED_MALLOC=yes ;; + openssl-noec) + INSTALL_OPENSSL=OpenSSL_1_1_1k + SSLCONFOPTS="no-ec" + ;; openssl-*) INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-) case ${INSTALL_OPENSSL} in @@ -94,7 +98,8 @@ if [ ! -z "${INSTALL_OPENSSL}" ]; then (cd ${HOME} && git clone https://github.com/openssl/openssl.git && cd ${HOME}/openssl && - ./config no-threads no-engine no-fips no-shared --prefix=/opt/openssl/head && + ./config no-threads no-engine no-fips no-shared ${SSLCONFOPTS} \ + --prefix=/opt/openssl/head && make -j2 && sudo make install_sw) fi diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index 0dab607ed..81a6f0e05 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -33,6 +33,7 @@ jobs: - { os: ubuntu-20.04, configs: libressl-3.0.2 } - { os: ubuntu-20.04, configs: libressl-3.2.5 } - { os: ubuntu-20.04, configs: openssl-master } + - { os: ubuntu-20.04, configs: openssl-noec } - { os: ubuntu-20.04, configs: openssl-1.0.1 } - { os: ubuntu-20.04, configs: openssl-1.0.1u } - { os: ubuntu-20.04, configs: openssl-1.0.2u } From 33f62dfbe865f4de77980ab88774bf1eb5e4e040 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Mon, 26 Apr 2021 17:13:44 +1000 Subject: [PATCH 024/578] Add c89 here too. --- .github/setup_ci.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 4c7a90196..1b0c8870e 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -24,7 +24,7 @@ fi for TARGET in $TARGETS; do case $TARGET in - default|without-openssl|without-zlib) + default|without-openssl|without-zlib|c89) # nothing to do ;; kerberos5) From 77532609874a99a19e3e2eb2d1b7fa93aef963bb Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Mon, 26 Apr 2021 17:18:25 +1000 Subject: [PATCH 025/578] Export CC and CFLAGS for c89 test. --- .github/configs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/configs b/.github/configs index f6d39ed62..6f612dd0a 100755 --- a/.github/configs +++ b/.github/configs @@ -146,4 +146,4 @@ if [ -x "$(which plink 2>/dev/null)" ]; then export REGRESS_INTEROP_PUTTY fi -export LTESTS SUDO TEST_TARGET TEST_SSH_UNSAFE_PERMISSIONS +export CC CFLAGS LTESTS SUDO TEST_TARGET TEST_SSH_UNSAFE_PERMISSIONS From b3cc9fbdff2782eca79e33e02ac22450dc63bce9 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Tue, 27 Apr 2021 09:18:02 +1000 Subject: [PATCH 026/578] Fix custom OpenSSL tests. Check out specified OpenSSL version. Install custom libcrypto where configure expects to find it. Remove unneeded OpenSSL config time options. Older OpenSSL versions were not make -j safe so remove it. --- .github/setup_ci.sh | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 1b0c8870e..1918a4236 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -98,9 +98,10 @@ if [ ! -z "${INSTALL_OPENSSL}" ]; then (cd ${HOME} && git clone https://github.com/openssl/openssl.git && cd ${HOME}/openssl && - ./config no-threads no-engine no-fips no-shared ${SSLCONFOPTS} \ - --prefix=/opt/openssl/head && - make -j2 && sudo make install_sw) + git checkout ${INSTALL_OPENSSL} && + ./config no-threads ${SSLCONFOPTS} \ + --prefix=/opt/openssl && + make && sudo make install_sw) fi if [ ! -z "${INSTALL_LIBRESSL}" ]; then @@ -109,6 +110,6 @@ if [ ! -z "${INSTALL_LIBRESSL}" ]; then cd ${HOME}/libressl/portable && git checkout ${INSTALL_LIBRESSL} && sh update.sh && sh autogen.sh && - ./configure --prefix=/opt/libressl/head && + ./configure --prefix=/opt/libressl && make -j2 && sudo make install) fi From 9f79e80dc40965c2e73164531250b83b176c1eea Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Tue, 27 Apr 2021 12:24:10 +1000 Subject: [PATCH 027/578] Always build OpenSSL shared. This is the default for current versions but we need it to test against earlier versions. --- .github/setup_ci.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index 1918a4236..70a444e4e 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -99,7 +99,7 @@ if [ ! -z "${INSTALL_OPENSSL}" ]; then git clone https://github.com/openssl/openssl.git && cd ${HOME}/openssl && git checkout ${INSTALL_OPENSSL} && - ./config no-threads ${SSLCONFOPTS} \ + ./config no-threads shared ${SSLCONFOPTS} \ --prefix=/opt/openssl && make && sudo make install_sw) fi From 9bc20efd39ce8525be33df3ee009f5a4564224f1 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Tue, 27 Apr 2021 12:37:59 +1000 Subject: [PATCH 028/578] Use the default VM type for libcrypto ver tests. --- .github/workflows/c-cpp.yml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index 81a6f0e05..29c3cd630 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -27,19 +27,19 @@ jobs: - { os: ubuntu-20.04, configs: pam } - { os: ubuntu-20.04, configs: kitchensink } - { os: ubuntu-20.04, configs: hardenedmalloc } - - { os: ubuntu-20.04, configs: libressl-master } - - { os: ubuntu-20.04, configs: libressl-2.2.9 } - - { os: ubuntu-20.04, configs: libressl-2.8.3 } - - { os: ubuntu-20.04, configs: libressl-3.0.2 } - - { os: ubuntu-20.04, configs: libressl-3.2.5 } - - { os: ubuntu-20.04, configs: openssl-master } - - { os: ubuntu-20.04, configs: openssl-noec } - - { os: ubuntu-20.04, configs: openssl-1.0.1 } - - { os: ubuntu-20.04, configs: openssl-1.0.1u } - - { os: ubuntu-20.04, configs: openssl-1.0.2u } - - { os: ubuntu-20.04, configs: openssl-1.1.0g } - - { os: ubuntu-20.04, configs: openssl-1.1.1 } - - { os: ubuntu-20.04, configs: openssl-1.1.1k } + - { os: ubuntu-latest, configs: libressl-master } + - { os: ubuntu-latest, configs: libressl-2.2.9 } + - { os: ubuntu-latest, configs: libressl-2.8.3 } + - { os: ubuntu-latest, configs: libressl-3.0.2 } + - { os: ubuntu-latest, configs: libressl-3.2.5 } + - { os: ubuntu-latest, configs: openssl-master } + - { os: ubuntu-latest, configs: openssl-noec } + - { os: ubuntu-latest, configs: openssl-1.0.1 } + - { os: ubuntu-latest, configs: openssl-1.0.1u } + - { os: ubuntu-latest, configs: openssl-1.0.2u } + - { os: ubuntu-latest, configs: openssl-1.1.0g } + - { os: ubuntu-latest, configs: openssl-1.1.1 } + - { os: ubuntu-latest, configs: openssl-1.1.1k } - { os: ubuntu-18.04, configs: pam } - { os: ubuntu-18.04, configs: kerberos5 } - { os: ubuntu-18.04, configs: libedit } From 1b8108ebd12fc4ed0fb39ef94c5ba122558ac373 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Tue, 27 Apr 2021 14:22:20 +1000 Subject: [PATCH 029/578] Test against OpenSSL 1.1.0h instead of 1.1.0g. 1.1.0g requires a perl glob module that's not installed by default. --- .github/workflows/c-cpp.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index 29c3cd630..a8234ab8a 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -37,7 +37,7 @@ jobs: - { os: ubuntu-latest, configs: openssl-1.0.1 } - { os: ubuntu-latest, configs: openssl-1.0.1u } - { os: ubuntu-latest, configs: openssl-1.0.2u } - - { os: ubuntu-latest, configs: openssl-1.1.0g } + - { os: ubuntu-latest, configs: openssl-1.1.0h } - { os: ubuntu-latest, configs: openssl-1.1.1 } - { os: ubuntu-latest, configs: openssl-1.1.1k } - { os: ubuntu-18.04, configs: pam } From e627067ec8ef9ae8e7a638f4dbac91d52dee3e6d Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Wed, 28 Apr 2021 11:35:28 +1000 Subject: [PATCH 030/578] Add test building upstream OpenBSD source. --- .github/workflows/upstream.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/upstream.yml diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml new file mode 100644 index 000000000..9c8efb192 --- /dev/null +++ b/.github/workflows/upstream.yml @@ -0,0 +1,34 @@ +name: Upstream self-hosted + +on: + push: + branches: [ master, ci ] + +jobs: + selfhosted: + if: github.repository == 'openssh/openssh-portable-selfhosted' + runs-on: ${{ matrix.os }} + env: + TARGET_HOST: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [ obsdsnap ] + configs: [ default ] + steps: + - uses: actions/checkout@v2 + - name: shutdown VM if running + run: vmshutdown + - name: startup VM + run: vmstartup + - name: update source + run: vmrun "cd /usr/src && cvs up -dPA usr.bin/ssh regress/usr.bin/ssh" + - name: make + run: vmrun "cd /usr/src/usr.bin/ssh && make obj && make clean && make" + - name: make install + run: vmrun "cd /usr/src/usr.bin/ssh && sudo make install" + - name: make tests + run: vmrun "cd /usr/src/regress/usr.bin/ssh && make obj && make clean && SUDO=sudo make" + - name: shutdown VM + if: always() + run: vmshutdown From 40b59024cc3365815381474cdf4fe423102e391b Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Wed, 28 Apr 2021 12:22:11 +1000 Subject: [PATCH 031/578] Add obsdsnap (OpenBSD snapshot) test target. --- .github/workflows/selfhosted.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index 0c0e707a9..a8f65678e 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -33,6 +33,7 @@ jobs: - obsd51 - obsd67 - obsd68 + - obsdsnap - openindiana - sol10 - sol11 From 70a8dc138a6480f85065cdb239915ad4b7f928cf Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Wed, 28 Apr 2021 14:44:07 +1000 Subject: [PATCH 032/578] Add status badges for Actions-based tests. --- .github/README.md | 4 ++++ README.md | 1 + 2 files changed, 5 insertions(+) create mode 100644 .github/README.md diff --git a/.github/README.md b/.github/README.md new file mode 100644 index 000000000..0ad8bf5aa --- /dev/null +++ b/.github/README.md @@ -0,0 +1,4 @@ +[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml) +[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml) +[![Upstream self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml) +[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh) diff --git a/README.md b/README.md index e9ee372ca..de4717737 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,6 @@ # Portable OpenSSH +[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh) OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution and file transfer. It includes a client ``ssh`` and server ``sshd``, file transfer utilities ``scp`` and ``sftp`` as well as tools for key generation (``ssh-keygen``), run-time key storage (``ssh-agent``) and a number of supporting programs. From ae5f9b0d5c8126214244ee6b35aae29c21028133 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Thu, 29 Apr 2021 13:01:50 +1000 Subject: [PATCH 033/578] Wrap sntrup761x25519 inside ifdef. From balu.gajjala at gmail.com via bz#3306. --- regress/unittests/kex/test_kex.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c index 06bd001ae..3bd71a9f4 100644 --- a/regress/unittests/kex/test_kex.c +++ b/regress/unittests/kex/test_kex.c @@ -202,6 +202,8 @@ kex_tests(void) do_kex("diffie-hellman-group-exchange-sha1"); do_kex("diffie-hellman-group14-sha1"); do_kex("diffie-hellman-group1-sha1"); +# ifdef USE_SNTRUP761X25519 do_kex("sntrup761x25519-sha512@openssh.com"); +# endif /* USE_SNTRUP761X25519 */ #endif /* WITH_OPENSSL */ } From e65cf00da6bc31e5f54603b7feb7252dc018c033 Mon Sep 17 00:00:00 2001 From: "dtucker@openbsd.org" Date: Fri, 30 Apr 2021 04:02:52 +0000 Subject: [PATCH 034/578] upstream: Remove now-unused skey function prototypes leftover from skey removal. OpenBSD-Commit-ID: 2fc36d519fd37c6f10ce74854c628561555a94c3 --- monitor.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/monitor.c b/monitor.c index 1a00d4591..9d23d8234 100644 --- a/monitor.c +++ b/monitor.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor.c,v 1.225 2021/04/15 16:24:31 markus Exp $ */ +/* $OpenBSD: monitor.c,v 1.226 2021/04/30 04:02:52 dtucker Exp $ */ /* * Copyright 2002 Niels Provos * Copyright 2002 Markus Friedl @@ -120,8 +120,6 @@ int mm_answer_authserv(struct ssh *, int, struct sshbuf *); int mm_answer_authpassword(struct ssh *, int, struct sshbuf *); int mm_answer_bsdauthquery(struct ssh *, int, struct sshbuf *); int mm_answer_bsdauthrespond(struct ssh *, int, struct sshbuf *); -int mm_answer_skeyquery(struct ssh *, int, struct sshbuf *); -int mm_answer_skeyrespond(struct ssh *, int, struct sshbuf *); int mm_answer_keyallowed(struct ssh *, int, struct sshbuf *); int mm_answer_keyverify(struct ssh *, int, struct sshbuf *); int mm_answer_pty(struct ssh *, int, struct sshbuf *); From f06893063597c5bb9d9e93f851c4070e77d2fba9 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 30 Apr 2021 04:29:53 +0000 Subject: [PATCH 035/578] upstream: a little debugging in the main mux process for status confirmation failures in multiplexed sessions OpenBSD-Commit-ID: 6e27b87c95176107597035424e1439c3232bcb49 --- clientloop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/clientloop.c b/clientloop.c index cb3ff8645..7c91104f1 100644 --- a/clientloop.c +++ b/clientloop.c @@ -1,4 +1,4 @@ -/* $OpenBSD: clientloop.c,v 1.359 2021/03/19 02:22:34 djm Exp $ */ +/* $OpenBSD: clientloop.c,v 1.360 2021/04/30 04:29:53 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -696,6 +696,8 @@ client_status_confirm(struct ssh *ssh, int type, Channel *c, void *ctx) * their stderr. */ if (tochan) { + debug3_f("channel %d: mux request: %s", c->self, + cr->request_type); if ((r = sshbuf_put(c->extended, errmsg, strlen(errmsg))) != 0) fatal_fr(r, "sshbuf_put"); From 8e32e97e788e0676ce83018a742203614df6a2b3 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Sat, 1 May 2021 20:07:47 +1000 Subject: [PATCH 036/578] Add obsd69 test target. --- .github/workflows/selfhosted.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml index a8f65678e..5a597ac6a 100644 --- a/.github/workflows/selfhosted.yml +++ b/.github/workflows/selfhosted.yml @@ -33,6 +33,7 @@ jobs: - obsd51 - obsd67 - obsd68 + - obsd69 - obsdsnap - openindiana - sol10 From ac31aa3c6341905935e75f0539cf4a61bbe99779 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Mon, 3 May 2021 00:16:45 +0000 Subject: [PATCH 037/578] upstream: more debugging for UpdateHostKeys signature failures OpenBSD-Commit-ID: 1ee95f03875e1725df15d5e4bea3e73493d57d36 --- clientloop.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/clientloop.c b/clientloop.c index 7c91104f1..cbfe098b7 100644 --- a/clientloop.c +++ b/clientloop.c @@ -1,4 +1,4 @@ -/* $OpenBSD: clientloop.c,v 1.360 2021/04/30 04:29:53 djm Exp $ */ +/* $OpenBSD: clientloop.c,v 1.361 2021/05/03 00:16:45 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -2154,11 +2154,14 @@ client_global_hostkeys_private_confirm(struct ssh *ssh, int type, */ use_kexsigtype = kexsigtype == KEY_RSA && sshkey_type_plain(ctx->keys[i]->type) == KEY_RSA; + debug3_f("verify %s key %zu using %s sigalg", + sshkey_type(ctx->keys[i]), i, + use_kexsigtype ? ssh->kex->hostkey_alg : NULL); if ((r = sshkey_verify(ctx->keys[i], sig, siglen, sshbuf_ptr(signdata), sshbuf_len(signdata), use_kexsigtype ? ssh->kex->hostkey_alg : NULL, 0, NULL)) != 0) { - error_f("server gave bad signature for %s key %zu", + error_fr(r, "server gave bad signature for %s key %zu", sshkey_type(ctx->keys[i]), i); goto out; } From f43859159cc62396ad5d080f0b1f2635a67dac02 Mon Sep 17 00:00:00 2001 From: "dtucker@openbsd.org" Date: Tue, 4 May 2021 22:53:52 +0000 Subject: [PATCH 038/578] upstream: Don't pass NULL as a string in debugging as it does not work on some platforms in -portable. ok djm@ OpenBSD-Commit-ID: 937c892c99aa3c9c272a8ed78fa7c2aba3a44fc9 --- clientloop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/clientloop.c b/clientloop.c index cbfe098b7..219f0e904 100644 --- a/clientloop.c +++ b/clientloop.c @@ -1,4 +1,4 @@ -/* $OpenBSD: clientloop.c,v 1.361 2021/05/03 00:16:45 djm Exp $ */ +/* $OpenBSD: clientloop.c,v 1.362 2021/05/04 22:53:52 dtucker Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -2156,7 +2156,7 @@ client_global_hostkeys_private_confirm(struct ssh *ssh, int type, sshkey_type_plain(ctx->keys[i]->type) == KEY_RSA; debug3_f("verify %s key %zu using %s sigalg", sshkey_type(ctx->keys[i]), i, - use_kexsigtype ? ssh->kex->hostkey_alg : NULL); + use_kexsigtype ? ssh->kex->hostkey_alg : "default"); if ((r = sshkey_verify(ctx->keys[i], sig, siglen, sshbuf_ptr(signdata), sshbuf_len(signdata), use_kexsigtype ? ssh->kex->hostkey_alg : NULL, 0, From 24fee8973abdf1c521cd2c0047d89e86d9c3fc38 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 7 May 2021 02:29:40 +0000 Subject: [PATCH 039/578] upstream: correct mistake in spec - the private key blobs are encoded verbatim and not as strings (i.e. no 4-byte length header) OpenBSD-Commit-ID: 3606b5d443d72118c5b76c4af6dd87a5d5a4f837 --- PROTOCOL.key | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/PROTOCOL.key b/PROTOCOL.key index 959bd7aee..38df268b6 100644 --- a/PROTOCOL.key +++ b/PROTOCOL.key @@ -35,9 +35,9 @@ of the cipher block size. uint32 checkint uint32 checkint - string privatekey1 + byte[] privatekey1 string comment1 - string privatekey2 + byte[] privatekey2 string comment2 ... string privatekeyN @@ -48,6 +48,9 @@ of the cipher block size. ... char padlen % 255 +where each private key is encoded using the same rules as used for +SSH agent. + Before the key is encrypted, a random integer is assigned to both checkint fields so successful decryption can be quickly checked by verifying that both checkint fields @@ -65,4 +68,4 @@ For unencrypted keys the cipher "none" and the KDF "none" are used with empty passphrases. The options if the KDF "none" are the empty string. -$OpenBSD: PROTOCOL.key,v 1.1 2013/12/06 13:34:54 markus Exp $ +$OpenBSD: PROTOCOL.key,v 1.2 2021/05/07 02:29:40 djm Exp $ From c0d7e36e979fa3cdb60f5dcb6ac9ad3fd018543b Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 7 May 2021 02:26:55 +0000 Subject: [PATCH 040/578] upstream: dump out a usable private key string too; inspired by Tyson Whitehead OpenBSD-Regress-ID: 65572d5333801cb2f650ebc778cbdc955e372058 --- regress/unittests/sshsig/webauthn.html | 80 +++++++++++++++++++++++++- 1 file changed, 77 insertions(+), 3 deletions(-) diff --git a/regress/unittests/sshsig/webauthn.html b/regress/unittests/sshsig/webauthn.html index 953041e61..1869c8b37 100644 --- a/regress/unittests/sshsig/webauthn.html +++ b/regress/unittests/sshsig/webauthn.html @@ -37,6 +37,8 @@ Lots of debugging is printed along the way. 

 
attestationObject

 

+
key handle

+

 
authData raw

 

 
authData

@@ -45,6 +47,8 @@ Lots of debugging is printed along the way.
 

 
SSH pubkey string

 

+
SSH private key string

+