tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstrem-bsd/master' into sync-with-upstream-2

This commit is contained in:
tgauth@bu.edu 2024-01-22 11:09:08 -05:00
parent 9142077e39 0d96b1506b
commit 83b59226a4
24 changed files with 316 additions and 83 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
channels.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: channels.c,v 1.435 2023/12/18 14:47:20 djm Exp $ */
/* $OpenBSD: channels.c,v 1.436 2024/01/09 22:19:00 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -214,6 +214,9 @@ struct ssh_channels {
/* Channel timeouts by type */
struct ssh_channel_timeout *timeouts;
size_t ntimeouts;
/* Global timeout for all OPEN channels */
int global_deadline;
time_t lastused;
};
/* helper */
@ -316,6 +319,11 @@ channel_add_timeout(struct ssh *ssh, const char *type_pattern,
{
struct ssh_channels *sc = ssh->chanctxt;
if (strcmp(type_pattern, "global") == 0) {
debug2_f("global channel timeout %d seconds", timeout_secs);
sc->global_deadline = timeout_secs;
return;
}
debug2_f("channel type \"%s\" timeout %d seconds",
type_pattern, timeout_secs);
sc->timeouts = xrecallocarray(sc->timeouts, sc->ntimeouts,
@ -376,6 +384,38 @@ channel_set_xtype(struct ssh *ssh, int id, const char *xctype)
c->inactive_deadline);
}
/*
* update "last used" time on a channel.
* NB. nothing else should update lastused except to clear it.
*/
static void
channel_set_used_time(struct ssh *ssh, Channel *c)
{
ssh->chanctxt->lastused = monotime();
if (c != NULL)
c->lastused = ssh->chanctxt->lastused;
}
/*
* Get the time at which a channel is due to time out for inactivity.
* Returns 0 if the channel is not due to time out ever.
*/
static time_t
channel_get_expiry(struct ssh *ssh, Channel *c)
{
struct ssh_channels *sc = ssh->chanctxt;
time_t expiry = 0, channel_expiry;
if (sc->lastused != 0 && sc->global_deadline != 0)
expiry = sc->lastused + sc->global_deadline;
if (c->lastused != 0 && c->inactive_deadline != 0) {
channel_expiry = c->lastused + c->inactive_deadline;
if (expiry == 0 || channel_expiry < expiry)
expiry = channel_expiry;
}
return expiry;
}
/*
* Register filedescriptors for a channel, used when allocating a channel or
* when the channel consumer/producer is ready, e.g. shell exec'd
@ -441,6 +481,8 @@ channel_register_fds(struct ssh *ssh, Channel *c, int rfd, int wfd, int efd,
if (efd != -1)
set_nonblock(efd);
}
/* channel might be entering a larval state, so reset global timeout */
channel_set_used_time(ssh, NULL);
}
/*
@ -1197,7 +1239,7 @@ channel_set_fds(struct ssh *ssh, int id, int rfd, int wfd, int efd,
channel_register_fds(ssh, c, rfd, wfd, efd, extusage, nonblock, is_tty);
c->type = SSH_CHANNEL_OPEN;
c->lastused = monotime();
channel_set_used_time(ssh, c);
c->local_window = c->local_window_max = window_max;
if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST)) != 0 ||
@ -1369,7 +1411,7 @@ channel_pre_x11_open(struct ssh *ssh, Channel *c)
if (ret == 1) {
c->type = SSH_CHANNEL_OPEN;
c->lastused = monotime();
channel_set_used_time(ssh, c);
channel_pre_open(ssh, c);
} else if (ret == -1) {
logit("X11 connection rejected because of wrong "
@ -2025,7 +2067,7 @@ channel_post_connecting(struct ssh *ssh, Channel *c)
c->self, c->connect_ctx.host, c->connect_ctx.port);
channel_connect_ctx_free(&c->connect_ctx);
c->type = SSH_CHANNEL_OPEN;
c->lastused = monotime();
channel_set_used_time(ssh, c);
if (isopen) {
/* no message necessary */
} else {
@ -2117,7 +2159,7 @@ channel_handle_rfd(struct ssh *ssh, Channel *c)
goto rfail;
}
if (nr != 0)
c->lastused = monotime();
channel_set_used_time(ssh, c);
return 1;
}
@ -2143,7 +2185,7 @@ channel_handle_rfd(struct ssh *ssh, Channel *c)
}
return -1;
}
c->lastused = monotime();
channel_set_used_time(ssh, c);
if (c->input_filter != NULL) {
if (c->input_filter(ssh, c, buf, len) == -1) {
debug2("channel %d: filter stops", c->self);
@ -2224,7 +2266,7 @@ channel_handle_wfd(struct ssh *ssh, Channel *c)
}
return -1;
}
c->lastused = monotime();
channel_set_used_time(ssh, c);
#ifndef BROKEN_TCGETATTR_ICANON
if (c->isatty && dlen >= 1 && buf[0] != '\r') {
if (tcgetattr(c->wfd, &tio) == 0 &&
@ -2273,7 +2315,7 @@ channel_handle_efd_write(struct ssh *ssh, Channel *c)
if ((r = sshbuf_consume(c->extended, len)) != 0)
fatal_fr(r, "channel %i: consume", c->self);
c->local_consumed += len;
c->lastused = monotime();
channel_set_used_time(ssh, c);
}
return 1;
}
@ -2300,7 +2342,7 @@ channel_handle_efd_read(struct ssh *ssh, Channel *c)
channel_close_fd(ssh, c, &c->efd);
return 1;
}
c->lastused = monotime();
channel_set_used_time(ssh, c);
if (c->extended_usage == CHAN_EXTENDED_IGNORE)
debug3("channel %d: discard efd", c->self);
else if ((r = sshbuf_put(c->extended, buf, len)) != 0)
@ -2590,10 +2632,9 @@ channel_handler(struct ssh *ssh, int table, struct timespec *timeout)
continue;
}
if (ftab[c->type] != NULL) {
if (table == CHAN_PRE &&
c->type == SSH_CHANNEL_OPEN &&
c->inactive_deadline != 0 && c->lastused != 0 &&
now >= c->lastused + c->inactive_deadline) {
if (table == CHAN_PRE && c->type == SSH_CHANNEL_OPEN &&
channel_get_expiry(ssh, c) != 0 &&
now >= channel_get_expiry(ssh, c)) {
/* channel closed for inactivity */
verbose("channel %d: closing after %u seconds "
"of inactivity", c->self,
@ -2605,10 +2646,9 @@ channel_handler(struct ssh *ssh, int table, struct timespec *timeout)
/* inactivity timeouts must interrupt poll() */
if (timeout != NULL &&
c->type == SSH_CHANNEL_OPEN &&
c->lastused != 0 &&
c->inactive_deadline != 0) {
channel_get_expiry(ssh, c) != 0) {
ptimeout_deadline_monotime(timeout,
c->lastused + c->inactive_deadline);
channel_get_expiry(ssh, c));
}
} else if (timeout != NULL) {
/*
@ -3567,7 +3607,7 @@ channel_input_open_confirmation(int type, u_int32_t seq, struct ssh *ssh)
c->open_confirm(ssh, c->self, 1, c->open_confirm_ctx);
debug2_f("channel %d: callback done", c->self);
}
c->lastused = monotime();
channel_set_used_time(ssh, c);
debug2("channel %d: open confirm rwindow %u rmax %u", c->self,
c->remote_window, c->remote_maxpacket);
return 0;

12
configure.ac
View File

@ -2067,6 +2067,18 @@ AC_ARG_WITH([security-key-builtin],
[ enable_sk_internal=$withval ]
)
disable_ecdsa=
AC_ARG_ENABLE([dsa-keys],
[ --disable-dsa-keys disable DSA key support [no]],
[
if test "x$enableval" = "xno" ; then
disable_ecdsa=1
fi
]
)
test -z "$disable_ecdsa" &&
AC_DEFINE([WITH_DSA], [1], [Define if to enable DSA keys.])
AC_SEARCH_LIBS([dlopen], [dl])
AC_CHECK_FUNCS([dlopen])
AC_CHECK_DECL([RTLD_NOW], [], [], [#include <dlfcn.h>])

4
readconf.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: readconf.c,v 1.383 2023/10/12 02:18:18 djm Exp $ */
/* $OpenBSD: readconf.c,v 1.384 2024/01/11 01:45:36 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -2733,7 +2733,9 @@ fill_default_options(Options * options)
add_identity_file(options, "~/",
_PATH_SSH_CLIENT_ID_ED25519_SK, 0);
add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_XMSS, 0);
#ifdef WITH_DSA
add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_DSA, 0);
#endif
}
if (options->escape_char == -1)
options->escape_char = '~';

4
readconf.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: readconf.h,v 1.154 2023/10/12 02:18:18 djm Exp $ */
/* $OpenBSD: readconf.h,v 1.155 2024/01/11 01:45:36 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@ -87,7 +87,7 @@ typedef struct {
char *sk_provider; /* Security key provider */
int verify_host_key_dns; /* Verify host key using DNS */
int num_identity_files; /* Number of files for RSA/DSA identities. */
int num_identity_files; /* Number of files for identities. */
char *identity_files[SSH_MAX_IDENTITY_FILES];
int identity_file_userprovided[SSH_MAX_IDENTITY_FILES];
struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES];

22
regress/Makefile
View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile,v 1.131 2023/12/18 14:50:08 djm Exp $
# $OpenBSD: Makefile,v 1.133 2024/01/11 04:50:28 djm Exp $
tests: prep file-tests t-exec unit
@ -180,10 +180,12 @@ t5:
awk '{print $$2}' | diff - ${.CURDIR}/t5.ok
t6:
${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.prv > $(OBJ)/t6.out1
${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.pub > $(OBJ)/t6.out2
chmod 600 $(OBJ)/t6.out1
${TEST_SSH_SSHKEYGEN} -yf $(OBJ)/t6.out1 | diff - $(OBJ)/t6.out2
set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q ^ssh-dss ; then \
${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.prv > $(OBJ)/t6.out1 ; \
${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.pub > $(OBJ)/t6.out2 ; \
chmod 600 $(OBJ)/t6.out1 ; \
${TEST_SSH_SSHKEYGEN} -yf $(OBJ)/t6.out1 | diff - $(OBJ)/t6.out2 ; \
fi
$(OBJ)/t7.out:
${TEST_SSH_SSHKEYGEN} -q -t rsa -N '' -f $@
@ -193,11 +195,15 @@ t7: $(OBJ)/t7.out
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t7.out > /dev/null
$(OBJ)/t8.out:
${TEST_SSH_SSHKEYGEN} -q -t dsa -N '' -f $@
set -xe ; if ssh -Q key | grep -q ^ssh-dss ; then \
${TEST_SSH_SSHKEYGEN} -q -t dsa -N '' -f $@ ; \
fi
t8: $(OBJ)/t8.out
${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t8.out > /dev/null
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t8.out > /dev/null
set -xe ; if ssh -Q key | grep -q ^ssh-dss ; then \
${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t8.out > /dev/null ; \
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t8.out > /dev/null ; \
fi
$(OBJ)/t9.out:
! ${TEST_SSH_SSH} -Q key-plain | grep ecdsa >/dev/null || \

74
regress/channel-timeout.sh
View File

@ -1,10 +1,33 @@
# $OpenBSD: channel-timeout.sh,v 1.1 2023/01/06 08:07:39 djm Exp $
# $OpenBSD: channel-timeout.sh,v 1.2 2024/01/09 22:19:36 djm Exp $
# Placed in the Public Domain.
tid="channel timeout"
# XXX not comprehensive. Still need -R -L agent X11 forwarding + interactive
rm -f $OBJ/finished.* $OBJ/mux.*
MUXPATH=$OBJ/mux.$$
open_mux() {
${SSH} -nNfM -oControlPath=$MUXPATH -F $OBJ/ssh_proxy "$@" somehost ||
fatal "open mux failed"
test -e $MUXPATH || fatal "mux socket $MUXPATH not established"
}
close_mux() {
test -e $MUXPATH || fatal "mux socket $MUXPATH missing"
${SSH} -qF $OBJ/ssh_proxy -oControlPath=$MUXPATH -O exit somehost ||
fatal "could not terminate mux process"
for x in 1 2 3 4 5 6 7 8 9 10 ; do
test -e $OBJ/mux && break
sleep 1
done
test -e $MUXPATH && fatal "mux did not clean up"
}
mux_client() {
${SSH} -F $OBJ/ssh_proxy -oControlPath=$MUXPATH somehost "$@"
}
rm -f $OBJ/sshd_proxy.orig
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
@ -26,6 +49,15 @@ if [ $r -ne 127 ]; then
fail "ssh returned unexpected error code $r"
fi
verbose "command long timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:command=60") \
> $OBJ/sshd_proxy
${SSH} -F $OBJ/ssh_proxy somehost "exit 23"
r=$?
if [ $r -ne 23 ]; then
fail "ssh returned unexpected error code $r"
fi
verbose "command wildcard timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:*=1") \
> $OBJ/sshd_proxy
@ -45,6 +77,45 @@ if [ $r -ne 23 ]; then
fail "ssh failed"
fi
if config_defined DISABLE_FD_PASSING ; then
verbose "skipping multiplexing tests"
else
verbose "multiplexed command timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:command=1") \
> $OBJ/sshd_proxy
open_mux
mux_client "sleep 5 ; exit 23"
r=$?
if [ $r -ne 255 ]; then
fail "ssh returned unexpected error code $r"
fi
close_mux
verbose "irrelevant multiplexed command timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:shell=1") \
> $OBJ/sshd_proxy
open_mux
mux_client "sleep 5 ; exit 23"
r=$?
if [ $r -ne 23 ]; then
fail "ssh returned unexpected error code $r"
fi
close_mux
verbose "global command timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout global=10") \
> $OBJ/sshd_proxy
open_mux
mux_client "sleep 1 ; echo ok ; sleep 1; echo ok; sleep 60; touch $OBJ/finished.1" >/dev/null &
mux_client "sleep 60 ; touch $OBJ/finished.2" >/dev/null &
mux_client "sleep 2 ; touch $OBJ/finished.3" >/dev/null &
wait
test -f $OBJ/finished.1 && fail "first mux process completed"
test -f $OBJ/finished.2 && fail "second mux process completed"
test -f $OBJ/finished.3 || fail "third mux process did not complete"
close_mux
fi
# Set up a "slow sftp server" that sleeps before executing the real one.
cat > $OBJ/slow-sftp-server.sh << _EOF
#!/bin/sh
@ -91,4 +162,3 @@ if [ $r -ne 0 ]; then
fail "sftp failed"
fi
cmp $DATA $COPY || fail "corrupted copy"

7
regress/unittests/Makefile.inc
View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile.inc,v 1.15 2023/09/24 08:14:13 claudio Exp $
# $OpenBSD: Makefile.inc,v 1.16 2024/01/11 01:45:58 djm Exp $
.include <bsd.own.mk>
.include <bsd.obj.mk>
@ -13,6 +13,11 @@ TEST_ENV?= MALLOC_OPTIONS=${MALLOC_OPTIONS}
# XXX detect from ssh binary?
OPENSSL?= yes
DSAKEY?= yes
.if (${DSAKEY:L} == "yes")
CFLAGS+= -DWITH_DSA
.endif
.if (${OPENSSL:L} == "yes")
CFLAGS+= -DWITH_OPENSSL

11
regress/unittests/hostkeys/test_iterate.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_iterate.c,v 1.8 2021/12/14 21:25:27 deraadt Exp $ */
/* $OpenBSD: test_iterate.c,v 1.9 2024/01/11 01:45:58 djm Exp $ */
/*
* Regress test for hostfile.h hostkeys_foreach()
*
@ -94,6 +94,11 @@ check(struct hostkey_foreach_line *l, void *_ctx)
expected->no_parse_keytype == KEY_ECDSA)
skip = 1;
#endif /* OPENSSL_HAS_ECC */
#ifndef WITH_DSA
if (expected->l.keytype == KEY_DSA ||
expected->no_parse_keytype == KEY_DSA)
skip = 1;
#endif
#ifndef WITH_OPENSSL
if (expected->l.keytype == KEY_DSA ||
expected->no_parse_keytype == KEY_DSA ||
@ -155,6 +160,10 @@ prepare_expected(struct expected *expected, size_t n)
if (expected[i].l.keytype == KEY_ECDSA)
continue;
#endif /* OPENSSL_HAS_ECC */
#ifndef WITH_DSA
if (expected[i].l.keytype == KEY_DSA)
continue;
#endif
#ifndef WITH_OPENSSL
switch (expected[i].l.keytype) {
case KEY_RSA:

4
regress/unittests/kex/test_kex.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_kex.c,v 1.6 2021/12/14 21:25:27 deraadt Exp $ */
/* $OpenBSD: test_kex.c,v 1.7 2024/01/11 01:45:58 djm Exp $ */
/*
* Regress test KEX
*
@ -179,7 +179,9 @@ do_kex(char *kex)
{
#ifdef WITH_OPENSSL
do_kex_with_key(kex, KEY_RSA, 2048);
#ifdef WITH_DSA
do_kex_with_key(kex, KEY_DSA, 1024);
#endif
#ifdef OPENSSL_HAS_ECC
do_kex_with_key(kex, KEY_ECDSA, 256);
#endif /* OPENSSL_HAS_ECC */

4
regress/unittests/sshkey/test_file.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_file.c,v 1.10 2021/12/14 21:25:27 deraadt Exp $ */
/* $OpenBSD: test_file.c,v 1.11 2024/01/11 01:45:58 djm Exp $ */
/*
* Regress test for sshkey.h key management API
*
@ -167,6 +167,7 @@ sshkey_file_tests(void)
sshkey_free(k1);
#ifdef WITH_DSA
TEST_START("parse DSA from private");
buf = load_file("dsa_1");
ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@ -259,6 +260,7 @@ sshkey_file_tests(void)
TEST_DONE();
sshkey_free(k1);
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("parse ECDSA from private");

8
regress/unittests/sshkey/test_fuzz.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_fuzz.c,v 1.13 2021/12/14 21:25:27 deraadt Exp $ */
/* $OpenBSD: test_fuzz.c,v 1.14 2024/01/11 01:45:58 djm Exp $ */
/*
* Fuzz tests for key parsing
*
@ -160,6 +160,7 @@ sshkey_fuzz_tests(void)
fuzz_cleanup(fuzz);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("fuzz DSA private");
buf = load_file("dsa_1");
fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
@ -203,6 +204,7 @@ sshkey_fuzz_tests(void)
sshbuf_free(fuzzed);
fuzz_cleanup(fuzz);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("fuzz ECDSA private");
@ -288,6 +290,7 @@ sshkey_fuzz_tests(void)
sshkey_free(k1);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("fuzz DSA public");
buf = load_file("dsa_1");
ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@ -301,6 +304,7 @@ sshkey_fuzz_tests(void)
public_fuzz(k1);
sshkey_free(k1);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("fuzz ECDSA public");
@ -358,6 +362,7 @@ sshkey_fuzz_tests(void)
sshkey_free(k1);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("fuzz DSA sig");
buf = load_file("dsa_1");
ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@ -365,6 +370,7 @@ sshkey_fuzz_tests(void)
sig_fuzz(k1, NULL);
sshkey_free(k1);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("fuzz ECDSA sig");

23
regress/unittests/sshkey/test_sshkey.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_sshkey.c,v 1.23 2023/01/04 22:48:57 tb Exp $ */
/* $OpenBSD: test_sshkey.c,v 1.24 2024/01/11 01:45:58 djm Exp $ */
/*
* Regress test for sshkey.h key management API
*
@ -180,14 +180,14 @@ get_private(const char *n)
void
sshkey_tests(void)
{
struct sshkey *k1, *k2, *k3, *kf;
struct sshkey *k1 = NULL, *k2 = NULL, *k3 = NULL, *kf = NULL;
#ifdef WITH_OPENSSL
struct sshkey *k4, *kr, *kd;
struct sshkey *k4 = NULL, *kr = NULL, *kd = NULL;
#ifdef OPENSSL_HAS_ECC
struct sshkey *ke;
struct sshkey *ke = NULL;
#endif /* OPENSSL_HAS_ECC */
#endif /* WITH_OPENSSL */
struct sshbuf *b;
struct sshbuf *b = NULL;
TEST_START("new invalid");
k1 = sshkey_new(-42);
@ -208,12 +208,14 @@ sshkey_tests(void)
sshkey_free(k1);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("new/free KEY_DSA");
k1 = sshkey_new(KEY_DSA);
ASSERT_PTR_NE(k1, NULL);
ASSERT_PTR_NE(k1->dsa, NULL);
sshkey_free(k1);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("new/free KEY_ECDSA");
@ -245,12 +247,14 @@ sshkey_tests(void)
ASSERT_PTR_EQ(k1, NULL);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("generate KEY_DSA wrong bits");
ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 2048, &k1),
SSH_ERR_KEY_LENGTH);
ASSERT_PTR_EQ(k1, NULL);
sshkey_free(k1);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("generate KEY_ECDSA wrong bits");
@ -273,6 +277,7 @@ sshkey_tests(void)
ASSERT_INT_EQ(BN_num_bits(rsa_n(kr)), 1024);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("generate KEY_DSA");
ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &kd), 0);
ASSERT_PTR_NE(kd, NULL);
@ -280,6 +285,7 @@ sshkey_tests(void)
ASSERT_PTR_NE(dsa_g(kd), NULL);
ASSERT_PTR_NE(dsa_priv_key(kd), NULL);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("generate KEY_ECDSA");
@ -317,6 +323,7 @@ sshkey_tests(void)
sshkey_free(k1);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("demote KEY_DSA");
ASSERT_INT_EQ(sshkey_from_private(kd, &k1), 0);
ASSERT_PTR_NE(k1, NULL);
@ -331,6 +338,7 @@ sshkey_tests(void)
ASSERT_INT_EQ(sshkey_equal(kd, k1), 1);
sshkey_free(k1);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("demote KEY_ECDSA");
@ -382,9 +390,6 @@ sshkey_tests(void)
ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &k1), 0);
ASSERT_INT_EQ(sshkey_equal(kr, k1), 0);
sshkey_free(k1);
ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &k1), 0);
ASSERT_INT_EQ(sshkey_equal(kd, k1), 0);
sshkey_free(k1);
#ifdef OPENSSL_HAS_ECC
ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0);
ASSERT_INT_EQ(sshkey_equal(ke, k1), 0);
@ -479,6 +484,7 @@ sshkey_tests(void)
sshkey_free(k2);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("sign and verify DSA");
k1 = get_private("dsa_1");
ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_2.pub"), &k2,
@ -487,6 +493,7 @@ sshkey_tests(void)
sshkey_free(k1);
sshkey_free(k2);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("sign and verify ECDSA");

4
regress/unittests/sshsig/tests.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: tests.c,v 1.3 2021/12/14 21:25:27 deraadt Exp $ */
/* $OpenBSD: tests.c,v 1.4 2024/01/11 01:45:59 djm Exp $ */
/*
* Regress test for sshbuf.h buffer API
*
@ -103,9 +103,11 @@ tests(void)
check_sig("rsa.pub", "rsa.sig", msg, namespace);
TEST_DONE();
#ifdef WITH_DSA
TEST_START("check DSA signature");
check_sig("dsa.pub", "dsa.sig", msg, namespace);
TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC
TEST_START("check ECDSA signature");

4
ssh-add.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-add.c,v 1.171 2024/01/08 00:30:39 djm Exp $ */
/* $OpenBSD: ssh-add.c,v 1.172 2024/01/11 01:45:36 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -85,7 +85,9 @@ static char *default_files[] = {
_PATH_SSH_CLIENT_ID_ED25519,
_PATH_SSH_CLIENT_ID_ED25519_SK,
_PATH_SSH_CLIENT_ID_XMSS,
#ifdef WITH_DSA
_PATH_SSH_CLIENT_ID_DSA,
#endif
NULL
};

7
ssh-dss.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-dss.c,v 1.49 2023/03/05 05:34:09 dtucker Exp $ */
/* $OpenBSD: ssh-dss.c,v 1.50 2024/01/11 01:45:36 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@ -25,7 +25,7 @@
#include "includes.h"
#ifdef WITH_OPENSSL
#if defined(WITH_OPENSSL) && defined(WITH_DSA)
#include <sys/types.h>
@ -453,4 +453,5 @@ const struct sshkey_impl sshkey_dsa_cert_impl = {
/* .keybits = */ 0,
/* .funcs = */ &sshkey_dss_funcs,
};
#endif /* WITH_OPENSSL */
#endif /* WITH_OPENSSL && WITH_DSA */

26
ssh-keygen.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keygen.c,v 1.471 2023/09/04 10:29:58 job Exp $ */
/* $OpenBSD: ssh-keygen.c,v 1.472 2024/01/11 01:45:36 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -262,10 +262,12 @@ ask_filename(struct passwd *pw, const char *prompt)
name = _PATH_SSH_CLIENT_ID_ED25519;
else {
switch (sshkey_type_from_name(key_type_name)) {
#ifdef WITH_DSA
case KEY_DSA_CERT:
case KEY_DSA:
name = _PATH_SSH_CLIENT_ID_DSA;
break;
#endif
#ifdef OPENSSL_HAS_ECC
case KEY_ECDSA_CERT:
case KEY_ECDSA:
@ -376,10 +378,12 @@ do_convert_to_pkcs8(struct sshkey *k)
if (!PEM_write_RSA_PUBKEY(stdout, k->rsa))
fatal("PEM_write_RSA_PUBKEY failed");
break;
#ifdef WITH_DSA
case KEY_DSA:
if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
fatal("PEM_write_DSA_PUBKEY failed");
break;
#endif
#ifdef OPENSSL_HAS_ECC
case KEY_ECDSA:
if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa))
@ -400,10 +404,12 @@ do_convert_to_pem(struct sshkey *k)
if (!PEM_write_RSAPublicKey(stdout, k->rsa))
fatal("PEM_write_RSAPublicKey failed");
break;
#ifdef WITH_DSA
case KEY_DSA:
if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
fatal("PEM_write_DSA_PUBKEY failed");
break;
#endif
#ifdef OPENSSL_HAS_ECC
case KEY_ECDSA:
if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa))
@ -478,8 +484,10 @@ do_convert_private_ssh2(struct sshbuf *b)
u_int magic, i1, i2, i3, i4;
size_t slen;
u_long e;
#ifdef WITH_DSA
BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL;
BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL;
#endif
BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL;
BIGNUM *rsa_p = NULL, *rsa_q = NULL, *rsa_iqmp = NULL;
@ -507,10 +515,12 @@ do_convert_private_ssh2(struct sshbuf *b)
}
free(cipher);
if (strstr(type, "dsa")) {
ktype = KEY_DSA;
} else if (strstr(type, "rsa")) {
if (strstr(type, "rsa")) {
ktype = KEY_RSA;
#ifdef WITH_DSA
} else if (strstr(type, "dsa")) {
ktype = KEY_DSA;
#endif
} else {
free(type);
return NULL;
@ -520,6 +530,7 @@ do_convert_private_ssh2(struct sshbuf *b)
free(type);
switch (key->type) {
#ifdef WITH_DSA
case KEY_DSA:
if ((dsa_p = BN_new()) == NULL ||
(dsa_q = BN_new()) == NULL ||
@ -539,6 +550,7 @@ do_convert_private_ssh2(struct sshbuf *b)
fatal_f("DSA_set0_key failed");
dsa_pub_key = dsa_priv_key = NULL; /* transferred */
break;
#endif
case KEY_RSA:
if ((r = sshbuf_get_u8(b, &e1)) != 0 ||
(e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) ||
@ -702,12 +714,14 @@ do_convert_from_pkcs8(struct sshkey **k, int *private)
(*k)->type = KEY_RSA;
(*k)->rsa = EVP_PKEY_get1_RSA(pubkey);
break;
#ifdef WITH_DSA
case EVP_PKEY_DSA:
if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
fatal("sshkey_new failed");
(*k)->type = KEY_DSA;
(*k)->dsa = EVP_PKEY_get1_DSA(pubkey);
break;
#endif
#ifdef OPENSSL_HAS_ECC
case EVP_PKEY_EC:
if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
@ -777,10 +791,12 @@ do_convert_from(struct passwd *pw)
fprintf(stdout, "\n");
} else {
switch (k->type) {
#ifdef WITH_DSA
case KEY_DSA:
ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL,
NULL, 0, NULL, NULL);
break;
#endif
#ifdef OPENSSL_HAS_ECC
case KEY_ECDSA:
ok = PEM_write_ECPrivateKey(stdout, k->ecdsa, NULL,
@ -3786,9 +3802,11 @@ main(int argc, char **argv)
n += do_print_resource_record(pw,
_PATH_HOST_RSA_KEY_FILE, rr_hostname,
print_generic, opts, nopts);
#ifdef WITH_DSA
n += do_print_resource_record(pw,
_PATH_HOST_DSA_KEY_FILE, rr_hostname,
print_generic, opts, nopts);
#endif
n += do_print_resource_record(pw,
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname,
print_generic, opts, nopts);

4
ssh-keyscan.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keyscan.c,v 1.154 2023/12/20 00:06:25 jsg Exp $ */
/* $OpenBSD: ssh-keyscan.c,v 1.155 2024/01/11 01:45:36 djm Exp $ */
/*
* Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
*
@ -791,9 +791,11 @@ main(int argc, char **argv)
int type = sshkey_type_from_name(tname);
switch (type) {
#ifdef WITH_DSA
case KEY_DSA:
get_keytypes |= KT_DSA;
break;
#endif
case KEY_ECDSA:
get_keytypes |= KT_ECDSA;
break;

7
ssh-keysign.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keysign.c,v 1.71 2022/08/01 11:09:26 djm Exp $ */
/* $OpenBSD: ssh-keysign.c,v 1.73 2024/01/11 01:51:16 djm Exp $ */
/*
* Copyright (c) 2002 Markus Friedl. All rights reserved.
*
@ -195,9 +195,14 @@ main(int argc, char **argv)
if (fd > 2)
close(fd);
for (i = 0; i < NUM_KEYTYPES; i++)
key_fd[i] = -1;
i = 0;
/* XXX This really needs to read sshd_config for the paths */
#ifdef WITH_DSA
key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
#endif
key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY);
key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY);
key_fd[i++] = open(_PATH_HOST_XMSS_KEY_FILE, O_RDONLY);

6
ssh.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh.c,v 1.599 2023/12/18 14:47:44 djm Exp $ */
/* $OpenBSD: ssh.c,v 1.600 2024/01/11 01:45:36 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -1704,11 +1704,15 @@ main(int ac, char **av)
L_CERT(_PATH_HOST_ECDSA_KEY_FILE, 0);
L_CERT(_PATH_HOST_ED25519_KEY_FILE, 1);
L_CERT(_PATH_HOST_RSA_KEY_FILE, 2);
#ifdef WITH_DSA
L_CERT(_PATH_HOST_DSA_KEY_FILE, 3);
#endif
L_PUBKEY(_PATH_HOST_ECDSA_KEY_FILE, 4);
L_PUBKEY(_PATH_HOST_ED25519_KEY_FILE, 5);
L_PUBKEY(_PATH_HOST_RSA_KEY_FILE, 6);
#ifdef WITH_DSA
L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 7);
#endif
L_CERT(_PATH_HOST_XMSS_KEY_FILE, 8);
L_PUBKEY(_PATH_HOST_XMSS_KEY_FILE, 9);
if (loaded == 0)

14
ssh_api.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh_api.c,v 1.27 2021/04/03 06:18:41 djm Exp $ */
/* $OpenBSD: ssh_api.c,v 1.28 2024/01/09 21:39:14 djm Exp $ */
/*
* Copyright (c) 2012 Markus Friedl. All rights reserved.
*
@ -82,6 +82,7 @@ int
ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
{
char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
char *populated[PROPOSAL_MAX];
struct ssh *ssh;
char **proposal;
static int called;
@ -99,10 +100,19 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
/* Initialize key exchange */
proposal = kex_params ? kex_params->proposal : myproposal;
if ((r = kex_ready(ssh, proposal)) != 0) {
kex_proposal_populate_entries(ssh, populated,
proposal[PROPOSAL_KEX_ALGS],
proposal[PROPOSAL_ENC_ALGS_CTOS],
proposal[PROPOSAL_MAC_ALGS_CTOS],
proposal[PROPOSAL_COMP_ALGS_CTOS],
proposal[PROPOSAL_SERVER_HOST_KEY_ALGS]);
r = kex_ready(ssh, populated);
kex_proposal_free_entries(populated);
if (r != 0) {
ssh_free(ssh);
return r;
}
ssh->kex->server = is_server;
if (is_server) {
#ifdef WITH_OPENSSL

22
ssh_config.5
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: ssh_config.5,v 1.391 2023/10/12 02:18:18 djm Exp $
.Dd $Mdocdate: October 12 2023 $
.\" $OpenBSD: ssh_config.5,v 1.393 2024/01/10 06:33:13 jmc Exp $
.Dd $Mdocdate: January 10 2024 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@ -463,8 +463,10 @@ Timeouts are specified as one or more
.Dq type=interval
pairs separated by whitespace, where the
.Dq type
must be a channel type name (as described in the table below), optionally
containing wildcard characters.
must be the special keyword
.Dq global
or a channel type name from the list below, optionally containing
wildcard characters.
.Pp
The timeout value
.Dq interval
@ -473,11 +475,19 @@ is specified in seconds or may use any of the units documented in the
section.
For example,
.Dq session=5m
would cause the interactive session to terminate after five minutes of
would cause interactive sessions to terminate after five minutes of
inactivity.
Specifying a zero value disables the inactivity timeout.
.Pp
The available channel types include:
The special timeout
.Dq global
applies to all active channels, taken together.
Traffic on any active channel will reset the timeout, but when the timeout
expires then all open channels will be closed.
Note that this global timeout is not matched by wildcards and must be
specified explicitly.
.Pp
The available channel type names include:
.Bl -tag -width Ds
.It Cm agent-connection
Open connections to

4
sshconnect.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect.c,v 1.365 2023/11/20 02:50:00 djm Exp $ */
/* $OpenBSD: sshconnect.c,v 1.366 2024/01/11 01:45:36 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -1632,7 +1632,9 @@ show_other_keys(struct hostkeys *hostkeys, struct sshkey *key)
{
int type[] = {
KEY_RSA,
#ifdef WITH_DSA
KEY_DSA,
#endif
KEY_ECDSA,
KEY_ED25519,
KEY_XMSS,

44
sshd_config.5
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: sshd_config.5,v 1.350 2023/07/28 05:42:36 jmc Exp $
.Dd $Mdocdate: July 28 2023 $
.\" $OpenBSD: sshd_config.5,v 1.352 2024/01/10 06:33:13 jmc Exp $
.Dd $Mdocdate: January 10 2024 $
.Dt SSHD_CONFIG 5
.Os
.Sh NAME
@ -409,8 +409,10 @@ Timeouts are specified as one or more
.Dq type=interval
pairs separated by whitespace, where the
.Dq type
must be a channel type name (as described in the table below), optionally
containing wildcard characters.
must be the special keyword
.Dq global
or a channel type name from the list below, optionally containing
wildcard characters.
.Pp
The timeout value
.Dq interval
@ -418,11 +420,20 @@ is specified in seconds or may use any of the units documented in the
.Sx TIME FORMATS
section.
For example,
.Dq session:*=5m
would cause all sessions to terminate after five minutes of inactivity.
.Dq session=5m
would cause interactive sessions to terminate after five minutes of
inactivity.
Specifying a zero value disables the inactivity timeout.
.Pp
The available channel types include:
The special timeout
.Dq global
applies to all active channels, taken together.
Traffic on any active channel will reset the timeout, but when the timeout
expires then all open channels will be closed.
Note that this global timeout is not matched by wildcards and must be
specified explicitly.
.Pp
The available channel type names include:
.Bl -tag -width Ds
.It Cm agent-connection
Open connections to
@ -443,15 +454,15 @@ listening on behalf of a
.Xr ssh 1
remote forwarding, i.e.\&
.Cm RemoteForward .
.It Cm session:command
Command execution sessions.
.It Cm session:shell
Interactive shell sessions.
.It Cm session:subsystem:...
Subsystem sessions, e.g. for
.It Cm session
The interactive main session, including shell session, command execution,
.Xr scp 1 ,
.Xr sftp 1 ,
which could be identified as
.Cm session:subsystem:sftp .
etc.
.It Cm tun-connection
Open
.Cm TunnelForward
connections.
.It Cm x11-connection
Open X11 forwarding sessions.
.El
@ -465,9 +476,6 @@ close the SSH connection, nor does it prevent a client from
requesting another channel of the same type.
In particular, expiring an inactive forwarding session does not prevent
another identical forwarding from being subsequently created.
See also
.Cm UnusedConnectionTimeout ,
which may be used in conjunction with this option.
.Pp
The default is not to expire channels of any type for inactivity.
.It Cm ChrootDirectory

10
sshkey.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshkey.c,v 1.141 2023/12/20 00:06:25 jsg Exp $ */
/* $OpenBSD: sshkey.c,v 1.142 2024/01/11 01:45:36 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Alexander von Gernler. All rights reserved.
@ -130,8 +130,10 @@ extern const struct sshkey_impl sshkey_rsa_sha256_impl;
extern const struct sshkey_impl sshkey_rsa_sha256_cert_impl;
extern const struct sshkey_impl sshkey_rsa_sha512_impl;
extern const struct sshkey_impl sshkey_rsa_sha512_cert_impl;
# ifdef WITH_DSA
extern const struct sshkey_impl sshkey_dss_impl;
extern const struct sshkey_impl sshkey_dsa_cert_impl;
# endif
#endif /* WITH_OPENSSL */
#ifdef WITH_XMSS
extern const struct sshkey_impl sshkey_xmss_impl;
@ -161,8 +163,10 @@ const struct sshkey_impl * const keyimpls[] = {
&sshkey_ecdsa_sk_webauthn_impl,
# endif /* ENABLE_SK */
# endif /* OPENSSL_HAS_ECC */
# ifdef WITH_DSA
&sshkey_dss_impl,
&sshkey_dsa_cert_impl,
# endif
&sshkey_rsa_impl,
&sshkey_rsa_cert_impl,
&sshkey_rsa_sha256_impl,
@ -3287,6 +3291,7 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf,
goto out;
switch (key->type) {
#ifdef WITH_DSA
case KEY_DSA:
if (format == SSHKEY_PRIVATE_PEM) {
success = PEM_write_bio_DSAPrivateKey(bio, key->dsa,
@ -3295,6 +3300,7 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf,
success = EVP_PKEY_set1_DSA(pkey, key->dsa);
}
break;
#endif
#ifdef OPENSSL_HAS_ECC
case KEY_ECDSA:
if (format == SSHKEY_PRIVATE_PEM) {
@ -3523,6 +3529,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
}
if ((r = sshkey_check_rsa_length(prv, 0)) != 0)
goto out;
#ifdef WITH_DSA
} else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA &&
(type == KEY_UNSPEC || type == KEY_DSA)) {
if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
@ -3534,6 +3541,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
#ifdef DEBUG_PK
DSA_print_fp(stderr, prv->dsa, 8);
#endif
#endif
#ifdef OPENSSL_HAS_ECC
} else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC &&
(type == KEY_UNSPEC || type == KEY_ECDSA)) {