tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstrem-bsd/master' into sync-with-upstream-2

This commit is contained in:
tgauth@bu.edu 2024-01-22 11:09:08 -05:00
parent 9142077e39 0d96b1506b
commit 83b59226a4
24 changed files with 316 additions and 83 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
channels.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: channels.c,v 1.435 2023/12/18 14:47:20 djm Exp $ */ /* $OpenBSD: channels.c,v 1.436 2024/01/09 22:19:00 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -214,6 +214,9 @@ struct ssh_channels {
/* Channel timeouts by type */ /* Channel timeouts by type */
struct ssh_channel_timeout *timeouts; struct ssh_channel_timeout *timeouts;
size_t ntimeouts; size_t ntimeouts;
/* Global timeout for all OPEN channels */
int global_deadline;
time_t lastused;
}; };
/* helper */ /* helper */
@ -316,6 +319,11 @@ channel_add_timeout(struct ssh *ssh, const char *type_pattern,
{ {
struct ssh_channels *sc = ssh->chanctxt; struct ssh_channels *sc = ssh->chanctxt;
if (strcmp(type_pattern, "global") == 0) {
debug2_f("global channel timeout %d seconds", timeout_secs);
sc->global_deadline = timeout_secs;
return;
}
debug2_f("channel type \"%s\" timeout %d seconds", debug2_f("channel type \"%s\" timeout %d seconds",
type_pattern, timeout_secs); type_pattern, timeout_secs);
sc->timeouts = xrecallocarray(sc->timeouts, sc->ntimeouts, sc->timeouts = xrecallocarray(sc->timeouts, sc->ntimeouts,
@ -376,6 +384,38 @@ channel_set_xtype(struct ssh *ssh, int id, const char *xctype)
c->inactive_deadline); c->inactive_deadline);
} }
/*
* update "last used" time on a channel.
* NB. nothing else should update lastused except to clear it.
*/
static void
channel_set_used_time(struct ssh *ssh, Channel *c)
{
ssh->chanctxt->lastused = monotime();
if (c != NULL)
c->lastused = ssh->chanctxt->lastused;
}
/*
* Get the time at which a channel is due to time out for inactivity.
* Returns 0 if the channel is not due to time out ever.
*/
static time_t
channel_get_expiry(struct ssh *ssh, Channel *c)
{
struct ssh_channels *sc = ssh->chanctxt;
time_t expiry = 0, channel_expiry;
if (sc->lastused != 0 && sc->global_deadline != 0)
expiry = sc->lastused + sc->global_deadline;
if (c->lastused != 0 && c->inactive_deadline != 0) {
channel_expiry = c->lastused + c->inactive_deadline;
if (expiry == 0 || channel_expiry < expiry)
expiry = channel_expiry;
}
return expiry;
}
/* /*
* Register filedescriptors for a channel, used when allocating a channel or * Register filedescriptors for a channel, used when allocating a channel or
* when the channel consumer/producer is ready, e.g. shell exec'd * when the channel consumer/producer is ready, e.g. shell exec'd
@ -441,6 +481,8 @@ channel_register_fds(struct ssh *ssh, Channel *c, int rfd, int wfd, int efd,
if (efd != -1) if (efd != -1)
set_nonblock(efd); set_nonblock(efd);
} }
/* channel might be entering a larval state, so reset global timeout */
channel_set_used_time(ssh, NULL);
} }
/* /*
@ -1197,7 +1239,7 @@ channel_set_fds(struct ssh *ssh, int id, int rfd, int wfd, int efd,
channel_register_fds(ssh, c, rfd, wfd, efd, extusage, nonblock, is_tty); channel_register_fds(ssh, c, rfd, wfd, efd, extusage, nonblock, is_tty);
c->type = SSH_CHANNEL_OPEN; c->type = SSH_CHANNEL_OPEN;
c->lastused = monotime(); channel_set_used_time(ssh, c);
c->local_window = c->local_window_max = window_max; c->local_window = c->local_window_max = window_max;
if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST)) != 0 || if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST)) != 0 ||
@ -1369,7 +1411,7 @@ channel_pre_x11_open(struct ssh *ssh, Channel *c)
if (ret == 1) { if (ret == 1) {
c->type = SSH_CHANNEL_OPEN; c->type = SSH_CHANNEL_OPEN;
c->lastused = monotime(); channel_set_used_time(ssh, c);
channel_pre_open(ssh, c); channel_pre_open(ssh, c);
} else if (ret == -1) { } else if (ret == -1) {
logit("X11 connection rejected because of wrong " logit("X11 connection rejected because of wrong "
@ -2025,7 +2067,7 @@ channel_post_connecting(struct ssh *ssh, Channel *c)
c->self, c->connect_ctx.host, c->connect_ctx.port); c->self, c->connect_ctx.host, c->connect_ctx.port);
channel_connect_ctx_free(&c->connect_ctx); channel_connect_ctx_free(&c->connect_ctx);
c->type = SSH_CHANNEL_OPEN; c->type = SSH_CHANNEL_OPEN;
c->lastused = monotime(); channel_set_used_time(ssh, c);
if (isopen) { if (isopen) {
/* no message necessary */ /* no message necessary */
} else { } else {
@ -2117,7 +2159,7 @@ channel_handle_rfd(struct ssh *ssh, Channel *c)
goto rfail; goto rfail;
} }
if (nr != 0) if (nr != 0)
c->lastused = monotime(); channel_set_used_time(ssh, c);
return 1; return 1;
} }
@ -2143,7 +2185,7 @@ channel_handle_rfd(struct ssh *ssh, Channel *c)
} }
return -1; return -1;
} }
c->lastused = monotime(); channel_set_used_time(ssh, c);
if (c->input_filter != NULL) { if (c->input_filter != NULL) {
if (c->input_filter(ssh, c, buf, len) == -1) { if (c->input_filter(ssh, c, buf, len) == -1) {
debug2("channel %d: filter stops", c->self); debug2("channel %d: filter stops", c->self);
@ -2224,7 +2266,7 @@ channel_handle_wfd(struct ssh *ssh, Channel *c)
} }
return -1; return -1;
} }
c->lastused = monotime(); channel_set_used_time(ssh, c);
#ifndef BROKEN_TCGETATTR_ICANON #ifndef BROKEN_TCGETATTR_ICANON
if (c->isatty && dlen >= 1 && buf[0] != '\r') { if (c->isatty && dlen >= 1 && buf[0] != '\r') {
if (tcgetattr(c->wfd, &tio) == 0 && if (tcgetattr(c->wfd, &tio) == 0 &&
@ -2273,7 +2315,7 @@ channel_handle_efd_write(struct ssh *ssh, Channel *c)
if ((r = sshbuf_consume(c->extended, len)) != 0) if ((r = sshbuf_consume(c->extended, len)) != 0)
fatal_fr(r, "channel %i: consume", c->self); fatal_fr(r, "channel %i: consume", c->self);
c->local_consumed += len; c->local_consumed += len;
c->lastused = monotime(); channel_set_used_time(ssh, c);
} }
return 1; return 1;
} }
@ -2300,7 +2342,7 @@ channel_handle_efd_read(struct ssh *ssh, Channel *c)
channel_close_fd(ssh, c, &c->efd); channel_close_fd(ssh, c, &c->efd);
return 1; return 1;
} }
c->lastused = monotime(); channel_set_used_time(ssh, c);
if (c->extended_usage == CHAN_EXTENDED_IGNORE) if (c->extended_usage == CHAN_EXTENDED_IGNORE)
debug3("channel %d: discard efd", c->self); debug3("channel %d: discard efd", c->self);
else if ((r = sshbuf_put(c->extended, buf, len)) != 0) else if ((r = sshbuf_put(c->extended, buf, len)) != 0)
@ -2590,10 +2632,9 @@ channel_handler(struct ssh *ssh, int table, struct timespec *timeout)
continue; continue;
} }
if (ftab[c->type] != NULL) { if (ftab[c->type] != NULL) {
if (table == CHAN_PRE && if (table == CHAN_PRE && c->type == SSH_CHANNEL_OPEN &&
c->type == SSH_CHANNEL_OPEN && channel_get_expiry(ssh, c) != 0 &&
c->inactive_deadline != 0 && c->lastused != 0 && now >= channel_get_expiry(ssh, c)) {
now >= c->lastused + c->inactive_deadline) {
/* channel closed for inactivity */ /* channel closed for inactivity */
verbose("channel %d: closing after %u seconds " verbose("channel %d: closing after %u seconds "
"of inactivity", c->self, "of inactivity", c->self,
@ -2605,10 +2646,9 @@ channel_handler(struct ssh *ssh, int table, struct timespec *timeout)
/* inactivity timeouts must interrupt poll() */ /* inactivity timeouts must interrupt poll() */
if (timeout != NULL && if (timeout != NULL &&
c->type == SSH_CHANNEL_OPEN && c->type == SSH_CHANNEL_OPEN &&
c->lastused != 0 && channel_get_expiry(ssh, c) != 0) {
c->inactive_deadline != 0) {
ptimeout_deadline_monotime(timeout, ptimeout_deadline_monotime(timeout,
c->lastused + c->inactive_deadline); channel_get_expiry(ssh, c));
} }
} else if (timeout != NULL) { } else if (timeout != NULL) {
/* /*
@ -3567,7 +3607,7 @@ channel_input_open_confirmation(int type, u_int32_t seq, struct ssh *ssh)
c->open_confirm(ssh, c->self, 1, c->open_confirm_ctx); c->open_confirm(ssh, c->self, 1, c->open_confirm_ctx);
debug2_f("channel %d: callback done", c->self); debug2_f("channel %d: callback done", c->self);
} }
c->lastused = monotime(); channel_set_used_time(ssh, c);
debug2("channel %d: open confirm rwindow %u rmax %u", c->self, debug2("channel %d: open confirm rwindow %u rmax %u", c->self,
c->remote_window, c->remote_maxpacket); c->remote_window, c->remote_maxpacket);
return 0; return 0;

12
configure.ac
View File

@ -2067,6 +2067,18 @@ AC_ARG_WITH([security-key-builtin],
[ enable_sk_internal=$withval ] [ enable_sk_internal=$withval ]
) )
disable_ecdsa=
AC_ARG_ENABLE([dsa-keys],
[ --disable-dsa-keys disable DSA key support [no]],
[
if test "x$enableval" = "xno" ; then
disable_ecdsa=1
fi
]
)
test -z "$disable_ecdsa" &&
AC_DEFINE([WITH_DSA], [1], [Define if to enable DSA keys.])
AC_SEARCH_LIBS([dlopen], [dl]) AC_SEARCH_LIBS([dlopen], [dl])
AC_CHECK_FUNCS([dlopen]) AC_CHECK_FUNCS([dlopen])
AC_CHECK_DECL([RTLD_NOW], [], [], [#include <dlfcn.h>]) AC_CHECK_DECL([RTLD_NOW], [], [], [#include <dlfcn.h>])

4
readconf.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: readconf.c,v 1.383 2023/10/12 02:18:18 djm Exp $ */ /* $OpenBSD: readconf.c,v 1.384 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -2733,7 +2733,9 @@ fill_default_options(Options * options)
add_identity_file(options, "~/", add_identity_file(options, "~/",
_PATH_SSH_CLIENT_ID_ED25519_SK, 0); _PATH_SSH_CLIENT_ID_ED25519_SK, 0);
add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_XMSS, 0); add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_XMSS, 0);
#ifdef WITH_DSA
add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_DSA, 0); add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_DSA, 0);
#endif
} }
if (options->escape_char == -1) if (options->escape_char == -1)
options->escape_char = '~'; options->escape_char = '~';

4
readconf.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: readconf.h,v 1.154 2023/10/12 02:18:18 djm Exp $ */ /* $OpenBSD: readconf.h,v 1.155 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
@ -87,7 +87,7 @@ typedef struct {
char *sk_provider; /* Security key provider */ char *sk_provider; /* Security key provider */
int verify_host_key_dns; /* Verify host key using DNS */ int verify_host_key_dns; /* Verify host key using DNS */
int num_identity_files; /* Number of files for RSA/DSA identities. */ int num_identity_files; /* Number of files for identities. */
char *identity_files[SSH_MAX_IDENTITY_FILES]; char *identity_files[SSH_MAX_IDENTITY_FILES];
int identity_file_userprovided[SSH_MAX_IDENTITY_FILES]; int identity_file_userprovided[SSH_MAX_IDENTITY_FILES];
struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES]; struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES];

22
regress/Makefile
View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile,v 1.131 2023/12/18 14:50:08 djm Exp $ # $OpenBSD: Makefile,v 1.133 2024/01/11 04:50:28 djm Exp $
tests: prep file-tests t-exec unit tests: prep file-tests t-exec unit
@ -180,10 +180,12 @@ t5:
awk '{print $$2}' | diff - ${.CURDIR}/t5.ok awk '{print $$2}' | diff - ${.CURDIR}/t5.ok
t6: t6:
${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.prv > $(OBJ)/t6.out1 set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q ^ssh-dss ; then \
${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.pub > $(OBJ)/t6.out2 ${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.prv > $(OBJ)/t6.out1 ; \
chmod 600 $(OBJ)/t6.out1 ${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.pub > $(OBJ)/t6.out2 ; \
${TEST_SSH_SSHKEYGEN} -yf $(OBJ)/t6.out1 | diff - $(OBJ)/t6.out2 chmod 600 $(OBJ)/t6.out1 ; \
${TEST_SSH_SSHKEYGEN} -yf $(OBJ)/t6.out1 | diff - $(OBJ)/t6.out2 ; \
fi
$(OBJ)/t7.out: $(OBJ)/t7.out:
${TEST_SSH_SSHKEYGEN} -q -t rsa -N '' -f $@ ${TEST_SSH_SSHKEYGEN} -q -t rsa -N '' -f $@
@ -193,11 +195,15 @@ t7: $(OBJ)/t7.out
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t7.out > /dev/null ${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t7.out > /dev/null
$(OBJ)/t8.out: $(OBJ)/t8.out:
${TEST_SSH_SSHKEYGEN} -q -t dsa -N '' -f $@ set -xe ; if ssh -Q key | grep -q ^ssh-dss ; then \
${TEST_SSH_SSHKEYGEN} -q -t dsa -N '' -f $@ ; \
fi
t8: $(OBJ)/t8.out t8: $(OBJ)/t8.out
${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t8.out > /dev/null set -xe ; if ssh -Q key | grep -q ^ssh-dss ; then \
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t8.out > /dev/null ${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t8.out > /dev/null ; \
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t8.out > /dev/null ; \
fi
$(OBJ)/t9.out: $(OBJ)/t9.out:
! ${TEST_SSH_SSH} -Q key-plain | grep ecdsa >/dev/null || \ ! ${TEST_SSH_SSH} -Q key-plain | grep ecdsa >/dev/null || \

74
regress/channel-timeout.sh
View File

@ -1,10 +1,33 @@
# $OpenBSD: channel-timeout.sh,v 1.1 2023/01/06 08:07:39 djm Exp $ # $OpenBSD: channel-timeout.sh,v 1.2 2024/01/09 22:19:36 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="channel timeout" tid="channel timeout"
# XXX not comprehensive. Still need -R -L agent X11 forwarding + interactive # XXX not comprehensive. Still need -R -L agent X11 forwarding + interactive
rm -f $OBJ/finished.* $OBJ/mux.*
MUXPATH=$OBJ/mux.$$
open_mux() {
${SSH} -nNfM -oControlPath=$MUXPATH -F $OBJ/ssh_proxy "$@" somehost ||
fatal "open mux failed"
test -e $MUXPATH || fatal "mux socket $MUXPATH not established"
}
close_mux() {
test -e $MUXPATH || fatal "mux socket $MUXPATH missing"
${SSH} -qF $OBJ/ssh_proxy -oControlPath=$MUXPATH -O exit somehost ||
fatal "could not terminate mux process"
for x in 1 2 3 4 5 6 7 8 9 10 ; do
test -e $OBJ/mux && break
sleep 1
done
test -e $MUXPATH && fatal "mux did not clean up"
}
mux_client() {
${SSH} -F $OBJ/ssh_proxy -oControlPath=$MUXPATH somehost "$@"
}
rm -f $OBJ/sshd_proxy.orig rm -f $OBJ/sshd_proxy.orig
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
@ -26,6 +49,15 @@ if [ $r -ne 127 ]; then
fail "ssh returned unexpected error code $r" fail "ssh returned unexpected error code $r"
fi fi
verbose "command long timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:command=60") \
> $OBJ/sshd_proxy
${SSH} -F $OBJ/ssh_proxy somehost "exit 23"
r=$?
if [ $r -ne 23 ]; then
fail "ssh returned unexpected error code $r"
fi
verbose "command wildcard timeout" verbose "command wildcard timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:*=1") \ (cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:*=1") \
> $OBJ/sshd_proxy > $OBJ/sshd_proxy
@ -45,6 +77,45 @@ if [ $r -ne 23 ]; then
fail "ssh failed" fail "ssh failed"
fi fi
if config_defined DISABLE_FD_PASSING ; then
verbose "skipping multiplexing tests"
else
verbose "multiplexed command timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:command=1") \
> $OBJ/sshd_proxy
open_mux
mux_client "sleep 5 ; exit 23"
r=$?
if [ $r -ne 255 ]; then
fail "ssh returned unexpected error code $r"
fi
close_mux
verbose "irrelevant multiplexed command timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:shell=1") \
> $OBJ/sshd_proxy
open_mux
mux_client "sleep 5 ; exit 23"
r=$?
if [ $r -ne 23 ]; then
fail "ssh returned unexpected error code $r"
fi
close_mux
verbose "global command timeout"
(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout global=10") \
> $OBJ/sshd_proxy
open_mux
mux_client "sleep 1 ; echo ok ; sleep 1; echo ok; sleep 60; touch $OBJ/finished.1" >/dev/null &
mux_client "sleep 60 ; touch $OBJ/finished.2" >/dev/null &
mux_client "sleep 2 ; touch $OBJ/finished.3" >/dev/null &
wait
test -f $OBJ/finished.1 && fail "first mux process completed"
test -f $OBJ/finished.2 && fail "second mux process completed"
test -f $OBJ/finished.3 || fail "third mux process did not complete"
close_mux
fi
# Set up a "slow sftp server" that sleeps before executing the real one. # Set up a "slow sftp server" that sleeps before executing the real one.
cat > $OBJ/slow-sftp-server.sh << _EOF cat > $OBJ/slow-sftp-server.sh << _EOF
#!/bin/sh #!/bin/sh
@ -91,4 +162,3 @@ if [ $r -ne 0 ]; then
fail "sftp failed" fail "sftp failed"
fi fi
cmp $DATA $COPY || fail "corrupted copy" cmp $DATA $COPY || fail "corrupted copy"

7
regress/unittests/Makefile.inc
View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile.inc,v 1.15 2023/09/24 08:14:13 claudio Exp $ # $OpenBSD: Makefile.inc,v 1.16 2024/01/11 01:45:58 djm Exp $
.include <bsd.own.mk> .include <bsd.own.mk>
.include <bsd.obj.mk> .include <bsd.obj.mk>
@ -13,6 +13,11 @@ TEST_ENV?= MALLOC_OPTIONS=${MALLOC_OPTIONS}
# XXX detect from ssh binary? # XXX detect from ssh binary?
OPENSSL?= yes OPENSSL?= yes
DSAKEY?= yes
.if (${DSAKEY:L} == "yes")
CFLAGS+= -DWITH_DSA
.endif
.if (${OPENSSL:L} == "yes") .if (${OPENSSL:L} == "yes")
CFLAGS+= -DWITH_OPENSSL CFLAGS+= -DWITH_OPENSSL

11
regress/unittests/hostkeys/test_iterate.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_iterate.c,v 1.8 2021/12/14 21:25:27 deraadt Exp $ */ /* $OpenBSD: test_iterate.c,v 1.9 2024/01/11 01:45:58 djm Exp $ */
/* /*
* Regress test for hostfile.h hostkeys_foreach() * Regress test for hostfile.h hostkeys_foreach()
* *
@ -94,6 +94,11 @@ check(struct hostkey_foreach_line *l, void *_ctx)
expected->no_parse_keytype == KEY_ECDSA) expected->no_parse_keytype == KEY_ECDSA)
skip = 1; skip = 1;
#endif /* OPENSSL_HAS_ECC */ #endif /* OPENSSL_HAS_ECC */
#ifndef WITH_DSA
if (expected->l.keytype == KEY_DSA ||
expected->no_parse_keytype == KEY_DSA)
skip = 1;
#endif
#ifndef WITH_OPENSSL #ifndef WITH_OPENSSL
if (expected->l.keytype == KEY_DSA || if (expected->l.keytype == KEY_DSA ||
expected->no_parse_keytype == KEY_DSA || expected->no_parse_keytype == KEY_DSA ||
@ -155,6 +160,10 @@ prepare_expected(struct expected *expected, size_t n)
if (expected[i].l.keytype == KEY_ECDSA) if (expected[i].l.keytype == KEY_ECDSA)
continue; continue;
#endif /* OPENSSL_HAS_ECC */ #endif /* OPENSSL_HAS_ECC */
#ifndef WITH_DSA
if (expected[i].l.keytype == KEY_DSA)
continue;
#endif
#ifndef WITH_OPENSSL #ifndef WITH_OPENSSL
switch (expected[i].l.keytype) { switch (expected[i].l.keytype) {
case KEY_RSA: case KEY_RSA:

4
regress/unittests/kex/test_kex.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_kex.c,v 1.6 2021/12/14 21:25:27 deraadt Exp $ */ /* $OpenBSD: test_kex.c,v 1.7 2024/01/11 01:45:58 djm Exp $ */
/* /*
* Regress test KEX * Regress test KEX
* *
@ -179,7 +179,9 @@ do_kex(char *kex)
{ {
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
do_kex_with_key(kex, KEY_RSA, 2048); do_kex_with_key(kex, KEY_RSA, 2048);
#ifdef WITH_DSA
do_kex_with_key(kex, KEY_DSA, 1024); do_kex_with_key(kex, KEY_DSA, 1024);
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
do_kex_with_key(kex, KEY_ECDSA, 256); do_kex_with_key(kex, KEY_ECDSA, 256);
#endif /* OPENSSL_HAS_ECC */ #endif /* OPENSSL_HAS_ECC */

4
regress/unittests/sshkey/test_file.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_file.c,v 1.10 2021/12/14 21:25:27 deraadt Exp $ */ /* $OpenBSD: test_file.c,v 1.11 2024/01/11 01:45:58 djm Exp $ */
/* /*
* Regress test for sshkey.h key management API * Regress test for sshkey.h key management API
* *
@ -167,6 +167,7 @@ sshkey_file_tests(void)
sshkey_free(k1); sshkey_free(k1);
#ifdef WITH_DSA
TEST_START("parse DSA from private"); TEST_START("parse DSA from private");
buf = load_file("dsa_1"); buf = load_file("dsa_1");
ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@ -259,6 +260,7 @@ sshkey_file_tests(void)
TEST_DONE(); TEST_DONE();
sshkey_free(k1); sshkey_free(k1);
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("parse ECDSA from private"); TEST_START("parse ECDSA from private");

8
regress/unittests/sshkey/test_fuzz.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_fuzz.c,v 1.13 2021/12/14 21:25:27 deraadt Exp $ */ /* $OpenBSD: test_fuzz.c,v 1.14 2024/01/11 01:45:58 djm Exp $ */
/* /*
* Fuzz tests for key parsing * Fuzz tests for key parsing
* *
@ -160,6 +160,7 @@ sshkey_fuzz_tests(void)
fuzz_cleanup(fuzz); fuzz_cleanup(fuzz);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("fuzz DSA private"); TEST_START("fuzz DSA private");
buf = load_file("dsa_1"); buf = load_file("dsa_1");
fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf), fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
@ -203,6 +204,7 @@ sshkey_fuzz_tests(void)
sshbuf_free(fuzzed); sshbuf_free(fuzzed);
fuzz_cleanup(fuzz); fuzz_cleanup(fuzz);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("fuzz ECDSA private"); TEST_START("fuzz ECDSA private");
@ -288,6 +290,7 @@ sshkey_fuzz_tests(void)
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("fuzz DSA public"); TEST_START("fuzz DSA public");
buf = load_file("dsa_1"); buf = load_file("dsa_1");
ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@ -301,6 +304,7 @@ sshkey_fuzz_tests(void)
public_fuzz(k1); public_fuzz(k1);
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("fuzz ECDSA public"); TEST_START("fuzz ECDSA public");
@ -358,6 +362,7 @@ sshkey_fuzz_tests(void)
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("fuzz DSA sig"); TEST_START("fuzz DSA sig");
buf = load_file("dsa_1"); buf = load_file("dsa_1");
ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@ -365,6 +370,7 @@ sshkey_fuzz_tests(void)
sig_fuzz(k1, NULL); sig_fuzz(k1, NULL);
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("fuzz ECDSA sig"); TEST_START("fuzz ECDSA sig");

23
regress/unittests/sshkey/test_sshkey.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: test_sshkey.c,v 1.23 2023/01/04 22:48:57 tb Exp $ */ /* $OpenBSD: test_sshkey.c,v 1.24 2024/01/11 01:45:58 djm Exp $ */
/* /*
* Regress test for sshkey.h key management API * Regress test for sshkey.h key management API
* *
@ -180,14 +180,14 @@ get_private(const char *n)
void void
sshkey_tests(void) sshkey_tests(void)
{ {
struct sshkey *k1, *k2, *k3, *kf; struct sshkey *k1 = NULL, *k2 = NULL, *k3 = NULL, *kf = NULL;
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
struct sshkey *k4, *kr, *kd; struct sshkey *k4 = NULL, *kr = NULL, *kd = NULL;
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
struct sshkey *ke; struct sshkey *ke = NULL;
#endif /* OPENSSL_HAS_ECC */ #endif /* OPENSSL_HAS_ECC */
#endif /* WITH_OPENSSL */ #endif /* WITH_OPENSSL */
struct sshbuf *b; struct sshbuf *b = NULL;
TEST_START("new invalid"); TEST_START("new invalid");
k1 = sshkey_new(-42); k1 = sshkey_new(-42);
@ -208,12 +208,14 @@ sshkey_tests(void)
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("new/free KEY_DSA"); TEST_START("new/free KEY_DSA");
k1 = sshkey_new(KEY_DSA); k1 = sshkey_new(KEY_DSA);
ASSERT_PTR_NE(k1, NULL); ASSERT_PTR_NE(k1, NULL);
ASSERT_PTR_NE(k1->dsa, NULL); ASSERT_PTR_NE(k1->dsa, NULL);
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("new/free KEY_ECDSA"); TEST_START("new/free KEY_ECDSA");
@ -245,12 +247,14 @@ sshkey_tests(void)
ASSERT_PTR_EQ(k1, NULL); ASSERT_PTR_EQ(k1, NULL);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("generate KEY_DSA wrong bits"); TEST_START("generate KEY_DSA wrong bits");
ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 2048, &k1), ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 2048, &k1),
SSH_ERR_KEY_LENGTH); SSH_ERR_KEY_LENGTH);
ASSERT_PTR_EQ(k1, NULL); ASSERT_PTR_EQ(k1, NULL);
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("generate KEY_ECDSA wrong bits"); TEST_START("generate KEY_ECDSA wrong bits");
@ -273,6 +277,7 @@ sshkey_tests(void)
ASSERT_INT_EQ(BN_num_bits(rsa_n(kr)), 1024); ASSERT_INT_EQ(BN_num_bits(rsa_n(kr)), 1024);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("generate KEY_DSA"); TEST_START("generate KEY_DSA");
ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &kd), 0); ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &kd), 0);
ASSERT_PTR_NE(kd, NULL); ASSERT_PTR_NE(kd, NULL);
@ -280,6 +285,7 @@ sshkey_tests(void)
ASSERT_PTR_NE(dsa_g(kd), NULL); ASSERT_PTR_NE(dsa_g(kd), NULL);
ASSERT_PTR_NE(dsa_priv_key(kd), NULL); ASSERT_PTR_NE(dsa_priv_key(kd), NULL);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("generate KEY_ECDSA"); TEST_START("generate KEY_ECDSA");
@ -317,6 +323,7 @@ sshkey_tests(void)
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("demote KEY_DSA"); TEST_START("demote KEY_DSA");
ASSERT_INT_EQ(sshkey_from_private(kd, &k1), 0); ASSERT_INT_EQ(sshkey_from_private(kd, &k1), 0);
ASSERT_PTR_NE(k1, NULL); ASSERT_PTR_NE(k1, NULL);
@ -331,6 +338,7 @@ sshkey_tests(void)
ASSERT_INT_EQ(sshkey_equal(kd, k1), 1); ASSERT_INT_EQ(sshkey_equal(kd, k1), 1);
sshkey_free(k1); sshkey_free(k1);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("demote KEY_ECDSA"); TEST_START("demote KEY_ECDSA");
@ -382,9 +390,6 @@ sshkey_tests(void)
ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &k1), 0); ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &k1), 0);
ASSERT_INT_EQ(sshkey_equal(kr, k1), 0); ASSERT_INT_EQ(sshkey_equal(kr, k1), 0);
sshkey_free(k1); sshkey_free(k1);
ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &k1), 0);
ASSERT_INT_EQ(sshkey_equal(kd, k1), 0);
sshkey_free(k1);
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0); ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0);
ASSERT_INT_EQ(sshkey_equal(ke, k1), 0); ASSERT_INT_EQ(sshkey_equal(ke, k1), 0);
@ -479,6 +484,7 @@ sshkey_tests(void)
sshkey_free(k2); sshkey_free(k2);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("sign and verify DSA"); TEST_START("sign and verify DSA");
k1 = get_private("dsa_1"); k1 = get_private("dsa_1");
ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_2.pub"), &k2, ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_2.pub"), &k2,
@ -487,6 +493,7 @@ sshkey_tests(void)
sshkey_free(k1); sshkey_free(k1);
sshkey_free(k2); sshkey_free(k2);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("sign and verify ECDSA"); TEST_START("sign and verify ECDSA");

4
regress/unittests/sshsig/tests.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: tests.c,v 1.3 2021/12/14 21:25:27 deraadt Exp $ */ /* $OpenBSD: tests.c,v 1.4 2024/01/11 01:45:59 djm Exp $ */
/* /*
* Regress test for sshbuf.h buffer API * Regress test for sshbuf.h buffer API
* *
@ -103,9 +103,11 @@ tests(void)
check_sig("rsa.pub", "rsa.sig", msg, namespace); check_sig("rsa.pub", "rsa.sig", msg, namespace);
TEST_DONE(); TEST_DONE();
#ifdef WITH_DSA
TEST_START("check DSA signature"); TEST_START("check DSA signature");
check_sig("dsa.pub", "dsa.sig", msg, namespace); check_sig("dsa.pub", "dsa.sig", msg, namespace);
TEST_DONE(); TEST_DONE();
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
TEST_START("check ECDSA signature"); TEST_START("check ECDSA signature");

4
ssh-add.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-add.c,v 1.171 2024/01/08 00:30:39 djm Exp $ */ /* $OpenBSD: ssh-add.c,v 1.172 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -85,7 +85,9 @@ static char *default_files[] = {
_PATH_SSH_CLIENT_ID_ED25519, _PATH_SSH_CLIENT_ID_ED25519,
_PATH_SSH_CLIENT_ID_ED25519_SK, _PATH_SSH_CLIENT_ID_ED25519_SK,
_PATH_SSH_CLIENT_ID_XMSS, _PATH_SSH_CLIENT_ID_XMSS,
#ifdef WITH_DSA
_PATH_SSH_CLIENT_ID_DSA, _PATH_SSH_CLIENT_ID_DSA,
#endif
NULL NULL
}; };

7
ssh-dss.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-dss.c,v 1.49 2023/03/05 05:34:09 dtucker Exp $ */ /* $OpenBSD: ssh-dss.c,v 1.50 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
* *
@ -25,7 +25,7 @@
#include "includes.h" #include "includes.h"
#ifdef WITH_OPENSSL #if defined(WITH_OPENSSL) && defined(WITH_DSA)
#include <sys/types.h> #include <sys/types.h>
@ -453,4 +453,5 @@ const struct sshkey_impl sshkey_dsa_cert_impl = {
/* .keybits = */ 0, /* .keybits = */ 0,
/* .funcs = */ &sshkey_dss_funcs, /* .funcs = */ &sshkey_dss_funcs,
}; };
#endif /* WITH_OPENSSL */
#endif /* WITH_OPENSSL && WITH_DSA */

26
ssh-keygen.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keygen.c,v 1.471 2023/09/04 10:29:58 job Exp $ */ /* $OpenBSD: ssh-keygen.c,v 1.472 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -262,10 +262,12 @@ ask_filename(struct passwd *pw, const char *prompt)
name = _PATH_SSH_CLIENT_ID_ED25519; name = _PATH_SSH_CLIENT_ID_ED25519;
else { else {
switch (sshkey_type_from_name(key_type_name)) { switch (sshkey_type_from_name(key_type_name)) {
#ifdef WITH_DSA
case KEY_DSA_CERT: case KEY_DSA_CERT:
case KEY_DSA: case KEY_DSA:
name = _PATH_SSH_CLIENT_ID_DSA; name = _PATH_SSH_CLIENT_ID_DSA;
break; break;
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
case KEY_ECDSA_CERT: case KEY_ECDSA_CERT:
case KEY_ECDSA: case KEY_ECDSA:
@ -376,10 +378,12 @@ do_convert_to_pkcs8(struct sshkey *k)
if (!PEM_write_RSA_PUBKEY(stdout, k->rsa)) if (!PEM_write_RSA_PUBKEY(stdout, k->rsa))
fatal("PEM_write_RSA_PUBKEY failed"); fatal("PEM_write_RSA_PUBKEY failed");
break; break;
#ifdef WITH_DSA
case KEY_DSA: case KEY_DSA:
if (!PEM_write_DSA_PUBKEY(stdout, k->dsa)) if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
fatal("PEM_write_DSA_PUBKEY failed"); fatal("PEM_write_DSA_PUBKEY failed");
break; break;
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
case KEY_ECDSA: case KEY_ECDSA:
if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa)) if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa))
@ -400,10 +404,12 @@ do_convert_to_pem(struct sshkey *k)
if (!PEM_write_RSAPublicKey(stdout, k->rsa)) if (!PEM_write_RSAPublicKey(stdout, k->rsa))
fatal("PEM_write_RSAPublicKey failed"); fatal("PEM_write_RSAPublicKey failed");
break; break;
#ifdef WITH_DSA
case KEY_DSA: case KEY_DSA:
if (!PEM_write_DSA_PUBKEY(stdout, k->dsa)) if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
fatal("PEM_write_DSA_PUBKEY failed"); fatal("PEM_write_DSA_PUBKEY failed");
break; break;
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
case KEY_ECDSA: case KEY_ECDSA:
if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa)) if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa))
@ -478,8 +484,10 @@ do_convert_private_ssh2(struct sshbuf *b)
u_int magic, i1, i2, i3, i4; u_int magic, i1, i2, i3, i4;
size_t slen; size_t slen;
u_long e; u_long e;
#ifdef WITH_DSA
BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL; BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL;
BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL; BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL;
#endif
BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL; BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL;
BIGNUM *rsa_p = NULL, *rsa_q = NULL, *rsa_iqmp = NULL; BIGNUM *rsa_p = NULL, *rsa_q = NULL, *rsa_iqmp = NULL;
@ -507,10 +515,12 @@ do_convert_private_ssh2(struct sshbuf *b)
} }
free(cipher); free(cipher);
if (strstr(type, "dsa")) { if (strstr(type, "rsa")) {
ktype = KEY_DSA;
} else if (strstr(type, "rsa")) {
ktype = KEY_RSA; ktype = KEY_RSA;
#ifdef WITH_DSA
} else if (strstr(type, "dsa")) {
ktype = KEY_DSA;
#endif
} else { } else {
free(type); free(type);
return NULL; return NULL;
@ -520,6 +530,7 @@ do_convert_private_ssh2(struct sshbuf *b)
free(type); free(type);
switch (key->type) { switch (key->type) {
#ifdef WITH_DSA
case KEY_DSA: case KEY_DSA:
if ((dsa_p = BN_new()) == NULL || if ((dsa_p = BN_new()) == NULL ||
(dsa_q = BN_new()) == NULL || (dsa_q = BN_new()) == NULL ||
@ -539,6 +550,7 @@ do_convert_private_ssh2(struct sshbuf *b)
fatal_f("DSA_set0_key failed"); fatal_f("DSA_set0_key failed");
dsa_pub_key = dsa_priv_key = NULL; /* transferred */ dsa_pub_key = dsa_priv_key = NULL; /* transferred */
break; break;
#endif
case KEY_RSA: case KEY_RSA:
if ((r = sshbuf_get_u8(b, &e1)) != 0 || if ((r = sshbuf_get_u8(b, &e1)) != 0 ||
(e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) || (e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) ||
@ -702,12 +714,14 @@ do_convert_from_pkcs8(struct sshkey **k, int *private)
(*k)->type = KEY_RSA; (*k)->type = KEY_RSA;
(*k)->rsa = EVP_PKEY_get1_RSA(pubkey); (*k)->rsa = EVP_PKEY_get1_RSA(pubkey);
break; break;
#ifdef WITH_DSA
case EVP_PKEY_DSA: case EVP_PKEY_DSA:
if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
fatal("sshkey_new failed"); fatal("sshkey_new failed");
(*k)->type = KEY_DSA; (*k)->type = KEY_DSA;
(*k)->dsa = EVP_PKEY_get1_DSA(pubkey); (*k)->dsa = EVP_PKEY_get1_DSA(pubkey);
break; break;
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
case EVP_PKEY_EC: case EVP_PKEY_EC:
if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
@ -777,10 +791,12 @@ do_convert_from(struct passwd *pw)
fprintf(stdout, "\n"); fprintf(stdout, "\n");
} else { } else {
switch (k->type) { switch (k->type) {
#ifdef WITH_DSA
case KEY_DSA: case KEY_DSA:
ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL, ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL,
NULL, 0, NULL, NULL); NULL, 0, NULL, NULL);
break; break;
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
case KEY_ECDSA: case KEY_ECDSA:
ok = PEM_write_ECPrivateKey(stdout, k->ecdsa, NULL, ok = PEM_write_ECPrivateKey(stdout, k->ecdsa, NULL,
@ -3786,9 +3802,11 @@ main(int argc, char **argv)
n += do_print_resource_record(pw, n += do_print_resource_record(pw,
_PATH_HOST_RSA_KEY_FILE, rr_hostname, _PATH_HOST_RSA_KEY_FILE, rr_hostname,
print_generic, opts, nopts); print_generic, opts, nopts);
#ifdef WITH_DSA
n += do_print_resource_record(pw, n += do_print_resource_record(pw,
_PATH_HOST_DSA_KEY_FILE, rr_hostname, _PATH_HOST_DSA_KEY_FILE, rr_hostname,
print_generic, opts, nopts); print_generic, opts, nopts);
#endif
n += do_print_resource_record(pw, n += do_print_resource_record(pw,
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname, _PATH_HOST_ECDSA_KEY_FILE, rr_hostname,
print_generic, opts, nopts); print_generic, opts, nopts);

4
ssh-keyscan.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keyscan.c,v 1.154 2023/12/20 00:06:25 jsg Exp $ */ /* $OpenBSD: ssh-keyscan.c,v 1.155 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
* *
@ -791,9 +791,11 @@ main(int argc, char **argv)
int type = sshkey_type_from_name(tname); int type = sshkey_type_from_name(tname);
switch (type) { switch (type) {
#ifdef WITH_DSA
case KEY_DSA: case KEY_DSA:
get_keytypes |= KT_DSA; get_keytypes |= KT_DSA;
break; break;
#endif
case KEY_ECDSA: case KEY_ECDSA:
get_keytypes |= KT_ECDSA; get_keytypes |= KT_ECDSA;
break; break;

7
ssh-keysign.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keysign.c,v 1.71 2022/08/01 11:09:26 djm Exp $ */ /* $OpenBSD: ssh-keysign.c,v 1.73 2024/01/11 01:51:16 djm Exp $ */
/* /*
* Copyright (c) 2002 Markus Friedl. All rights reserved. * Copyright (c) 2002 Markus Friedl. All rights reserved.
* *
@ -195,9 +195,14 @@ main(int argc, char **argv)
if (fd > 2) if (fd > 2)
close(fd); close(fd);
for (i = 0; i < NUM_KEYTYPES; i++)
key_fd[i] = -1;
i = 0; i = 0;
/* XXX This really needs to read sshd_config for the paths */ /* XXX This really needs to read sshd_config for the paths */
#ifdef WITH_DSA
key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY); key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
#endif
key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY); key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY);
key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY); key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY);
key_fd[i++] = open(_PATH_HOST_XMSS_KEY_FILE, O_RDONLY); key_fd[i++] = open(_PATH_HOST_XMSS_KEY_FILE, O_RDONLY);

6
ssh.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh.c,v 1.599 2023/12/18 14:47:44 djm Exp $ */ /* $OpenBSD: ssh.c,v 1.600 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -1704,11 +1704,15 @@ main(int ac, char **av)
L_CERT(_PATH_HOST_ECDSA_KEY_FILE, 0); L_CERT(_PATH_HOST_ECDSA_KEY_FILE, 0);
L_CERT(_PATH_HOST_ED25519_KEY_FILE, 1); L_CERT(_PATH_HOST_ED25519_KEY_FILE, 1);
L_CERT(_PATH_HOST_RSA_KEY_FILE, 2); L_CERT(_PATH_HOST_RSA_KEY_FILE, 2);
#ifdef WITH_DSA
L_CERT(_PATH_HOST_DSA_KEY_FILE, 3); L_CERT(_PATH_HOST_DSA_KEY_FILE, 3);
#endif
L_PUBKEY(_PATH_HOST_ECDSA_KEY_FILE, 4); L_PUBKEY(_PATH_HOST_ECDSA_KEY_FILE, 4);
L_PUBKEY(_PATH_HOST_ED25519_KEY_FILE, 5); L_PUBKEY(_PATH_HOST_ED25519_KEY_FILE, 5);
L_PUBKEY(_PATH_HOST_RSA_KEY_FILE, 6); L_PUBKEY(_PATH_HOST_RSA_KEY_FILE, 6);
#ifdef WITH_DSA
L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 7); L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 7);
#endif
L_CERT(_PATH_HOST_XMSS_KEY_FILE, 8); L_CERT(_PATH_HOST_XMSS_KEY_FILE, 8);
L_PUBKEY(_PATH_HOST_XMSS_KEY_FILE, 9); L_PUBKEY(_PATH_HOST_XMSS_KEY_FILE, 9);
if (loaded == 0) if (loaded == 0)

14
ssh_api.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh_api.c,v 1.27 2021/04/03 06:18:41 djm Exp $ */ /* $OpenBSD: ssh_api.c,v 1.28 2024/01/09 21:39:14 djm Exp $ */
/* /*
* Copyright (c) 2012 Markus Friedl. All rights reserved. * Copyright (c) 2012 Markus Friedl. All rights reserved.
* *
@ -82,6 +82,7 @@ int
ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
{ {
char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT }; char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
char *populated[PROPOSAL_MAX];
struct ssh *ssh; struct ssh *ssh;
char **proposal; char **proposal;
static int called; static int called;
@ -99,10 +100,19 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
/* Initialize key exchange */ /* Initialize key exchange */
proposal = kex_params ? kex_params->proposal : myproposal; proposal = kex_params ? kex_params->proposal : myproposal;
if ((r = kex_ready(ssh, proposal)) != 0) { kex_proposal_populate_entries(ssh, populated,
proposal[PROPOSAL_KEX_ALGS],
proposal[PROPOSAL_ENC_ALGS_CTOS],
proposal[PROPOSAL_MAC_ALGS_CTOS],
proposal[PROPOSAL_COMP_ALGS_CTOS],
proposal[PROPOSAL_SERVER_HOST_KEY_ALGS]);
r = kex_ready(ssh, populated);
kex_proposal_free_entries(populated);
if (r != 0) {
ssh_free(ssh); ssh_free(ssh);
return r; return r;
} }
ssh->kex->server = is_server; ssh->kex->server = is_server;
if (is_server) { if (is_server) {
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL

22
ssh_config.5
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.\" $OpenBSD: ssh_config.5,v 1.391 2023/10/12 02:18:18 djm Exp $ .\" $OpenBSD: ssh_config.5,v 1.393 2024/01/10 06:33:13 jmc Exp $
.Dd $Mdocdate: October 12 2023 $ .Dd $Mdocdate: January 10 2024 $
.Dt SSH_CONFIG 5 .Dt SSH_CONFIG 5
.Os .Os
.Sh NAME .Sh NAME
@ -463,8 +463,10 @@ Timeouts are specified as one or more
.Dq type=interval .Dq type=interval
pairs separated by whitespace, where the pairs separated by whitespace, where the
.Dq type .Dq type
must be a channel type name (as described in the table below), optionally must be the special keyword
containing wildcard characters. .Dq global
or a channel type name from the list below, optionally containing
wildcard characters.
.Pp .Pp
The timeout value The timeout value
.Dq interval .Dq interval
@ -473,11 +475,19 @@ is specified in seconds or may use any of the units documented in the
section. section.
For example, For example,
.Dq session=5m .Dq session=5m
would cause the interactive session to terminate after five minutes of would cause interactive sessions to terminate after five minutes of
inactivity. inactivity.
Specifying a zero value disables the inactivity timeout. Specifying a zero value disables the inactivity timeout.
.Pp .Pp
The available channel types include: The special timeout
.Dq global
applies to all active channels, taken together.
Traffic on any active channel will reset the timeout, but when the timeout
expires then all open channels will be closed.
Note that this global timeout is not matched by wildcards and must be
specified explicitly.
.Pp
The available channel type names include:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Cm agent-connection .It Cm agent-connection
Open connections to Open connections to

4
sshconnect.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect.c,v 1.365 2023/11/20 02:50:00 djm Exp $ */ /* $OpenBSD: sshconnect.c,v 1.366 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -1632,7 +1632,9 @@ show_other_keys(struct hostkeys *hostkeys, struct sshkey *key)
{ {
int type[] = { int type[] = {
KEY_RSA, KEY_RSA,
#ifdef WITH_DSA
KEY_DSA, KEY_DSA,
#endif
KEY_ECDSA, KEY_ECDSA,
KEY_ED25519, KEY_ED25519,
KEY_XMSS, KEY_XMSS,

44
sshd_config.5
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.\" $OpenBSD: sshd_config.5,v 1.350 2023/07/28 05:42:36 jmc Exp $ .\" $OpenBSD: sshd_config.5,v 1.352 2024/01/10 06:33:13 jmc Exp $
.Dd $Mdocdate: July 28 2023 $ .Dd $Mdocdate: January 10 2024 $
.Dt SSHD_CONFIG 5 .Dt SSHD_CONFIG 5
.Os .Os
.Sh NAME .Sh NAME
@ -409,8 +409,10 @@ Timeouts are specified as one or more
.Dq type=interval .Dq type=interval
pairs separated by whitespace, where the pairs separated by whitespace, where the
.Dq type .Dq type
must be a channel type name (as described in the table below), optionally must be the special keyword
containing wildcard characters. .Dq global
or a channel type name from the list below, optionally containing
wildcard characters.
.Pp .Pp
The timeout value The timeout value
.Dq interval .Dq interval
@ -418,11 +420,20 @@ is specified in seconds or may use any of the units documented in the
.Sx TIME FORMATS .Sx TIME FORMATS
section. section.
For example, For example,
.Dq session:*=5m .Dq session=5m
would cause all sessions to terminate after five minutes of inactivity. would cause interactive sessions to terminate after five minutes of
inactivity.
Specifying a zero value disables the inactivity timeout. Specifying a zero value disables the inactivity timeout.
.Pp .Pp
The available channel types include: The special timeout
.Dq global
applies to all active channels, taken together.
Traffic on any active channel will reset the timeout, but when the timeout
expires then all open channels will be closed.
Note that this global timeout is not matched by wildcards and must be
specified explicitly.
.Pp
The available channel type names include:
.Bl -tag -width Ds .Bl -tag -width Ds
.It Cm agent-connection .It Cm agent-connection
Open connections to Open connections to
@ -443,15 +454,15 @@ listening on behalf of a
.Xr ssh 1 .Xr ssh 1
remote forwarding, i.e.\& remote forwarding, i.e.\&
.Cm RemoteForward . .Cm RemoteForward .
.It Cm session:command .It Cm session
Command execution sessions. The interactive main session, including shell session, command execution,
.It Cm session:shell .Xr scp 1 ,
Interactive shell sessions.
.It Cm session:subsystem:...
Subsystem sessions, e.g. for
.Xr sftp 1 , .Xr sftp 1 ,
which could be identified as etc.
.Cm session:subsystem:sftp . .It Cm tun-connection
Open
.Cm TunnelForward
connections.
.It Cm x11-connection .It Cm x11-connection
Open X11 forwarding sessions. Open X11 forwarding sessions.
.El .El
@ -465,9 +476,6 @@ close the SSH connection, nor does it prevent a client from
requesting another channel of the same type. requesting another channel of the same type.
In particular, expiring an inactive forwarding session does not prevent In particular, expiring an inactive forwarding session does not prevent
another identical forwarding from being subsequently created. another identical forwarding from being subsequently created.
See also
.Cm UnusedConnectionTimeout ,
which may be used in conjunction with this option.
.Pp .Pp
The default is not to expire channels of any type for inactivity. The default is not to expire channels of any type for inactivity.
.It Cm ChrootDirectory .It Cm ChrootDirectory

10
sshkey.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshkey.c,v 1.141 2023/12/20 00:06:25 jsg Exp $ */ /* $OpenBSD: sshkey.c,v 1.142 2024/01/11 01:45:36 djm Exp $ */
/* /*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Alexander von Gernler. All rights reserved. * Copyright (c) 2008 Alexander von Gernler. All rights reserved.
@ -130,8 +130,10 @@ extern const struct sshkey_impl sshkey_rsa_sha256_impl;
extern const struct sshkey_impl sshkey_rsa_sha256_cert_impl; extern const struct sshkey_impl sshkey_rsa_sha256_cert_impl;
extern const struct sshkey_impl sshkey_rsa_sha512_impl; extern const struct sshkey_impl sshkey_rsa_sha512_impl;
extern const struct sshkey_impl sshkey_rsa_sha512_cert_impl; extern const struct sshkey_impl sshkey_rsa_sha512_cert_impl;
# ifdef WITH_DSA
extern const struct sshkey_impl sshkey_dss_impl; extern const struct sshkey_impl sshkey_dss_impl;
extern const struct sshkey_impl sshkey_dsa_cert_impl; extern const struct sshkey_impl sshkey_dsa_cert_impl;
# endif
#endif /* WITH_OPENSSL */ #endif /* WITH_OPENSSL */
#ifdef WITH_XMSS #ifdef WITH_XMSS
extern const struct sshkey_impl sshkey_xmss_impl; extern const struct sshkey_impl sshkey_xmss_impl;
@ -161,8 +163,10 @@ const struct sshkey_impl * const keyimpls[] = {
&sshkey_ecdsa_sk_webauthn_impl, &sshkey_ecdsa_sk_webauthn_impl,
# endif /* ENABLE_SK */ # endif /* ENABLE_SK */
# endif /* OPENSSL_HAS_ECC */ # endif /* OPENSSL_HAS_ECC */
# ifdef WITH_DSA
&sshkey_dss_impl, &sshkey_dss_impl,
&sshkey_dsa_cert_impl, &sshkey_dsa_cert_impl,
# endif
&sshkey_rsa_impl, &sshkey_rsa_impl,
&sshkey_rsa_cert_impl, &sshkey_rsa_cert_impl,
&sshkey_rsa_sha256_impl, &sshkey_rsa_sha256_impl,
@ -3287,6 +3291,7 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf,
goto out; goto out;
switch (key->type) { switch (key->type) {
#ifdef WITH_DSA
case KEY_DSA: case KEY_DSA:
if (format == SSHKEY_PRIVATE_PEM) { if (format == SSHKEY_PRIVATE_PEM) {
success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, success = PEM_write_bio_DSAPrivateKey(bio, key->dsa,
@ -3295,6 +3300,7 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf,
success = EVP_PKEY_set1_DSA(pkey, key->dsa); success = EVP_PKEY_set1_DSA(pkey, key->dsa);
} }
break; break;
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
case KEY_ECDSA: case KEY_ECDSA:
if (format == SSHKEY_PRIVATE_PEM) { if (format == SSHKEY_PRIVATE_PEM) {
@ -3523,6 +3529,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
} }
if ((r = sshkey_check_rsa_length(prv, 0)) != 0) if ((r = sshkey_check_rsa_length(prv, 0)) != 0)
goto out; goto out;
#ifdef WITH_DSA
} else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA && } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA &&
(type == KEY_UNSPEC || type == KEY_DSA)) { (type == KEY_UNSPEC || type == KEY_DSA)) {
if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
@ -3534,6 +3541,7 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
#ifdef DEBUG_PK #ifdef DEBUG_PK
DSA_print_fp(stderr, prv->dsa, 8); DSA_print_fp(stderr, prv->dsa, 8);
#endif #endif
#endif
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
} else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC && } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC &&
(type == KEY_UNSPEC || type == KEY_ECDSA)) { (type == KEY_UNSPEC || type == KEY_ECDSA)) {