Commit Graph

10904 Commits

Author SHA1 Message Date
Darren Tucker 5c8f41ad10 Quote SSHD_CONFOPTS in case it contains spaces. 2021-02-18 09:59:09 +11:00
Darren Tucker 4653116c1f Fix labels on targets (dots vs underscores). 2021-02-18 09:51:18 +11:00
Darren Tucker 4512047f57 More compact representation of config matrix. 2021-02-17 21:47:48 +11:00
Darren Tucker 0406cd09f0 Skip unit tests on hosted VMs to speed things up. 2021-02-17 21:19:18 +11:00
Darren Tucker 4582612e61 Merge macos and ubuntu tests. 2021-02-17 20:46:03 +11:00
Darren Tucker 09f4b84654 Convert most github hosted tests to new config structure. 2021-02-17 20:46:03 +11:00
Darren Tucker 65380ff7e0 Only run selfhosted tests from selfhosted repo. 2021-02-17 18:27:36 +11:00
Darren Tucker f031366535 Add self-hosted runners for VMs of other platforms.
Github only hosts a limited number of platforms, and the runner code
is only supported on slightly wider range of platforms.  To increase
our test coverage beyond that, we run the runner natively on a VM host,
where it runs a jobs that boot VMs of other platforms, waits for them
to come up then runs the build and test by ssh'ing into the guest.
This means that the minimum dependencies for the guests are quite low
(basically just sshd, a compiler and make).

The interface to the VM host is fairly simple (basically 3 scripts:
vmstartup, vmrun and vmshutdown), but those are specific to the VM host
so are not in the public repo.  We also mount the working directory on the
host via sshfs, so things like artifact upload by the runner also work.

As part of this we are moving the per-test-target configs into a single
place (.github/configs) where there will be referenced by a single short
"config" key.  I plan to make the github-hosted runners use this too.

The self-hosted runners are run off a private repo on github since that
prevents third parties from accessing them[0], and since runner quota is
limited on private repos, we avoid running the tests we run on the public
repo.

[0] https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories
2021-02-17 18:20:40 +11:00
dtucker@openbsd.org 64bbd7444d upstream: Make sure puttygen is new enough to successfully run the
PuTTY interop tests, otherwise skip them.

OpenBSD-Regress-ID: 34565bb50b8aec58331ed02a5e9e0a9a929bef51
2021-02-17 15:08:29 +11:00
markus@openbsd.org da0a9afcc4 upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding
with SOCKS ok djm@, dtucker@

OpenBSD-Commit-ID: 64fe7b6360acc4ea56aa61b66498b5ecc0a96a7c
2021-02-17 15:03:41 +11:00
markus@openbsd.org b696858a7f upstream: factor out opt_array_append; ok djm@
OpenBSD-Commit-ID: 571bc5dd35f99c5cf9de6aaeac428b168218e74a
2021-02-17 15:03:41 +11:00
dlg@openbsd.org ad74fc127c upstream: ProxyJump takes "none" to disable processing like
ProxyCommand does

ok djm@ jmc@

OpenBSD-Commit-ID: 941a2399da2193356bdc30b879d6e1692f18b6d3
2021-02-17 15:03:41 +11:00
djm@openbsd.org 16eacdb016 upstream: sftp: add missing lsetstat@openssh.com documentation
patch from Mike Frysinger

OpenBSD-Commit-ID: 9c114db88d505864075bfe7888b7c8745549715b
2021-02-17 15:03:41 +11:00
djm@openbsd.org e04fd6dde1 upstream: factor SSH_AGENT_CONSTRAIN_EXTENSION parsing into its own
function and remove an unused variable; ok dtucker@

OpenBSD-Commit-ID: e1a938657fbf7ef0ba5e73b30365734a0cc96559
2021-02-17 15:03:41 +11:00
Darren Tucker 1bb130ed34 Add __NR_futex_time64 to seccomp sandbox.
This is apparently needed for (some) 32 bit platforms with glibc 2.33.
Patch from nix at esperi.org.uk and jjelen at redhat.com via bz#3260.
2021-02-11 10:18:05 +11:00
Darren Tucker f88a7a4312 Add a hostname function for systems that don't have it.
Some systems don't have a hostname command (it's not required by POSIX).
The do have uname -n (which is), but as found by tim@ some others (eg
UnixWare) do not report the FQDN from uname -n.
2021-02-06 09:37:01 +11:00
dtucker@openbsd.org 5e385a71ef upstream: Roll back the hostname->uname change in rev 1.10. It turns
out uname -n doesn't do what we need for some platforms in portable, so we'll
fix the original problem (that some other platforms don't have hostname at
all) by providing wrapper function to implement it.

OpenBSD-Regress-ID: 827a707d6201d5a8e196a8c28aec1d2c76c52341
2021-02-06 09:35:14 +11:00
dtucker@openbsd.org b446c21427 upstream: hostname is not specified by POSIX but uname -n is, so use
the latter for portability.  Patch from Geert Hendrickx via github PR#208.

OpenBSD-Regress-ID: d6a79c7c4d141a0d05ade4a042eb57dddbce89f3
2021-02-05 17:38:19 +11:00
David Carlier 1cb6ce98d6 Using explicit_memset for the explicit_bzero compatibility layer.
Favoriting the native implementation in this case.
2021-02-05 17:07:03 +11:00
Luca Weiss 2e0beff67d Deny (non-fatal) statx in preauth privsep child. 2021-02-05 13:56:26 +11:00
dtucker@openbsd.org a35d3e911e upstream: Remove debug message from sigchld handler. While this
works on OpenBSD it can cause problems on other platforms.  From kircherlike
at outlook.com via bz#3259, ok djm@

OpenBSD-Commit-ID: 3e241d7ac1ee77e3de3651780b5dc47b283a7668
2021-02-05 13:38:57 +11:00
djm@openbsd.org 69338ab46a upstream: whitespace
OpenBSD-Commit-ID: 544bb092e03fcbecb420196cd0f70af13ea868ad
2021-02-05 13:38:57 +11:00
djm@openbsd.org f71219a01d upstream: fix memleaks in private key deserialisation; enforce more
consistency between redundant fields in private key certificate and private
key body; ok markus@

OpenBSD-Commit-ID: dec344e414d47f0a7adc13aecf3760fe58101240
2021-02-05 13:38:57 +11:00
djm@openbsd.org 3287790e78 upstream: memleak on error path; ok markus@
OpenBSD-Commit-ID: 2091a36d6ca3980c81891a6c4bdc544e63cb13a8
2021-02-05 13:38:57 +11:00
djm@openbsd.org 3dd0c64e08 upstream: more strictly enforce KEX state-machine by banning packet
types once they are received. Fixes memleak caused by duplicate
SSH2_MSG_KEX_DH_GEX_REQUEST (spotted by portable OpenSSH kex_fuzz via
oss-fuzz #30078).

ok markus@

OpenBSD-Commit-ID: 87331c715c095b587d5c88724694cdeb701c9def
2021-02-01 09:57:28 +11:00
dtucker@openbsd.org 7a92a324a2 upstream: Set linesize returned by getline to zero when freeing and
NULLing the returned string.  OpenBSD's getline handles this just fine, but
some implementations used by -portable do not.  ok djm@

OpenBSD-Commit-ID: 4d7bd5169d3397654247db9655cc69a9908d165c
2021-02-01 09:57:28 +11:00
Damien Miller a5dfc5bae8 allow a fuzz case to contain more than one request
loop until input buffer empty, no message consumed or 256 messages
processed
2021-01-30 16:32:29 +11:00
Damien Miller 0ef24ad602 expect fuzz cases to have length prefix
might make life a little easier for the fuzzer, e.g. it can now
produce valid (multi-request) messages by smashing two cases together.
2021-01-30 16:28:23 +11:00
Damien Miller de613f2713 ssh-agent fuzzer 2021-01-30 13:18:30 +11:00
Damien Miller 7e96c877bc move keys out of kex_fuzz.cc into separate header
add certificates and missing key types
2021-01-30 12:02:46 +11:00
Damien Miller 76f46d7566 some fixed test data (mostly keys) for fuzzing 2021-01-30 12:02:10 +11:00
djm@openbsd.org 7c2e3d6de1 upstream: add a SK_DUMMY_INTEGRATE define that allows the dummy
security key middleware to be directly linked; useful for writing fuzzers,
etc.

OpenBSD-Regress-ID: 0ebd00159b58ebd85e61d8270fc02f1e45df1544
2021-01-30 11:58:38 +11:00
djm@openbsd.org 1a4b927586 upstream: fix the values of enum sock_type
OpenBSD-Commit-ID: 18d048f4dbfbb159ff500cfc2700b8fb1407facd
2021-01-30 11:58:31 +11:00
djm@openbsd.org 8afaa7d791 upstream: give typedef'd struct a struct name; makes the fuzzer I'm
writing a bit easier

OpenBSD-Commit-ID: 1052ab521505a4d8384d67acb3974ef81b8896cb
2021-01-30 11:58:31 +11:00
Damien Miller 1e660115f0 fuzz diffie-hellman-group-exchange-sha1 kex too 2021-01-29 11:09:14 +11:00
Damien Miller be5f0048ea support for running kex fuzzer with null cipher 2021-01-29 11:03:35 +11:00
Darren Tucker 3d59e88c0e make with -j2 to use available CPUs. 2021-01-28 20:55:16 +11:00
Darren Tucker 66dd9ddb5d Add test against openssl head and libressl head. 2021-01-28 15:04:01 +11:00
Darren Tucker 237dbb34e2 Remove whitespace. 2021-01-28 14:35:41 +11:00
djm@openbsd.org d983e1732b upstream: fix leak: was double allocating kex->session_id buffer
OpenBSD-Commit-ID: 3765f4cc3ae1df874dba9102a3588ba7b48b8183
2021-01-28 10:50:56 +11:00
Damien Miller 1134a48cdc correct kex name in disabled code 2021-01-28 08:57:31 +11:00
djm@openbsd.org 67f47f1965 upstream: this needs kex.h now
OpenBSD-Commit-ID: c5a42166c5aa002197217421a971e48be7cb5d41
2021-01-27 21:16:45 +11:00
djm@openbsd.org 39be3dc209 upstream: make ssh->kex->session_id a sshbuf instead of u_char*/size_t
and use that instead of global variables containing copies of it. feedback/ok
markus@

OpenBSD-Commit-ID: a4b1b1ca4afd2e37cb9f64f737b30a6a7f96af68
2021-01-27 21:10:57 +11:00
djm@openbsd.org 4ca6a1fac3 upstream: remove global variable used to stash compat flags and use the
purpose-built ssh->compat variable instead; feedback/ok markus@

OpenBSD-Commit-ID: 7c4f200e112dae6bcf99f5bae1a5629288378a06
2021-01-27 20:28:25 +11:00
Darren Tucker bba229b6f3 Install moduli file before tests.
Reduces warnings during test runs.
2021-01-27 12:34:07 +11:00
Darren Tucker 1b83185593 Run one test with -Werror to catch warnings. 2021-01-27 11:58:26 +11:00
dtucker@openbsd.org d1532d9007 upstream: Logical not bitwise or. ok djm@
OpenBSD-Commit-ID: d4dc855cf04951b93c45caa383e1ac9af0a3b0e5
2021-01-27 11:45:50 +11:00
naddy@openbsd.org 507b448a24 upstream: move HostbasedAcceptedAlgorithms to the right place in
alphabetical order

OpenBSD-Commit-ID: d766820d33dd874d944c14b0638239adb522c7ec
2021-01-27 11:45:50 +11:00
dtucker@openbsd.org e26c980778 upstream: Remove unused variables leftover from refactoring. ok
djm@

OpenBSD-Commit-ID: 8b3ad58bff828fcf874e54b2fc27a4cf1d9505e8
2021-01-26 22:50:40 +11:00
dtucker@openbsd.org e9f78d6b06 upstream: Rename HostbasedKeyTypes (ssh) and
HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms, which more
accurately reflects its effect. This matches a previous change to
PubkeyAcceptedAlgorithms.  The previous names are retained as aliases.  ok
djm@

OpenBSD-Commit-ID: 49451c382adc6e69d3fa0e0663eeef2daa4b199e
2021-01-26 22:50:40 +11:00