13127 Commits

Author SHA1 Message Date
Tess Gauthier
58150f0983
add codeql suppression justification for restart (#708) 2023-12-13 11:27:41 -05:00
djm@openbsd.org
aa7b217085
upstream: when invoking KnownHostsCommand to determine the order of
host key algorithms to request, ensure that the hostname passed to the
command is decorated with the port number for ports other than 22.

This matches the behaviour of KnownHostsCommand when invoked to look
up the actual host key.

bz3643, ok dtucker@

OpenBSD-Commit-ID: 5cfabc0b7c6c7ab473666df314f377b1f15420b1
2023-12-13 14:33:50 +11:00
markus@openbsd.org
4086bd6652
upstream: prevent leak in sshsig_match_principals; ok djm@
OpenBSD-Commit-ID: 594f61ad4819ff5c72dfe99ba666a17f0e1030ae
2023-12-13 14:33:50 +11:00
Tess Gauthier
c1e15ab968
Crank versions (#707)
* bump-dependency-versions

* Update version.rc
2023-12-12 11:11:35 -05:00
Tess Gauthier
2745347ae0
Merge pull request #703 from tgauth/merge-9.5
Merge 9.5
2023-12-07 14:41:39 -05:00
Tess Gauthier
9f9fd0d09d
add check for pipes to do_upload (#704)
* add check for pipes to do_upload

* add parentheses

* add pester tests to sftp

* use pester 3.4 assertions

* add debug

* temp build in debug

* temp build in debug

* revert building CI in debug

* remove pester test for changes; will test manually
2023-12-07 14:37:36 -05:00
Tess Gauthier
4cd3519fbf
Add telemetry event (#702)
* test sending new event from sshd after kex exchange

* rename telemetry event for clarity

* add comments

* remove else since if block has fatal call

* rename method for additional clarity
2023-12-07 14:35:34 -05:00
djm@openbsd.org
19d3ee2f3a
upstream: short circuit debug log processing early if we're not going
to log anything. From Kobe Housen

OpenBSD-Commit-ID: 2bcddd695872a1bef137cfff7823044dcded90ea
2023-12-07 08:09:11 +11:00
tgauth@bu.edu
e10443e229 remove debug statements from pester tests 2023-12-01 15:49:33 -05:00
Andrew
4ee8dc6498
Removed sha1-based MACs from default config (#706) 2023-11-30 18:08:35 -08:00
tgauth@bu.edu
a6248c1e5b add SCP symlink coverage to Pester Tests in place of Bash tests 2023-11-30 16:50:01 -05:00
tgauth@bu.edu
42e182fd4a fix scp.sh test failures 2023-11-30 15:27:59 -05:00
tgauth@bu.edu
476d7f5a26 add comments to bash test changes 2023-11-29 16:54:45 -05:00
tgauth@bu.edu
702f528bb7 add SCP sym link tests to Windows pester tests 2023-11-29 14:15:23 -05:00
tgauth@bu.edu
00ef5b4d9c remove sym link part of scp bash tests on Windows 2023-11-29 11:41:35 -05:00
Darren Tucker
947affad48
Add tests for OpenSSL 3.2.0 and 3.2 stable branch. 2023-11-27 09:37:28 +11:00
Darren Tucker
747dce3620
Use non-zero arg in compiler test program.
Now that we're running the test program, passing zero to the test function
can cause divide-by-zero exceptions which might show up in logs.
2023-11-25 09:03:38 +11:00
dtucker@openbsd.org
3d44a5c565
upstream: Plug mem leak of msg when processing a quit message.
Coverity CID#427852, ok djm@

OpenBSD-Commit-ID: bf85362addbe2134c3d8c4b80f16601fbff823b7
2023-11-24 12:01:34 +11:00
dtucker@openbsd.org
1d7f9b6e29
upstream: Include existing mux path in debug message.
OpenBSD-Commit-ID: 1c3641be10c2f4fbad2a1b088a441d072e18bf16
2023-11-24 12:01:31 +11:00
Darren Tucker
f29934066b
Add an Ubuntu 22.04 test VM.
This is the same version as Github's runners so most of the testing on
it is over there, but having a local VM makes debugging much easier.
2023-11-23 19:41:27 +11:00
Darren Tucker
a93284a780
Add gcc-12 -Werror test on Ubuntu 22.04.
Explictly specify gcc-11 on Ubuntu 22.04 (it's the system compiler).
2023-11-23 19:36:22 +11:00
Darren Tucker
670f5a647e
Check return value from write to prevent warning.
... and since we're testing for flags with -Werror, this caused
configure to mis-detect compiler flags.
2023-11-23 19:34:57 +11:00
Darren Tucker
cea007d691
Run compiler test program when compiling natively.
ok djm@
2023-11-23 14:40:51 +11:00
Darren Tucker
ee0d305828
Factor out compiler test program into a macro.
ok djm@
2023-11-23 14:40:48 +11:00
Darren Tucker
de304c7631
Add fbsd14 VM to test pool. 2023-11-22 08:55:36 +11:00
Darren Tucker
99a2df5e19
Expand -fzero-call-used-regs test to cover gcc 11.
It turns out that gcc also has some problems with -fzero-call-used-regs,
at least v11 on mips.  Previously the test in OSSH_CHECK_CFLAG_COMPILE
was sufficient to catch it with "=all", but not sufficient for "=used".
Expand the testcase and include it in the other tests for good measure.
See bz#3629.  ok djm@.
2023-11-21 16:24:17 +11:00
Darren Tucker
ff220d4010
Stop using -fzero-call-used-regs=all
... since it seems to be problematic with several different versions of
clang.  Only use -fzero-call-used-regs=used which is less
problematic, except with Apple's clang where we don't use it at all.
bz#3629, ok djm@
2023-11-21 14:04:34 +11:00
Darren Tucker
2a19e02f36
Allow for vendor prefix on clang version numbers.
Correctly detects the version of OpenBSD's native clang, as well as
Apple's.  Spotted tb@, ok djm@.
2023-11-21 14:02:18 +11:00
djm@openbsd.org
c52db01148
upstream: set errno=EAFNOSUPPORT when filtering addresses that don't
match AddressFamily; yields slightly better error message if no address
matches. bz#3526

OpenBSD-Commit-ID: 29cea900ddd8b04a4d1968da5c4a893be2ebd9e6
2023-11-20 13:51:15 +11:00
djm@openbsd.org
26f3f3bbc6
upstream: when connecting via socket (the default case), filter
addresses by AddressFamily if one was specified. Fixes the case where, if
CanonicalizeHostname is enabled, ssh may ignore AddressFamily. bz5326; ok
dtucker

OpenBSD-Commit-ID: 6c7d7751f6cd055126b2b268a7b64dcafa447439
2023-11-16 10:05:32 +11:00
djm@openbsd.org
050c335c8d
upstream: when deciding whether to enable keystroke timing
obfuscation, only consider enabling it when a channel with a tty is open.

Avoids turning on the obfucation when X11 forwarding only is in use,
which slows it right down. Reported by Roger Marsh

OpenBSD-Commit-ID: c292f738db410f729190f92de100c39ec931a4f1
2023-11-16 09:53:42 +11:00
tobhe@openbsd.org
676377ce67
upstream: Make sure sftp_get_limits() only returns 0 if 'limits'
was initialized. This fixes a potential uninitialized use of 'limits' in
sftp_init() if sftp_get_limits() returned early because of an unexpected
message type.

ok djm@

OpenBSD-Commit-ID: 1c177d7c3becc1d71bc8763eecf61873a1d3884c
2023-11-16 09:53:42 +11:00
Darren Tucker
64e0600f23
Test current releases of LibreSSL and OpenSSL.
Retire some of the older releases.
2023-11-13 20:03:31 +11:00
tgauth@bu.edu
0c1b7a7d26 rename path_append to sftp_path_append within WINDOWS ifdef 2023-11-01 10:03:52 -04:00
dtucker@openbsd.org
c8ed7cc545
upstream: Specify ssh binary to use
... instead of relying on installed one.  Fixes test failures in -portable
when running tests prior to installation.

OpenBSD-Regress-ID: b6d6ba71c23209c616efc805a60d9a445d53a685
2023-11-01 13:55:45 +11:00
Darren Tucker
e9fc2c4812
Put long-running test targets on hipri runners.
Some of the selfhosted test targets take a long time to run for various
reasons, so label them for "libvirt-hipri" runners so that they can
start immediately.  This should reduce the time to complete all tests.
2023-11-01 13:11:31 +11:00
djm@openbsd.org
7ddf27668f
upstream: add some tests of forced commands overriding Subsystem
directives

OpenBSD-Regress-ID: eb48610282f6371672bdf2a8b5d2aa33cfbd322b
2023-11-01 11:39:55 +11:00
dtucker@openbsd.org
fb06f9b5a0
upstream: Don't try to use sudo inside sshd log wrapper.
We still need to check if we're using sudo since we don't want to chown
unecessarily, as on some platforms this causes an error which pollutes
stderr. We also don't want to unnecessarily invoke sudo, since it's
running in the context of the proxycommand, on *other* platforms it
may not be able to authenticate, and if we're using SUDO then it should
already be privileged.

OpenBSD-Regress-ID: 70d58df7503db699de579a9479300e5f3735f4ee
2023-10-31 15:35:53 +11:00
dtucker@openbsd.org
fc3cc33e88
upstream: Only try to chmod logfile if we have sudo. If we don't have
sudo then we won't need to chmod.

OpenBSD-Regress-ID: dbad2f5ece839658ef8af3376cb1fb1cabe2e324
2023-10-31 14:01:25 +11:00
djm@openbsd.org
3a506598fd
upstream: move PKCS#11 setup code to test-exec.sh so it can be reused
elsewhere

OpenBSD-Regress-ID: 1d29e6be40f994419795d9e660a8d07f538f0acb
2023-10-31 10:04:32 +11:00
tgauth@bu.edu
e6fa11e07e openssh-9.5p1
-----BEGIN SSH SIGNATURE-----
 U1NIU0lHAAAAAQAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQ
 AAAAhuaXN0cDI1NgAAAEEEucmjdlUMQ1hkZebm472VTtvSIMWrmAelO7Uxoc9ZMR892/D4
 CMVBD+rliLO4wmRcawx1iZuUkQllgemb0hLtmQAAAARzc2g6AAAAA2dpdAAAAAAAAAAGc2
 hhNTEyAAAAeAAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAASQAA
 ACEA7WcEKKcqxpjfRRhVOznHOSsf6SlAWbpkBYA01cN3nl0AAAAgIlhw5EaLbGdhj9DaVi
 Mtgw72SsEKJdOA52IQKECVmAQAAAAEDw==
 -----END SSH SIGNATURE-----

resolve merge conflicts; scp and sftp fail to compile
2023-10-30 17:06:35 -04:00
djm@openbsd.org
f82fa227a5
upstream: tidy and refactor PKCS#11 setup code
Replace the use of a perl script to delete the controlling TTY with a
SSH_ASKPASS script to directly load the PIN.

Move PKCS#11 setup code to functions in anticipation of it being used
elsewhere in additional tests.

Reduce stdout spam

OpenBSD-Regress-ID: 07705c31de30bab9601a95daf1ee6bef821dd262
2023-10-31 04:36:27 +11:00
Darren Tucker
3cf698c6d4
Add obsd74 test VM and retire obsd69 and obsd70. 2023-10-30 21:35:03 +11:00
Darren Tucker
3e21d58a09
Add OpenSSL 3.3.0 as a known dev version. 2023-10-30 18:34:12 +11:00
Darren Tucker
917ba181c2
Restore nopasswd sudo rule on Mac OS X.
This seems to be missing from some (but not all) github runners, so
restore it if it seems to be missing.
2023-10-30 16:13:04 +11:00
Darren Tucker
c5698abad6
Don't exit early when setting up on Mac OS X.
We probably need some of the other bits in there (specifically, setting
the perms on the home directory) so make it less of a special snowflake.
2023-10-30 13:54:00 +11:00
dtucker@openbsd.org
1d6a878ceb
upstream: Only try to chown logfiles that exist to prevent spurious
errors.

OpenBSD-Regress-ID: f1b20a476734e885078c481f1324c9ea03af991e
2023-10-29 17:33:18 +11:00
anton@openbsd.org
e612376427
upstream: make use of bsd.regress.mk in extra and interop targets; ok
dtucker@

OpenBSD-Regress-ID: 7ea21b5f6fc4506165093b2123d88d20ff13a4f0
2023-10-29 17:32:47 +11:00
dtucker@openbsd.org
ea00391739
upstream: Skip conch interop tests when not enabled instead of fatal.
OpenBSD-Regress-ID: b0abf81c24ac6c21f367233663228ba16fa96a46
2023-10-27 00:02:26 +11:00
dtucker@openbsd.org
d220b9ed54
upstream: Import regenerated moduli.
OpenBSD-Commit-ID: 95f5dd6107e8902b87dc5b005ef2b53f1ff378b8
2023-10-26 23:46:03 +11:00