Commit Graph

10935 Commits

Author SHA1 Message Date
djm@openbsd.org 9beeab8a37 upstream: s/PubkeyAcceptedKeyTypes/PubkeyAcceptedAlgorithms/
OpenBSD-Regress-ID: 3dbc005fa29f69dc23d97e433b6dffed6fe7cb69
2021-02-25 15:15:46 +11:00
dtucker@openbsd.org 2dd9870c16 upstream: Rename pubkeyacceptedkeytypes to pubkeyacceptedalgorithms in
test to match change to config-dump output.

OpenBSD-Regress-ID: 74c9a4ad50306be873d032819d5e55c24eb74d5d
2021-02-25 10:31:47 +11:00
dtucker@openbsd.org b9225c3a1c upstream: Put obsolete aliases for hostbasedalgorithms and
pubkeyacceptedalgorithms after their current names so that the config-dump
mode finds and uses the current names.  Spotted by Phil Pennock.

OpenBSD-Commit-ID: 5dd10e93cccfaff3aaaa09060c917adff04a9b15
2021-02-25 00:28:45 +11:00
djm@openbsd.org 8b8b60542d upstream: lots more s/key types/signature algorithms/ mostly in
HostbasedAcceptedAlgorithms and HostKeyAlgorithms; prompted by Jakub Jelen

OpenBSD-Commit-ID: 3f719de4385b1a89e4323b2549c66aae050129cb
2021-02-24 08:56:22 +11:00
djm@openbsd.org 0aeb508aaa upstream: Correct reference to signature algorithms as keys; from
Jakub Jelen

OpenBSD-Commit-ID: 36f7ecee86fc811aa0f8e21e7a872eee044b4be5
2021-02-24 08:56:22 +11:00
Darren Tucker f186a020f2 Add a couple more test VMs. 2021-02-23 16:05:22 +11:00
Darren Tucker ffcdd3d90e Valgrind test: split and move up list.
Since the valgrind test takes so long it approaches the limit allowed by
github, move it to the head of the list so it's the first one started and
split the longest tests out into a second instance that runs concurrently
with the first.
2021-02-23 11:18:49 +11:00
djm@openbsd.org c3b1636770 upstream: warn when the user specifies a ForwardAgent path that does
not exist and exit if ExitOnForwardFailure is set; bz3264

OpenBSD-Commit-ID: 72f7875865e723e464c71bf8692e83110699bf26
2021-02-23 11:09:07 +11:00
Darren Tucker 5fcb051494 Disable rlimit sandbox, doesn't work with valgrind
Only run regress tests, runing unit tests as well makes it run longer
than allowed y github.
2021-02-21 15:39:01 +11:00
Darren Tucker bb0b9bf453 Upload valgrind logs on failure. 2021-02-20 13:29:41 +11:00
Darren Tucker ebb3b75e97 Rename "vm" to "os" in selfhosted to match c-cpp.
Should make it easier to share code or maybe merge at some point.
2021-02-19 22:20:00 +11:00
Darren Tucker 76c0be0fe0 Upload regress failure logs in c-cpp too. 2021-02-19 22:19:38 +11:00
Darren Tucker 8751b6c313 Comment out Solaris 64bit PAM build...
until I can figure out why it's failing.
2021-02-19 22:13:36 +11:00
Darren Tucker e9f6d563c0 Actually run Valgrind tests. 2021-02-19 10:20:17 +11:00
Darren Tucker 41d232e226 Add test against Valgrind. 2021-02-19 10:16:56 +11:00
Darren Tucker e6528d91f1 Add fbsd12 test target. 2021-02-18 16:30:01 +11:00
Darren Tucker 6506cb2798 Remove unused arg. 2021-02-18 15:21:13 +11:00
Darren Tucker 93c31a6239 Add DEBUG_SK to kitchensink builds. 2021-02-18 14:54:07 +11:00
Darren Tucker 65085740d3 Add bbone test target (arm32). 2021-02-18 14:53:14 +11:00
djm@openbsd.org 63238f5aed upstream: Fix the hostkeys rotation extension documentation
The documentation was lacking the needed want-reply field in the initial
global request.

https://github.com/openssh/openssh-portable/pull/218 by dbussink

OpenBSD-Commit-ID: 051824fd78edf6d647a0b9ac011bf88e28775054
2021-02-18 13:50:37 +11:00
djm@openbsd.org 34c5ef6e2d upstream: make names in function prototypes match those in
definition from https://github.com/openssh/openssh-portable/pull/225 by
ZenithalHourlyRate

OpenBSD-Commit-ID: 7c736307bf3f2c7cb24d6f82f244eee959485acd
2021-02-18 13:17:43 +11:00
djm@openbsd.org 88e3d4de31 upstream: unbreak SK_DEBUG builds
from https://github.com/openssh/openssh-portable/pull/225 by
ZenithalHourlyRate

OpenBSD-Commit-ID: 28d7259ce1b04d025411464decfa2f1a097b43eb
2021-02-18 13:17:43 +11:00
djm@openbsd.org 788cbc5b74 upstream: sftp-server: implement limits@openssh.com extension
This is a simple extension that allows the server to clearly
communicate transfer limits it is imposing so the client doesn't
have to guess, or force the user to manually tune.  This is
particularly useful when an attempt to use too large of a value
causes the server to abort the connection.

Patch from Mike Frysinger; ok dtucker@

OpenBSD-Commit-ID: f96293221e5aa24102d9bf30e4f4ef04d5f4fb51
2021-02-18 13:17:43 +11:00
Damien Miller 324449a68d support OpenSSL 3.x cipher IV API change
OpenSSL renamed the "get current CIPHER_CTX" IV operation in 3.x.
This uses the new name if available.

https://github.com/openssl/openssl/issues/13411

bz#3238 ok dtucker@
2021-02-18 12:06:25 +11:00
Damien Miller 845fe9811c prefer login_getpwclass() to login_getclass()
FreeBSD has login_getpwclass() that does some special magic for
UID=0. Prefer this to login_getclass() as its easier to emulate
the former with the latter.

Based on FreeBSD PR 37416 via Ed Maste; ok dtucker@
2021-02-18 11:27:09 +11:00
Darren Tucker d0763c8d56 Fixing quoting for installing moduli on target guest. 2021-02-18 11:05:48 +11:00
Darren Tucker b3afc243bc Install moduli on target not host. 2021-02-18 10:41:58 +11:00
Damien Miller f060c2bc85 don't free string returned by login_getcapstr(3)
OpenBSD and NetBSD require the caller to free strings returned
bu the login_* functions, but FreeBSD requires that callers don't.

Fortunately in this case, we can harmlessly leak as the process is
about to exec the shell/command.

From https://reviews.freebsd.org/D28617 via Ed Maste; ok dtucker@
2021-02-18 10:36:54 +11:00
Darren Tucker bc9b0c2570 Skip unit tests on sol11 to speed things up. 2021-02-18 10:10:00 +11:00
Darren Tucker 161873035c Remove SKIP_UNIT as it needs to be a make arg. 2021-02-18 10:09:27 +11:00
Darren Tucker 1c293868e4 Always intall moduli.
Allows us to run tests without falling back to a fixed modulus.  Ensure that
the directory exists.
2021-02-18 10:05:03 +11:00
Darren Tucker 5c8f41ad10 Quote SSHD_CONFOPTS in case it contains spaces. 2021-02-18 09:59:09 +11:00
Darren Tucker 4653116c1f Fix labels on targets (dots vs underscores). 2021-02-18 09:51:18 +11:00
Darren Tucker 4512047f57 More compact representation of config matrix. 2021-02-17 21:47:48 +11:00
Darren Tucker 0406cd09f0 Skip unit tests on hosted VMs to speed things up. 2021-02-17 21:19:18 +11:00
Darren Tucker 4582612e61 Merge macos and ubuntu tests. 2021-02-17 20:46:03 +11:00
Darren Tucker 09f4b84654 Convert most github hosted tests to new config structure. 2021-02-17 20:46:03 +11:00
Darren Tucker 65380ff7e0 Only run selfhosted tests from selfhosted repo. 2021-02-17 18:27:36 +11:00
Darren Tucker f031366535 Add self-hosted runners for VMs of other platforms.
Github only hosts a limited number of platforms, and the runner code
is only supported on slightly wider range of platforms.  To increase
our test coverage beyond that, we run the runner natively on a VM host,
where it runs a jobs that boot VMs of other platforms, waits for them
to come up then runs the build and test by ssh'ing into the guest.
This means that the minimum dependencies for the guests are quite low
(basically just sshd, a compiler and make).

The interface to the VM host is fairly simple (basically 3 scripts:
vmstartup, vmrun and vmshutdown), but those are specific to the VM host
so are not in the public repo.  We also mount the working directory on the
host via sshfs, so things like artifact upload by the runner also work.

As part of this we are moving the per-test-target configs into a single
place (.github/configs) where there will be referenced by a single short
"config" key.  I plan to make the github-hosted runners use this too.

The self-hosted runners are run off a private repo on github since that
prevents third parties from accessing them[0], and since runner quota is
limited on private repos, we avoid running the tests we run on the public
repo.

[0] https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories
2021-02-17 18:20:40 +11:00
dtucker@openbsd.org 64bbd7444d upstream: Make sure puttygen is new enough to successfully run the
PuTTY interop tests, otherwise skip them.

OpenBSD-Regress-ID: 34565bb50b8aec58331ed02a5e9e0a9a929bef51
2021-02-17 15:08:29 +11:00
markus@openbsd.org da0a9afcc4 upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding
with SOCKS ok djm@, dtucker@

OpenBSD-Commit-ID: 64fe7b6360acc4ea56aa61b66498b5ecc0a96a7c
2021-02-17 15:03:41 +11:00
markus@openbsd.org b696858a7f upstream: factor out opt_array_append; ok djm@
OpenBSD-Commit-ID: 571bc5dd35f99c5cf9de6aaeac428b168218e74a
2021-02-17 15:03:41 +11:00
dlg@openbsd.org ad74fc127c upstream: ProxyJump takes "none" to disable processing like
ProxyCommand does

ok djm@ jmc@

OpenBSD-Commit-ID: 941a2399da2193356bdc30b879d6e1692f18b6d3
2021-02-17 15:03:41 +11:00
djm@openbsd.org 16eacdb016 upstream: sftp: add missing lsetstat@openssh.com documentation
patch from Mike Frysinger

OpenBSD-Commit-ID: 9c114db88d505864075bfe7888b7c8745549715b
2021-02-17 15:03:41 +11:00
djm@openbsd.org e04fd6dde1 upstream: factor SSH_AGENT_CONSTRAIN_EXTENSION parsing into its own
function and remove an unused variable; ok dtucker@

OpenBSD-Commit-ID: e1a938657fbf7ef0ba5e73b30365734a0cc96559
2021-02-17 15:03:41 +11:00
Darren Tucker 1bb130ed34 Add __NR_futex_time64 to seccomp sandbox.
This is apparently needed for (some) 32 bit platforms with glibc 2.33.
Patch from nix at esperi.org.uk and jjelen at redhat.com via bz#3260.
2021-02-11 10:18:05 +11:00
Darren Tucker f88a7a4312 Add a hostname function for systems that don't have it.
Some systems don't have a hostname command (it's not required by POSIX).
The do have uname -n (which is), but as found by tim@ some others (eg
UnixWare) do not report the FQDN from uname -n.
2021-02-06 09:37:01 +11:00
dtucker@openbsd.org 5e385a71ef upstream: Roll back the hostname->uname change in rev 1.10. It turns
out uname -n doesn't do what we need for some platforms in portable, so we'll
fix the original problem (that some other platforms don't have hostname at
all) by providing wrapper function to implement it.

OpenBSD-Regress-ID: 827a707d6201d5a8e196a8c28aec1d2c76c52341
2021-02-06 09:35:14 +11:00
dtucker@openbsd.org b446c21427 upstream: hostname is not specified by POSIX but uname -n is, so use
the latter for portability.  Patch from Geert Hendrickx via github PR#208.

OpenBSD-Regress-ID: d6a79c7c4d141a0d05ade4a042eb57dddbce89f3
2021-02-05 17:38:19 +11:00
David Carlier 1cb6ce98d6 Using explicit_memset for the explicit_bzero compatibility layer.
Favoriting the native implementation in this case.
2021-02-05 17:07:03 +11:00