summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* upstream: whitespacedjm@openbsd.org2022-08-261-4/+4
| | | | OpenBSD-Commit-ID: d297e4387935d4aef091c5e9432578c2e513f538
* initial list of allowed signersDamien Miller2022-08-261-0/+2
|
* Install Cygwin packages based on OS not config.Darren Tucker2022-08-191-2/+2
|
* upstream: attemp FIDO key signing without PIN and use the errordjm@openbsd.org2022-08-191-22/+20
| | | | | | | code returned to fall back only if necessary. Avoids PIN prompts for FIDO tokens that don't require them; part of GHPR#302 OpenBSD-Commit-ID: 4f752aaf9f2e7c28bcaaf3d4f8fc290131bd038e
* upstream: remove incorrect check that can break enrolling adjm@openbsd.org2022-08-191-5/+1
| | | | | | resident key (introduced in r1.40) OpenBSD-Commit-ID: 4cab364d518470e29e624af3d3f9ffa9c92b6f01
* upstream: Strictly enforce the maximum allowed SSH2 banner size indtucker@openbsd.org2022-08-191-1/+15
| | | | | | | ssh-keyscan and prevent a one-byte buffer overflow. Patch from Qualys, ok djm@ OpenBSD-Commit-ID: 6ae664f9f4db6e8a0589425f74cd0bbf3aeef4e4
* Fix cygwin conditional steps.Darren Tucker2022-08-191-2/+2
|
* Add a bit more debug output.Darren Tucker2022-08-191-0/+2
|
* Add Cygwin (on windows-2019) test target.Darren Tucker2022-08-193-7/+25
| | | | | | In addition to installing the requisite Cygwin packages, we also need to explicitly invoke "sh" for steps that run other scripts since the runner environment doesn't understand #! paths.
* upstream: double free() in error path; from Eusgor via GHPR333djm@openbsd.org2022-08-191-3/+4
| | | | OpenBSD-Commit-ID: 39f35e16ba878c8d02b4d01d8826d9b321be26d4
* Check for perms to run agent-getpeereid test.Darren Tucker2022-08-181-1/+11
| | | | | | Ubuntu 22.04 defaults to private home dirs which prevents "nobody" running ssh-add during the agent-getpeereid test. Check for this and add the necessary permissions.
* on Cygwin, prefer WinHello FIDO deviceDamien Miller2022-08-171-0/+4
| | | | | | | If no FIDO device was explictly specified, then prefer the windows://hello FIDO device. An exception to this is when probing resident FIDO keys, in which case hardware FIDO devices are preferred.
* upstream: add an extra flag to sk_probe() to indicate whether we'redjm@openbsd.org2022-08-171-6/+6
| | | | | | | probing for a FIDO resident key or not. Unused here, but will make like easier for portable OpenBSD-Commit-ID: 432c8ff70e270378df9dbceb9bdeaa5b43b5a832
* upstream: use .Cm for "sign"; from josiah frentsosjmc@openbsd.org2022-08-171-3/+3
| | | | OpenBSD-Commit-ID: 7f80a53d54857ac6ae49ea6ad93c5bd12231d1e4
* Revert "check_sk_options: add temporary WinHello workaround"Corinna Vinschen2022-08-121-9/+0
| | | | | | | | | Cygwin now comes with libfido2 1.11.0, so this workaround isn't required anymore. This reverts commit 242c044ab111a37aad3b0775727c36a4c5f0102c. Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
* fido_dev_is_winhello: return 0, not "false"Corinna Vinschen2022-08-121-1/+1
| | | | | | | "false" is not used anywhere in OpenSSH, so return 0 like everywhere else. Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
* upstream: sftp-server: support home-directory requestdjm@openbsd.org2022-08-122-2/+51
| | | | | | | | | | | Add support to the sftp-server for the home-directory extension defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing expand-path@openssh.com, but uses a more official protocol name, and so is a bit more likely to be implemented by non-OpenSSH clients. From Mike Frysinger, ok dtucker@ OpenBSD-Commit-ID: bfc580d05cc0c817831ae7ecbac4a481c23566ab
* Replace deprecated ubuntu-18.04 runners with 22.04Darren Tucker2022-08-121-9/+9
|
* Add a timegm implementation from Heimdal via Samba.Darren Tucker2022-08-115-0/+89
| | | | Fixes build on (at least Solaris 10).
* Rerun tests if any .github config file changes.Darren Tucker2022-08-113-4/+4
|
* Skip hostbased during Valgrind tests.Darren Tucker2022-08-111-2/+3
| | | | | | | | | Valgrind doesn't let ssh exec ssh-keysign (because it's setuid) so skip it during the Valgrind based tests. See https://bugs.kde.org/show_bug.cgi?id=119404 for a discussion of this (ironically there the problematic binary was ssh(1) back when it could still be setuid).
* upstream: add some tests for parse_absolute_time(), including casesdjm@openbsd.org2022-08-111-1/+63
| | | | | | where it is forced to the UTC timezone. bz3468 ok dtucker OpenBSD-Regress-ID: ea07ca31c2f3847a38df028ca632763ae44e8759
* upstream: allow certificate validity intervals, sshsig verificationdjm@openbsd.org2022-08-114-35/+113
| | | | | | | | | | | | | | | | times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 ok dtucker OpenBSD-Commit-ID: 454db1cdffa9fa346aea5211223a2ce0588dfe13
* Fix conditional for running hostbased tests.Darren Tucker2022-08-111-1/+1
|
* fix SANDBOX_SECCOMP_FILTER_DEBUGDamien Miller2022-08-111-6/+9
|
* Test hostbased auth on github runners.Darren Tucker2022-08-102-0/+15
|
* Rename our getentropy to prevent possible loops.Darren Tucker2022-08-103-2/+11
| | | | | | | | Since arc4random seeds from getentropy, and we use OpenSSL for that if enabled, there's the possibility that if we build on a system that does not have getentropy then run on a system that does have it, then OpenSSL could end up calling our getentropy and getting stuck in a loop. Pointed out by deraadt@, ok djm@
* Actually put HAVE_STDINT_H around the stdint.h.Darren Tucker2022-08-081-2/+2
|
* Give unused param a name.Darren Tucker2022-08-084-5/+70
| | | | | Fixes builds on platforms that do have fido2 but don't have fido_dev_is_winhello.
* upstream: don't prompt for FIDO passphrase before attempting to enrolldjm@openbsd.org2022-08-051-9/+2
| | | | | | | | | the credential, just let the enroll operating fail and we'll attempt to get a PIN anyway. Might avoid some unneccessary PIN prompts. Part of GHPR#302 from Corinna Vinschen; ok dtucker@ OpenBSD-Commit-ID: bd5342ffc353ee37d39617906867c305564d1ce2
* sk_sign: set FIDO2 uv attribute explicitely for WinHelloCorinna Vinschen2022-08-051-0/+8
| | | | | | | | | | WinHello via libfido2 performs user verification by default. However, if we stick to that, there's no way to differentiate between keys created with or without "-O verify-required". Set FIDO2 uv attribute explicitely to FIDO_OPT_FALSE, then check if user verification has been requested. Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
* check_sk_options: add temporary WinHello workaroundCorinna Vinschen2022-08-051-0/+9
| | | | | | | | Up to libfido 1.10.0, WinHello advertises "clientPin" rather than "uv" capability. This is fixed in 1.11.0. For the time being, workaround it here. Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
* compat code for fido_dev_is_winhello()Corinna Vinschen2022-08-052-0/+9
| | | | Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
* Factor out getrnd() and rename to getentropy().Darren Tucker2022-08-055-55/+91
| | | | | | | Factor out the arc4random seeding into its own file and change the interface to match getentropy. Use native getentropy if available. This will make it easier to resync OpenBSD changes to arc4random. Prompted by bz#3467, ok djm@.
* Include CHANNEL and FIDO2 libs in configure outputDarren Tucker2022-08-041-0/+6
|
* upstream: avoid double-free in error path introduced in r1.70; reportdjm@openbsd.org2022-08-011-4/+2
| | | | | | and fix based on GHPR#332 by v-rzh ok dtucker@ OpenBSD-Commit-ID: 3d21aa127b1f37cfc5bdc21461db369a663a951f
* Remove deprecated MacOS 10.15 runners.Darren Tucker2022-07-271-2/+1
|
* Move stale-configure check as early as possible.Darren Tucker2022-07-272-6/+9
| | | | | | | We added a check in Makefile to catch the case where configure needs to be rebuilt, however this did not happen until a build was attempted in which case all of the work done by configure was wasted. Move this check to the start of configure to catch it as early as possible. ok djm@
* Move libcrypto into CHANNELLIBS.Darren Tucker2022-07-272-24/+26
| | | | | This will result in sftp, sftp-server and scp no longer being linked against libcrypto. ok djm@
* Remove seed_rng calls from scp, sftp, sftp-server.Darren Tucker2022-07-273-6/+0
| | | | | These binaries don't use OpenSSL's random functions. The next step will be to stop linking them against libcrypto. ok djm@
* Group libcrypto and PRNGD checks together.Darren Tucker2022-07-271-20/+20
| | | | | They're related more than the libcrypt or libiaf checks which are currently between them. ok djm@
* Do not link scp, sftp and sftp-server w/ zlib.Darren Tucker2022-07-272-10/+15
| | | | | | | | Some of our binaries (eg sftp, sftp-server, scp) do not interact with the channels code and thus do use libraries such as zlib and libcrypto although they are linked with them. This adds a CHANNELLIBS and starts by moving zlib into it, which means the aformentioned binaries are no longer linked against zlib. ok djm@
* Remove workarounds for OpenSSL missing AES-CTR.Darren Tucker2022-07-256-189/+1
| | | | | | | We have some compatibility hacks that were added to support OpenSSL versions that do not support AES CTR mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have CTR, so this is no longer needed. ok djm@
* Remove workarounds for OpenSSL missing AES-GCM.Darren Tucker2022-07-253-49/+0
| | | | | | | We have some compatibility hacks that were added to support OpenSSL versions that do not support AES GCM mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have GCM, so this is no longer needed. ok djm@
* upstream: Restore missing "!" in TEST_SSH_ELAPSED_TIMES test.dtucker@openbsd.org2022-07-251-2/+2
| | | | OpenBSD-Regress-ID: 38783f9676ec348c5a792caecee9a16e354b37b0
* upstream: Test TEST_SSH_ELAPSED_TIMES for empty string notdtucker@openbsd.org2022-07-251-2/+2
| | | | | | | executable. No-op on most platforms but should prevent warnings in -portable on systems that don't have 'date %s'. OpenBSD-Regress-ID: e39d79867b8065e33d0c5926fa1a31f85659d2a4
* Convert "have_prog" function into "which".Darren Tucker2022-07-231-1/+9
| | | | | | | "which" and its behaviour is not standardized, so convert the existing have_prog function into "which" so we can rely on it being available and what its semantics are. Add a have_prog wrapper that maintains the existing behaviour.
* Skip scp3 test if there's no scp on remote path.Darren Tucker2022-07-231-0/+6
| | | | | scp -3 ends up using the scp that's in the remote path and will fail if one is not available. Based on a patch from rapier at psc.edu.
* crank SSH_SK_VERSION_MAJOR in sk-dummy.soDamien Miller2022-07-201-1/+1
|
* upstream: ssh-keygen: fix touch prompt, pin retries;djm@openbsd.org2022-07-201-13/+10
| | | | | | part of GHPR329 from Pedro Martelletto OpenBSD-Commit-ID: 75d1005bd2ef8f29fa834c90d2684e73556fffe8
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 08:53:01 +0100