Commit Graph

10921 Commits

Author SHA1 Message Date
Darren Tucker
41d232e226 Add test against Valgrind. 2021-02-19 10:16:56 +11:00
Darren Tucker
e6528d91f1 Add fbsd12 test target. 2021-02-18 16:30:01 +11:00
Darren Tucker
6506cb2798 Remove unused arg. 2021-02-18 15:21:13 +11:00
Darren Tucker
93c31a6239 Add DEBUG_SK to kitchensink builds. 2021-02-18 14:54:07 +11:00
Darren Tucker
65085740d3 Add bbone test target (arm32). 2021-02-18 14:53:14 +11:00
djm@openbsd.org
63238f5aed upstream: Fix the hostkeys rotation extension documentation
The documentation was lacking the needed want-reply field in the initial
global request.

https://github.com/openssh/openssh-portable/pull/218 by dbussink

OpenBSD-Commit-ID: 051824fd78edf6d647a0b9ac011bf88e28775054
2021-02-18 13:50:37 +11:00
djm@openbsd.org
34c5ef6e2d upstream: make names in function prototypes match those in
definition from https://github.com/openssh/openssh-portable/pull/225 by
ZenithalHourlyRate

OpenBSD-Commit-ID: 7c736307bf3f2c7cb24d6f82f244eee959485acd
2021-02-18 13:17:43 +11:00
djm@openbsd.org
88e3d4de31 upstream: unbreak SK_DEBUG builds
from https://github.com/openssh/openssh-portable/pull/225 by
ZenithalHourlyRate

OpenBSD-Commit-ID: 28d7259ce1b04d025411464decfa2f1a097b43eb
2021-02-18 13:17:43 +11:00
djm@openbsd.org
788cbc5b74 upstream: sftp-server: implement limits@openssh.com extension
This is a simple extension that allows the server to clearly
communicate transfer limits it is imposing so the client doesn't
have to guess, or force the user to manually tune.  This is
particularly useful when an attempt to use too large of a value
causes the server to abort the connection.

Patch from Mike Frysinger; ok dtucker@

OpenBSD-Commit-ID: f96293221e5aa24102d9bf30e4f4ef04d5f4fb51
2021-02-18 13:17:43 +11:00
Damien Miller
324449a68d support OpenSSL 3.x cipher IV API change
OpenSSL renamed the "get current CIPHER_CTX" IV operation in 3.x.
This uses the new name if available.

https://github.com/openssl/openssl/issues/13411

bz#3238 ok dtucker@
2021-02-18 12:06:25 +11:00
Damien Miller
845fe9811c prefer login_getpwclass() to login_getclass()
FreeBSD has login_getpwclass() that does some special magic for
UID=0. Prefer this to login_getclass() as its easier to emulate
the former with the latter.

Based on FreeBSD PR 37416 via Ed Maste; ok dtucker@
2021-02-18 11:27:09 +11:00
Darren Tucker
d0763c8d56 Fixing quoting for installing moduli on target guest. 2021-02-18 11:05:48 +11:00
Darren Tucker
b3afc243bc Install moduli on target not host. 2021-02-18 10:41:58 +11:00
Damien Miller
f060c2bc85 don't free string returned by login_getcapstr(3)
OpenBSD and NetBSD require the caller to free strings returned
bu the login_* functions, but FreeBSD requires that callers don't.

Fortunately in this case, we can harmlessly leak as the process is
about to exec the shell/command.

From https://reviews.freebsd.org/D28617 via Ed Maste; ok dtucker@
2021-02-18 10:36:54 +11:00
Darren Tucker
bc9b0c2570 Skip unit tests on sol11 to speed things up. 2021-02-18 10:10:00 +11:00
Darren Tucker
161873035c Remove SKIP_UNIT as it needs to be a make arg. 2021-02-18 10:09:27 +11:00
Darren Tucker
1c293868e4 Always intall moduli.
Allows us to run tests without falling back to a fixed modulus.  Ensure that
the directory exists.
2021-02-18 10:05:03 +11:00
Darren Tucker
5c8f41ad10 Quote SSHD_CONFOPTS in case it contains spaces. 2021-02-18 09:59:09 +11:00
Darren Tucker
4653116c1f Fix labels on targets (dots vs underscores). 2021-02-18 09:51:18 +11:00
Darren Tucker
4512047f57 More compact representation of config matrix. 2021-02-17 21:47:48 +11:00
Darren Tucker
0406cd09f0 Skip unit tests on hosted VMs to speed things up. 2021-02-17 21:19:18 +11:00
Darren Tucker
4582612e61 Merge macos and ubuntu tests. 2021-02-17 20:46:03 +11:00
Darren Tucker
09f4b84654 Convert most github hosted tests to new config structure. 2021-02-17 20:46:03 +11:00
Darren Tucker
65380ff7e0 Only run selfhosted tests from selfhosted repo. 2021-02-17 18:27:36 +11:00
Darren Tucker
f031366535 Add self-hosted runners for VMs of other platforms.
Github only hosts a limited number of platforms, and the runner code
is only supported on slightly wider range of platforms.  To increase
our test coverage beyond that, we run the runner natively on a VM host,
where it runs a jobs that boot VMs of other platforms, waits for them
to come up then runs the build and test by ssh'ing into the guest.
This means that the minimum dependencies for the guests are quite low
(basically just sshd, a compiler and make).

The interface to the VM host is fairly simple (basically 3 scripts:
vmstartup, vmrun and vmshutdown), but those are specific to the VM host
so are not in the public repo.  We also mount the working directory on the
host via sshfs, so things like artifact upload by the runner also work.

As part of this we are moving the per-test-target configs into a single
place (.github/configs) where there will be referenced by a single short
"config" key.  I plan to make the github-hosted runners use this too.

The self-hosted runners are run off a private repo on github since that
prevents third parties from accessing them[0], and since runner quota is
limited on private repos, we avoid running the tests we run on the public
repo.

[0] https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories
2021-02-17 18:20:40 +11:00
dtucker@openbsd.org
64bbd7444d upstream: Make sure puttygen is new enough to successfully run the
PuTTY interop tests, otherwise skip them.

OpenBSD-Regress-ID: 34565bb50b8aec58331ed02a5e9e0a9a929bef51
2021-02-17 15:08:29 +11:00
markus@openbsd.org
da0a9afcc4 upstream: ssh: add PermitRemoteOpen for remote dynamic forwarding
with SOCKS ok djm@, dtucker@

OpenBSD-Commit-ID: 64fe7b6360acc4ea56aa61b66498b5ecc0a96a7c
2021-02-17 15:03:41 +11:00
markus@openbsd.org
b696858a7f upstream: factor out opt_array_append; ok djm@
OpenBSD-Commit-ID: 571bc5dd35f99c5cf9de6aaeac428b168218e74a
2021-02-17 15:03:41 +11:00
dlg@openbsd.org
ad74fc127c upstream: ProxyJump takes "none" to disable processing like
ProxyCommand does

ok djm@ jmc@

OpenBSD-Commit-ID: 941a2399da2193356bdc30b879d6e1692f18b6d3
2021-02-17 15:03:41 +11:00
djm@openbsd.org
16eacdb016 upstream: sftp: add missing lsetstat@openssh.com documentation
patch from Mike Frysinger

OpenBSD-Commit-ID: 9c114db88d505864075bfe7888b7c8745549715b
2021-02-17 15:03:41 +11:00
djm@openbsd.org
e04fd6dde1 upstream: factor SSH_AGENT_CONSTRAIN_EXTENSION parsing into its own
function and remove an unused variable; ok dtucker@

OpenBSD-Commit-ID: e1a938657fbf7ef0ba5e73b30365734a0cc96559
2021-02-17 15:03:41 +11:00
Darren Tucker
1bb130ed34 Add __NR_futex_time64 to seccomp sandbox.
This is apparently needed for (some) 32 bit platforms with glibc 2.33.
Patch from nix at esperi.org.uk and jjelen at redhat.com via bz#3260.
2021-02-11 10:18:05 +11:00
Darren Tucker
f88a7a4312 Add a hostname function for systems that don't have it.
Some systems don't have a hostname command (it's not required by POSIX).
The do have uname -n (which is), but as found by tim@ some others (eg
UnixWare) do not report the FQDN from uname -n.
2021-02-06 09:37:01 +11:00
dtucker@openbsd.org
5e385a71ef upstream: Roll back the hostname->uname change in rev 1.10. It turns
out uname -n doesn't do what we need for some platforms in portable, so we'll
fix the original problem (that some other platforms don't have hostname at
all) by providing wrapper function to implement it.

OpenBSD-Regress-ID: 827a707d6201d5a8e196a8c28aec1d2c76c52341
2021-02-06 09:35:14 +11:00
dtucker@openbsd.org
b446c21427 upstream: hostname is not specified by POSIX but uname -n is, so use
the latter for portability.  Patch from Geert Hendrickx via github PR#208.

OpenBSD-Regress-ID: d6a79c7c4d141a0d05ade4a042eb57dddbce89f3
2021-02-05 17:38:19 +11:00
David Carlier
1cb6ce98d6 Using explicit_memset for the explicit_bzero compatibility layer.
Favoriting the native implementation in this case.
2021-02-05 17:07:03 +11:00
Luca Weiss
2e0beff67d Deny (non-fatal) statx in preauth privsep child. 2021-02-05 13:56:26 +11:00
dtucker@openbsd.org
a35d3e911e upstream: Remove debug message from sigchld handler. While this
works on OpenBSD it can cause problems on other platforms.  From kircherlike
at outlook.com via bz#3259, ok djm@

OpenBSD-Commit-ID: 3e241d7ac1ee77e3de3651780b5dc47b283a7668
2021-02-05 13:38:57 +11:00
djm@openbsd.org
69338ab46a upstream: whitespace
OpenBSD-Commit-ID: 544bb092e03fcbecb420196cd0f70af13ea868ad
2021-02-05 13:38:57 +11:00
djm@openbsd.org
f71219a01d upstream: fix memleaks in private key deserialisation; enforce more
consistency between redundant fields in private key certificate and private
key body; ok markus@

OpenBSD-Commit-ID: dec344e414d47f0a7adc13aecf3760fe58101240
2021-02-05 13:38:57 +11:00
djm@openbsd.org
3287790e78 upstream: memleak on error path; ok markus@
OpenBSD-Commit-ID: 2091a36d6ca3980c81891a6c4bdc544e63cb13a8
2021-02-05 13:38:57 +11:00
djm@openbsd.org
3dd0c64e08 upstream: more strictly enforce KEX state-machine by banning packet
types once they are received. Fixes memleak caused by duplicate
SSH2_MSG_KEX_DH_GEX_REQUEST (spotted by portable OpenSSH kex_fuzz via
oss-fuzz #30078).

ok markus@

OpenBSD-Commit-ID: 87331c715c095b587d5c88724694cdeb701c9def
2021-02-01 09:57:28 +11:00
dtucker@openbsd.org
7a92a324a2 upstream: Set linesize returned by getline to zero when freeing and
NULLing the returned string.  OpenBSD's getline handles this just fine, but
some implementations used by -portable do not.  ok djm@

OpenBSD-Commit-ID: 4d7bd5169d3397654247db9655cc69a9908d165c
2021-02-01 09:57:28 +11:00
Damien Miller
a5dfc5bae8 allow a fuzz case to contain more than one request
loop until input buffer empty, no message consumed or 256 messages
processed
2021-01-30 16:32:29 +11:00
Damien Miller
0ef24ad602 expect fuzz cases to have length prefix
might make life a little easier for the fuzzer, e.g. it can now
produce valid (multi-request) messages by smashing two cases together.
2021-01-30 16:28:23 +11:00
Damien Miller
de613f2713 ssh-agent fuzzer 2021-01-30 13:18:30 +11:00
Damien Miller
7e96c877bc move keys out of kex_fuzz.cc into separate header
add certificates and missing key types
2021-01-30 12:02:46 +11:00
Damien Miller
76f46d7566 some fixed test data (mostly keys) for fuzzing 2021-01-30 12:02:10 +11:00
djm@openbsd.org
7c2e3d6de1 upstream: add a SK_DUMMY_INTEGRATE define that allows the dummy
security key middleware to be directly linked; useful for writing fuzzers,
etc.

OpenBSD-Regress-ID: 0ebd00159b58ebd85e61d8270fc02f1e45df1544
2021-01-30 11:58:38 +11:00
djm@openbsd.org
1a4b927586 upstream: fix the values of enum sock_type
OpenBSD-Commit-ID: 18d048f4dbfbb159ff500cfc2700b8fb1407facd
2021-01-30 11:58:31 +11:00