Skip to content

Commit 7dac438

Browse files
rapier1rapier1
committed
First pass at porting hpnssh to the alpha release of 9.3
1 parent eb3d71a commit 7dac438

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

92 files changed

+1129
-617
lines changed

‎.github/ci-status.md

+4-3
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ master :
44
[![Upstream self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml?query=branch:master)
55
[![CIFuzz](https://github.com/openssh/openssh-portable/actions/workflows/cifuzz.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/cifuzz.yml)
66
[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh)
7+
[![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)
78

8-
9.1 :
9-
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_1)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_1)
10-
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_1)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_1)
9+
9.2 :
10+
[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_2)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_2)
11+
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_2)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_2)

‎.github/configs

+1-1
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ case "${TARGET_HOST}" in
221221
# test run does not time out.
222222
# The agent-restrict test fails due to some quoting issue when run
223223
# with sh or ksh so specify bash for now.
224-
TEST_TARGET="t-exec TEST_SHELL=bash"
224+
TEST_TARGET="t-exec unit TEST_SHELL=bash"
225225
SKIP_LTESTS="rekey sftp"
226226
;;
227227
debian-riscv64)

‎.github/run_test.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ if [ ! -z "$SUDO" ] && [ ! -z "$TEST_SSH_HOSTBASED_AUTH" ]; then
2121
fi
2222

2323
output_failed_logs() {
24-
for i in regress/failed*; do
24+
for i in regress/failed*.log; do
2525
if [ -f "$i" ]; then
2626
echo -------------------------------------------------------------------------
2727
echo LOGFILE $i

‎.github/setup_ci.sh

+3-3
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ PACKAGES=""
77
case "`./config.guess`" in
88
*cygwin)
99
PACKAGER=setup
10-
echo Setting CYGWIN sustem environment variable.
10+
echo Setting CYGWIN system environment variable.
1111
setx CYGWIN "binmode"
12-
chmod -R go-rw /cygdrive/d/a
13-
umask 077
12+
echo Removing extended ACLs so umask works as expected.
13+
setfacl -b . regress
1414
PACKAGES="$PACKAGES,autoconf,automake,cygwin-devel,gcc-core"
1515
PACKAGES="$PACKAGES,make,openssl-devel,zlib-devel"
1616
;;

‎.github/workflows/c-cpp.yml

+1
Original file line numberDiff line numberDiff line change
@@ -96,3 +96,4 @@ jobs:
9696
regress/valgrind-out/
9797
regress/asan.log.*
9898
regress/msan.log.*
99+
regress/log/*

‎.github/workflows/selfhosted.yml

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
name: C/C++ CI self-hosted
2+
3+
on:
4+
push:
5+
branches: [pre-stage, master]
6+
paths: [ '**.c', '**.h', '**.m4', '**.sh', '.github/**', '**/Makefile.in', 'configure.ac' ]
7+
8+
jobs:
9+
selfhosted:
10+
if: github.repository == 'rapier1/openssh-portable-selfhosted'
11+
runs-on: ${{ matrix.host }}
12+
timeout-minutes: 600
13+
env:
14+
HOST: ${{ matrix.host }}
15+
TARGET_HOST: ${{ matrix.target }}
16+
TARGET_CONFIG: ${{ matrix.config }}
17+
strategy:
18+
fail-fast: false
19+
# We use a matrix in two parts: firstly all of the VMs are tested with the
20+
# default config. "target" corresponds to a label associated with the
21+
# worker. The default is an ephemeral VM running under libvirt.
22+
matrix:
23+
target:
24+
- alpine
25+
- centos7
26+
- debian-i386
27+
- dfly30
28+
- dfly48
29+
- dfly58
30+
- dfly60
31+
- dfly62
32+
- fbsd10
33+
- fbsd12
34+
- fbsd13
35+
- minix3
36+
- nbsd3
37+
- nbsd4
38+
- nbsd8
39+
- nbsd9
40+
- obsd51
41+
- obsd67
42+
- obsd69
43+
- obsd70
44+
- obsdsnap
45+
- obsdsnap-i386
46+
- openindiana
47+
- sol10
48+
- sol11
49+
config:
50+
- default
51+
host:
52+
- libvirt
53+
include:
54+
# Then we include extra libvirt test configs.
55+
- { target: aix51, config: default, host: libvirt }
56+
- { target: centos7, config: pam, host: libvirt }
57+
- { target: debian-i386, config: pam, host: libvirt }
58+
- { target: dfly30, config: without-openssl, host: libvirt}
59+
- { target: dfly48, config: pam ,host: libvirt }
60+
- { target: dfly58, config: pam, host: libvirt }
61+
- { target: dfly60, config: pam, host: libvirt }
62+
- { target: dfly62, config: pam, host: libvirt }
63+
- { target: fbsd10, config: pam, host: libvirt }
64+
- { target: fbsd12, config: pam, host: libvirt }
65+
- { target: fbsd13, config: pam, host: libvirt }
66+
- { target: nbsd8, config: pam, host: libvirt }
67+
- { target: nbsd9, config: pam, host: libvirt }
68+
- { target: openindiana, config: pam, host: libvirt }
69+
- { target: sol10, config: pam, host: libvirt }
70+
- { target: sol11, config: pam-krb5, host: libvirt }
71+
- { target: sol11, config: sol64, host: libvirt }
72+
# VMs with persistent disks that have their own runner.
73+
- { target: win10, config: default, host: win10 }
74+
- { target: win10, config: cygwin-release, host: win10 }
75+
# Physical hosts, with either native runners or remote via ssh.
76+
- { target: ARM, config: default, host: ARM }
77+
- { target: ARM64, config: default, host: ARM64 }
78+
- { target: ARM64, config: pam, host: ARM64 }
79+
- { target: debian-riscv64, config: default, host: debian-riscv64 }
80+
- { target: openwrt-mips, config: default, host: openwrt-mips }
81+
- { target: openwrt-mipsel, config: default, host: openwrt-mipsel }
82+
steps:
83+
- name: shutdown VM if running
84+
run: vmshutdown
85+
working-directory: ${{ runner.temp }}
86+
- uses: actions/checkout@main
87+
- name: autoreconf
88+
run: autoreconf
89+
- name: startup VM
90+
run: vmstartup
91+
working-directory: ${{ runner.temp }}
92+
- name: configure
93+
run: vmrun ./.github/configure.sh ${{ matrix.config }}
94+
- name: save config
95+
uses: actions/upload-artifact@main
96+
with:
97+
name: ${{ matrix.target }}-${{ matrix.config }}-config
98+
path: config.h
99+
- name: make clean
100+
run: vmrun make clean
101+
- name: make
102+
run: vmrun make
103+
- name: make tests
104+
run: vmrun ./.github/run_test.sh ${{ matrix.config }}
105+
timeout-minutes: 600
106+
- name: save logs
107+
if: failure()
108+
uses: actions/upload-artifact@main
109+
with:
110+
name: ${{ matrix.target }}-${{ matrix.config }}-logs
111+
path: |
112+
config.h
113+
config.log
114+
regress/*.log
115+
regress/log/*
116+
regress/valgrind-out/
117+
- name: shutdown VM
118+
if: always()
119+
run: vmshutdown
120+
working-directory: ${{ runner.temp }}

‎.github/workflows/upstream.yml

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Upstream self-hosted
2+
3+
on:
4+
push:
5+
branches: [ master, pre-stage ]
6+
paths: [ '**.c', '**.h', '.github/**' ]
7+
8+
jobs:
9+
selfhosted:
10+
if: github.repository == 'rapier1/openssh-portable-selfhosted'
11+
runs-on: 'libvirt'
12+
env:
13+
HOST: 'libvirt'
14+
TARGET_HOST: ${{ matrix.target }}
15+
TARGET_CONFIG: ${{ matrix.config }}
16+
strategy:
17+
fail-fast: false
18+
matrix:
19+
target: [ obsdsnap, obsdsnap-i386 ]
20+
config: [ default, without-openssl, ubsan ]
21+
steps:
22+
- name: shutdown VM if running
23+
run: vmshutdown
24+
working-directory: ${{ runner.temp }}
25+
- uses: actions/checkout@main
26+
- name: startup VM
27+
run: vmstartup
28+
working-directory: ${{ runner.temp }}
29+
- name: update source
30+
run: vmrun "cd /usr/src && cvs up -dPA usr.bin/ssh regress/usr.bin/ssh"
31+
- name: make clean
32+
run: vmrun "cd /usr/src/usr.bin/ssh && make obj && make clean && cd /usr/src/regress/usr.bin/ssh && make obj && make clean && sudo chmod -R g-w /usr/src /usr/obj"
33+
- name: make
34+
run: vmrun "cd /usr/src/usr.bin/ssh && case ${{ matrix.config }} in without-openssl) make OPENSSL=no;; ubsan) make DEBUG='-fsanitize-minimal-runtime -fsanitize=undefined';; *) make; esac"
35+
- name: make install
36+
run: vmrun "cd /usr/src/usr.bin/ssh && sudo make install"
37+
- name: make tests`
38+
run: vmrun "cd /usr/src/regress/usr.bin/ssh && case ${{ matrix.config }} in without-openssl) make OPENSSL=no;; ubsan) make DEBUG='-fsanitize-minimal-runtime -fsanitize=undefined';; *) make; esac"
39+
env:
40+
SUDO: sudo
41+
timeout-minutes: 300
42+
- name: save logs
43+
if: failure()
44+
uses: actions/upload-artifact@main
45+
with:
46+
name: ${{ matrix.target }}-${{ matrix.config }}-logs
47+
path: |
48+
/usr/obj/regress/usr.bin/ssh/obj/*.log
49+
/usr/obj/regress/usr.bin/ssh/obj/log/*
50+
- name: shutdown VM
51+
if: always()
52+
run: vmshutdown
53+
working-directory: ${{ runner.temp }}

‎Makefile.in

+5
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,10 @@ regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c $(REGRESSLIBS)
518518
$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/modpipe.c \
519519
$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS)
520520

521+
regress/timestamp$(EXEEXT): $(srcdir)/regress/timestamp.c $(REGRESSLIBS)
522+
$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/timestamp.c \
523+
$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS)
524+
521525
regress/setuid-allowed$(EXEEXT): $(srcdir)/regress/setuid-allowed.c $(REGRESSLIBS)
522526
$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/setuid-allowed.c \
523527
$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS)
@@ -692,6 +696,7 @@ regress/misc/sk-dummy/sk-dummy.so: $(SK_DUMMY_OBJS)
692696

693697
regress-binaries: regress-prep $(LIBCOMPAT) \
694698
regress/modpipe$(EXEEXT) \
699+
regress/timestamp$(EXEEXT) \
695700
regress/setuid-allowed$(EXEEXT) \
696701
regress/netcat$(EXEEXT) \
697702
regress/check-perm$(EXEEXT) \

‎auth-pam.c

+10-5
Original file line numberDiff line numberDiff line change
@@ -351,11 +351,12 @@ import_environments(struct sshbuf *b)
351351
/* Import environment from subprocess */
352352
if ((r = sshbuf_get_u32(b, &num_env)) != 0)
353353
fatal("%s: buffer error: %s", __func__, ssh_err(r));
354-
if (num_env > 1024)
355-
fatal("%s: received %u environment variables, expected <= 1024",
356-
__func__, num_env);
354+
if (num_env > 1024) {
355+
fatal_f("received %u environment variables, expected <= 1024",
356+
num_env);
357+
}
357358
sshpam_env = xcalloc(num_env + 1, sizeof(*sshpam_env));
358-
debug3("PAM: num env strings %d", num_env);
359+
debug3("PAM: num env strings %u", num_env);
359360
for(i = 0; i < num_env; i++) {
360361
if ((r = sshbuf_get_cstring(b, &(sshpam_env[i]), NULL)) != 0)
361362
fatal("%s: buffer error: %s", __func__, ssh_err(r));
@@ -365,7 +366,11 @@ import_environments(struct sshbuf *b)
365366
/* Import PAM environment from subprocess */
366367
if ((r = sshbuf_get_u32(b, &num_env)) != 0)
367368
fatal("%s: buffer error: %s", __func__, ssh_err(r));
368-
debug("PAM: num PAM env strings %d", num_env);
369+
if (num_env > 1024) {
370+
fatal_f("received %u PAM env variables, expected <= 1024",
371+
num_env);
372+
}
373+
debug("PAM: num PAM env strings %u", num_env);
369374
for (i = 0; i < num_env; i++) {
370375
if ((r = sshbuf_get_cstring(b, &env, NULL)) != 0)
371376
fatal("%s: buffer error: %s", __func__, ssh_err(r));

‎auth-shadow.c

+7-7
Original file line numberDiff line numberDiff line change
@@ -56,23 +56,23 @@ int
5656
auth_shadow_acctexpired(struct spwd *spw)
5757
{
5858
time_t today;
59-
int daysleft;
59+
long long daysleft;
6060
int r;
6161

6262
today = time(NULL) / DAY;
6363
daysleft = spw->sp_expire - today;
64-
debug3("%s: today %d sp_expire %d days left %d", __func__, (int)today,
65-
(int)spw->sp_expire, daysleft);
64+
debug3("%s: today %lld sp_expire %lld days left %lld", __func__,
65+
(long long)today, (long long)spw->sp_expire, daysleft);
6666

6767
if (spw->sp_expire == -1) {
6868
debug3("account expiration disabled");
6969
} else if (daysleft < 0) {
7070
logit("Account %.100s has expired", spw->sp_namp);
7171
return 1;
7272
} else if (daysleft <= spw->sp_warn) {
73-
debug3("account will expire in %d days", daysleft);
73+
debug3("account will expire in %lld days", daysleft);
7474
if ((r = sshbuf_putf(loginmsg,
75-
"Your account will expire in %d day%s.\n", daysleft,
75+
"Your account will expire in %lld day%s.\n", daysleft,
7676
daysleft == 1 ? "" : "s")) != 0)
7777
fatal("%s: buffer error: %s", __func__, ssh_err(r));
7878
}
@@ -98,8 +98,8 @@ auth_shadow_pwexpired(Authctxt *ctxt)
9898
}
9999

100100
today = time(NULL) / DAY;
101-
debug3("%s: today %d sp_lstchg %d sp_max %d", __func__, (int)today,
102-
(int)spw->sp_lstchg, (int)spw->sp_max);
101+
debug3_f("today %lld sp_lstchg %lld sp_max %lld", (long long)today,
102+
(long long)spw->sp_lstchg, (long long)spw->sp_max);
103103

104104
#if defined(__hpux) && !defined(HAVE_SECUREWARE)
105105
if (iscomsec()) {

‎auth.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth.c,v 1.159 2022/12/09 00:17:40 dtucker Exp $ */
1+
/* $OpenBSD: auth.c,v 1.160 2023/03/05 05:34:09 dtucker Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -74,7 +74,6 @@
7474
#include "authfile.h"
7575
#include "monitor_wrap.h"
7676
#include "ssherr.h"
77-
#include "compat.h"
7877
#include "channels.h"
7978

8079
/* import */

‎auth2-hostbased.c

+1-8
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-hostbased.c,v 1.50 2022/09/17 10:34:29 djm Exp $ */
1+
/* $OpenBSD: auth2-hostbased.c,v 1.52 2023/03/05 05:34:09 dtucker Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -40,7 +40,6 @@
4040
#include "log.h"
4141
#include "misc.h"
4242
#include "servconf.h"
43-
#include "compat.h"
4443
#include "sshkey.h"
4544
#include "hostfile.h"
4645
#include "auth.h"
@@ -101,12 +100,6 @@ userauth_hostbased(struct ssh *ssh, const char *method)
101100
"(received %d, expected %d)", key->type, pktype);
102101
goto done;
103102
}
104-
if (sshkey_type_plain(key->type) == KEY_RSA &&
105-
(ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
106-
error("Refusing RSA key because peer uses unsafe "
107-
"signature format");
108-
goto done;
109-
}
110103
if (match_pattern_list(pkalg, options.hostbased_accepted_algos, 0) != 1) {
111104
logit_f("signature algorithm %s not in "
112105
"HostbasedAcceptedAlgorithms", pkalg);

‎auth2-none.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-none.c,v 1.24 2021/12/19 22:12:07 djm Exp $ */
1+
/* $OpenBSD: auth2-none.c,v 1.25 2023/03/05 05:34:09 dtucker Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -44,7 +44,6 @@
4444
#include "log.h"
4545
#include "misc.h"
4646
#include "servconf.h"
47-
#include "compat.h"
4847
#include "ssh2.h"
4948
#include "ssherr.h"
5049
#ifdef GSSAPI

‎auth2-pubkey.c

+1-7
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-pubkey.c,v 1.117 2022/09/17 10:34:29 djm Exp $ */
1+
/* $OpenBSD: auth2-pubkey.c,v 1.118 2023/02/17 04:22:50 dtucker Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -153,12 +153,6 @@ userauth_pubkey(struct ssh *ssh, const char *method)
153153
"(received %d, expected %d)", key->type, pktype);
154154
goto done;
155155
}
156-
if (sshkey_type_plain(key->type) == KEY_RSA &&
157-
(ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
158-
logit("Refusing RSA key because client uses unsafe "
159-
"signature scheme");
160-
goto done;
161-
}
162156
if (auth2_key_already_used(authctxt, key)) {
163157
logit("refusing previously-used %s key", sshkey_type(key));
164158
goto done;

0 commit comments

Comments
 (0)