summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* session: skip timestamp init for non-blocking caseJon Simons2014-02-061-1/+5
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* session: add getters for session cipher namesJon Simons2014-02-062-0/+34
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Revert f2c2687ca6c6c7e25c9a547227027ab28eb4fc16Aris Adamantiadis2014-02-051-1/+1
| | | | | Fix bug #142 The mode does need to be an octal numeric string. Mode 0600 now gets sent on the wire as 0384, triggering a "scp: protocol error: bad mode" response, and an "scp status code 1d not valid" message from libssh.
* knownhosts: resolve leaks found by coverityAris Adamantiadis2014-02-052-9/+8
|
* knownhosts: detect variations of ecdsaAris Adamantiadis2014-02-045-43/+117
|
* server: use custom server bannersAudrius Butkevicius2014-02-041-2/+2
| | | | | | Value of session->serverbanner never gets used Signed-off-by: Audrius Butkevicius <audrius.butkevicius@gmail.com>
* threads: Be less strict when deciding whether to build libssh_threads.Raphael Kubo da Costa2014-02-031-2/+2
| | | | | | | | | | | | | | | | | As mentioned in the previous commit, there are cases where CMAKE_HAVE_THREADS_LIBRARY is not set and pthreads _is_ being used: one can pass -DTHREADS_HAVE_PTHREAD_ARG=1 to CMake directly so that it just passes -pthread to the compiler/linker and does not set CMAKE_HAVE_THREADS_LIBRARY. Since we are only interested in knowing whether any threading library has been found, we should use CMAKE_THREAD_LIBS_INIT instead (Threads_FOUND would also work). Note that, at the moment, there is only a pthreads backend available in threads/, so if it is not found configuration will fail because CMake will try to create a library from an empty set of source files. Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* ConfigureChecks: Stop checking for CMAKE_HAVE_THREADS_LIBRARY.Raphael Kubo da Costa2014-02-031-5/+3
| | | | | | | | | | | libssh is primarily interested in whether pthreads is present and can be used. Checking for CMAKE_HAVE_THREADS_LIBRARY is not the same thing, as there are cases where pthread exists but CMAKE_HAVE_THREADS_LIBRARY is not set (for example, FreeBSD passes -DTHREADS_HAVE_PTHREAD_ARG=1 to CMake by default as a way to skip the checks for -lpthread, -lpthreads and others and tell the build system that -pthread is the one expected to be used). Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* socket: fix read of non-connected socketJon Simons2014-02-021-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ensure to check whether the socket at hand is indeed still connected throughout POLLIN processing in ssh_socket_pollcallback. Before this change, the POLLIN block in ssh_socket_pollcallback is predicated against the condition (s->state == SSH_SOCKET_CONNECTED). Once entered, data from the socket is consumed through the data callback in this loop: do { r = s->callbacks->data(buffer_get_rest(s->in_buffer), buffer_get_rest_len(s->in_buffer), s->callbacks->userdata); buffer_pass_bytes(s->in_buffer,r); } while (r > 0); However, it is possible for the socket data callback to change the state of the socket (closing it, for example). Fix the loop to only continue so long as the socket remains connected: this also entails setting the ssh_socket state to SSH_SOCKET_CLOSED upon close. The bug can be observed before the change by sending a bogus banner to the server: 'echo -e "A\r\nB\r\n" | nc localhost 22'. Each of 'A' and 'B' will be processed by 'callback_receive_banner', even though the client socket is closed after rejection of 'A'. Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* doc: correct ssh_channel_read_timeout unitsJon Simons2014-02-022-7/+7
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* doc: Document expected return value of channel data callbackAudrius Butkevicius2014-02-021-0/+2
| | | | | Signed-off-by: Audrius Butkevicius <audrius.butkevicius@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* src: Fix argument order in ssh_channel_pty_window_change_callbackAudrius Butkevicius2014-02-021-2/+2
| | | | | | | So that it would match ssh_channel_pty_request_callback as well as the documentation Signed-off-by: Audrius Butkevicius <audrius.butkevicius@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* src: Define MAX_BUF_SIZE globally and use it.Joseph Southwell2014-02-025-5/+17
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* client: Fix EOF session error reporting.Joseph Southwell2014-02-022-3/+9
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Make function ssh_channel_accept() nonblocking if timeout is 0.Oleksandr Shneyder2014-02-021-1/+5
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* build: remove OSX deprecated warnings for opensslAris Adamantiadis2014-02-022-10/+7
|
* build: fix cmake bug introduced yesterdayAris Adamantiadis2014-02-021-3/+3
| | | | Compilation failed on OSX because of the missing OR OSX
* Kex: fix coverity warning + edge caseAris Adamantiadis2014-02-021-4/+8
|
* server: allow custom server banners (bug #83)Aris Adamantiadis2014-02-013-2/+12
|
* Knownhosts: implement hostkey with knownhosts heuristicAris Adamantiadis2014-02-011-1/+24
|
* knownhosts: add test case for bug #138Aris Adamantiadis2014-02-011-0/+43
|
* known_hosts: add ssh_knownhosts_algorithms()Aris Adamantiadis2014-02-013-3/+108
| | | | | Goal of that function is to test the preferred key exchange methods based on what's available in the known_hosts file
* Added known host test casesAris Adamantiadis2014-02-011-0/+122
|
* tests: fix compilation on OSX (libargp detection)Aris Adamantiadis2014-02-011-1/+1
|
* pki_crypto: Fix memory leak with EC_KEY_set_public_key().Andreas Schneider2014-01-281-1/+3
| | | | BUG: https://red.libssh.org/issues/146
* doc: Document the unit for ssh_select() timeout.Andreas Schneider2014-01-231-1/+1
| | | | BUG: https://red.libssh.org/issues/143
* dh: Fix NULL check for p_group14.Rod Vagg2014-01-231-1/+1
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* pki_crypto: fix DSA signature extractionJon Simons2014-01-231-26/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix the DSA portion of 'pki_signature_to_blob': before this change, it is possible to sometimes observe DSA signature validation failure when testing with OpenSSH clients. The problem ended up being the following snippet which did not account for the case when 'ssh_string_len(x)' may be less than 20: r = make_bignum_string(sig->dsa_sig->r); ... memcpy(buffer, ((char *) ssh_string_data(r)) + ssh_string_len(r) - 20, 20); Above consider the case that ssh_string_len(r) is 19; in that case the memcpy unintentionally starts in the wrong place. The same situation can happen for value 's' in this code. To fix, adjust the offsets used for the input and output pointers, taking into account that the lengths of 'r' and 's' can be less than 20. With the fix I am no longer able to reproduce the original failure mode. BUG: https://red.libssh.org/issues/144 Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* pki: Use ssh_buffer_add_data() in pki_gcrypt..Andreas Schneider2014-01-221-3/+3
|
* doc: Fix description of error parameter for ssh_get_error*Alan Dunn2014-01-221-2/+2
| | | | | | | | | ssh_get_error can actually work on anything with an ssh_common_struct as its first member. It is already used in examples in the distribution with ssh_sessions and ssh_binds. Signed-off-by: Alan Dunn <amdunn@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* pki_crypto: pad RSA signature blobsJon Simons2014-01-211-24/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Pad RSA signature blobs to the expected RSA signature length when processing via 'pki_signature_to_blob'. Some clients, notably PuTTY, may send unpadded RSA signatures during the public key exchange: before this change, one can sometimes observe failure in signature validation when using PuTTY's 'plink' client, along these lines: ssh_packet_process: ssh_packet_process: Dispatching handler for packet type 50 ssh_packet_userauth_request: ssh_packet_userauth_request: Auth request for service ssh-connection, method publickey for user 'foo' ssh_pki_signature_verify_blob: ssh_pki_signature_verify_blob: Going to verify a ssh-rsa type signature pki_signature_verify: pki_signature_verify: RSA error: error:04091077:rsa routines:INT_RSA_VERIFY:wrong signature length ssh_packet_userauth_request: ssh_packet_userauth_request: Received an invalid signature from peer For cross-reference this issue once also existed between PuTTY and OpenSSH: http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/rsa-verify-failed.html http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/ssh-rsa.c?rev=1.19;content-type=text%2Fx-cvsweb-markup With the fix I am unable to reproduce the above failure mode when testing with 'plink'. Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Test change to ssh_bind_accept_fdAlan Dunn2014-01-211-0/+139
| | | | | Signed-off-by: Alan Dunn <amdunn@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Import keys during ssh_bind_accept_fdAlan Dunn2014-01-211-1/+11
| | | | | Signed-off-by: Alan Dunn <amdunn@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Separate out key import functionality from ssh_bind_listenAlan Dunn2014-01-211-12/+23
| | | | | Signed-off-by: Alan Dunn <amdunn@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* src: Rename buffer_add_data() to ssh_buffer_add_data().Andreas Schneider2014-01-1920-89/+114
|
* src: Rename buffer_init to ssh_buffer_init().Andreas Schneider2014-01-1917-48/+53
|
* doc: Fix channel documentation.Andreas Schneider2014-01-171-31/+49
|
* pki: Do not use deprecated string functions.Andreas Schneider2014-01-171-1/+1
|
* src: Do not use deprecated functions.Andreas Schneider2014-01-169-35/+35
|
* include: Mark functions as deprecated!Andreas Schneider2014-01-161-45/+45
|
* bind: fix possible double-frees in ssh_bind_freeJon Simons2014-01-161-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure to explicitly set key pointers to NULL following the use of 'ssh_key_free' throughout bind.c. Before this change, a double free can happen via 'ssh_bind_free' as in this example callpath: // create an ssh_bind ssh_bind b = ssh_bind_new(); // provide a path to a wrong key-type ssh_bind_options_set(b, SSH_BIND_OPTIONS_DSAKEY, path_to_rsa_key); // initialize set key-type ssh_bind_listen(b); -> error path "The DSA host key has the wrong type: %d", ssh_key_free(sshbind->dsa) -> ssh_key_clean(key) // OK -> SAFE_FREE(key) // OK, but, sshbind->dsa is *not* set to NULL // ssh_bind_listen failed, so clean up ssh_bind ssh_bind_free(b); -> ssh_key_free(sshbind->dsa) // double-free here To fix, set pointers to NULL that have been free'd with 'ssh_key_free'. Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* doc: Add changes to the forwarding tutorial.Andreas Schneider2014-01-161-5/+6
|
* channel: Fix the name scheme of the forward functions.Andreas Schneider2014-01-165-24/+40
|
* channel: Add ssh_channel_accept_forward().Oleksandr Shneyder2014-01-162-3/+24
| | | | | | | | This works same way as ssh_forward_accept() but can return a destination port of the channel (useful if SSH connection forwarding several TCP/IP ports). Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Rename build directory to obj.Andreas Schneider2014-01-163-2/+2
| | | | | Some buildsystem use build in the pathname and so we will filter out e.g. docs generation.
* threads: support libgcrypt 1.6 hackAris Adamantiadis2014-01-083-2/+26
| | | | | | | Not 100% satisfied of this patch, but the way libgcrypt handles threading in 1.6 is not compatible with custom handlers. The new code basicaly uses pthreads in every case. This will probably not work on windows.
* include: Remove warning cause VSC doesn't know about it.Andreas Schneider2014-01-081-1/+0
|
* include: Fix building if we do not have asm volatile.Andreas Schneider2014-01-081-1/+2
|
* src: Update my mail address.Andreas Schneider2014-01-0719-19/+19
|
* cmake: Remove unused macro modules.Andreas Schneider2014-01-075-108/+0
|
generated by cgit (git 2.34.1) at 2025-08-31 03:59:33 +0000