summaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* ed25519: Generate, sign and verify keys.Aris2014-09-072-0/+19
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* crypto: Add ed25519 implementation from OpenSSH.Aris Adamantiadis2014-09-076-1/+267
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* buffer: Add a secure buffer mechanism to avoid memory spillsAris Adamantiadis2014-09-071-0/+2
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* bignums: detach bignum-related functions from dh.c.Aris Adamantiadis2014-08-062-4/+32
| | | | Reviewed-by: Andreas Schneider <asn@samba.org>
* crypto: fix secure burning, structure members namingAris Adamantiadis2014-08-061-2/+2
| | | | Reviewed-by: Andreas Schneider <asn@samba.org>
* buffer: add a hidden canary to detect format errorsAris Adamantiadis2014-08-061-2/+7
| | | | Reviewed-by: Andreas Schneider <asn@samba.org>
* buffers: adapt sftp.c to ssh_buffer_(un)pack()Aris Adamantiadis2014-08-061-4/+4
| | | | Reviewed-by: Andreas Schneider <asn@samba.org>
* Buffer: add ssh_buffer_(un)pack()Aris Adamantiadis2014-08-061-0/+6
| | | | | | | That function permits chaining of buffer values to minimize buffer handling in packet sending code. Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* pki: Add missing semi-colon.Andreas Schneider2014-05-071-1/+1
|
* pki: Make pki_key_ecdsa_nid_to_name() a shared function.Andreas Schneider2014-04-231-0/+1
|
* Add options support for setting and getting HMAC algorithmsDirkjan Bussink2014-04-222-0/+5
| | | | | | BUG: https://red.libssh.org/issues/91 Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Add negotiation for SHA2 HMAC algorithmsDirkjan Bussink2014-04-221-0/+7
| | | | | | BUG: https://red.libssh.org/issues/91 Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Add logic to support SHA2 HMAC algorithmsDirkjan Bussink2014-04-223-2/+9
| | | | | | BUG: https://red.libssh.org/issues/91 Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Add SHA2 algorithms for HMACDirkjan Bussink2014-04-223-1/+38
| | | | | | BUG: https://red.libssh.org/issues/91 Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* kex: server fix for first_kex_packet_followsJon Simons2014-04-221-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | Ensure to honor the 'first_kex_packet_follow' field when processing KEXINIT messages in the 'ssh_packet_kexinit' callback. Until now libssh would assume that this field is always unset (zero). But some clients may set this (dropbear at or beyond version 2013.57), and it needs to be included when computing the session ID. Also include logic for handling wrongly-guessed key exchange algorithms. Save whether a client's guess is wrong in a new field in the session struct: when set, the next KEX_DHINIT message to be processed will be ignored per RFC 4253, 7.1. While here, update both 'ssh_packet_kexinit' and 'make_sessionid' to use softabs with a 4 space indent level throughout, and also convert various error-checking to store intermediate values into an explicit 'rc'. Patch adjusted from original to ensure that client tests remain passing (ie 'torture_connect'): restrict the changes in 'ssh_packet_kexinit' only for the 'server_kex' case. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Revert "kex: server fix for first_kex_packet_follows"Andreas Schneider2014-04-151-9/+0
| | | | | | The patch breaks the client with ECDSA. This reverts commit 5865b9436fda96ac9fc7c18e4dffe5fb12dcc515.
* kex: server fix for first_kex_packet_followsJon Simons2014-04-101-0/+9
| | | | | | | | | | | | | | | | | | | | | Ensure to honor the 'first_kex_packet_follow' field when processing KEXINIT messages in the 'ssh_packet_kexinit' callback. Until now libssh would assume that this field is always unset (zero). But some clients may set this (dropbear at or beyond version 2013.57), and it needs to be included when computing the session ID. Also include logic for handling wrongly-guessed key exchange algorithms. Save whether a client's guess is wrong in a new field in the session struct: when set, the next KEX_DHINIT message to be processed will be ignored per RFC 4253, 7.1. While here, update both 'ssh_packet_kexinit' and 'make_sessionid' to use softabs with a 4 space indent level throughout, and also convert various error-checking to store intermediate values into an explicit 'rc'. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* Revert "direct-tcpip and forwarded-tcpip callbacks"Andreas Schneider2014-04-091-32/+2
| | | | | | | This reverts commit efe785e711e1fe8c66dc120b741d1e560ef556db. We need a Signed-off version. I didn't have the Certificate of Origin yet.
* direct-tcpip and forwarded-tcpip callbacksLoïc Michaux2014-04-091-2/+32
|
* pki crypto: expose new ssh_pki_key_ecdsa_name APIJon Simons2014-04-091-0/+2
| | | | | | | | | | | | | Enable retrieving the "ecdsa-sha2-nistpNNN" name of ECDSA keys with a new 'ssh_pki_key_ecdsa_name' API. This gives more information than the 'ssh_key_type_to_char' API, which yields "ssh-ecdsa" for ECDSA keys. The motivation is that this info is useful to have in a server context. The torture_pki unit test is updated to include the new API, and a few more passes are added to additionally test 384 and 521-bit keys. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* libsshpp: include required <string> header for std::stringPetar Koretic2014-04-091-0/+1
| | | | | Signed-off-by: Petar Koretic <petar.koretic@sartura.hr> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* doc: Improve and consolidate ssh_bind_options_set docsAlan Dunn2014-03-271-63/+0
| | | | | Signed-off-by: Alan Dunn <amdunn@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* libssh: libhpp: overload read function to support timeout parameterPetar Koretic2014-03-271-1/+19
| | | | | Signed-off-by: Petar Koretic <petar.koretic@sartura.hr> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* libssh: libhpp: avoid unnecessary call to ssh_channel_readPetar Koretic2014-03-271-1/+1
| | | | | | | | ssh_channel_read is a wrapper for ssh_channel_read_timeout with timeout -1 (infinite) so we call that directly. Signed-off-by: Petar Koretic <petar.koretic@sartura.hr> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* libssh: libhpp: fix multiple definitions for acceptForward functionPetar Koretic2014-03-271-4/+3
| | | | | | | | | Defining a non inlined class function in a header will cause multiple definitions when header is included in more that one file since for each file function will get defined. Signed-off-by: Petar Koretic <petar.koretic@sartura.hr> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* options: Allow use of host ECDSA keyAlan Dunn2014-03-271-1/+2
| | | | | Signed-off-by: Alan Dunn <amdunn@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* security: fix for vulnerability CVE-2014-0017Aris Adamantiadis2014-03-041-0/+1
| | | | | | | | | | When accepting a new connection, a forking server based on libssh forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique. This can cause several children to end up with same PRNG state which is a security issue.
* Add session/channel byte/packet countersAudrius Butkevicius2014-02-123-0/+16
| | | | Signed-off-by: Audrius Butkevicius <audrius.butkevicius@elastichosts.com>
* session: add getters for session cipher namesJon Simons2014-02-061-0/+2
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* knownhosts: detect variations of ecdsaAris Adamantiadis2014-02-042-1/+27
|
* doc: correct ssh_channel_read_timeout unitsJon Simons2014-02-021-1/+1
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* doc: Document expected return value of channel data callbackAudrius Butkevicius2014-02-021-0/+2
| | | | | Signed-off-by: Audrius Butkevicius <audrius.butkevicius@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* src: Define MAX_BUF_SIZE globally and use it.Joseph Southwell2014-02-021-0/+13
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* build: remove OSX deprecated warnings for opensslAris Adamantiadis2014-02-021-10/+0
|
* server: allow custom server banners (bug #83)Aris Adamantiadis2014-02-011-0/+1
|
* known_hosts: add ssh_knownhosts_algorithms()Aris Adamantiadis2014-02-011-0/+1
| | | | | Goal of that function is to test the preferred key exchange methods based on what's available in the known_hosts file
* src: Rename buffer_add_data() to ssh_buffer_add_data().Andreas Schneider2014-01-191-1/+1
|
* src: Rename buffer_init to ssh_buffer_init().Andreas Schneider2014-01-191-1/+1
|
* include: Mark functions as deprecated!Andreas Schneider2014-01-161-45/+45
|
* channel: Fix the name scheme of the forward functions.Andreas Schneider2014-01-162-8/+22
|
* channel: Add ssh_channel_accept_forward().Oleksandr Shneyder2014-01-161-0/+1
| | | | | | | | This works same way as ssh_forward_accept() but can return a destination port of the channel (useful if SSH connection forwarding several TCP/IP ports). Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
* threads: support libgcrypt 1.6 hackAris Adamantiadis2014-01-081-0/+2
| | | | | | | Not 100% satisfied of this patch, but the way libgcrypt handles threading in 1.6 is not compatible with custom handlers. The new code basicaly uses pthreads in every case. This will probably not work on windows.
* include: Remove warning cause VSC doesn't know about it.Andreas Schneider2014-01-081-1/+0
|
* include: Fix building if we do not have asm volatile.Andreas Schneider2014-01-081-1/+2
|
* session: Add ssh_get_clientbanner().Jon Simons2013-12-071-0/+1
|
* channels: Add a ssh_channel_read_timeout function.Andreas Schneider2013-12-041-0/+1
|
* pki: Add ssh_pki_import_privkey_file().Andreas Schneider2013-11-271-0/+5
|
* pki_gcrypt: Add pki_private_key_to_pem() stub.Andreas Schneider2013-11-271-0/+5
|
* ecdh: Check if we have ECC support.Andreas Schneider2013-11-272-2/+7
|
* server: Add a ssh_send_keepalive() function.Nicolas Viennot2013-11-241-0/+2
| | | | Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
generated by cgit (git 2.34.1) at 2024-06-21 03:11:32 +0000